Latest Cybersecurity News and Articles
09 May 2023
A new SolarWinds report details how foreign hackers have become the largest concern among government entities, and how zero-trust strategies have become the most popular defense.
09 May 2023
The Biden-Harris Administration has announced plans to encourage safe artificial intelligence (AI) development to improve national security.
09 May 2023
A public exploit targeting building automation systems has brought KNX security back into the spotlight, with industrial giant Schneider Electric releasing a security bulletin to warn customers about the potential risks.
09 May 2023
The FTC proposed to change a 2020 privacy order with Meta after the FTC alleges that the company has failed to fully comply with the order.
09 May 2023
"These attacks use a specific tactic: targeting the victim companies' support agents via chat applications – in particular, the Comm100 and LiveHelp100 apps," ESET said in a report shared with The Hacker News.
09 May 2023
The U.S. Federal Bureau of Investigation (FBI) this week seized 13 domain names connected to “booter” services that let paying customers launch crippling distributed denial-of-service (DDoS) attacks. Ten of the domains are reincarnations of DDoS-for-hire services the FBI seized in December 2022, when it charged six U.S. men with computer crimes for allegedly operating booters.
09 May 2023
A guide for Chief Information Security Officers (CISOs) was released to manage risks associated with generative AI being used in the workplace.
09 May 2023
A gambling company in the Philippines was the target of a China-aligned threat actor as part of a campaign that has been ongoing since October 2021.
Slovak cybersecurity firm ESET is tracking the series of attacks against Southeast Asian gambling companies under the name Operation ChattyGoblin.
"These attacks use a specific tactic: targeting the victim companies' support agents via chat
09 May 2023
"In this campaign, the SideWinder advanced persistent threat (APT) group used a server-based polymorphism technique to deliver the next stage payload," the BlackBerry Research and Intelligence Team said in a technical report published Monday.
09 May 2023
In the fast-paced cybersecurity landscape, product security takes center stage. DevSecOps swoops in, seamlessly merging security practices into DevOps, empowering teams to tackle challenges. Let's dive into DevSecOps and explore how collaboration can give your team the edge to fight cyber villains.
Application security and product security
Regrettably, application security teams often intervene
09 May 2023
The LockBit 3.0 ransomware group on Monday leaked 600 gigabytes of critical data stolen from Indian lender Fullerton India, two weeks after the group demanded a $3 million ransom from the company.
09 May 2023
Experts at Cleafy disclosed nearly a four-year-long online fraud campaign that infected Windows systems in organizations using drIBAN, a web inject kit. Criminals attempted to alter legitimate banking transfers by changing the beneficiary details and redirecting the funds to their accounts. Organizations are suggested to be well aware of the evolving threats and make continuous efforts to enhance their security posture.
09 May 2023
"Confirmed, Intel OEM private key leaked, causing an impact on the entire ecosystem," Alex Matrosov, founder and CEO of firmware security firm Binarly, said in a tweet over the weekend.
09 May 2023
The idea with E2E encryption is that data is kept confidential between the encryptor and the intended receiver. This might seem an obvious requirement, but not all so-called secure systems offer this level of protection.
09 May 2023
A newly discovered malware named KEKW has been found to be distributed through malicious open-source Python .whl (Wheel) files. This malware combines infostealers with clipper activities, allowing it to steal sensitive information from compromised systems and hijack cryptocurrency transactions.
09 May 2023
In such attacks (also known as push bombing or MFA push spam), cybercriminals flood the targets with mobile push notifications asking them to approve attempts to log into their corporate accounts using stolen credentials.
09 May 2023
Organizations need to be able to match the ingenuity and resources of cybercriminals to better defend themselves against the increasing number of threats and attacks that could paralyze their business.
09 May 2023
VulCheck developed a new PoC exploit against the critical PaperCut bug earmarked CVE-2023-27350 that is capable of evading all known detection rules. The bug affects PaperCut MF or NG versions 8.0 and above, whose exploitation paves the way for unauthenticated RCE attacks. The bug has previously been exploited in ransomware attacks by Cl0p and LockBit groups.
09 May 2023
The advanced persistent threat (APT) actor known as SideWinder has been accused of deploying a backdoor in attacks directed against Pakistan government organizations as part of a campaign that commenced in late November 2022.
"In this campaign, the SideWinder advanced persistent threat (APT) group used a server-based polymorphism technique to deliver the next stage payload," the BlackBerry
09 May 2023
Iranian nation-state groups have now joined financially motivated actors in actively exploiting a critical flaw in PaperCut print management software, Microsoft said.
The tech giant's threat intelligence team said it observed both Mango Sandstorm (Mercury) and Mint Sandstorm (Phosphorus) weaponizing CVE-2023-27350 in their operations to achieve initial access.
"This activity shows Mint