Cybercriminals Love Supply-Chain Chaos: Here’s How to Protect Your Inbox
Threat actors use bogus ‘shipping delays’ to deceive customers and businesses. Troy Gill, senior manager of threat intelligence at Zix, discusses how spoofing is evolving and what to do. Over
Update your iPhone and iPad right now. Apple just released a bunch of security fixes
Screenshots by Jason Cipriani/ZDNet It’s time to update your Apple devices once again. Apple on Wednesday released several security updates for the iPhone, iPad, Apple TV, Apple Watch, and Mac
TrickBot malware now crashes researchers’ devices to evade analysis
Since the return of TrickBot malware researchers are observing additional features and capabilities which makes its detection and analysis tougher than ever. TrickBot banking trojan has evolved into a full-featured,
Linux Bug in All Major Distros: ‘An Attacker’s Dream Come True’
The 12-year-old flaw in the sudo-like polkit’s pkexec tool, found in all major Linux distributions, is likely to be exploited in the wild within days. Every major Linux distribution has
Best Cybersecurity Research Paper Revealed
Best Cybersecurity Research Paper Revealed The National Security Agency has announced the winning entry to its ninth annual Best Cybersecurity Research Paper Competition. The winning paper was written by Yanyi Liu from Cornell University
How a Cyber Criminal Justice System Resolves Disputes
Security Intelligence – How a Cyber Criminal Justice System Resolves Disputes The darknet community uses its own underground justice system to solve disputes that arise between one cyber criminal and
EyeMed Fined $600k Over Data Breach
EyeMed Fined $600k Over Data Breach An Ohio-based healthcare provider has been fined $600k over a data breach that exposed the records of 2.1 million patients across America. Cyber-criminals targeted EyeMed Vision Care
#DataPrivacyWeek: Online Trackers Can Detect 80% of Users' Browsing History
#DataPrivacyWeek: Online Trackers Can Detect 80% of Users' Browsing History Online trackers can capture up to 80% of users’ browsing histories, with the practice far more pervasive than previously realized.
Ransomware is still the biggest security worry for business, but it's not the only headache
Ransomware is the number one cybersecurity concern for Chief Information Security Officers (CISO) are facing at the beginning of 2022, but it’s just one of many issues which they’re attempting
New DazzleSpy malware infects macOS devices through hacked websites
Protesters in Hong Kong were tricked into visiting a compromised pro-democracy radio station website that delivered DazzleSpy malware through a Safari exploit. The IT security researchers at ESET have reported a new
Cybercriminals laundered at least $8.6 billion worth of cryptocurrency in 2021: report
Cybercriminals managed to launder at least $8.6 billion worth of cryptocurrency in 2021, according to a new report from blockchain analytics company Chainalysis. The company said the $8.6 billion represents
APTs quiet ahead of Beijing games, but financially motivated hackers are still lurking, research says
Written by Tonya Riley Jan 26, 2022 | CYBERSCOOP State-sponsored hacking groups have been uncharacteristically quiet leading up to the Olympic Games next month in Beijing. Researchers say there’s one
Log4J: BlackBerry finds Prophet Spider access broker exploiting VMware Horizon
Initial access broker group, Prophet Spider, has been found exploiting the Log4J vulnerability in VMware Horizon, according to a new report from researchers with BlackBerry Research & Intelligence and Incident
Amazon Athena Security: 6 essential tips
Amazon Athena is a popular cloud service that enables lightning-fast queries on huge volumes of data in Amazon S3. It is 100% serverless, working without setting up a server the
How to report a security vulnerability to an organization
Finding a new vulnerability is exciting and, depending on the vulnerability and organization, can be lucrative. However, finding the vulnerability is only part of the process. Reporting a vulnerability to
Threat Actors Blanket Androids with Flubot, Teabot Campaigns
Attackers are getting creative, using smishing & a malicious Google Play QR reader to plant banking trojans on the phones of victims across the globe. Researchers have discovered a raft
There’s no such thing as “done” with application security
If you’re like most companies in the software business, you’re relentlessly developing new features, streamlining workflows and improving the user experience. But every single change to your platform also changes
QNAP Devices Targeted in Ransomware Attack
QNAP Systems, Inc. is a Taiwanese company that specializes in network-attached storage equipment for applications such as file sharing, virtualization, storage management, and surveillance. What Happened? The DeadBolt ransomware organization
TrickBot Crashes Browser Tabs to Hinder Malware Analysis
TrickBot is continuously evolving, as the malware has been recently extended with new features. These challenge its research, analysis, and detection as its latest variants are improved to crash browser
The Log4j flaw hasn't led to massive hacking attacks. But that doesn't mean the threat is over
Log4Shell affected hundreds of millions of devices and was cast as a critical tech emergency that would almost certainly be exploited attackers around the globe. But a month after the
2022 Cybersecurity predictions: Bitdefender Expert Picks
2021 wasn’t the best year for cybersecurity — if you pitted companies versus malicious hackers, hackers easily took the lead and seem to be in a prime position to repeat
DazzleSpy: Pro-democracy org hijacked to become macOS spyware distributor
Researchers have uncovered a new strain of macOS malware in targeted attacks against visitors to a Hong Kong pro-democracy radio station website. The website was used to facilitate a watering
Experts Reveals 29% Surge in Bugs Used by Ransomware Actors
Experts Reveals 29% Surge in Bugs Used by Ransomware Actors There’s been a 29% increase in the number of vulnerabilities exploited by ransomware groups to compromise their targets over the
UK NCSC Releases Nmap NSE Scripts to Discover Unpatched Flaws
The National Cyber Security Centre (NCSC) is a government organization in the United Kingdom that advises and supports the public and private sectors on how to prevent computer security threats.
Government Trials Effort to Make Bug Scanning Easier
Government Trials Effort to Make Bug Scanning Easier The UK’s leading cybersecurity agency has revealed details of a new initiative designed to make it easier for system administrators to root
Home Working Drives 44% Surge in Insider Threats
Home Working Drives 44% Surge in Insider Threats Insider threats cost organizations an average of over $15m annually to remediate last year, with stolen credentials a growing risk, according to Proofpoint. The
Trickbot will now try to crash researcher PCs to stop reverse engineering attempts
The Trickbot Trojan has been revised with a new set of anti-reverse engineering features including the capability to crash computers if analysis tools are detected. Over the years, Trickbot has
UK government security center, i100 publish NMAP scripts for vulnerability scanning
The UK’s National Cyber Security Center (NCSC) has released NMAP scripts to help defenders search for specific vulnerabilities in their networks. On January 25, the NCSC said the trial project
GitHub enables two-factor authentication mechanism through iOS, Android app
GitHub announced that two-factor authentication will be available to all users through GitHub Mobile this week. In a blog post, GitHub’s Berk Veral said GitHub Mobile 2FA will be available
Cyber-Partisans hackers hit Belarus railroad system with ransomware attack
A hacktivist group calling itself Belarusian Cyber-Partisans claims it hacked the Belarus railroad system as it allows the “occupying troops” (referring to the Russian military) to enter the country. A
F5 beats Wall Street expectations, warns of supply chain constraints in 2022
Application security company F5 Networks delivered better-than-expected Q1 financial results, reporting non-GAAP net income of $179 million, or $2.89 per diluted share, and a GAAP revenue of $687 million. But
Cyberattacks on Squid Game Minecraft Tourney Take Down Andorra’s Internet
Some of the bursts of traffic reached up to 10Gbps, reports noted, overwhelming the country’s only ISP, and crippling Andorran Squidcraft gamers along with the rest of the population. A
Ozzy Osbourne NFTs Used to Bite Off Chunk of Crypto Coin
A discarded Discord vanity URL for CryptoBatz was hijacked by cybercriminals to drain cryptocurrency wallets. Ozzy Osbourne and his famously enterprising wife and manager Sharon decided to launch a new
Segway Hit by Magecart Attack Hiding in a Favicon
Threat Post – Visitors who shopped on the company’s eCommerce website in January will likely find their payment-card data heisted, researchers warned. Segway, maker of the iconic – and much-spoofed
New MacOS Malware ‘DazzleSpy’ Used in Watering-Hole Attacks
A pro-democracy Hong Kong site was used to launch watering-hole attacks that planted a powerful macOS backdoor that researchers dubbed DazzleSpy. A new family of cyber-espionage malware targeting macOS and
LA Launches Cyber Resilience Center
LA Launches Cyber Resilience Center The Port of Los Angeles has opened a new Cyber Resilience Center (CRC) that will detect and protect against cyber-threats that could potentially impact cargo
New Mexico Files Cybersecurity Bills
New Mexico Files Cybersecurity Bills Lawmakers in New Mexico from both sides of the aisle have introduced new legislation to defend the state against cyber-threats. In the past six days,
Google reveals 'Topics' cookie replacement, acknowledges FLoC was problematic
Google has provided new information on the end of the troubled development process for the FLoC (Federated Learning of Cohorts) it had hoped to use as a replacement for cookies,
Vulnerability Spotlight: Vulnerability in Apple iOS, iPad OS and MacOS could lead to disclosure of sensitive memory data
Jaewon Min of Cisco Talos discovered these vulnerabilities. Blog by Jon Munshaw. Cisco Talos recently discovered an out-of-bounds read vulnerability in Apple’s macOS and iOS operating systems that could lead
Snag a 4-pack of Tile Mates for just $39 and never lose your keys again
Tile Sometimes, I question if my keys and wallet are like the toys in Toy Story, having their own entities and tip-toeing away when I’m not looking. True or not,
Cyber-Attack on Global Affairs Canada
Cyber-Attack on Global Affairs Canada Cyber-criminals have attacked the federal government entity responsible for Canada’s diplomatic and global relations. Global Affairs Canada was hit on Wednesday – one day before
New Threat Campaign: AsyncRAT Introduces a New Delivery Technique
Morphisec, through its breach prevention with Moving Target Defense technology, has identified a new, sophisticated campaign delivery which has been successfully evading the radar of many security vendors. Through a
AdSanity, AccessPress Plugins Open Scads of WordPress Sites to Takeover
A critical security bug and a months-long, ongoing supply-chain attack spell trouble for WordPress users. The WordPress content management system (CMS) is offering admins more headaches this week, thanks to
DDoS attacks on Minecraft event crippled the internet of a European country
The series of DDoS attacks took place during a live online gaming event titled “SqiudCraft” (inspired by Netflix’s Squid Game), while the country to suffer the most is Andorra, officially
Hackers hijacking Instagram accounts of companies and influencers, demanding ransom
Hackers are hijacking the Instagram accounts of companies and influencers with huge followings in a new phishing campaign identified by Secureworks. The cybersecurity company said it discovered the effort in
Critical SonicWall RCE Bug Actively Targeted by Threat Actors
A critical SonicWall RCE bug is now on the radar of hackers, as these are massively trying to exploit it. The vulnerability is related to the Secure Mobile Access (SMA)
Trellix finds OneDrive malware campaign targeting gov't officials in Western Asia
Hackers are using Microsoft OneDrive in a multi-stage espionage campaign aimed at high-ranking government officials in Western Asia, according to a new report from Trellix. Researchers with Trellix named the
Top tools for password-spraying attacks in active directory networks
Password guessing is essentially an art form when this attack is performed on a large scale against a large group of users. Password spraying attacks are part of this landscape,