CyberNews
CVE-2021-40444 exploitation: Researchers find connections to previous attacks
HelpNet Security – The recent targeted attacks exploiting the (at the time) zero-day remote code execution vulnerability (CVE-2021-40444) in Windows via booby-trapped Office documents have
FTC: Health app and connected device makers must disclose data breaches
The Record – The Federal Trade Commission approved a policy statement Wednesday that warns makers of health apps and connected devices that collect health-related information
Under Pressure: COVID-19 Forced Many Execs to Sideline Cybersecurity
Dark Reading – After polling some 1,000 senior cybersecurity leaders, EY found that CISOs and other security leaders are struggling with inadequate budgets, regulatory fragmentation,
South Africa’s Department of Justice Network Under Ransomware Attack
CISO Mag – Read Aloud The Department of Justice and Constitutional Development of South Africa admitted that its IT systems and operations were disrupted in
How to Protect and Support a Remote Workforce
Hack Read – Remote working amid the COVID19 pandemic has become new normal but for cybercriminals, those working from home are a lucrative target. When
Travis CI Flaw Exposes Secrets of Thousands of Open Source Projects
The Hacker News – Continuous integration vendor Travis CI has patched a serious security flaw that exposed API keys, access tokens, and credentials, potentially putting
Financial Cybercrime: Following Cryptocurrency via Public Ledgers
Threat Post – John Hammond, security researcher with Huntress, discusses a wallet-hijacking RAT, and how law enforcement recovered millions in Bitcoin after the Colonial Pipeline
Universal decryptor released for past REvil ransomware victims
The Record – Romanian cybersecurity firm Bitdefender has published today a universal decryption utility that will be able to help past victims of the REvil
REvil/Sodinokibi Ransomware Universal Decryptor Key Is Out
Threat Post – Bitdefender worked with law enforcement to create a key to unlock victims encrypted in ransomware attacks before REvil’s servers went belly-up on
Get 3 Years of powerful, super-fast VPN Protection from HotSpot Shield for just $89
ZDNet – Now that travel is becoming more normal; you may want to start thinking about a couple of things in addition to where you go
DDoS Attacks: A Flourishing Business for Cybercrooks – Podcast
Threat Post – Imperva’s Peter Klimek on how DDoS attacks started out as inconveniences but evolved to the point where attackers can disrupt businesses for
Free REvil ransomware master decrypter released for past victims
Bleeping Computer – A free master decryptor for the REvil ransomware operation has been released, allowing all victims encrypted before the gang disappeared to recover
New Go malware Capoae targets WordPress installs, Linux systems
ZDNet – A new strain of malware, written in Go, has been spotted in cyberattacks launched against WordPress and Linux systems. On Thursday, Larry Cashdollar, senior
Ransomware attackers targeted app developers with malicious Office docs, says Microsoft
ZDNet – Microsoft has detailed how it recently saw hackers exploiting a dangerous remote code execution vulnerability in the MSHTML aka Trident rendering engine of Internet
HP Omen Hub Exposes Millions of Gamers to Cyberattack
Threat Post – A driver privilege-escalation bug gives attackers kernel-mode access to millions of PCs used for gaming. Millions of devices running the HP Omen
Fake TeamViewer download ads distributing new ZLoader variant
Hack Read – The infection chain starts when the victim clicks on an ad from Google on the search results page. SentinelLabs researchers have identified a
Malware samples found trying to hack Windows from its Linux subsystem
The Record – Security researchers at Lumen’s Black Lotus Labs have found a series of malware samples that were configured to infect the Windows Subsystem
Health apps 'playing fast and loose' with user data, warns FTC chief
ZDNet – The Federal Trade Commission (FTC) has warned that health apps and devices that collect or use personal health information must comply with rules requiring
Azure Zero-Day Flaws Highlight Lurking Supply-Chain Risk
Threat Post – Dubbed OMIGOD, a series of vulnerabilities in the Open Management Infrastructure used in Azure on Linux demonstrate hidden security threats, researchers said.
Microsoft announces passwordless authentication option for consumers
HelpNet Security – After offering the passwordless authentication option to enterprise customers in March 2021, Microsoft has now started rolling it out to its consumer
Third Critical Bug Affects Netgear Smart Switches — Details and PoC Released
The Hacker News – New details have been revealed about a recently remediated critical vulnerability in Netgear smart switches that could be leveraged by an
Microsoft September 2021 Patch Tuesday: Mitigations and Workarounds
CISO Mag – Read Aloud Microsoft released fixes for 60 security vulnerabilities in its latest September 2021 Patch Tuesday update. Out of 60 vulnerabilities, 56
Household Names Hit with £500K Fine for Spamming Consumers
InfoSecurity Magazine – Household Names Hit with £500K Fine for Spamming Consumers Three big-name UK brands have been collectively fined nearly half a million pounds
Misconfigured APIs Account for Two-Thirds of Cloud Breaches
InfoSecurity Magazine – Misconfigured APIs Account for Two-Thirds of Cloud Breaches Shadow IT and misconfigured APIs accounted for the vast majority of security incidents in
Banks Slammed for Low Fraud Reimbursement Rates
InfoSecurity Magazine – Banks Slammed for Low Fraud Reimbursement Rates The UK’s high street banks have been called out for “shockingly low” reimbursement rates for