What's new arround internet
| Src | Date (GMT) | Titre | Description | Tags | Stories | Notes |
 |
2024-08-02 06:00:00 | Utilisez l'apprentissage ciblé pour réduire exponentiellement vos risques de cybersécurité Use Targeted Learning to Exponentially Reduce Your Cybersecurity Risks (lien direct) |
The days of a one-size fits all security awareness program are over. The State of the Phish report from Proofpoint notes that over 98% of businesses have a security awareness program. Yet a staggering 68% of users say they take risky actions despite knowing the risks. These statistics underscore the frustrations that we hear from prospective clients every day. They tell us that while they run a continuous educational program, they struggle to achieve the desired behavior improvements among their users. Some of the key challenges they face are: Not knowing who represents the greatest risk to the organization Not knowing what policies, threats and vulnerabilities to educate users about at any given moment Not being able to keep a program agile without exhausting resources, constantly updating user groups or continually tailoring curriculums These issues highlight the critical need to go beyond traditional security awareness and think holistically to build a human risk management program. A good place to start is focusing on highly targeted user groups. It\'s these users who are often the ones responsible for most of the security issues within a business. When you can tailor education to the specific needs of these users, you can mitigate individual vulnerabilities. You can also fortify your entire defense against potential attacks. A new workflow from Proofpoint focuses on these users to produce exponentially positive results in helping you reduce overall risk. In this blog, we\'ll explore why focusing on human risk management is so important. And we\'ll explain how Proofpoint can help you do just that. What is human risk management? Human risk management builds on existing security best practices to automate cyberattack prevention and response. What makes it different is that it places people at the center. Fundamental to a human risk management solution is an ability to ingest user event and identity activity across multiple security tools within a given environment. The solution will track: Attack risk. The likelihood a user will be attacked Vulnerability risk. The likelihood that the attack may be successful Privilege risk. The damage that a successful attack may cause the organization Then it quantifies an overall risk score for each individual. With this insight, companies and their security teams can: Gain visibility into which individuals or groups are prime targets and prioritize strategies to best protect them Intervene with technical controls to immediately prevent a risky action or provide contextual nudges that advise users about their risks and how to avoid them Automatically enroll risky users into tailored education curriculums, which empowers them to protect themselves and the company against future cyberattacks Easily track improvements in user behaviors and foster a positive security culture These are the issues that the new Adaptive Threat and User-Risk Response Workflow within Proofpoint Security Awareness is designed to address. In short, this new workflow lets you take advantage of everything that is great about Proofpoint. Our Adaptive Threat and User-Risk Response Workflow The new workflow integrates three core capabilities. It enables you to: Dynamically create and manage user groups based on the user risk profiles and groups derived from Proofpoint Nexus People Risk Explorer (NPRE) and Proofpoint Targeted Attack Protection (TAP) using Adaptive Groups Create a threat-driven educational curriculum based on the defined Threat Families tracked by our own Threat Research and reported via TAP Build an Adaptive Assignment to auto-enroll new users into the curriculum whenever a new user qualifies for the previously created Adaptive Group This adaptive learning approach prioritizes education for highly targeted groups. It helps to drive maximum user engagement, too, by enabling administrators to tailor | Tool Vulnerability Threat Cloud Technical | ||
 |
2024-08-01 19:02:00 | Hackers Distributing Malicious Python Packages via Popular Developer Q&A Platform (lien direct) | In yet another sign that threat actors are always looking out for new ways to trick users into downloading malware, it has come to light that the question-and-answer (Q&A) platform known as Stack Exchange has been abused to direct unsuspecting developers to bogus Python packages capable of draining their cryptocurrency wallets. "Upon installation, this code would execute automatically, | |||
|
2024-08-01 18:22:00 | New Android Banking Trojan Bingomod vole de l'argent, des dispositifs essuie New Android Banking Trojan BingoMod Steals Money, Wipes Devices (lien direct) |
Les chercheurs en cybersécurité ont découvert un nouveau Trojan (RAT) d'accès à distance Android appelé Bingomod qui non seulement effectue des transferts d'argent frauduleux des appareils compromis, mais les essuie également pour tenter d'effacer les traces du malveillant.
La société italienne de cybersécurité Cleafy, qui a découvert le rat vers la fin du mois de mai 2024, a déclaré que les logiciels malveillants sont en cours de développement actif.Il a attribué le
Cybersecurity researchers have uncovered a new Android remote access trojan (RAT) called BingoMod that not only performs fraudulent money transfers from the compromised devices but also wipes them in an attempt to erase traces of the malware. Italian cybersecurity firm Cleafy, which discovered the RAT towards the end of May 2024, said the malware is under active development. It attributed the |
Malware Mobile | ★★★ | |
|
2024-08-01 16:37:00 | Obfuscation: il y a deux côtés à tout Obfuscation: There Are Two Sides To Everything (lien direct) |
Comment détecter et empêcher les attaquants d'utiliser ces différentes techniques
L'obscurcissement est une technique importante pour protéger les logiciels qui comportent également des risques, en particulier lorsqu'ils sont utilisés par les auteurs de logiciels malveillants.Dans cet article, nous examinons l'obscurcissement, ses effets et ses réponses.
Qu'est-ce que l'obscurcissement?
L'obscurcissement est la technique de rendre intentionnellement difficile à lire les informations, en particulier dans
How to detect and prevent attackers from using these various techniques Obfuscation is an important technique for protecting software that also carries risks, especially when used by malware authors. In this article, we examine obfuscation, its effects, and responses to it. What Is Obfuscation? Obfuscation is the technique of intentionally making information difficult to read, especially in |
Malware | ||
|
2024-08-01 15:19:00 | Google Chrome ajoute un cryptage lié à l'application pour protéger les cookies des logiciels malveillants Google Chrome Adds App-Bound Encryption to Protect Cookies from Malware (lien direct) |
Google a annoncé qu'il ajoutait une nouvelle couche de protection à son navigateur Chrome à travers ce qui s'appelle le cryptage lié à l'application pour empêcher les logiciels malveillants de voler les informations de saisir des cookies sur les systèmes Windows.
"Sur Windows, Chrome utilise l'API de protection des données (DPAPI) qui protège les données au repos des autres utilisateurs sur le système ou les attaques de démarrage à froid", Will Harris de l'équipe de sécurité de Chrome
Google has announced that it\'s adding a new layer of protection to its Chrome browser through what\'s called app-bound encryption to prevent information-stealing malware from grabbing cookies on Windows systems. "On Windows, Chrome uses the Data Protection API (DPAPI) which protects the data at rest from other users on the system or cold boot attacks," Will Harris from the Chrome security team |
Malware | ★★★ | |
 |
2024-08-01 13:54:48 | US reportedly preparing to release Russian hackers as part of prisoner swap (lien direct) | Pas de details / No more details | |||
 |
2024-08-01 13:30:53 | European Commission seeks input on AI Code of Practice, invites stakeholders on future of general AI models (lien direct) | >The European Commission has launched a multi-stakeholder consultation on a Code of Practice for providers of general-purpose Artificial... | |||
 |
2024-08-01 13:25:07 | Does Antivirus Software Slow You Down? (lien direct) | >
“Antivirus software slows down my PC.” This is a comment that is often heard when talking about antivirus and malware protection....
|
|||
 |
2024-08-01 13:00:43 | Plus de 20 000 caméras et routeurs Ubiquiti sont vulnérables aux attaques d'amplification et aux risques de confidentialité Over 20,000 Ubiquiti Cameras and Routers are Vulnerable to Amplification Attacks and Privacy Risks (lien direct) |
> Vérifier la recherche sur les points (RCR) a évalué la populaire caméra instantanée Ubiquiti G4, une caméra compacte, grand angle et connecté au wifi avec un audio bidirectionnel, ainsi que l'appareil cloud + un appareil qui accompagne l'application.Les principaux points forts CPR ont effectué une évaluation de la surface d'attaque, en découvrant que deux processus privilégiés personnalisés ont été exposés sur l'interface réseau de l'appareil photo: les ports 10001 et 7004, tous deux utilisant le protocole UDP à la suite des vulnérabilités de port, plus de 20 000 périphériques UbQuiti ont été identifiés commeexposés sur Internet, révélant des données d'information, y compris leurs noms de plate-forme, leur version logicielle, les adresses IP configurées et plus les données exposées pourraient être utilisées pour la technique et sociale [& # 8230;]
>Check Point Research (CPR) assessed the popular Ubiquiti G4 Instant Camera, a compact, wide-angle, WiFi-connected camera with two-way audio, along with the accompanying Cloud Key+ device that supports the application. Key Highlights CPR conducted an attack surface assessment, discovering two custom privileged processes were exposed on the camera\'s network interface: Ports 10001 and 7004, both using UDP protocol As a result of the port vulnerabilities, over 20,000 Ubquiti devices were identified as exposed on the Internet, revealing informational data including their platform names, software version, configured IP addresses and more The exposed data could be used for technical and social […] |
Vulnerability Cloud Technical | ★★★ | |
 |
2024-08-01 12:53:29 | AI générative: combler l'écart technologique entre les cyber équipes et les criminels Generative AI: Closing The Tech Gap Between Cyber Teams And Criminals (lien direct) |
> Cette semaine en cybersécurité des éditeurs du magazine Cybercrime & # 8211; lisez l'histoire complète à Forbes Sausalito, Californie & # 8211;1er août 2024 De nombreuses équipes de sécurité ne sont pas préparées aux cyberattaques. & # 160; Les nouvelles données & # 160; de VikingCloud montrent que 55% des leaders de la sécurité informatique signalent que les cybercriminels modernes sont plus avancés que
>This week in cybersecurity from the editors at Cybercrime Magazine –Read the Full Story in Forbes Sausalito, Calif. – Aug. 1, 2024 Many security teams are unprepared for cyberattacks. New data from VikingCloud shows 55 percent of IT security leaders report modern cybercriminals are more advanced than |
★★★ | ||
|
2024-08-01 12:02:00 | Les publicités Facebook conduisent à de faux sites Web volant des informations de carte de crédit Facebook Ads Lead to Fake Websites Stealing Credit Card Information (lien direct) |
Les utilisateurs de Facebook sont l'objectif d'un réseau de commerce électronique d'escroquerie qui utilise des centaines de faux sites Web pour voler des données personnelles et financières en utilisant une imitation de marque et des astuces de malvertisation.
L'équipe de renseignement sur la fraude de paiement de Future \\ de Future, qui a détecté la campagne le 17 avril 2024, lui a donné le nom Eriakos en raison de l'utilisation du même réseau de livraison de contenu (CDN) Oss.eriakos [.] Com.
"Ces
Facebook users are the target of a scam e-commerce network that uses hundreds of fake websites to steal personal and financial data using brand impersonation and malvertising tricks. Recorded Future\'s Payment Fraud Intelligence team, which detected the campaign on April 17, 2024, has given it the name ERIAKOS owing to the use of the same content delivery network (CDN) oss.eriakos[.]com. "These |
★★★ | ||
 |
2024-08-01 12:00:19 | Cisco innovante une nouvelle ère de sécurité à Black Hat 2024 Cisco Innovating a New Era of Security at Black Hat 2024 (lien direct) |
Il est presque temps pour une autre année de recherche de pointe et de conférences innovantes, car des milliers de pirates et de professionnels de la sécurité descendent sur Las Vegas pour Black Hat 2024. 
It\'s almost time for another year of cutting-edge research and innovative talks, as thousands of hackers and security professionals descend upon Las Vegas for Black Hat 2024.  |
|||
|
2024-08-01 11:50:23 | Menace Actor abuse des tunnels Cloudflare pour livrer des rats Threat Actor Abuses Cloudflare Tunnels to Deliver RATs (lien direct) |
Key findings Proofpoint has observed an increase in malware delivery via TryCloudflare Tunnel abuse. The activity is financially motivated and delivers exclusively remote access trojans (RATs). Since initial observation, the threat activity set behind the campaigns has modified tactics, techniques, and procedures in attempts to bypass detection and improve efficacy. Proofpoint does not attribute this activity to a tracked TA, but research is ongoing. Overview Proofpoint is tracking a cluster of cybercriminal threat activity leveraging Cloudflare Tunnels to deliver malware. Specifically, the activity abuses the TryCloudflare feature that allows an attacker to create a one-time tunnel without creating an account. Tunnels are a way to remotely access data and resources that are not on the local network, like using a virtual private network (VPN) or secure shell (SSH) protocol. First observed in February 2024, the cluster increased activity in May through July, with most campaigns leading to Xworm, a remote access trojan (RAT), in recent months. In most campaigns, messages contain a URL or attachment leading to an internet shortcut (.URL) file. When executed, it establishes a connection to an external file share, typically via WebDAV, to download an LNK or VBS file. When executed, the LNK/VBS executes a BAT or CMD file that downloads a Python installer package and a series of Python scripts leading to malware installation. In some cases, file staging leverages the search-ms protocol handler to retrieve the LNK from a WebDAV share. Typically in campaigns, a benign PDF is displayed to the user to appear legitimate. In June and July, nearly all observed campaigns delivered Xworm, but previous campaigns also delivered AsyncRAT, VenomRAT, GuLoader, and Remcos. Some campaigns will lead to multiple different malware payloads, with each unique Python script leading to the installation of a different malware. Malware observed in related campaigns leveraging “trycloudflare” tunnels. Campaign message volumes range from hundreds to tens of thousands of messages impacting dozens to thousands of organizations globally. In addition to English, researchers observed French, Spanish, and German language lures. Xworm, AsyncRAT, and VenomRAT campaigns are often higher volume than campaigns delivering Remcos or GuLoader. Lure themes vary, but typically include business-relevant topics like invoices, document requests, package deliveries, and taxes. While the tactics, techniques and procedures (TTPs) of the campaigns remain consistent, the threat actor does appear to modify different parts of the attack chain to increase sophistication and defense evasion. For example, initial campaigns used little to no obfuscation in their helper scripts. The scripts often included detailed comments about the functionality of the code. However, this changed in June when the threat actors began to incorporate obfuscation in their code. Helper script without obfuscation (May 2024 campaign example). Helper script with obfuscation (June 2024 campaign example). Threat actor abuse of TryCloudflare tunnels became popular in 2023 and appears to be increasing among cybercriminal threat actors. Each use of TryCloudflare Tunnels will generate a random subdomain on trycloudflare[.]com, for example ride-fatal-italic-information[.]trycloudflare[.]com. Traffic to the subdomains is proxied through Cloudflare to the operators\' local server. Campaign examples AsyncRAT / Xworm Campaign 28 May 2024 Proofpoint observed a campaign on 28 May 2024 delivering AsyncRAT and Xworm. In this campaign, tax-themed messages contained URLs leading to a zipped .URL file. The campaign targeted organizations in law and finance and included less than 50 total messages. 28 May 2024 email lure using 2023 tax themes. The .URL file pointed to a remote .LNK file. If executed, it led to a CMD helper script w | Malware Threat | ★★★ | |
 |
2024-08-01 11:45:31 | La nouvelle attaque DNS «Sit New “Sitting Ducks” DNS Attack Lets Hackers Easy Domain Takeover (lien direct) |
Ne soyez pas un canard assis à cette attaque!
Don\'t Be a Sitting Duck to this attack! |
|||
 |
2024-08-01 11:18:10 | Bingomod Android Rat essuie les appareils après avoir volé de l'argent BingoMod Android RAT Wipes Devices After Stealing Money (lien direct) |
> Le Trojan Android Bingomod vole les informations et la communication des utilisateurs et permet aux attaquants de voler de l'argent via le rachat de compte.
>The BingoMod Android trojan steals user information and communication and allows attackers to steal money via account takeover. |
Mobile | ||
 |
2024-08-01 11:03:53 | Éducation dans le développement de logiciels sécurisés Education in Secure Software Development (lien direct) |
La Linux Foundation et OpenSSF ont publié un Rapport Sur l'état de l'éducation dans le développement de logiciels sécurisés.
& # 8230; De nombreux développeurs n'ont pas les connaissances et les compétences essentielles pour implémenter efficacement le développement de logiciels sécurisés.Les résultats de l'enquête décrits dans le rapport montrent que près d'un tiers de tous les professionnels sont directement impliqués dans le développement et le déploiement et timide;opérations système, développeurs de logiciels, engageurs et mainteneurs et timide;L'auto-évaluation ne se sent pas familière avec les pratiques de développement logiciel sécurisées.Ceci est particulièrement préoccupant car ce sont eux à l'avant-garde de la création et du maintien du code qui exécute les applications et les systèmes d'une entreprise ...
The Linux Foundation and OpenSSF released a report on the state of education in secure software development. …many developers lack the essential knowledge and skills to effectively implement secure software development. Survey findings outlined in the report show nearly one-third of all professionals directly involved in development and deployment system operations, software developers, committers, and maintainers self-report feeling unfamiliar with secure software development practices. This is of particular concern as they are the ones at the forefront of creating and maintaining the code that runs a company\'s applications and systems... |
★★★ | ||
 |
2024-08-01 11:00:24 | Revamping Sécurité des e-mails: Présentation de CMS du portail d'administration amélioré de Slashnext \\ Revamping Email Security: Introducing SlashNext\\'s Enhanced Administration Portal CMS (lien direct) |
> Dans le paysage numérique au rythme rapide d'aujourd'hui, garantissant une sécurité des e-mails robuste tout en maintenant l'efficacité opérationnelle est primordiale.Chez Slashnext, nous nous engageons à fournir des solutions de pointe pour garder votre organisation en sécurité des menaces de messagerie avancées entre les e-mails, le mobile / SMS et le navigateur.Nous sommes ravis d'annoncer une refonte majeure de notre CMS du portail d'administration, conçu pour améliorer l'utilisateur [& # 8230;]
Le post réorganisation de la sécurité des e-mails: introduction de Slashnext \\ Administration améliorée CMS portale Tout d'abordest apparu sur slashnext .
>In today\'s fast-paced digital landscape, ensuring robust email security while maintaining operational efficiency is paramount. At SlashNext, we are dedicated to providing cutting-edge solutions to keep your organization secure from advanced messaging threats across email, mobile/SMS, and browser. We are excited to announce a major overhaul of our administration portal CMS, designed to enhance user […] The post Revamping Email Security: Introducing SlashNext\'s Enhanced Administration Portal CMS first appeared on SlashNext. |
Mobile | ★★★ | |
 |
2024-08-01 11:00:00 | Perplexica – Le moteur de recherche open source propulsé à l\'IA (lien direct) | Découvrez Perplexica, un moteur de recherche open source boosté à l'IA qui comprend vos questions et trouve les meilleures réponses sur le web. Basé sur des algorithmes avancés, il offre une expérience de recherche révolutionnaire, tout en respectant votre vie privée. | |||
 |
2024-08-01 11:00:00 | Un outil open source de 500 $ permet à quiconque pirater des puces informatiques avec des lasers A $500 Open-Source Tool Lets Anyone Hack Computer Chips With Lasers (lien direct) |
Le Rayv Lite rendra des centaines de fois moins cher pour que quiconque réalise des exploits en physique de piratage matériel.
The RayV Lite will make it hundreds of times cheaper for anyone to carry out physics-bending feats of hardware hacking. |
Hack Tool | ★★★★ | |
 |
2024-08-01 10:47:21 | Pallier le retard de la cybersécurité dans le domaine de la santé et réduire les risques de la chaîne d\'approvisionnement (lien direct) | Contrairement à d'autres secteurs qui subissent des dommages financiers et des atteintes à la réputation à la suite de cyberattaques, dans le secteur de la santé, les conséquences peuvent être catastrophiques. Une attaque contre un hôpital pourrait mettre en danger les traitements des patients, voire des vies humaines, d'où l'importance vitale d'une stratégie de cybersécurité solide. - Points de Vue | ★★★ | ||
|
2024-08-01 10:25:29 | Création de déploiements de kubernetes évolutifs avec des mesures personnalisées Creating Scalable Kubernetes Deployments with Custom Metrics (lien direct) |
Engineering Insights is an ongoing blog series that gives a behind-the-scenes look into the technical challenges, lessons and advances that help our customers protect people and defend data every day. Each post is a firsthand account by one of our engineers about the process that led up to a Proofpoint innovation. Proofpoint Enterprise Archive offers a central, searchable repository that allows ingestion and meets Financial Industry Regulatory Authority (FINRA) standards for compliance. This blog explores how we achieved scale using Kubernetes as our deployment platform. Kubernetes and Horizontal Pod Autoscaler (HPA) Kubernetes is an open-source platform that provides straightforward container orchestration, scalability, resilience and fault tolerance for microservices. All of these factors made it a clear choice as a deployment platform for our application. HPA in Kubernetes is a built-in feature that automatically adjusts the number of replicas (pods) of a deployment based on observed metrics. In a regular environment, HPA queries the Kubernetes metric server, calculates the intended number of replicas and updates a deployment with a desired replica count. The deployment scales the pod count to the desired value. Horizontal Pod Autoscaler (HPA) in Kubernetes. Scaling a deployment based on custom metrics Autoscaling solutions are typically based on runtime metrics like CPU load. However, built-in system metrics are not always adequate for making autoscaling decisions. You need custom metrics to make useful autoscaling decisions. The Proofpoint Enterprise Archive includes a task scheduling system that takes tasks from the queue and executes them one by one. CPU-based autoscaling might not be optimal here because: Tasks can be IO-bound, not CPU-bound Tasks can have priorities, schedules and deadlines For prolonged periods, NO tasks might be scheduled to run at all; in this case, the scaling solution ideally would downscale to zero pods Another applicable scenario would be to scale proactively based on an artificial intelligence (AI) system that predicts load based on past usage patterns. For our use case, the tasks queue length can be a better metric to make scaling decisions, but it requires a custom queue length metric. Although you can set up Kubernetes HPA for this type of scaling, it can be challenging to implement custom metrics for scaling. Furthermore, HPA does not support scaling down to zero pods, which is essential to manage costs. Kubernetes Event Driven Autoscaling (KEDA) is a complementary autoscaling technology you can integrate into HPA. It offers a wide variety of scalers that can fetch metrics from various sources, including Prometheus monitors. KEDA uses these metrics for its integration with Kubernetes HPA. KEDA using its Prometheus Scaler to query metrics from Prometheus. The diagram above shows KEDA using its Prometheus Scaler to query metrics from Prometheus. In our system, the external metrics are mostly exposed by the application itself. KEDA uses these metrics to manage the HPA thereby indirectly controlling the pods\' replica count. KEDA also allows scaling the pods to zero by simply deleting the HPA object. When metrics demand the creation of pods, KEDA recreates the HPA object and starts to manage it. Sample definition and scaling behavior of a processor As a scaling example, we will show a background task processor (BTP) that waits for customer-driven events, picks them up and processes them. It is idle when there are no events to process. Our application exposes metrics that signal when and how many processors are required to handle customer events at any given time. Prometheus scrapes these metrics and makes them available to KEDA for processing. KEDA scale definition The above KEDA query definition includes the following parameters: btp_scaling_metrics is the Prometheus metric for scaling& | Tool Cloud Technical | ★★★ | |
 |
2024-08-01 10:00:17 | Comment les variantes de ransomware «professionnelles» augmentent les groupes de cybercriminalité How “professional” ransomware variants boost cybercrime groups (lien direct) |
Les chercheurs de Kaspersky ont étudié trois groupes de ransomwares qui ont fait des échantillons de logiciels malveillants nouvellement construits basés sur Babuk, Lockbit, Chaos et autres, tout en manquant de ressources professionnelles.
Kaspersky researchers investigated three ransomware groups that tapped newly built malware samples based on Babuk, Lockbit, Chaos and others, while lacking professional resources. |
Ransomware Malware | ||
 |
2024-08-01 10:00:00 | Cencora confirme les données sur les patients volés en cyber-attaque Cencora Confirms Patient Data Stolen in Cyber-Attack (lien direct) |
La société pharmaceutique Cencora a confirmé dans un dossier mis à jour de la SEC que les données personnelles et de santé sensibles étaient exfiltrées par les attaquants dans un incident de février 2024
Pharma company Cencora confirmed in an updated SEC filing that sensitive personal and health data was exfiltrated by attackers in a February 2024 incident |
★★★ | ||
|
2024-08-01 09:15:00 | La campagne de fraude du commerce électronique utilise plus de 600 sites faux E-Commerce Fraud Campaign Uses 600+ Fake Sites (lien direct) |
La campagne d'informations «Eriakos» utilise des centaines de fausses boutiques pour frauder les victimes
The “Eriakos” info-stealing campaign is using hundreds of fake web shops to defraud victims |
★★★ | ||
|
2024-08-01 08:34:47 | La révolution de l\'IA dans la lutte contre la fatigue des alertes : une nouvelle ère pour les SOC (lien direct) | Dans le monde de la cybersécurité, les centres opérationnels de sécurité (SOC) sont constamment sous pression. La surveillance continue, l'analyse des menaces et la réponse aux incidents sont autant de tâches critiques que les analystes doivent mener à bien pour protéger les infrastructures informatiques des entreprises. Cependant, un défi majeur persiste : l'alert fatigue. - Points de Vue | Threat | ★★★ | |
 |
2024-08-01 08:32:00 | Is it time to refresh the UK\'s cyber strategy? (lien direct) | Pas de details / No more details | |||
|
2024-08-01 08:30:00 | BEC attaque surge 20% par an grâce à l'outillage de l'IA BEC Attacks Surge 20% Annually Thanks to AI Tooling (lien direct) |
Une étude vipre révèle une augmentation de 20% des attaques de compromis par e-mail commercial
A Vipre study reveals a 20% increase in business email compromise attacks |
Studies | ★★★ | |
|
2024-08-01 07:22:55 | Chat au coin du feu noir: les consommateurs demandent des applications mobiles sécurisées;Il est grand temps pour que les marques livrent Black Hat Fireside Chat: Consumers demand secure mobile apps; it\\'s high time for brands to deliver (lien direct) |
> Deux décennies plus de vagues durables après la vague de logiciels malveillants et de fraude de l'application mobile ont finalement fait des ravages sur les utilisateurs.
vient maintenant un enquête mondiale de appdome et owasp qui révèle que la grande majorité des consommateurs en sont marre.
i & # 8230; (plus…)
Le message Chat au coin du feu du chapeau noir: les consommateurs demandent des applications mobiles sécurisées;Il est grand temps pour que les marques livrent apparaissent d'abord sur le dernier chien de garde .
>Two-plus decades of enduring wave after wave of mobile app malware and fraud has finally taken its toll on users. Now comes a global survey from Appdome and OWASP that reveals the vast majority of consumers are fed up. I … (more…) The post Black Hat Fireside Chat: Consumers demand secure mobile apps; it\'s high time for brands to deliver first appeared on The Last Watchdog. |
Malware Mobile | ★★★ | |
|
2024-08-01 07:00:00 | Github2file – Partagez votre code avec les chatbots IA (lien direct) | Github2file est un script Python qui facilite le partage de code avec les chatbots IA en exportant les dépôts GitHub dans un fichier texte unique, prêt à être uploadé ou copié-collé. | ★★★ | ||
 |
2024-08-01 05:59:59 | L'Allemagne nomme la Chine comme source d'attaque contre l'agence géospatiale du gouvernement Germany names China as source of attack on government geospatial agency (lien direct) |
Pendant ce temps, les États-Unis considèrent apparemment d'autres sanctions matérielles de l'IA Le gouvernement de l'Allemagne a nommé les acteurs contrôlés par la Chine comme les auteurs d'une cyberattaque en 2021 contre le Bureau fédéral de la cartographie et de la géodésie (BKG)& # 8211;L'agence de cartographie officielle.…
Meanwhile, US apparently considers further AI hardware sanctions Germany\'s government has named China-controlled actors as the perpetrators of a 2021 cyber attack on the Federal Office of Cartography and Geodesy (BKG) – the official mapping agency.… |
★★★ | ||
 |
2024-08-01 05:52:04 | Mendiant pour les bornes de soudures et plus d'informations Begging for Bounties and More Info Stealer Logs (lien direct) |
tl; dr & # x2014;Des dizaines de millions de références obtenues à partir de journaux d'info Stealer remplies de logiciels malveillants ont été publiés sur les canaux télégrammes le mois dernier et utilisés pour secouer les entreprises pour les primes de bogues sous la fausse déclaration Les données provenaient de leur service. Combien de tentatives d'escroqueries obtenez-vous chaque jour?
TL;DR — Tens of millions of credentials obtained from info stealer logs populated by malware were posted to Telegram channels last month and used to shake down companies for bug bounties under the misrepresentation the data originated from their service.How many attempted scams do you get each day? |
Malware | ★★★ | |
 |
2024-08-01 01:09:55 | Sceau de menthe: une étude complète d'un voleur d'informations basé sur un python Mint Stealer: A Comprehensive Study of a Python-Based Information Stealer (lien direct) |
## Snapshot Researchers at Cyfirma have identified Mint Stealer, an [information-stealing malware](https://sip.security.microsoft.com/intel-profiles/2296d491ea381b532b24f2575f9418d4b6723c17b8a1f507d20c2140a75d16d6) operating within a malware-as-a-service (MaaS) framework. Mint Stealer is designed to covertly exfiltrate a wide-range of sensitive data from compromised systems, including web browser data, cryptocurrency wallet details, gaming credentials, VPN client information, messaging app data, FTP client data, and more. ## Description Mint-stealer\'s capabilities include capturing system information, detecting debuggers and analysis tools, continuously capturing clipboard data through PowerShell commands, encrypting exfiltrated data, and communicating with its C2 server for updates and instructions. Mint Stealer is created using the Nuitka Python compiler and relies on Python dynamic modules to support its functionality. The initial payload acts as a dropper, with the main payload hidden in a compressed form within the resources section of the executable. It uploads stolen data to free file-sharing websites and communicates with its command-and-control server (C2) for updates and instructions. The threat actor behind Mint Stealer is associated with another malware-selling website, cashout\[.\]pw, and offers hosting services that do not respect DMCA requests. ## Microsoft Analysis In recent years, Microsoft has tracked the growing risk that infostealers pose to enterprise security. Infostealers are commodity malware used to steal information from a target device and send it to the threat actor. The popularity of this class of malware led to the emergence of an infostealer ecosystem and a new class of threat actors who leveraged these capabilities to conduct their attacks. Often, infostealers are advertised as a malware as a service (MaaS) offering – a business model where the developers lease the infostealer payload to distributers for a fee. The new class of actors enabled by the infostealer ecosystem demonstrate that it is possible to gain initial access to an organization with minimal native malware development skills, by purchasing tools already available. Information stealers are versatile and can be distributed in various forms including through phishing email campaigns, malvertising, and trojanized software, games and tools. They can target a range of information like session tokens and cookies, saved passwords, financial information, and credentials for internet-facing systems and applications. ## Detections/Hunting Queries ### Microsoft Defender Antivirus Microsoft Defender Antivirus detects threat components as the following malware: - Trojan:Win32/Casdet ### Microsoft Defender for Endpoint Alerts with the following titles in the security center can indicate threat activity on your network: - Information stealing malware activity ## Recommendations Microsoft recommends the following mitigations to reduce the impact of this threat. Check the recommendations card for the deployment status of monitored mitigations. - Check your Office 365 email filtering settings to ensure you block spoofed emails, spam, and emails with malware. Use [Microsoft Defender for Office 365](https://learn.microsoft.com/microsoft-365/security/office-365-security/defender-for-office-365?ocid=magicti_ta_learndoc) for enhanced phishing protection and coverage against new threats and polymorphic variants. Configure Microsoft Defender for Office 365 to [recheck links on click](https://learn.microsoft.com/microsoft-365/security/office-365-security/safe-links-about?ocid=magicti_ta_learndoc) and [delete sent mail](https://learn.microsoft.com/microsoft-365/security/office-365-security/zero-hour-auto-purge?ocid=magicti_ta_learndoc) in response to newly acquired threat intelligence. Turn on [safe attachments policies](https://learn.microsoft.com/microsoft-365/security/office-365-security/safe-attachments-policies-configure?ocid=magic | Ransomware Spam Malware Tool Threat Studies | ★★★ | |
|
2024-08-01 00:12:30 | L'infection par ransomware réduit l'approvisionnement en sang à plus de 250 hôpitaux Ransomware infection cuts off blood supply to 250+ hospitals (lien direct) |
Scumbags opter pour l'attaque jugulaire une attaque de ransomware contre un seul organisme à but non lucratif de donation sanguine, qui dessert plus de 250 hôpitaux américains, a "considérablement réduit" la capacité de l'organisation, tester, tester,et distribuer du sang.…
Scumbags go for the jugular A ransomware attack against blood-donation nonprofit OneBlood, which services more than 250 American hospitals, has "significantly reduced" the org\'s ability to take, test, and distribute blood.… |
Ransomware | ★★★ | |
 |
2024-08-01 00:00:00 | La campagne de malvertisation des médias sociaux promeut le faux site Web de l'éditeur d'IA pour le vol d'identification Social Media Malvertising Campaign Promotes Fake AI Editor Website for Credential Theft (lien direct) |
Nous avons découvert une campagne de malvertising où l'acteur de menace détourne les pages de médias sociaux, les renommant pour imiter les éditeurs de photos populaires de l'IA, puis publie des liens malveillants vers de faux sites Web.
We uncovered a malvertising campaign where the threat actor hijacks social media pages, renames them to mimic popular AI photo editors, then posts malicious links to fake websites. |
Threat | ★★ | |
 |
2024-07-31 23:57:59 | Microsoft saisit le domaine utilisé par le groupe vietnamien pour vendre de faux comptes, services Microsoft seizes domain used by Vietnamese group to sell fake accounts, services (lien direct) |
> Les documents judiciaires révèlent la dernière décision de Microsoft \\ pour lutter contre une opération qui a utilisé des comptes frauduleux pour contourner les services CAPTCHA.
>Court documents reveal Microsoft\'s latest move to combat an operation that used fraudulent accounts to skirt CAPTCHA services. |
★★★ | ||
 |
2024-07-31 23:29:11 | Les avantages d'approvisionnement et opérationnels d'une plateforme de cybersécurité The Procurement and Operational Benefits of a Cybersecurity Platform (lien direct) |
> La consolidation de plusieurs solutions dans une plate-forme unifiée comble les lacunes de sécurité qui augmentent lors du déploiement de produits de points individuels pour résoudre des problèmes spécifiques.
>Consolidating multiple solutions into a unified platform closes security gaps that rise when deploying individual point products to address specific issues. |
★★★ | ||
|
2024-07-31 23:02:08 | Le géant pharmaceutique Cencora dit que les données de santé personnelles ont été divulguées au cours du cyber-incident de février Pharma giant Cencora says personal health data leaked during February cyber incident (lien direct) |
Pas de details / No more details | ★★★ | ||
 |
2024-07-31 23:00:00 | Les entreprises australiennes devront bientôt signaler les paiements de rançon Australian Companies Will Soon Need to Report Ransom Payments (lien direct) |
Une législation importante à venir promet de resserrer les vis sur la réponse des cyber-incidents en Australie, en reflétant Circia aux États-Unis.
Significant upcoming legislation promises to tighten the screws on cyber incident response in Australia, mirroring CIRCIA in the US. |
Legislation | ★★★ | |
|
2024-07-31 23:00:00 | Épisode 39: Throwback jeudi!I \\ 'M UNIQUEMENT H.U.M.A.N (S): Pirater le système d'exploitation humain pour maîtriser la conformité à la cybersécurité EPISODE 39: Throwback Thursday! I\\'m Only H.U.M.A.N(S): Hacking the Human OS to Master Cybersecurity Compliance (lien direct) |
Bienvenue pour compromettre les positions! Le podcast technologique primé qui demande aux professionnels non-cybersécurité ce que nous, dans l'industrieCyber-menaces centrées sur l'homme! & nbsp; Cet épisode que nous retournons dans les coffres pour vous apporter la version inabris de notre interview fantastique et extrêmement populaire avec christian Hunt, Le fondateur de risque humain .Il a comportemental & nbsp; science expert et auteur du livre primé \\ 'Humaniser Rules \'. Takeways clés: L'importance de concevoir des choses sur la façon dont les gens se comportent réellement (par opposition à la façon dont nous voudrions qu'ils se comportent!) Les simulations de phishing sont-elles toujours adaptées à l'usage? L'éthique des simulations de phishing et comment mesurer le succès de la formation de sensibilisation à la cybersécurité f * ck vos règles! Nous entrons dans ce que les gens ressentent vraiment des règles qu'ils ne respectent pas et comment vous pouvez les empêcher de se rebeller contre vos contrôles de cybersécurité! Arrêtez de traiter tout le monde comme un maître criminel! Pourquoi une approche unique de la suspicion causera plus de mal que de bien pour votre posture de cybersécurité i \\ 'm seulement H.U.M.A.N (S) - Christian partage son cadre H.U.M.A.N.S à utiliser dans votre organisation aujourd'hui! Les liens vers tout ce dont nous avons discuté dans cet épisode peuvent être trouvés dans les notes de l'émission et si vous avez aimé le spectacle, veuillez nous laisser une revue . Suivez-nous sur toutes les bonnes plates-formes de podcasting et via notre chaîne YouTube, et n'oubliez pas de partager partager sur LinkedIn et dans vos équipes . Cela nous aide vraiment diffuser le mot et obtenir des invités de haute qualité, sur les épisodes futurs. & nbsp; Nous espérons que vous avez apprécié cet épisode - à la prochaine fois, restez en sécurité et n'oubliez pas de vous demander, \\ 'suis-je la position compromettante ici? \' & nbsp; Mots-clés: cybersécurité, phishing, science comportementale, règles, conformité, H.U.M.A.N.S Framework Afficher les notes le livre de Christian \\ (hautement recommandé) - Règles d'humanisation | ★★★ | ||
|
2024-07-31 22:40:07 | Rapport trimestriel de la cyber-menace: MITER ATT & CK Framework Trends in Osint (avril 2024 & # 8211; juin 2024) Quarterly cyber threat report: MITRE ATT&CK framework trends in OSINT (April 2024 – June 2024) (lien direct) |
## Snapshot This report presents an analysis of recent trends in cyber threats based on 111 articles published by threat researchers across the security community between April and June 2024. These articles are curated by Microsoft Threat Intelligence from across a number of trusted sources and included in Microsoft Defender Threat Intelligence as open source intelligence (OSINT) articles. The analysis focuses on the nearly 1,000 MITRE ATT&CK framework tags correlated to the content in each article. By distilling insights from these tags and the related intelligence, we can highlight prevalent tactics, techniques, and procedures (TTPs) observed in the cyber security landscape over the past quarter. This dataset is not exhaustive but represents a curated set of most high-profile cyber threat intelligence reporting from across the security community. When prioritizing cyber security efforts, it\'s essential to understand the trending TTPs observed in the wild. This knowledge helps defenders make informed decisions about the most effective strategies to implement, especially where to focus engineering efforts and finite resources. ## Activity Overview - **Initial access: Phishing**: Phishing remains a prevalent initial access method, mentioned in a third of reports, including spear-phishing attachments and links. The persistence of this technique underscores its effectiveness and the ongoing need for robust user education and email security measures. - **Defense evasion: Obfuscated files or information:** Over a third of reports highlighted the use of obfuscation techniques, such as dynamic API resolution and steganography, to evade detection. This trend is likely underpinned by factors such as the cybercrime market for obfuscating even basic credential theft malware as well as the growing sophistication in some malware to bypass traditional security measures. - **Command and control: Ingress tool transfer:** Ingress tool transfer was the most frequently referenced technique, involving the transfer of tools from an external system to a compromised one. Key threats driving the prevalence of this tactic included an increase in OSINT reporting on threat actors misusing the ms-appinstaller URI scheme (App Installer) to distribute malware. - **Execution: Command and scripting interpreter/PowerShell:** Execution through PowerShell was prominent, continuing its trend of broad adoption in attacks over the past decade. The widespread adoption of PowerShell to launch malicious code is in part due to numerous toolkits that have been developed to allow quick deployment of a wide range of attacks. - **Exfiltration: Exfiltration over C2 channel:** The most commonly referenced exfiltration method was over the command-and-control (C2) channel, highlighting the critical need for network monitoring and anomaly detection to identify and mitigate data breaches. The frequent reports on infostealers such as Lumma and DarkGate-commodity malware used to steal information from a target device and send it to the threat actor-are likely key drivers of this MITRE tag\'s prominence. - **Impact: Data encrypted for impact:** Ransomware involving data encryption was the most frequently observed impact technique, with LockBit and other groups exploiting vulnerabilities. The use of Bring Your Own Vulnerable Driver (BYOVD) tactics, such as Warp AV Killer, remained common. #### Initial access: Phishing Phishing remains a significant initial access method in open-source research, with a third of the reports mentioning its use. This includes both spear-phishing attachments and spear-phishing links. Phishing involves deceptive attempts to trick individuals into divulging sensitive information or installing malicious software, often through seemingly legitimate emails. The persistence of this technique underscores its effectiveness and the ongoing need for robust user education and email security measures. Phishing remains a dominant method for initial access in cyber threat landscapes due to its effective | Ransomware Spam Malware Tool Vulnerability Threat Legislation Prediction Cloud | ★★★ | |
|
2024-07-31 21:21:59 | Les Nord-Coréens ciblent les développeurs du monde entier avec des logiciels espions, des offres d'emploi North Koreans Target Devs Worldwide With Spyware, Job Offers (lien direct) |
Dev # Popper est de retour, cherche à livrer un infostecteur complet et mis à jour pour coder les demandeurs d'emploi par le biais d'un gambit de génie social avisé.
DEV#POPPER is back, looking to deliver a comprehensive, updated infostealer to coding job seekers by way of a savvy social engineering gambit. |
★★★ | ||
|
2024-07-31 21:17:43 | (Déjà vu) «Echospoofing» - une campagne de phishing massive exploitant la protection par e-mail de Proofpoint \\ pour envoyer des millions de courriels parfaitement usurpés “EchoSpoofing” - A Massive Phishing Campaign Exploiting Proofpoint\\'s Email Protection to Dispatch Millions of Perfectly Spoofed Emails (lien direct) |
## Snapshot In a coordinated report, Guardio Labs and Proofpoint detailed spam campaigns, which exploited weak permissions in Proofpoint\'s email protection service to send millions of spoofed emails impersonating major entities like Disney, Nike, IBM, and Coca-Cola to Fortune 100 companies. ## Description The campaign, which began in January 2024, involved an average of 3 million spoofed emails per day, peaking at 14 million emails in early June. Threat actors utilized their own SMTP (Simple Mail Transfer Protocol) servers to create spoofed emails with manipulated headers and relayed them through compromised or rogue Microsoft Office 365 accounts via Proofpoint\'s relay servers. As of July 30th, Guardio Labs reported that a number of the Microsoft accounts have been removed. The attackers leveraged Virtual Private Servers (VPS) hosted by OVHCloud and Centrilogic, as well as various domains registered through Namecheap to conduct the campaign. Proofpoint assesses that this activity was likely conducted by one actor, who is currently unknown. The phishing emails were designed to steal sensitive personal information and incur unauthorized charges, and they passed SPF and DKIM checks, allowing them to bypass spam filters and reach recipients\' inboxes. Proofpoint, after being notified by Guardio Labs, tightened security measures and provided new settings and advice to mitigate these attacks. ## Recommendations Microsoft recommends the following mitigations to reduce the impact of this threat. - Turn on [cloud-delivered protection](https://learn.microsoft.com/en-us/defender-endpoint/linux-preferences) in Microsoft Defender Antivirus or the equivalent for your antivirus product to cover rapidly evolving attacker tools and techniques. Cloud-based machine learning protections block a majority of new and unknown threats. - Run [EDR in block mode](https://learn.microsoft.com/microsoft-365/security/defender-endpoint/edr-in-block-mode?view=o365-worldwide?ocid=magicti_ta_learndoc) so that Microsoft Defender for Endpoint can block malicious artifacts, even when your non-Microsoft antivirus does not detect the threat or when Microsoft Defender Antivirus is running in passive mode. EDR in block mode works behind the scenes to remediate malicious artifacts that are detected post-breach. - Allow [investigation and remediation](https://learn.microsoft.com/microsoft-365/security/defender-endpoint/automated-investigations?view=o365-worldwide?ocid=magicti_ta_learndoc) in full automated mode to allow Microsoft Defender for Endpoint to take immediate action on alerts to resolve breaches, significantly reducing alert volume. - [Enable](https://learn.microsoft.com/en-us/defender-endpoint/enable-controlled-folders) controlled folder access. - Ensure that [tamper protection](https://learn.microsoft.com/en-us/defender-endpoint/prevent-changes-to-security-settings-with-tamper-protection#how-do-i-configure-or-manage-tamper-protection) is enabled in Microsoft Defender for Endpoint. - Enable [network protection](https://learn.microsoft.com/en-us/defender-endpoint/enable-network-protection) in Microsoft Defender for Endpoint. - Follow the credential hardening recommendations in the [on-premises credential theft overview](https://security.microsoft.com/threatanalytics3/9382203e-5155-4b5e-af74-21562b1004d5/analystreport) to defend against common credential theft techniques like LSASS access. - [Enable](https://learn.microsoft.com/en-us/defender-endpoint/attack-surface-reduction-rules-reference#block-credential-stealing-from-the-windows-local-security-authority-subsystem) LSA protection. - Microsoft Defender XDR customers can turn on the following [attack surface reduction rule](https://learn.microsoft.com/microsoft-365/security/defender-endpoint/attack-surface-reduction) to prevent common attack techniques used for ransomware. - - [Block](https://learn.microsoft.com/en-us/defender-endpoint/attack-surface-reduction-rules-reference#block-executable-content-from-email-client-and-webmai | Ransomware Spam Tool Threat | ★★★ | |
|
2024-07-31 21:03:41 | CISA, le FBI met en garde contre les attaques potentielles du DDOS lors des élections 2024 CISA, FBI warn of potential DDoS attacks on 2024 elections (lien direct) |
Pas de details / No more details | |||
|
2024-07-31 20:30:20 | ESET révèle la dernière solution d'authentification native du cloud ESET Reveals Latest Cloud-Native Authentication Solution (lien direct) |
Pas de details / No more details | |||
|
2024-07-31 20:25:25 | Protect AI acquiert des sydelabs pour l'équipe rouge de grande langue des modèles de langue Protect AI Acquires SydeLabs to Red Team Large Language Models (lien direct) |
Pas de details / No more details | |||
|
2024-07-31 20:17:42 | Les imitations des dirigeants dirigés par l'IA émergent comme une menace importante pour les processus de paiement commercial AI-Driven Executive Impersonations Emerge As Significant Threat to Business Payment Processes (lien direct) |
Pas de details / No more details | Threat | ★★★ | |
|
2024-07-31 20:02:49 | (Déjà vu) Socgholish malware attaquant les utilisateurs de Windows à l'aide d'une fausse mise à jour du navigateur SocGholish Malware Attacking Windows Users Using Fake Browser Update (lien direct) |
## Snapshot GData Software analysts found that the [SocGholish](https://security.microsoft.com/intel-profiles/7e30959d011aa33939afaa2477fd0cd097cee346fa3b646446a6b1e55f0c007f) malware, favored by threat groups like Evil Corp (tracked by Microsoft as [Manatee Tempest](https://security.microsoft.com/intel-profiles/1b66d1619b5365957ba8c785bfd7936bfa9cf8b58ad9f55b7987f7f3b390f4fc)) and TA569 (tracked by Microsft as [Mustard Tempest](https://security.microsoft.com/intel-profiles/79a9547522d81fe6c1f5e42d828009656892f3976c547360db52c33f0ba16db9)), is actively targeting Windows users with fake browser updates. ## Description This complex JavaScript downloader uses drive-by download techniques to silently install malware on user machines. It has evolved to exploit vulnerable WordPress plugins using the Keitaro traffic distribution system, with its infrastructure traced to Russian-hosted servers. The malware employs advanced techniques such as user profiling, browser fingerprinting, and fake browser update pages as lures. Potential payloads associated with SocGholish include backdoors, information stealers, remote access Trojans, and ransomware. Recent infections indicate the use of PowerShell scripts for persistence on compromised systems, enhancing its adaptability and evasion capabilities. ## Microsoft Analysis Microsoft researchers have investigated multiple incidents involving fake software updates served by the SocGholish malware distribution framework. [SocGholish](https://security.microsoft.com/intel-profiles/7e30959d011aa33939afaa2477fd0cd097cee346fa3b646446a6b1e55f0c007f) is an attack framework that malicious attackers have used since at least 2020. The attacker framework entices users to install fake software updates that eventually let attackers infiltrate target organizations. SocGholish can be tweaked to deliver any payload an attacker chooses. Threat actors [Mustard Tempest](https://security.microsoft.com/intel-profiles/79a9547522d81fe6c1f5e42d828009656892f3976c547360db52c33f0ba16db9?tab=tradeCraft) and [Manatee Tempest](https://security.microsoft.com/intel-profiles/1b66d1619b5365957ba8c785bfd7936bfa9cf8b58ad9f55b7987f7f3b390f4fc) use SocGholish/FakeUpdates as their primary technique to gain intial access. ## Detections/Hunting Queries Microsoft Defender Antivirus detects threat components as the following malware: - [TrojanDownloader:JS/FakeUpdates](https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=TrojanDownloader:JS/FakeUpdates.J&threatId=-2147133367?ocid=magicti_ta_ency) - [Behavior:Win32/FakeUpdates](https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Behavior:Win32/FakeUpdates.A&threatId=-2147140656?ocid=magicti_ta_ency) - [Trojan:JS/FakeUpdate](https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:JS/FakeUpdate.C) - [Behavior:Win32/Socgolsh](https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Behavior:Win32/Socgolsh.SB&threatId=-2147152249?ocid=magicti_ta_ency) - [TrojanDownloader:JS/SocGholish](https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=TrojanDownloader:JS/SocGholish!MSR&threatId=-2147135220?ocid=magicti_ta_ency) - [Trojan:JS/Socgolsh.A](https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:JS/Socgolsh.A) - [Behavior:Win32/Socgolsh.SB](https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Behavior:Win32/Socgolsh.SB) - [Trojan:Win32/Blister](https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Blister.A&threatId=-2147152044?ocid=magicti_ta_ency) - [Trojan:Win64/Blister](https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win64/Blister.A&threatId=-2147153518?ocid=magicti_ta_ency) - [Behavior:Win32/SuspRclone](https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Behavior:Win32/Sus | Ransomware Malware Tool Threat | ||
|
2024-07-31 20:02:24 | Cyber Bills on Federal Regs, Health Security and Workforce Clear Sénat Panel Cyber bills on federal regs, health security and workforce clear Senate panel (lien direct) |
> Les membres du comité ont voté 10-1 pour faire avancer les trois lois bipartisanes, ouvrant le terrain pour une considération complète du Sénat.
>Committee members voted 10-1 to advance all three bipartisan pieces of legislation, setting the stage for full Senate consideration. |
Legislation | ||
|
2024-07-31 19:50:19 | Bitgo signe la Cybersecurity and Infrastructure Security Agency (CISA) BitGo Signs the Cybersecurity and Infrastructure Security Agency (CISA) (lien direct) |
Bitgo Signe l'engagement de la Cybersecurity and Infrastructure Security Agency (CISA) pour améliorer la résilience de la cybersécurité
En tant que première entreprise de crypto à signer, Bitgo, le leader de la sécurité des actifs numériques, encourage les participants à l'industrie à s'engager dans les meilleures pratiques promues par CISA.
-
nouvelles commerciales
BitGo Signs the Cybersecurity and Infrastructure Security Agency (CISA) Pledge to Enhance Cybersecurity Resilience As the first crypto firm to sign, BitGo, the leader in digital asset security, encourages industry participants to commit to the best practices promoted by CISA. - Business News |
|||
|
2024-07-31 19:43:00 | Digicert pour révoquer plus de 83 000 certificats SSL en raison de la surveillance de la validation du domaine DigiCert to Revoke 83,000+ SSL Certificates Due to Domain Validation Oversight (lien direct) |
Certificate Authority (CA) DiGinert a averti qu'elle révoquerait un sous-ensemble de certificats SSL / TLS dans les 24 heures en raison d'une surveillance de la façon dont il a vérifié si un certificat numérique est délivré au propriétaire légitime d'un domaine.
La société a déclaré qu'elle prendrait la mesure de révocation des certificats qui ne disposaient pas de validation appropriée de contrôle du domaine (DCV).
"Avant de délivrer un certificat à un
Certificate authority (CA) DigiCert has warned that it will be revoking a subset of SSL/TLS certificates within 24 hours due to an oversight with how it verified if a digital certificate is issued to the rightful owner of a domain. The company said it will be taking the step of revoking certificates that do not have proper Domain Control Validation (DCV). "Before issuing a certificate to a |
To see everything:
