What's new arround internet
| Src | Date (GMT) | Titre | Description | Tags | Stories | Notes |
 |
2024-06-13 19:38:00 | Nouvelle technique d'attaque \\ 'Sleepy Pickle \\' cible les modèles d'apprentissage automatique New Attack Technique \\'Sleepy Pickle\\' Targets Machine Learning Models (lien direct) |
Les risques de sécurité posés par le format de cornichon sont de nouveau revenus au premier plan avec la découverte d'un nouveau "technique d'exploitation du modèle Hybrid Machine Learning (ML)" surnommé Sleepy Pickle.
La méthode d'attaque, par trace de bits, arme le format omniprésent utilisé pour emballer et distribuer des modèles d'apprentissage automatique (ML) pour corrompre le modèle lui-même, posant un risque de chaîne d'approvisionnement sévère pour un
The security risks posed by the Pickle format have once again come to the fore with the discovery of a new "hybrid machine learning (ML) model exploitation technique" dubbed Sleepy Pickle. The attack method, per Trail of Bits, weaponizes the ubiquitous format used to package and distribute machine learning (ML) models to corrupt the model itself, posing a severe supply chain risk to an |
|||
 |
2024-06-13 19:35:28 | Prepare to Implement NERC CIP-015 Internal Network Security Monitoring (INSM) Requirements (lien direct) | >On January 19, 2023, the Federal Energy Regulatory Commission (FERC) issued Order No. 887 directing the North American Electric Reliability... The post Prepare to Implement NERC CIP-015 Internal Network Security Monitoring (INSM) Requirements first appeared on Dragos. | |||
|
2024-06-13 19:25:00 | Arid Viper lance une campagne d'espionnage mobile avec des logiciels malveillants aridspy Arid Viper Launches Mobile Espionage Campaign with AridSpy Malware (lien direct) |
L'acteur de menace connu sous le nom d'Arid Viper a été attribué à une campagne d'espionnage mobile qui exploite des applications Android trojanisées pour offrir une souche spyware baptisé AridSpy.
"Le logiciel malveillant est distribué via des sites Web dédiés imitant diverses applications de messagerie, une application d'opportunité d'emploi et une application de registre civil palestinien", a déclaré aujourd'hui le chercheur ESET LUK & AACUTE; Š štefanko dans un rapport publié aujourd'hui."Souvent
The threat actor known as Arid Viper has been attributed to a mobile espionage campaign that leverages trojanized Android apps to deliver a spyware strain dubbed AridSpy. "The malware is distributed through dedicated websites impersonating various messaging apps, a job opportunity app, and a Palestinian Civil Registry app," ESET researcher Lukáš Štefanko said in a report published today. "Often |
Malware Threat Mobile | APT-C-23 | |
 |
2024-06-13 19:16:14 | PoC Exploit Emerges for Critical RCE Bug in Ivanti Endpoint Manager (lien direct) | A new month, a new high-risk Ivanti bug for attackers to exploit - this time, an SQL injection issue in its centralized endpoint manager. | |||
 |
2024-06-13 19:10:43 | NSO Group co-founder launches AI institute at top Israeli university (lien direct) | A new month, a new high-risk Ivanti bug for attackers to exploit - this time, an SQL injection issue in its centralized endpoint manager. | |||
|
2024-06-13 18:56:16 | Le grésil de la pierre de lune de la Corée du Nord élargit la distribution du code malveillant North Korea\\'s Moonstone Sleet Widens Distribution of Malicious Code (lien direct) |
L'acteur de menace récemment identifié utilise des registres publics pour la distribution et a élargi les capacités pour perturber la chaîne d'approvisionnement des logiciels.
The recently identified threat actor uses public registries for distribution and has expanded capabilities to disrupt the software supply chain. |
Threat | ||
|
2024-06-13 18:36:17 | City governments in Michigan, New York face shutdowns after ransomware attacks (lien direct) | L'acteur de menace récemment identifié utilise des registres publics pour la distribution et a élargi les capacités pour perturber la chaîne d'approvisionnement des logiciels.
The recently identified threat actor uses public registries for distribution and has expanded capabilities to disrupt the software supply chain. |
|||
 |
2024-06-13 18:33:01 | UNC5537 Targets Snowflake Customer Instances for Data Theft and Extortion (lien direct) | ## Snapshot Mandiant has uncovered a cyber threat campaign targeting Snowflake customer database instances, aiming to steal data and extort victims. Snowflake is an American cloud computing–based data cloud company. ## Description This campaign, attributed to a group Mandiant tracks as UNC5537, involves systematic compromise of Snowflake instances using stolen customer credentials. These credentials were primarily acquired through infostealer malware as early as 2020. Read Microsoft's [Tool Profile on Infostealers](https://security.microsoft.com/intel-profiles/2296d491ea381b532b24f2575f9418d4b6723c17b8a1f507d20c2140a75d16d6). Mandiant found no evidence that Snowflake's own systems were breached; rather, the breaches were due to compromised customer credentials. In April 2024, Mandiant identified stolen database records from a Snowflake instance, leading to an investigation that revealed the use of infostealer malware to obtain credentials. A significant vulnerability was the lack of multi-factor authentication (MFA) on compromised accounts. In May 2024, Mandiant identified a broader campaign targeting multiple Snowflake customers, resulting in notifications to approximately 165 organizations. Snowflake has since provided detection and hardening guidance to its customers. The compromised credentials were obtained from various infostealers such as Vidar, RisePro, RedLine, [Lumma](https://security.microsoft.com/intel-profiles/33933578825488511c30b0728dd3c4f8b5ca20e41c285a56f796eb39f57531ad), MetaStealer, and Raccoon Stealer, with many stolen years ago and never rotated or secured with MFA. UNC5537 used VPNs and virtual private servers (VPS) to access and exfiltrate data from Snowflake instances, later attempting to sell this data on cybercriminal forums. The group leveraged FrostBite utility for reconnaissance and used database management utilities for further exploitation. The campaign's success is attributed to poor credential management and security practices, such as lack of MFA and failure to update credentials. This incident highlights the risks posed by widespread infostealer malware and the importance of robust security measures to protect cloud-based data warehouses. Mandiant anticipates that UNC5537 will continue targeting SaaS platforms due to the lucrative nature of such attacks. ## Detections/Hunting Queries **Microsoft Defender for Endpoint** Microsoft Defender Antivirus detects threat components as the following malware: - *[PWS:Win32/Vidar](https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=PWS:Win32/Vidar&threatId=-2147198594)* - *[Ransom:Win32/Vidar](https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/Vidar&threatId=-2147235644)* - [*Trojan:Win32/Vidar*](https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Vidar.PAZ!MTB&threatId=-2147125956) - [*Trojan:Win32/Risepro*](https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Risepro&threatId=-2147077417) - [*PWS:Win32/RisePro*](https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=PWS:Win32/RisePro!MSR&threatId=-2147070426) - [*Trojan:Win32/Redline*](https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Redline&threatId=-2147134038) - [*Trojan:Win64/RedLine*](https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win64/RedLine&threatId=-2147104481) - [*Spyware:Win32/Redline*](https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Spyware:Win32/Redline&threatId=369640) - [*Trojan:MSIL/RedLine*](https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:MSIL/RedLine.ME&threatId=-2147060400) - [*Trojan:Win64/Lumma*](https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Wi | |||
 |
2024-06-13 18:29:59 | Phishing With Deepfakes for HK$200 Million (lien direct) |
|
|||
 |
2024-06-13 18:05:49 | Two Recent Campaigns from Brazil and Korea Exploiting Legitimate Cloud Services (lien direct) | >The exploitation of cloud services is a flexible weapon in the hands of attackers, so flexible that we uncover new campaigns abusing legitimate apps on a daily basis. Whether threat actors are driven by cybercrime or cyberespionage, they continue to target different audiences in different geographical regions of the world, exploiting different services in different […] | |||
|
2024-06-13 18:05:44 | Ai Chatbot Fools Scammeurs &Scores Intel de blanchiment d'argent AI Chatbot Fools Scammers & Scores Money-Laundering Intel (lien direct) |
L'expérience montre comment l'IA peut tourner les tables sur les cybercriminels, en capturant les détails du compte bancaire sur la façon dont les escrocs déplacent des fonds volés dans le monde.
Experiment demonstrates how AI can turn the tables on cybercriminals, capturing bank account details of how scammers move stolen funds around the world. |
|||
 |
2024-06-13 17:20:12 | Google borrows from Android to make ChromeOS better (lien direct) | 'Large portions' of droid tech stack going into laptop OS plumbing Google's ChromeOS team has begun borrowing "large portions" of Android's tech stack to innovate faster, to reduce the burden of maintaining multiple operating systems, and to enhance device interoperability in the face of vendor kernel variability, the web giant says.… | |||
 |
2024-06-13 17:13:35 | How Singapore is creating more inclusive AI (lien direct) | A bespoke model might be the answer to Western-focused LLMs - here's what it can do for Southeast Asia. | |||
|
2024-06-13 17:00:00 | Pourquoi la sécurité SaaS est soudainement chaude: courir pour défendre et se conformer Why SaaS Security is Suddenly Hot: Racing to Defend and Comply (lien direct) |
Les cyberattaques récentes de la chaîne d'approvisionnement incitent les réglementations de cybersécurité dans le secteur financier pour resserrer les exigences de conformité, et d'autres industries devraient suivre.De nombreuses entreprises n'ont toujours pas de méthodes efficaces pour gérer les tâches de sécurité et de conformité SaaS et de conformité.Les outils d'évaluation des risques SaaS gratuits sont un moyen facile et pratique de proposer une visibilité et initiale
Recent supply chain cyber-attacks are prompting cyber security regulations in the financial sector to tighten compliance requirements, and other industries are expected to follow. Many companies still don\'t have efficient methods to manage related time-sensitive SaaS security and compliance tasks. Free SaaS risk assessment tools are an easy and practical way to bring visibility and initial |
Tool Cloud | ||
 |
2024-06-13 16:47:27 | New Mobile Threat Alert – Operation Celestial Fore (lien direct) | >In this blog, Zimperium shares details about the mobile-targeted malware campaign named Operation Celestial Force, attributed to threat actors linked to Pakistan. Read the blog for more. | |||
 |
2024-06-13 16:44:08 | Chinese \'Smishing Triad\' Group Targets Pakistanis with SMS Phishing (lien direct) | Protect yourself from Smishing attacks in Pakistan! Smishing Triad, a notorious cybercriminal group, is targeting Pakistani bank customers with fake Pakistan Post messages. Learn how to identify and avoid these scams to protect your financial information. | |||
|
2024-06-13 16:29:51 | Ascension: Hackers stole some patient data but didn\'t breach electronic health record system (lien direct) | Protect yourself from Smishing attacks in Pakistan! Smishing Triad, a notorious cybercriminal group, is targeting Pakistani bank customers with fake Pakistan Post messages. Learn how to identify and avoid these scams to protect your financial information. | |||
 |
2024-06-13 16:27:55 | Les logiciels malveillants de Disgomoji ciblent le gouvernement indien DISGOMOJI Malware Used to Target Indian Government (lien direct) |
> Remarque: Volexity a signalé l'activité décrite dans ce blog et les détails des systèmes impactés sur CERT au National Informatics Center (NIC) en Inde.En 2024, Volexity a identifié une campagne de cyber-espionnage entrepris par un acteur de menace présumé basé au Pakistan que Volexité suit actuellement en vertu de l'alias UTA0137.Les logiciels malveillants utilisés dans ces campagnes récentes, que la volexité suit comme Disgomoji, est écrite en Golang et compilée pour les systèmes Linux.La volexité évalue avec une grande confiance que l'UTA0137 a des objectifs liés à l'espionnage et une remise pour cibler les entités gouvernementales en Inde.Sur la base de l'analyse de volexity \\, les campagnes d'UTA0137 \\ semblent avoir réussi.Disgomoji semble être exclusivement utilisé par UTA0137.Il s'agit d'une version modifiée du projet public Discord-C2, qui utilise le service de messagerie Discord pour la commande et le contrôle (C2), utilisant des emojis pour sa communication C2.L'utilisation de logiciels malveillants Linux pour un accès initial associé à des documents leurres (suggérant un [& # 8230;]
>Note: Volexity has reported the activity described in this blog and details of the impacted systems to CERT at the National Informatics Centre (NIC) in India. In 2024, Volexity identified a cyber-espionage campaign undertaken by a suspected Pakistan-based threat actor that Volexity currently tracks under the alias UTA0137. The malware used in these recent campaigns, which Volexity tracks as DISGOMOJI, is written in Golang and compiled for Linux systems. Volexity assesses with high confidence that UTA0137 has espionage-related objectives and a remit to target government entities in India. Based on Volexity\'s analysis, UTA0137\'s campaigns appear to have been successful. DISGOMOJI appears to be exclusively used by UTA0137. It is a modified version of the public project discord-c2, which uses the messaging service Discord for command and control (C2), making use of emojis for its C2 communication. The use of Linux malware for initial access paired with decoy documents (suggesting a […] |
Malware Threat | ||
|
2024-06-13 15:56:00 | La campagne de logiciels malveillants liée au Pakistan évolue vers des cibles Windows, Android et MacOS Pakistan-linked Malware Campaign Evolves to Target Windows, Android, and macOS (lien direct) |
Les acteurs de menace ayant des liens avec le Pakistan sont liés à une campagne de logiciels malveillants de longue date surnommée l'opération Celestial Force depuis au moins 2018.
L'activité, toujours en cours, implique l'utilisation d'un logiciel malveillant Android appelé GravityRat et d'un chargeur de logiciels malveillants basé sur Windows, nommé Heavylift, selon Cisco Talos, qui sont administrés à l'aide d'un autre outil autonome appelé GravityAdmin.
Le
Threat actors with ties to Pakistan have been linked to a long-running malware campaign dubbed Operation Celestial Force since at least 2018. The activity, still ongoing, entails the use of an Android malware called GravityRAT and a Windows-based malware loader codenamed HeavyLift, according to Cisco Talos, which are administered using another standalone tool referred to as GravityAdmin. The |
Malware Tool Threat Mobile | ||
 |
2024-06-13 15:52:26 | New York Times warns freelancers of GitHub repo data breach (lien direct) | The New York Times notified an undisclosed number of contributors that some of their sensitive personal information was stolen and leaked after its GitHub repositories were breached in January 2024. [...] | |||
|
2024-06-13 15:49:00 | Les cybercriminels utilisent un Phantomloader pour distribuer des logiciels malveillants SSLoad Cybercriminals Employ PhantomLoader to Distribute SSLoad Malware (lien direct) |
Les logiciels malveillants naissants connus sous le nom de SSLoad sont livrés au moyen d'un chargeur précédemment sans papiers appelé Phantomloader, selon les résultats de la société de cybersécurité Intezer.
"Le chargeur est ajouté à une DLL légitime, généralement des produits EDR ou AV, en corrigeant le fichier et en utilisant des techniques d'auto-modification pour échapper à la détection", a déclaré les chercheurs en sécurité Nicole Fishbein et Ryan Robinson
The nascent malware known as SSLoad is being delivered by means of a previously undocumented loader called PhantomLoader, according to findings from cybersecurity firm Intezer. "The loader is added to a legitimate DLL, usually EDR or AV products, by binary patching the file and employing self-modifying techniques to evade detection," security researchers Nicole Fishbein and Ryan Robinson said in |
Malware Patching | ||
 |
2024-06-13 15:08:28 | Quelles épreuves cyber pour les entreprises aux Jeux Olympiques Paris 2024 ? (lien direct) | Les Jeux Olympiques sont la compétition sportive la plus regardée au monde. Ils représentent une merveilleuse opportunité de mettre dans la lumière tout un pays en attirant publics et médias du monde entier. Dans un monde ultra connecté, attirer la visibilité, c'est aussi attirer la cybercriminalité. C'est en substance ce qu'a déclaré Franz Regul, le responsable de la sécurité des systèmes d'information du Comité d'organisation de Paris 2024 : " Aujourd'hui, la totale organisation repose sur la (...) - Points de Vue | |||
 |
2024-06-13 15:00:00 | Attaque en ascension causée par le téléchargement des employés au fichier malveillant Ascension Attack Caused by Employee Downloading Malicious File (lien direct) |
La société de santé Ascension a déclaré que les attaquants de ransomware ont eu accès à ses systèmes après qu'un employé ait accidentellement téléchargé un fichier malveillant
Healthcare firm Ascension said that ransomware attackers gained access to its systems after an employee accidently downloaded a malicious file |
Ransomware Medical | ||
 |
2024-06-13 14:49:51 | Conformité RGPD : l\'autoévaluation BCR en 50 questions (lien direct) | La CNIL a produit un outil d'évaluation de maturité pour les projets de BCR. On mesure la flexibilité du mécanisme... et ses complexités. | |||
|
2024-06-13 14:43:23 | Toronto District School Board hit by a ransomware attack (lien direct) | The Toronto District School Board (TDSB) is warning that it suffered a ransomware attack on its software testing environment and is now investigating whether any personal information was exposed. [...] | |||
|
2024-06-13 14:32:14 | Panera warns of employee data breach after March ransomware attack (lien direct) | U.S. food chain giant Panera Bread is notifying employees of a data breach after unknown threat actors stole their sensitive personal information in a March ransomware attack. [...] | |||
|
2024-06-13 14:30:35 | Microsoft, en retard au jeu sur une défaite dangereuse DNSSEC Zero-Day Microsoft, Late to the Game on Dangerous DNSSEC Zero-Day Flaw (lien direct) |
La raison pour laquelle la société a mis si longtemps à résoudre le problème n'est pas connue étant donné que la plupart des autres parties prenantes ont eu un correctif pour le problème il y a des mois.
Why the company took so long to address the issue is not known given that most other stakeholders had a fix out for the issue months ago. |
Vulnerability Threat | ||
|
2024-06-13 14:30:00 | Arid Viper Hackers Spy en Égypte et en Palestine en utilisant des logiciels espions Android Arid Viper Hackers Spy in Egypt and Palestine Using Android Spyware (lien direct) |
ESET a détecté cinq campagnes de cyber-espionnage ciblant les utilisateurs d'Android avec des applications trojanisées déploiement \\ 'AridSpy \' Spyware
ESET detected five cyber espionage campaigns targeting Android users with trojanized apps deploying \'AridSpy\' spyware |
Mobile | APT-C-23 | |
 |
2024-06-13 14:23:33 | The unsung security benefits of cloud migration (lien direct) | From better isolation to well-defined choke points, defenders are discovering more and more cloud security benefits. | |||
|
2024-06-13 14:15:00 | Usurpation d\'identité : Les grandes entreprises françaises ripostent avec l\'IA et les identités décentralisées (lien direct) | Depuis de nombreuses années déjà, les cybercriminels du monde entier utilisent des identités d'utilisateurs numériques compromises comme première porte d'entrée dans les systèmes informatiques de leurs victimes. Déguisés en utilisateurs vérifiés, ils espionnent leurs systèmes, placent des logiciels malveillants et des ransomwares, passent des commandes et effectuent des virements au nom d'autres personnes. Les experts en sécurité informatique du monde entier sont convaincus que ce danger va encore (...) - Points de Vue | |||
|
2024-06-13 14:12:57 | Multiples vulnérabilités dans Google Android et Pixel (13 juin 2024) (lien direct) | De multiples vulnérabilités ont été découvertes dans Google Android et Pixel. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une atteinte à la confidentialité des données et une élévation de privilèges. Google indique que la vulnérabilité CVE-2024-32896... - Vulnérabilités | |||
 |
2024-06-13 14:08:11 | Détection de shells Web: pourquoi il est important d'ajouter une couche de protection supplémentaire sur vos solutions de sécurité existantes Detecting Web Shells: Why it is important to add an additional layer of protection on your existing security solutions (lien direct) |
> Comprendre l'importance de la détection des coquilles Web est crucial dans le paysage de la cybersécurité d'aujourd'hui.Les solutions antivirus traditionnelles échouent souvent, mais des outils spécialisés comme le scanner Thor Apt de Nextron offrent une protection avancée contre ces menaces furtives, assurant une sécurité complète.
>Understanding the importance of web shell detection is crucial in today\'s cybersecurity landscape. Traditional antivirus solutions often fall short, but specialized tools like Nextron\'s THOR APT scanner provide advanced protection against these stealthy threats, ensuring comprehensive security. |
Tool | ||
|
2024-06-13 14:01:31 | Why Security Awareness Training is Your Best Defense (lien direct) | Cybercriminals are constantly on the lookout for ways to infiltrate our devices and steal our personal information. Data… | |||
|
2024-06-13 14:00:00 | Comment la cybercriminalité est construite How Cybercrime Empires Are Built (lien direct) |
Des partenariats solides et des collaborations entre l'industrie et les forces de l'ordre sont les moyens les plus critiques de démonter les groupes de cybercriminalité avant de croître.
Strong partnerships and collaborations between industry and law enforcement are the most critical ways to take down cybercrime groups before they grow. |
Legislation | ||
 |
2024-06-13 14:00:00 | UNC3944 Targets SaaS Applications (lien direct) | Introduction
UNC3944 is a financially motivated threat group that carries significant overlap with public reporting of "0ktapus," "Octo Tempest," "Scatter Swine," and "Scattered Spider," and has been observed adapting its tactics to include data theft from software-as-a-service (SaaS) applications to attacker-owned cloud storage objects (using cloud synchronization tools), persistence mechanisms against virtualization platforms, and lateral movement via SaaS permissions abuse. Active since at least May 2022, UNC3944 has leveraged underground communities like Telegram to acquire tools, services, and support to enhance their operations.
Initially, UNC3944 focused on credential harvesting and SIM swapping attacks in their operations, eventually migrating to ransomware and data theft extortion. However, recently, UNC3944 has shifted to primarily data theft extortion without the use of ransomware. This change in objectives has precipitated an expansion of targeted industries and organizations as evidenced by Mandiant investigations.
Evidence also suggests UNC3944 has occasionally resorted to fearmongering tactics to gain access to victim credentials. These tactics include threats of doxxing personal information, physical harm to victims and their families, and the distribution of compromising material.
This blog post aims to spotlight UNC3944's attacks against SaaS applications, providing insights into the group's evolving TTPs in line with its shifting mission objectives.
Tactics, Techniques, and Procedures (TTPs)
Figure 1: UNC3944 attack lifecycle
Mandiant has observed UNC3944 in multiple engagements leveraging social engineering techniques against corporate help desks to gain initial access to existing privileged accounts. Mandiant has analyzed several forensic recordings of these call center attacks, and of the observed rec |
|||
 |
2024-06-13 14:00:00 | GAO reminds White House of cyber backlog (lien direct) | >An 80-page report from the government watchdog details the cybersecurity policy to-do list for the White House. | |||
|
2024-06-13 13:58:33 | NATO to tackle Russian spying and sabotage operations, says Stoltenberg (lien direct) | >An 80-page report from the government watchdog details the cybersecurity policy to-do list for the White House. | |||
 |
2024-06-13 13:51:06 | Le nouveau rapport de la CISA aborde zéro confiance dans l'espace, stimulant la sécurité des satellites et des infrastructures terrestres New CISA report addresses zero trust in space, boosting security for satellites and ground infrastructure (lien direct) |
L'Agence américaine de sécurité de la cybersécurité et des infrastructures (CISA) a récemment publié un rapport mettant en évidence l'intégration rapide des satellites, ...
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) recently released a report highlighting the rapid integration of satellites,... |
|||
|
2024-06-13 13:48:18 | Olympic Games, teleworking and security (lien direct) | With the Paris 2024 Olympic Games just a few months away, the party's in full swing. Businesses are preparing for it too: according to a Yousign study in partnership with IPSOS, 20% of companies in the Paris region have decided to use digital solutions to facilitate remote working. This will save time for sports fans, who will be able to follow sporting events more easily. But there is a danger lurking: the security of data and access linked to remote working. As we prepare for Paris, data (...) - Opinion | |||
|
2024-06-13 13:35:00 | L'arrêt de la police ukrainienne suspecte lié à des groupes de ransomware de verrouillage et de continu Ukraine Police Arrest Suspect Linked to LockBit and Conti Ransomware Groups (lien direct) |
La Cyber Police of Ukraine a annoncé l'arrestation d'un homme local soupçonné d'avoir offert ses services aux groupes de ransomware de verrouillage et de continu.
Le natif de 28 ans sans nom de la région de Kharkiv se serait spécialisé dans le développement de Crypters pour crypter et obscurcir les charges utiles malveillantes afin d'échapper à la détection par des programmes de sécurité.
Le produit aurait été
The Cyber Police of Ukraine has announced the arrest of a local man who is suspected to have offered their services to LockBit and Conti ransomware groups. The unnamed 28-year-old native of the Kharkiv region allegedly specialized in the development of crypters to encrypt and obfuscate malicious payloads in order to evade detection by security programs. The product is believed to have been |
Ransomware Legislation | ||
|
2024-06-13 13:25:21 | US seeks to undercut third-party semiconductor supply to Russia with new sanctions (lien direct) | La Cyber Police of Ukraine a annoncé l'arrestation d'un homme local soupçonné d'avoir offert ses services aux groupes de ransomware de verrouillage et de continu.
Le natif de 28 ans sans nom de la région de Kharkiv se serait spécialisé dans le développement de Crypters pour crypter et obscurcir les charges utiles malveillantes afin d'échapper à la détection par des programmes de sécurité.
Le produit aurait été
The Cyber Police of Ukraine has announced the arrest of a local man who is suspected to have offered their services to LockBit and Conti ransomware groups. The unnamed 28-year-old native of the Kharkiv region allegedly specialized in the development of crypters to encrypt and obfuscate malicious payloads in order to evade detection by security programs. The product is believed to have been |
|||
|
2024-06-13 13:06:58 | Comment Accor a basculé son système de réservation sur AWS (lien direct) | La plateforme de réservation du groupe Accor, TARS, est exploitée sur AWS.depuis fin 2023. Une migration à haut risque menée avec succès sans rupture de service grâce à une approche de type Blue/Green. Retour d'expérience. | |||
|
2024-06-13 13:03:14 | Netskope aide les entreprises à évoluer vers une collaboration et une productivité modernes tout en protégeant leurs données critiques dans Google Workspace (lien direct) | En rejoignant l'alliance Google Workspace Security, le leader du SASE accroît la sécurité de la plateforme Google Workspace en ajoutant une couche de sécurité des données et de protection contre les cybermenaces. Netskope, un leader sur le marché du SASE (Secure Access Service Edge), a rejoint l'alliance Google Workspace Security dans le but d'accroître le niveau de sécurité et de protection des données des utilisateurs Workspace. La plateforme Netskope One offre de nombreuses fonctionnalités de (...) - Business | |||
 |
2024-06-13 13:00:46 | How ThreatCloud AI\'s Threat Emulation Engine Prevents DLL Sideloading (Trojan) Attacks (lien direct) | >A sophisticated new malware/trojan attack is designed to steal login credentials and credit card information from payment systems, banks and crypto exchanges. This attack tricks legitimate business applications into running compromised but innocent-looking dynamic link library (DLL) files — making it very difficult to detect and block. DLL sideloading is a technique used by cybercriminals to execute malicious code on a target system by exploiting the way Windows loads dynamic link libraries (DLLs). This blog explores how Check Point's advanced Threat Emulation engines, part of Infinity ThreatCloud AI, detected and prevented a DLL Sideloading attack on one of our customers. […] | |||
 |
2024-06-13 12:53:58 | Navigating the Stages of AppSec Maturity: A Tactical Guide for Risk Management (lien direct) | In the rapidly evolving digital landscape, the maturity of an organization's Application Security (AppSec) program is not just beneficial; it's imperative for resilience at scale and reducing security debt accumulation. Since software is increasingly central to business operations, the need for robust AppSec programs has never been more critical. Here's a guide to understanding the various stages of AppSec maturity and how to evolve through them for effective risk management. Why AppSec Maturity Matters for Maximized Risk Management AppSec maturity refers to the level of sophistication and effectiveness of an organization's approach to securing their applications. It includes the tools and processes in place and the culture and mindset towards security within the organization. As companies continue to integrate more sophisticated technologies such as artificial intelligence (AI) and cloud services into their development processes, the complexity, risk, and… | |||
|
2024-06-13 12:38:00 | Google prévient la sécurité de la sécurité du micrologiciel Pixel exploitée comme zéro-jour Google Warns of Pixel Firmware Security Flaw Exploited as Zero-Day (lien direct) |
Google a averti qu'un défaut de sécurité ayant un impact sur le micrologiciel Pixel a été exploité dans la nature comme un jour zéro.
La vulnérabilité à haute sévérité, étiquetée comme CVE-2024-32896, a été décrite comme une élévation du problème de privilège dans le micrologiciel Pixel.
La société n'a partagé aucun détail supplémentaire lié à la nature des attaques qui l'exploitant, mais a noté "Il y a des indications que le CVE-2024-32896 peut être
Google has warned that a security flaw impacting Pixel Firmware has been exploited in the wild as a zero-day. The high-severity vulnerability, tagged as CVE-2024-32896, has been described as an elevation of privilege issue in Pixel Firmware. The company did not share any additional details related to the nature of attacks exploiting it, but noted "there are indications that CVE-2024-32896 may be |
Vulnerability Threat | ||
|
2024-06-13 12:19:26 | Indian Ex-Employee Jailed for Wiping 180 Virtual Servers in Singapore (lien direct) | A terminated employee deleted his employer's servers, causing major financial loss. Read about the growing threat of disgruntled ex-employees and how companies can protect themselves from this threat. | |||
 |
2024-06-13 12:04:05 | Comment assurer la sécurité de vos enfants en ligne How to Keep Your Kids Safe Online (lien direct) |
> 
Je plaisante souvent sur la façon dont j'aimerais pouvoir envelopper mes enfants en coton pour les protéger de ...
> 
I often joke about how I wish I could wrap up my kids in cotton wool to protect them from...
|
|||
 |
2024-06-13 12:00:46 | Gestion de la posture de sécurité SaaS de renforcement avec une architecture de confiance zéro Bolster SaaS Security Posture Management with Zero Trust Architecture (lien direct) |
Selon le rapport de la sécurité de l'état de la SAAS de 2023 d'Appomni \\, 79% des organisations ont signalé un incident de sécurité SaaS au cours de la période précédente de 12 mois.Alors que les entreprises stockent et traitent progressivement des données plus sensibles dans les applications SaaS, il n'est pas surprenant que la sécurité de ces applications soit plus importante.Solutions de service de sécurité (SSE) avec [& # 8230;] 
According to AppOmni\'s 2023 State of SaaS Security report, 79% of organizations reported a SaaS security incident during the preceding 12-month period. As enterprises incrementally store and process more sensitive data in SaaS applications, it is no surprise that the security of these applications has come into greater focus. Security Service Edge (SSE) solutions with […] |
Cloud | ||
|
2024-06-13 12:00:01 | Opérationnalisation de notre «Soc dans une boîte» personnalisée à la conférence RSA 2024 Operationalizing our custom “SOC in a Box” at the RSA Conference 2024 (lien direct) |
Les ingénieurs de Cisco sont souvent confrontés au défi de mettre en place un centre d'opérations de sécurité en deux jours lors d'événements mondiaux.Aditya Sankar explique le processus avec notre "Soc dans une boîte" dans ce blog. 
Cisco engineers often face the challenge of setting up a Security Operations Center in two days at global events. Aditya Sankar explains the process with our “SOC in a Box” in this blog. |
Conference |
To see everything:
