What's new arround internet
| Src | Date (GMT) | Titre | Description | Tags | Stories | Notes |
 |
2023-02-27 12:42:00 | Dutch Police Arrest 3 Hackers Involved in Massive Data Theft and Extortion Scheme (lien direct) | The Dutch police announced the arrest of three individuals in connection with a "large-scale" criminal operation involving data theft, extortion, and money laundering. The suspects include two 21-year-old men from Zandvoort and Rotterdam and an 18-year-old man without a permanent residence. The arrests were made on January 23, 2023. It's estimated that the hackers stole personal data belonging | ★ | ||
|
2023-02-24 21:08:00 | Google Teams Up with Ecosystem Partners to Enhance Security of SoC Processors (lien direct) | Google said it's working with ecosystem partners to harden the security of firmware that interacts with Android. While the Android operating system runs on what's called the application processor (AP), it's just one of the many processors of a system-on-chip (SoC) that cater to various tasks like cellular communications and multimedia processing. "Securing the Android Platform requires going | ★★★ | ||
|
2023-02-24 19:31:00 | How to Tackle the Top SaaS Challenges of 2023 (lien direct) | Are you prepared to tackle the top SaaS challenges of 2023? With high-profile data breaches affecting major companies like Nissan and Slack, it's clear that SaaS apps are a prime target for cyberattacks. The vast amounts of valuable information stored in these apps make them a goldmine for hackers. But don't panic just yet. With the right knowledge and tools, you can protect your company's | Cloud | ★★★ | |
|
2023-02-24 18:52:00 | How to Use AI in Cybersecurity and Avoid Being Trapped (lien direct) | The use of AI in cybersecurity is growing rapidly and is having a significant impact on threat detection, incident response, fraud detection, and vulnerability management. According to a report by Juniper Research, the use of AI for fraud detection and prevention is expected to save businesses $11 billion annually by 2023. But how to integrate AI into business cybersecurity infrastructure | Vulnerability Threat | ★★★ | |
|
2023-02-24 18:40:00 | CISA Sounds Alarm on Cybersecurity Threats Amid Russia\'s Invasion Anniversary (lien direct) | The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is urging organizations and individuals to increase their cyber vigilance, as Russia's military invasion of Ukraine officially enters one year. "CISA assesses that the United States and European nations may experience disruptive and defacement attacks against websites in an attempt to sow chaos and societal discord on February 24, | Prediction | ★★ | |
|
2023-02-24 14:30:00 | Majority of Android Apps on Google Play Store Provide Misleading Data Safety Labels (lien direct) | An investigation into data safety labels for Android apps available on the Google Play Store has uncovered "serious loopholes" that allow apps to provide misleading or outright false information. The study, conducted by the Mozilla Foundation as part of its *Privacy Not Included initiative, compared the privacy policies and labels of the 20 most popular paid apps and the 20 most popular free | Guideline | ★★★ | |
|
2023-02-23 22:19:00 | Hackers Using Trojanized macOS Apps to Deploy Evasive Cryptocurrency Mining Malware (lien direct) | Trojanized versions of legitimate applications are being used to deploy evasive cryptocurrency mining malware on macOS systems. Jamf Threat Labs, which made the discovery, said the XMRig coin miner was executed as Final Cut Pro, a video editing software from Apple, which contained an unauthorized modification. "This malware makes use of the Invisible Internet Project (i2p) [...] to download | Malware Threat | ★ | |
|
2023-02-23 20:32:00 | Experts Sound Alarm Over Growing Attacks Exploiting Zoho ManageEngine Products (lien direct) | Multiple threat actors have been observed opportunistically weaponizing a now-patched critical security vulnerability impacting several Zoho ManageEngine products since January 20, 2023. Tracked as CVE-2022-47966 (CVSS score: 9.8), the remote code execution flaw allows a complete takeover of the susceptible systems by unauthenticated attackers. As many as 24 different products, including Access | Vulnerability Threat | ★★ | |
|
2023-02-23 18:02:00 | The Secret Vulnerability Finance Execs are Missing (lien direct) | The (Other) Risk in Finance A few years ago, a Washington-based real estate developer received a document link from First American – a financial services company in the real estate industry – relating to a deal he was working on. Everything about the document was perfectly fine and normal. The odd part, he told a reporter, was that if he changed a single digit in the URL, suddenly, he could see | Vulnerability | ★★ | |
|
2023-02-23 17:37:00 | New Hacking Cluster \'Clasiopa\' Targeting Materials Research Organizations in Asia (lien direct) | Materials research organizations in Asia have been targeted by a previously unknown threat actor using a distinct set of tools. Symantec, by Broadcom Software, is tracking the cluster under the moniker Clasiopa. The origins of the hacking group and its affiliations are currently unknown, but there are hints that suggest the adversary could have ties to India. This includes references to " | Threat | ★★ | |
|
2023-02-23 17:17:00 | Lazarus Group Using New WinorDLL64 Backdoor to Exfiltrate Sensitive Data (lien direct) | A new backdoor associated with a malware downloader named Wslink has been discovered, with the tool likely used by the notorious North Korea-aligned Lazarus Group, new findings reveal. The payload, dubbed WinorDLL64 by ESET, is a fully-featured implant that can exfiltrate, overwrite, and delete files; execute PowerShell commands; and obtain comprehensive information about the underlying machine. | Malware Tool Medical | APT 38 | ★ |
|
2023-02-23 16:15:00 | New S1deload Malware Hijacking Users\' Social Media Accounts and Mining Cryptocurrency (lien direct) | An active malware campaign has set its sights on Facebook and YouTube users by leveraging a new information stealer to hijack the accounts and abuse the systems' resources to mine cryptocurrency. Bitdefender is calling the malware S1deload Stealer for its use of DLL side-loading techniques to get past security defenses and execute its malicious components. "Once infected, S1deload Stealer steals | Malware | ★ | |
|
2023-02-23 11:55:00 | Python Developers Warned of Trojanized PyPI Packages Mimicking Popular Libraries (lien direct) | Cybersecurity researchers are warning of "imposter packages" mimicking popular libraries available on the Python Package Index (PyPI) repository. The 41 malicious PyPI packages have been found to pose as typosquatted variants of legitimate modules such as HTTP, AIOHTTP, requests, urllib, and urllib3. The names of the packages are as follows: aio5, aio6, htps1, httiop, httops, httplat, httpscolor | ★ | ||
|
2023-02-22 18:26:00 | Apple Warns of 3 New Vulnerabilities Affecting iPhone, iPad, and Mac Devices (lien direct) | Apple has revised the security advisories it released last month to include three new vulnerabilities impacting iOS, iPadOS, and macOS. The first flaw is a race condition in the Crash Reporter component (CVE-2023-23520) that could enable a malicious actor to read arbitrary files as root. The iPhone maker said it addressed the issue with additional validation. The two other vulnerabilities, | ★★★ | ||
|
2023-02-22 16:47:00 | Attackers Flood NPM Repository with Over 15,000 Spam Packages Containing Phishing Links (lien direct) | In what's a continuing assault on the open source ecosystem, over 15,000 spam packages have flooded the npm repository in an attempt to distribute phishing links. "The packages were created using automated processes, with project descriptions and auto-generated names that closely resembled one another," Checkmarx researcher Yehuda Gelb said in a Tuesday report. "The attackers referred to retail | Spam | ★★ | |
|
2023-02-22 16:33:00 | 3 Steps to Automate Your Third-Party Risk Management Program (lien direct) | If you Google "third-party data breaches" you will find many recent reports of data breaches that were either caused by an attack at a third party or sensitive information stored at a third-party location was exposed. Third-party data breaches don't discriminate by industry because almost every company is operating with some sort of vendor relationship – whether it be a business partner, | ★★ | ||
|
2023-02-22 16:29:00 | Hydrochasma: New Threat Actor Targets Shipping Companies and Medical Labs in Asia (lien direct) | Shipping companies and medical laboratories in Asia have been the subject of a suspected espionage campaign carried out by a never-before-seen threat actor dubbed Hydrochasma. The activity, which has been ongoing since October 2022, "relies exclusively on publicly available and living-off-the-land tools," Symantec, by Broadcom Software, said in a report shared with The Hacker News. There is no | Threat Medical | ★★ | |
|
2023-02-22 12:48:00 | Threat Actors Adopt Havoc Framework for Post-Exploitation in Targeted Attacks (lien direct) | An open source command-and-control (C2) framework known as Havoc is being adopted by threat actors as an alternative to other well-known legitimate toolkits like Cobalt Strike, Sliver, and Brute Ratel. Cybersecurity firm Zscaler said it observed a new campaign in the beginning of January 2023 targeting an unnamed government organization that utilized Havoc. "While C2 frameworks are prolific, the | Threat | ★★★★ | |
|
2023-02-22 12:21:00 | Gcore Thwarts Massive 650 Gbps DDoS Attack on Free Plan Client (lien direct) | At the beginning of January, Gcore faced an incident involving several L3/L4 DDoS attacks with a peak volume of 650 Gbps. Attackers exploited over 2000 servers belonging to one of the top three cloud providers worldwide and targeted a client who was using a free CDN plan. However, due to Gcore's distribution of infrastructure and a large number of peering partners, the attacks were mitigated, | ★★★★ | ||
|
2023-02-22 11:08:00 | U.S. Cybersecurity Agency CISA Adds Three New Vulnerabilities in KEV Catalog (lien direct) | The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added three security flaws to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation. The list of shortcomings is as follows - CVE-2022-47986 (CVSS score: 9.8) - IBM Aspera Faspex Code Execution Vulnerability CVE-2022-41223 (CVSS score: 6.8) - Mitel MiVoice Connect Code Injection | ★★★ | ||
|
2023-02-22 10:25:00 | VMware Patches Critical Vulnerability in Carbon Black App Control Product (lien direct) | VMware on Tuesday released patches to address a critical security vulnerability affecting its Carbon Black App Control product. Tracked as CVE-2023-20858, the shortcoming carries a CVSS score of 9.1 out of a maximum of 10 and impacts App Control versions 8.7.x, 8.8.x, and 8.9.x. The virtualization services provider describes the issue as an injection vulnerability. Security researcher Jari | Vulnerability | ★★★ | |
|
2023-02-21 19:09:00 | MyloBot Botnet Spreading Rapidly Worldwide: Infecting Over 50,000 Devices Daily (lien direct) | A sophisticated botnet known as MyloBot has compromised thousands of systems, with most of them located in India, the U.S., Indonesia, and Iran. That's according to new findings from BitSight, which said it's "currently seeing more than 50,000 unique infected systems every day," down from a high of 250,000 unique hosts in 2020. Furthermore, an analysis of MyloBot's infrastructure has found | ★★★ | ||
|
2023-02-21 18:12:00 | The Future of Network Security: Predictive Analytics and ML-Driven Solutions (lien direct) | As the digital age evolves and continues to shape the business landscape, corporate networks have become increasingly complex and distributed. The amount of data a company collects to detect malicious behaviour constantly increases, making it challenging to detect deceptive and unknown attack patterns and the so-called "needle in the haystack". With a growing number of cybersecurity threats, | ★★★★ | ||
|
2023-02-21 16:05:00 | Researchers Discover Dozens Samples of Information Stealer \'Stealc\' in the Wild (lien direct) | A new information stealer called Stealc that's being advertised on the dark web could emerge as a worthy competitor to other malware of its ilk. "The threat actor presents Stealc as a fully featured and ready-to-use stealer, whose development relied on Vidar, Raccoon, Mars, and RedLine stealers," SEKOIA said in a Monday report. The French cybersecurity company said it discovered more than 40 | Malware Threat | ★★★ | |
|
2023-02-21 15:43:00 | Coinbase Employee Falls for SMS Scam in Cyber Attack, Limited Data Exposed (lien direct) | Popular cryptocurrency exchange platform Coinbase disclosed that it experienced a cybersecurity attack that targeted its employees. The company said its "cyber controls prevented the attacker from gaining direct system access and prevented any loss of funds or compromise of customer information." The incident, which took place on February 5, 2023, resulted in the exposure of a "limited amount of | ★★ | ||
|
2023-02-21 11:25:00 | Researchers Warn of ReverseRAT Backdoor Targeting Indian Government Agencies (lien direct) | A spear-phishing campaign targeting Indian government entities aims to deploy an updated version of a backdoor called ReverseRAT. Cybersecurity firm ThreatMon attributed the activity to a threat actor tracked as SideCopy. SideCopy is a threat group of Pakistani origin that shares overlaps with another actor called Transparent Tribe. It is so named for mimicking the infection chains associated | Threat | APT 36 | ★★★ |
|
2023-02-20 16:53:00 | Norway Seizes $5.84 Million in Cryptocurrency Stolen by Lazarus Hackers (lien direct) | Norwegian police agency Økokrim has announced the seizure of 60 million NOK (about $5.84 million) worth of cryptocurrency stolen by the Lazarus Group in March 2022 following the Axie Infinity Ronin Bridge hack. "This case shows that we also have a great capacity to follow the money on the blockchain, even if the criminals use advanced methods," the agency said in a statement. The development | Medical | APT 38 | ★★ |
|
2023-02-20 16:32:00 | How to Detect New Threats via Suspicious Activities (lien direct) | Unknown malware presents a significant cybersecurity threat and can cause serious damage to organizations and individuals alike. When left undetected, malicious code can gain access to confidential information, corrupt data, and allow attackers to gain control of systems. Find out how to avoid these circumstances and detect unknown malicious behavior efficiently. Challenges of new threats' | Malware Threat | ★★★ | |
|
2023-02-20 16:24:00 | Google Reveals Alarming Surge in Russian Cyber Attacks Against Ukraine (lien direct) | Russia's cyber attacks against Ukraine surged by 250% in 2022 when compared to two years ago, Google's Threat Analysis Group (TAG) and Mandiant disclosed in a new joint report. The targeting, which coincided and has since persisted following the country's military invasion of Ukraine in February 2022, focused heavily on the Ukrainian government and military entities, alongside critical | Threat | ★★ | |
|
2023-02-20 15:41:00 | North Korean Cyber Espionage Group Deploys WhiskerSpy Backdoor in Latest Attacks (lien direct) | The cyber espionage threat actor tracked as Earth Kitsune has been observed deploying a new backdoor called WhiskerSpy as part of a social engineering campaign. Earth Kitsune, active since at least 2019, is known to primarily target individuals interested in North Korea with self-developed malware such as dneSpy and agfSpy. Previously documented intrusions have entailed the use of watering holes | Malware Threat | ★★ | |
|
2023-02-20 11:20:00 | Samsung Introduces New Feature to Protect Users from Zero-Click Malware Attacks (lien direct) | Samsung has announced a new feature called Message Guard that comes with safeguards to protect users from malware and spyware via what's referred to as zero-click attacks. The South Korean chaebol said the solution "preemptively" secures users' devices by "limiting exposure to invisible threats disguised as image attachments." The security feature, available on Samsung Messages and Google | Malware | ★★ | |
|
2023-02-19 11:57:00 | Fortinet Issues Patches for 40 Flaws Affecting FortiWeb, FortiOS, FortiOS, and FortiProxy (lien direct) | Fortinet has released security updates to address 40 vulnerabilities in its software lineup, including FortiWeb, FortiOS, FortiNAS, and FortiProxy, among others. Two of the 40 flaws are rated Critical, 15 are rated High, 22 are rated Medium, and one is rated Low in severity. Top of the list is a severe bug residing in the FortiNAC network access control solution (CVE-2022-39952, CVSS score: 9.8) | ★★★★ | ||
|
2023-02-18 16:40:00 | Twitter Limits SMS-Based 2-Factor Authentication to Blue Subscribers Only (lien direct) | Twitter has announced that it's limiting the use of SMS-based two-factor authentication (2FA) to its Blue subscribers. "While historically a popular form of 2FA, unfortunately we have seen phone-number based 2FA be used – and abused – by bad actors," the company said. "We will no longer allow accounts to enroll in the text message/SMS method of 2FA unless they are Twitter Blue subscribers." | ★★★ | ||
|
2023-02-18 14:51:00 | GoDaddy Discloses Multi-Year Security Breach Causing Malware Installations and Source Code Theft (lien direct) | Web hosting services provider GoDaddy on Friday disclosed a multi-year security breach that enabled unknown threat actors to install malware and siphon source code related to some of its services. The company attributed the campaign to a "sophisticated and organized group targeting hosting services." GoDaddy said in December 2022, it received an unspecified number of customer complaints about | Malware Threat | ★★★★ | |
|
2023-02-17 21:21:00 | Experts Warn of RambleOn Android Malware Targeting South Korean Journalists (lien direct) | Suspected North Korean nation-state actors targeted a journalist in South Korea with a malware-laced Android app as part of a social engineering campaign. The findings come from South Korea-based non-profit Interlab, which coined the new malware RambleOn. The malicious functionalities include the "ability to read and leak target's contact list, SMS, voice call content, location and others from | Malware | ★★ | |
|
2023-02-17 18:46:00 | ⚡Top Cybersecurity News Stories This Week - Cybersecurity Newsletter (lien direct) | Hey 👋 there, cyber friends! Welcome to this week's cybersecurity newsletter, where we aim to keep you informed and empowered in the ever-changing world of cyber threats. In today's edition, we will cover some interesting developments in the cybersecurity landscape and share some insightful analysis of each to help you protect yourself against potential attacks. 1. Apple 📱 Devices Hacked with | ★★★ | ||
|
2023-02-17 18:17:00 | Armenian Entities Hit by New Version of OxtaRAT Spying Tool (lien direct) | Entities in Armenia have come under a cyber attack using an updated version of a backdoor called OxtaRAT that allows remote access and desktop surveillance. "The tool capabilities include searching for and exfiltrating files from the infected machine, recording the video from the web camera and desktop, remotely controlling the compromised machine with TightVNC, installing a web shell, | Tool | ★★★ | |
|
2023-02-17 14:55:00 | New Mirai Botnet Variant \'V3G4\' Exploiting 13 Flaws to Target Linux and IoT Devices (lien direct) | A new variant of the notorious Mirai botnet has been found leveraging several security vulnerabilities to propagate itself to Linux and IoT devices. Observed during the second half of 2022, the new version has been dubbed V3G4 by Palo Alto Networks Unit 42, which identified three different campaigns likely conducted by the same threat actor. "Once the vulnerable devices are compromised, they | Threat | ★★★ | |
|
2023-02-17 11:16:00 | Critical RCE Vulnerability Discovered in ClamAV Open-Source Antivirus Software (lien direct) | Cisco has rolled out security updates to address a critical flaw reported in the ClamAV open source antivirus engine that could lead to remote code execution on susceptible devices. Tracked as CVE-2023-20032 (CVSS score: 9.8), the issue relates to a case of remote code execution residing in the HFS+ file parser component. The flaw affects versions 1.0.0 and earlier, 0.105.1 and earlier, and | Vulnerability Guideline | ★★★★ | |
|
2023-02-17 00:00:00 | Researchers Hijack Popular NPM Package with Millions of Downloads (lien direct) | A popular npm package with more than 3.5 million weekly downloads has been found vulnerable to an account takeover attack. "The package can be taken over by recovering an expired domain name for one of its maintainers and resetting the password," software supply chain security company Illustria said in a report. While npm's security protections limit users to have only one active email address | ★★★ | ||
|
2023-02-16 23:46:00 | Researchers Link SideWinder Group to Dozens of Targeted Attacks in Multiple Countries (lien direct) | The prolific SideWinder group has been attributed as the nation-state actor behind attempted attacks against 61 entities in Afghanistan, Bhutan, Myanmar, Nepal, and Sri Lanka between June and November 2021. Targets included government, military, law enforcement, banks, and other organizations, according to an exhaustive report published by Group-IB, which also found links between the adversary | APT-C-17 | ★★★ | |
|
2023-02-16 19:12:00 | Hackers Using Google Ads to Spread FatalRAT Malware Disguised as Popular Apps (lien direct) | Chinese-speaking individuals in Southeast and East Asia are the targets of a new rogue Google Ads campaign that delivers remote access trojans such as FatalRAT to compromised machines. The attacks involve purchasing ad slots to appear in Google search results that direct users searching for popular applications to rogue websites hosting trojanized installers, ESET said in a report published | Malware | ★★ | |
|
2023-02-16 18:48:00 | Researchers Warn of Critical Security Bugs in Schneider Electric Modicon PLCs (lien direct) | Security researchers have disclosed two new vulnerabilities affecting Schneider Electric Modicon programmable logic controllers (PLCs) that could allow for authentication bypass and remote code execution. The flaws, tracked as CVE-2022-45788 (CVSS score: 7.5) and CVE-2022-45789 (CVSS score: 8.1), are part of a broader collection of security defects tracked by Forescout as OT:ICEFALL. Successful | ★★★ | ||
|
2023-02-16 16:42:00 | Breaking the Security "Black Box" in DBs, Data Warehouses and Data Lakes (lien direct) | Security teams typically have great visibility over most areas, for example, the corporate network, endpoints, servers, and cloud infrastructure. They use this visibility to enforce the necessary security and compliance requirements. However, this is not the case when it comes to sensitive data sitting in production or analytic databases, data warehouses or data lakes. Security teams have to | ★★ | ||
|
2023-02-16 16:29:00 | New Threat Actor WIP26 Targeting Telecom Service Providers in the Middle East (lien direct) | Telecommunication service providers in the Middle East are being targeted by a previously undocumented threat actor as part of a suspected espionage-related campaign. Cybersecurity firms SentinelOne and QGroup are tracking the activity cluster under the former's work-in-progress moniker WIP26. "WIP26 relies heavily on public cloud infrastructure in an attempt to evade detection by making | Threat | ★★ | |
|
2023-02-16 15:43:00 | ESXiArgs Ransomware Hits Over 500 New Targets in European Countries (lien direct) | More than 500 hosts have been newly compromised en masse by the ESXiArgs ransomware strain, most of which are located in France, Germany, the Netherlands, the U.K., and Ukraine. The findings come from attack surface management firm Censys, which discovered "two hosts with strikingly similar ransom notes dating back to mid-October 2022, just after ESXi versions 6.5 and 6.7 reached end of life." | Ransomware | ★★ | |
|
2023-02-15 20:29:00 | North Korea\'s APT37 Targeting Southern Counterpart with New M2RAT Malware (lien direct) | The North Korea-linked threat actor tracked as APT37 has been linked to a piece of new malware dubbed M2RAT in attacks targeting its southern counterpart, suggesting continued evolution of the group's features and tactics. APT37, also tracked under the monikers Reaper, RedEyes, Ricochet Chollima, and ScarCruft, is linked to North Korea's Ministry of State Security (MSS) unlike the Lazarus and | Malware Threat Cloud | APT 38 APT 37 | ★★ |
|
2023-02-15 19:16:00 | Webinar - A MythBusting Special: 9 Myths about File-based Threats (lien direct) | Bad actors love to deliver threats in files. Persistent and persuasive messages convince unsuspecting victims to accept and open files from unknown sources, executing the first step in a cyber attack. This continues to happen whether the file is an EXE or a Microsoft Excel document. Far too often, end users have an illusion of security, masked by good faith efforts of other users and ( | ★★★ | ||
|
2023-02-15 19:03:00 | Financially Motivated Threat Actor Strikes with New Ransomware and Clipper Malware (lien direct) | A new financially motivated campaign that commenced in December 2022 has seen the unidentified threat actor behind it deploying a novel ransomware strain dubbed MortalKombat and a clipper malware known as Laplas. Cisco Talos said it "observed the actor scanning the internet for victim machines with an exposed remote desktop protocol (RDP) port 3389." The attacks, per the cybersecurity company, | Ransomware Malware Threat | ★★★ | |
|
2023-02-15 14:58:00 | Regular Pen Testing Is Key to Resolving Conflict Between SecOps and DevOps (lien direct) | In an ideal world, security and development teams would be working together in perfect harmony. But we live in a world of competing priorities, where DevOps and security departments often butt heads with each other. Agility and security are often at odds with each other- if a new feature is delivered quickly but contains security vulnerabilities, the SecOps team will need to scramble the release | ★★★ |
To see everything:
Our RSS (filtrered)
