This is the RSS 2.0 feed from www.secnews.physaphae.fr. IT's a simple agragated flow of multiple articles soruces. Liste of sources, can be found on www.secnews.physaphae.fr. 2025-05-12T09:15:33+00:00 www.secnews.physaphae.fr AlienVault Lab Blog - AlienVault est un acteur de defense majeur dans les IOC 2025-03-20T06:00:00+00:00 https://levelblue.com/blogs/security-essentials/dangers-of-data-logging-and-data-hashing-in-cybersecurity www.secnews.physaphae.fr/article.php?IdArticle=8656956 False Data Breach,Tool,Vulnerability,Threat,Technical None 2.0000000000000000 ProofPoint - Cyber Firms 2025-03-20T05:34:47+00:00 https://www.proofpoint.com/us/blog/information-protection/ai-in-cybersecurity-empowering-teams www.secnews.physaphae.fr/article.php?IdArticle=8657082 False Malware,Tool,Threat,Studies,Prediction None 3.0000000000000000 The Last Watchdog - Blog Sécurité de Byron V Acohido Austin, TX, MA. 19, 2025, CyberNewswire - L'utilisateur moyen de l'entreprise a désormais 146 enregistrements volés liés à leur identité, une augmentation moyenne de 12 fois par rapport aux estimations précédentes, reflétant une augmentation des expositions à l'identité holistique. spycloud , la principale menace d'identité… (plus…) Le message alerte de nouvelles: l'étude spycloud montre d'abord l'identité notante href = "https://www.lastwatchdog.com"> Le dernier chien de garde .

---

>Austin, TX, Ma. 19, 2025, CyberNewswire — The average corporate user now has 146 stolen records linked to their identity, an average 12x increase from previous estimates, reflecting a surge in holistic identity exposures. SpyCloud, the leading identity threat … (more…) The post News alert: SpyCloud study shows Darknet identity exploitation arising to become a primary cyber risk first appeared on The Last Watchdog.]]> 2025-03-20T00:00:04+00:00 https://www.lastwatchdog.com/news-alert-spycloud-study-shows-darknet-identity-exploitation-arising-to-become-a-primary-cyber-risk/ www.secnews.physaphae.fr/article.php?IdArticle=8656803 False Threat,Studies None 2.0000000000000000 The Hacker News - The Hacker News est un blog de news de hack (surprenant non?) Threat actors are exploiting a severe security flaw in PHP to deliver cryptocurrency miners and remote access trojans (RATs) like Quasar RAT. The vulnerability, assigned the CVE identifier CVE-2024-4577, refers to an argument injection vulnerability in PHP affecting Windows-based systems running in CGI mode that could allow remote attackers to run arbitrary code. Cybersecurity company]]> 2025-03-19T21:22:00+00:00 https://thehackernews.com/2025/03/hackers-exploit-severe-php-flaw-to.html www.secnews.physaphae.fr/article.php?IdArticle=8656732 False Vulnerability,Threat None 1.00000000000000000000 Dark Reading - Informationweek Branch Trend Micro uncovered a method that nation-state threat actors are using to target victims via the Windows .Ink shortcut file extension.]]> 2025-03-19T20:29:20+00:00 https://www.darkreading.com/cyber-risk/nation-state-groups-abuse-microsoft-windows-shortcut-exploit www.secnews.physaphae.fr/article.php?IdArticle=8656778 False Threat,Prediction None 2.0000000000000000 Global Security Mag - Site de news francais Produits]]> 2025-03-19T20:19:23+00:00 https://www.globalsecuritymag.fr/trend-micro-incorporated-annonce-la-mise-a-disposition-en-open-source-de-trend.html www.secnews.physaphae.fr/article.php?IdArticle=8656776 False Threat,Prediction None 2.0000000000000000 HackRead - Chercher Cyber Microsoft refuses to patch serious Windows shortcut vulnerability abused in global espionage campaigns!]]> 2025-03-19T20:00:30+00:00 https://hackread.com/nation-state-hackers-exploit-windows-unpatched-flaw-2017/ www.secnews.physaphae.fr/article.php?IdArticle=8656765 False Vulnerability,Threat None 3.0000000000000000 The Hacker News - The Hacker News est un blog de news de hack (surprenant non?) The threat actors behind the ClearFake campaign are using fake reCAPTCHA or Cloudflare Turnstile verifications as lures to trick users into downloading malware such as Lumma Stealer and Vidar Stealer. ClearFake, first highlighted in July 2023, is the name given to a threat activity cluster that employs fake web browser update baits on compromised WordPress as a malware distribution vector. The]]> 2025-03-19T16:29:00+00:00 https://thehackernews.com/2025/03/clearfake-infects-9300-sites-uses-fake.html www.secnews.physaphae.fr/article.php?IdArticle=8656670 False Malware,Threat None 2.0000000000000000 The Hacker News - The Hacker News est un blog de news de hack (surprenant non?) Identity-based attacks are on the rise. Attackers are targeting identities with compromised credentials, hijacked authentication methods, and misused privileges. While many threat detection solutions focus on cloud, endpoint, and network threats, they overlook the unique risks posed by SaaS identity ecosystems. This blind spot is wreaking havoc on heavily SaaS-reliant organizations big and small]]> 2025-03-19T16:00:00+00:00 https://thehackernews.com/2025/03/5-identity-threat-detection-response.html www.secnews.physaphae.fr/article.php?IdArticle=8656657 False Threat,Cloud None 2.0000000000000000 IndustrialCyber - cyber risk firms for industrial Cyber threat intelligence firm PRODAFT has identified two critical OS command injection vulnerabilities in mySCADA myPRO Manager, a... ]]> 2025-03-19T13:21:01+00:00 https://industrialcyber.co/vulnerabilities/prodaft-detects-high-severity-flaws-in-myscada-mypro-manager-warns-of-industrial-network-breaches/ www.secnews.physaphae.fr/article.php?IdArticle=8656851 False Vulnerability,Threat,Industrial None 2.0000000000000000 Checkpoint - Fabricant Materiel Securite Les chercheurs de point de contrôle ont découvert une attaque de récolte des diplômes sophistiquée qui exploite Firebase, un service d'hébergement d'application Web populaire. Cette attaque implique la création de pages Web de phishing très convaincantes et conçues par des professionnels qui se font passer pour des services bien connus. Les attaquants utilisent également un fournisseur compromis pour envoyer des liens de phishing dans les correspondances e-mail existantes, ce qui rend l'arnaque encore plus trompeuse. Comment cela fonctionne: les attaquants tirent parti de Firebase pour héberger des pages Web de phishing qui imitent les services légitimes. En compromettant le compte de messagerie d'un fournisseur, les cybercriminels insérent ensuite les liens de phishing vers des threads de messagerie en cours. Cette tactique augmente la probabilité que le bénéficiaire faisait confiance au […]

---

>Check Point researchers have uncovered a sophisticated credential harvesting attack that leverages Firebase, a popular web application hosting service. This attack involves the creation of highly convincing and professionally designed phishing web pages that impersonate well-known services. The attackers also utilize a compromised vendor to send phishing links within existing email correspondences, making the scam even more deceptive. How it Works: The attackers leverage Firebase to host phishing web pages that mimic legitimate services. By compromising a vendor\'s email account, cyber criminals then insert phishing links into ongoing email threads. This tactic increases the likelihood of the recipient trusting the […] ]]> 2025-03-19T13:00:44+00:00 https://blog.checkpoint.com/securing-user-and-access/is-firebase-phishing-a-threat-to-your-organization/ www.secnews.physaphae.fr/article.php?IdArticle=8656681 False Threat None 2.0000000000000000 Cyble - CyberSecurity Firm 2025-03-19T12:49:21+00:00 https://cyble.com/blog/cisa-alerts-users-of-cve-2025-24472/ www.secnews.physaphae.fr/article.php?IdArticle=8656685 False Tool,Vulnerability,Threat None 3.0000000000000000 DarkTrace - DarkTrace: AI bases detection To strengthen its distributed and complex operations, this global technology leader implemented Darktrace / EMAIL to monitor, detect, and mitigate potential email threats. Read the blog to discover their results.]]> 2025-03-19T12:35:01+00:00 https://darktrace.com/blog/global-technology-provider-transforms-email-threat-detection-with-darktrace www.secnews.physaphae.fr/article.php?IdArticle=8656682 False Threat None 3.0000000000000000 DarkTrace - DarkTrace: AI bases detection To strengthen its distributed and complex operations, this global technology leader implemented Darktrace / EMAIL to monitor, detect, and mitigate potential email threats. Read the blog to discover their results.]]> 2025-03-19T12:35:01+00:00 https://www.darktrace.com/blog/global-technology-provider-transforms-email-threat-detection-with-darktrace www.secnews.physaphae.fr/article.php?IdArticle=8657146 False Threat None 3.0000000000000000 Bleeping Computer - Magazine Américain WhatsApp has patched a zero-click, zero-day vulnerability used to install Paragon\'s Graphite spyware following reports from security researchers at the University of Toronto\'s Citizen Lab. [...]]]> 2025-03-19T12:02:20+00:00 https://www.bleepingcomputer.com/news/security/whatsapp-patched-zero-day-flaw-used-in-paragon-spyware-attacks/ www.secnews.physaphae.fr/article.php?IdArticle=8656719 False Vulnerability,Threat None 2.0000000000000000 InfoSecurity Mag - InfoSecurity Magazine Gartner has claimed that AI agents will reduce the time it takes to exploit exposed accounts]]> 2025-03-19T10:45:00+00:00 https://www.infosecurity-magazine.com/news/gartner-agentic-ai-accelerate/ www.secnews.physaphae.fr/article.php?IdArticle=8656658 False Threat None 2.0000000000000000 DarkTrace - DarkTrace: AI bases detection Part 2/4: Darktrace releases insights on the State of AI in cybersecurity. This blog discusses AI\'s impact on the cyber threat landscape.]]> 2025-03-19T10:10:37+00:00 https://www.darktrace.com/blog/survey-findings-ai-cyber-threats-are-a-reality-the-people-are-acting-now www.secnews.physaphae.fr/article.php?IdArticle=8657149 False Threat None 2.0000000000000000 InfoSecurity Mag - InfoSecurity Magazine Europol\'s annual report warns of a growing threat from aligned state and cybercrime groups, enabled by AI technologies]]> 2025-03-19T10:00:00+00:00 https://www.infosecurity-magazine.com/news/europol-warns-shadow-alliance/ www.secnews.physaphae.fr/article.php?IdArticle=8656648 False Threat None 2.0000000000000000 Cyble - CyberSecurity Firm 2025-03-19T08:35:18+00:00 https://cyble.com/blog/cert-nz-warns-of-cve-2025-24813-in-tomcat/ www.secnews.physaphae.fr/article.php?IdArticle=8656638 False Vulnerability,Threat None 2.0000000000000000 ProofPoint - Cyber Firms 2025-03-19T08:01:36+00:00 https://www.proofpoint.com/us/blog/security-awareness-training/how-zenguide-elevates-human-risk-management www.secnews.physaphae.fr/article.php?IdArticle=8656819 False Tool,Vulnerability,Threat None 2.0000000000000000 ProofPoint - Cyber Firms 2025-03-19T07:36:56+00:00 https://www.proofpoint.com/us/blog/dspm/cspm-vs-dspm-understanding-the-differences www.secnews.physaphae.fr/article.php?IdArticle=8656818 False Vulnerability,Threat,Cloud None 2.0000000000000000 InformationSecurityBuzzNews - Site de News Securite A new wave of malware is gaining traction in the form of infostealers, potent data-harvesting tools that have quickly become the go-to choice for threat actors due to their ability to quickly and effectively siphon sensitive information to sell on the dark web. Use of infostealers by groups specializing in ransomware surged by 266%, according [...]]]> 2025-03-19T06:52:02+00:00 https://informationsecuritybuzz.com/stopping-infostealers-in-their-tracks/ www.secnews.physaphae.fr/article.php?IdArticle=8656619 False Ransomware,Malware,Tool,Threat None 2.0000000000000000 The State of Security - Magazine Américain Introduction In a report published by Statista, cybercrime cost the world over $9 trillion in 2024 and is predicted to rise to nearly $14 trillion by 2028. These figures are a deep source of worry for governments and private businesses about what\'s next in the cyber threat landscape. The problem is that cyber threats are rising in both volume and scale. More so, the major threats are directed at emerging technologies, aiming to capitalize on weaknesses in emerging AI and ML systems. Cyber threats increasingly play a role in international conflicts, such as the recent reports of the “salt...]]> 2025-03-19T04:56:12+00:00 https://www.tripwire.com/state-of-security/intersection-public-policy-and-cybersecurity-building-framework-2025-and-beyond www.secnews.physaphae.fr/article.php?IdArticle=8656646 False Threat None 2.0000000000000000 ProofPoint - Cyber Firms 2025-03-19T04:18:01+00:00 https://www.proofpoint.com/us/blog/security-awareness-training/onboarding-kit-prepare-new-hires-to-be-cyber-defenders www.secnews.physaphae.fr/article.php?IdArticle=8656821 False Tool,Threat,Cloud None 3.0000000000000000 ProofPoint - Cyber Firms 2025-03-19T02:43:37+00:00 https://www.proofpoint.com/us/blog/email-and-cloud-threats/missed-spam-emails-threats-abnormals-blind-spot www.secnews.physaphae.fr/article.php?IdArticle=8656820 False Ransomware,Spam,Malware,Tool,Threat,Prediction,Technical None 2.0000000000000000 Global Security Mag - Site de news francais Revues de produits

---

Cloudflare expands threat intelligence offering with new comprehensive, real-time events platform Customers can tap into insights from Cloudflare\'s global network – one of the largest in the world – which blocked an average of 227 billion cyber threats each day during Q4 2024 - Product Reviews]]> 2025-03-18T22:01:33+00:00 https://www.globalsecuritymag.fr/cloudflare-inc-launched-the-cloudforce-one-threat-events-platform.html www.secnews.physaphae.fr/article.php?IdArticle=8656555 False Threat None 2.0000000000000000 Global Security Mag - Site de news francais Rapports spéciaux

---

Threat Researchers Detect 4x More Identity-Enabled Attacks as Infostealers Continue to Surge Red Canary\'s 2025 Threat Detection Report highlights top and emerging cybersecurity threats, including fakeCAPTCHA, LLMJacking, and macOS malware Adversaries have access to more tools than ever to compromise organizations, fueling a rise in attacks and straining security teams None of the nearly 93,000 threats analyzed in this report were prevented by customers\' expansive security controls, including all leading endpoint protection (EPP) and IAM platforms - Special Reports]]> 2025-03-18T21:48:41+00:00 https://www.globalsecuritymag.fr/threat-researchers-detect-4x-more-identity-enabled-attacks-as-infostealers.html www.secnews.physaphae.fr/article.php?IdArticle=8656558 False Tool,Threat None 2.0000000000000000 Recorded Future - FLux Recorded Future The Zero Day Initiative measured the prevalence of manipulated Windows shortcut files in campaigns attributed to nation-state hacking groups - finding at least 11 exploited a bug that allows malicious use of the files.]]> 2025-03-18T20:12:34+00:00 https://therecord.media/windows-lnk-files-nation-state-hacking-campaigns www.secnews.physaphae.fr/article.php?IdArticle=8656541 False Threat None 2.0000000000000000 The Hacker News - The Hacker News est un blog de news de hack (surprenant non?) An unpatched security flaw impacting Microsoft Windows has been exploited by 11 state-sponsored groups from China, Iran, North Korea, and Russia as part of data theft, espionage, and financially motivated campaigns that date back to 2017. The zero-day vulnerability, tracked by Trend Micro\'s Zero Day Initiative (ZDI) as ZDI-CAN-25373, refers to an issue that allows bad actors to execute hidden]]> 2025-03-18T19:39:00+00:00 https://thehackernews.com/2025/03/unpatched-windows-zero-day-flaw.html www.secnews.physaphae.fr/article.php?IdArticle=8656478 False Vulnerability,Threat,Prediction None 3.0000000000000000 The Hacker News - The Hacker News est un blog de news de hack (surprenant non?) A critical security vulnerability has been disclosed in AMI\'s MegaRAC Baseboard Management Controller (BMC) software that could allow an attacker to bypass authentication and carry out post-exploitation actions. The vulnerability, tracked as CVE-2024-54085, carries a CVSS v4 score of 10.0, indicating maximum severity. "A local or remote attacker can exploit the vulnerability by accessing the]]> 2025-03-18T19:01:00+00:00 https://thehackernews.com/2025/03/new-critical-ami-bmc-vulnerability.html www.secnews.physaphae.fr/article.php?IdArticle=8656480 False Vulnerability,Threat None 3.0000000000000000 The Hacker News - The Hacker News est un blog de news de hack (surprenant non?) Threat hunters have shed more light on a previously disclosed malware campaign undertaken by the China-aligned MirrorFace threat actor that targeted a diplomatic organization in the European Union with a backdoor known as ANEL. The attack, detected by ESET in late August 2024, singled out a Central European diplomatic institute with lures related to Word Expo, which is scheduled to kick off in]]> 2025-03-18T15:54:00+00:00 https://thehackernews.com/2025/03/china-linked-mirrorface-deploys-anel.html www.secnews.physaphae.fr/article.php?IdArticle=8656437 False Malware,Threat None 3.0000000000000000 The Hacker News - The Hacker News est un blog de news de hack (surprenant non?) At least four different threat actors have been identified as involved in an updated version of a massive ad fraud and residential proxy scheme called BADBOX, painting a picture of an interconnected cybercrime ecosystem. This includes SalesTracker Group, MoYu Group, Lemon Group, and LongTV, according to new findings from the HUMAN Satori Threat Intelligence and Research team, published in]]> 2025-03-18T15:31:00+00:00 https://thehackernews.com/2025/03/badbox-20-botnet-infects-1-million.html www.secnews.physaphae.fr/article.php?IdArticle=8656438 False Threat,Mobile Satori 3.0000000000000000 Dark Reading - Informationweek Branch A server-side request forgery vulnerability in OpenAI\'s chatbot infrastructure can allow attackers to direct users to malicious URLs, leading to a range of threat activity.]]> 2025-03-18T15:28:52+00:00 https://www.darkreading.com/cyberattacks-data-breaches/actively-exploited-chatgpt-bug-organizations-risk www.secnews.physaphae.fr/article.php?IdArticle=8656493 False Vulnerability,Threat ChatGPT 3.0000000000000000 The Register - Site journalistique Anglais \'Only\' a local access bug but important part of N Korea, Russia, and China attack picture An exploitation avenue found by Trend Micro has been used in an eight-year-long spying campaign, but there\'s no sign of a fix from Microsoft, which apparently considers this a low priority.…]]> 2025-03-18T15:13:08+00:00 https://go.theregister.com/feed/www.theregister.com/2025/03/18/microsoft_trend_flaw/ www.secnews.physaphae.fr/article.php?IdArticle=8656492 False Threat,Prediction None 3.0000000000000000 RedCanary - Red Canary Our annual analysis brings you a year\'s worth of security operations and intelligence insights, with actionable guidance on every page.]]> 2025-03-18T14:59:14+00:00 https://redcanary.com/blog/threat-detection/2025-threat-detection-report/ www.secnews.physaphae.fr/article.php?IdArticle=8656474 False Threat None 3.0000000000000000 Cyble - CyberSecurity Firm 2025-03-18T13:33:57+00:00 https://cyble.com/blog/it-vulnerability-report-for-apple-php-flaws/ www.secnews.physaphae.fr/article.php?IdArticle=8656464 False Vulnerability,Threat,Patching None 2.0000000000000000 HackRead - Chercher Cyber Cybercriminals exploit AI hype with SEO poisoning, tricking users into downloading malware disguised as DeepSeek software, warns McAfee Labs in a new report.]]> 2025-03-18T13:16:45+00:00 https://hackread.com/fake-deepseek-ai-installers-websites-apps-malware/ www.secnews.physaphae.fr/article.php?IdArticle=8656459 False Malware,Threat None 3.0000000000000000 Bleeping Computer - Magazine Américain At least 11 state-backed hacking groups from North Korea, Iran, Russia, and China have been exploiting a new Windows vulnerability in data theft and cyber espionage zero-day attacks since 2017. [...]]]> 2025-03-18T13:11:24+00:00 https://www.bleepingcomputer.com/news/security/new-windows-zero-day-exploited-by-11-state-hacking-groups-since-2017/ www.secnews.physaphae.fr/article.php?IdArticle=8656512 False Vulnerability,Threat None 2.0000000000000000 InformationSecurityBuzzNews - Site de News Securite The latest threat landscape report from ReliaQuest has unearthed some concerning findings regarding the critical threats faced by the hospitality and recreation sector. These include identifying a 43% increase in ransomware attacks, the discovery that 44% of phishing emails contained credential harvesters, and a staggering 433% increase in external remote services abuse.  The reporting period [...]]]> 2025-03-18T05:36:32+00:00 https://informationsecuritybuzz.com/insight-reliaquest-criti-cyber-threats/ www.secnews.physaphae.fr/article.php?IdArticle=8656388 False Ransomware,Threat None 2.0000000000000000 TrendLabs Security - Editeur Antivirus Trend Zero Day Initiative™ (ZDI) uncovered both state-sponsored and cybercriminal groups extensively exploiting ZDI-CAN-25373, a Windows .lnk file vulnerability that enables hidden command execution.]]> 2025-03-18T00:00:00+00:00 https://www.trendmicro.com/en_us/research/25/c/windows-shortcut-zero-day-exploit.html www.secnews.physaphae.fr/article.php?IdArticle=8656475 False Vulnerability,Threat,Prediction None 2.0000000000000000 Silicon - Site de News Francais 2025-03-18T00:00:00+00:00 https://www.silicon.fr/Thematique/cybersecurite-1371/Breves/cybersecurite-parlons-danger-gestion-risques-469050.htm#utm_source=IndexThematique&utm_medium=Rss&utm_campaign= www.secnews.physaphae.fr/article.php?IdArticle=8656427 False Threat None 2.0000000000000000 Dark Reading - Informationweek Branch The ClickFix attack tactic seems to be gaining traction among threat actors.]]> 2025-03-17T21:49:37+00:00 https://www.darkreading.com/cyberattacks-data-breaches/compromised-car-dealership-websites-clickfix-breach www.secnews.physaphae.fr/article.php?IdArticle=8656326 False Threat None 3.0000000000000000 HackRead - Chercher Cyber In its latest research report, cybersecurity firm Veriti has spotted active exploitation of a vulnerability within OpenAI’s ChatGPT…]]> 2025-03-17T21:26:03+00:00 https://hackread.com/hackers-exploit-chatgpt-cve-2024-27564-10000-attacks/ www.secnews.physaphae.fr/article.php?IdArticle=8656335 False Vulnerability,Threat ChatGPT 3.0000000000000000 Dark Reading - Informationweek Branch A new threat assessment from the Danish Civil Protection Authority (SAMSIK) warned of cyberattacks targeting the telecommunications sector after citing a wave of incidents hitting European organizations the past few years.]]> 2025-03-17T21:14:26+00:00 https://www.darkreading.com/threat-intelligence/denmark-warns-increased-cyber-espionage-telecom-sector www.secnews.physaphae.fr/article.php?IdArticle=8656329 False Threat None 3.0000000000000000 Recorded Future - FLux Recorded Future GitHub was forced to take action this weekend to help users after a threat actor compromised a popular open source package used by more than 23,000 organizations.]]> 2025-03-17T20:36:44+00:00 https://therecord.media/github-restores-code-malicious-tj-actions-changes www.secnews.physaphae.fr/article.php?IdArticle=8656315 False Tool,Threat None 3.0000000000000000 The Last Watchdog - Blog Sécurité de Byron V Acohido Francfort, Allemagne, 17 mars 2025, CyberNewswire - Les cyberattaques ne sont plus une menace abstraite - elles dominent la planification des risques pour les entreprises du monde entier. le dernier link11 Le rapport de cyber européen montre une tendance alarmante: le nombre d'attaques DDOS a plus que… (plus…) Le message News Alert: Link11 \'s Research Shows DDOS est plus ciblé - A et doublé - an-an-an-année href = "https://www.lastwatchdog.com"> Le dernier chien de garde .

---

>Frankfurt, Germany, Mar. 17, 2025, CyberNewswire — Cyberattacks are no longer an abstract threat – they dominate risk planning for companies worldwide. The latest Link11 European Cyber Report shows an alarming trend: the number of DDoS attacks has more than … (more…) The post News alert: Link11\'s research shows DDoS attacks are more targeted - and doubled - year-over-year first appeared on The Last Watchdog.]]> 2025-03-17T19:59:44+00:00 https://www.lastwatchdog.com/news-alert-link11s-research-shows-ddos-attacks-are-more-targeted-and-doubled-year-over-year/ www.secnews.physaphae.fr/article.php?IdArticle=8656306 False Threat,Prediction None 3.0000000000000000 Dark Reading - Informationweek Branch The researchers who discovered the initial assault warned that the simple, staged attack is just the beginning for advanced exploit sequences that will test cyber defenses in new and more difficult ways.]]> 2025-03-17T18:52:23+00:00 https://www.darkreading.com/vulnerabilities-threats/apache-tomcat-rce-vulnerability-exploit www.secnews.physaphae.fr/article.php?IdArticle=8656299 False Vulnerability,Threat None 3.0000000000000000 The Hacker News - The Hacker News est un blog de news de hack (surprenant non?) An unpatched security flaw impacting the Edimax IC-7100 network camera is being exploited by threat actors to deliver Mirat botnet malware variants since at least May 2024. The vulnerability in question is CVE-2025-1316 (CVSS v4 score: 9.3), a critical operating system command injection flaw that an attacker could exploit to achieve remote code execution on susceptible devices by means of a]]> 2025-03-17T18:42:00+00:00 https://thehackernews.com/2025/03/unpatched-edimax-camera-flaw-exploited.html www.secnews.physaphae.fr/article.php?IdArticle=8656239 False Malware,Vulnerability,Threat None 3.0000000000000000 The Hacker News - The Hacker News est un blog de news de hack (surprenant non?) Malicious actors are exploiting Cascading Style Sheets (CSS), which are used to style and format the layout of web pages, to bypass spam filters and track users\' actions. That\'s according to new findings from Cisco Talos, which said such malicious activities can compromise a victim\'s security and privacy. "The features available in CSS allow attackers and spammers to track users\' actions and]]> 2025-03-17T17:22:00+00:00 https://thehackernews.com/2025/03/cybercriminals-exploit-css-to-evade.html www.secnews.physaphae.fr/article.php?IdArticle=8656240 False Spam,Threat None 2.0000000000000000 The Hacker News - The Hacker News est un blog de news de hack (surprenant non?) From sophisticated nation-state campaigns to stealthy malware lurking in unexpected places, this week\'s cybersecurity landscape is a reminder that attackers are always evolving. Advanced threat groups are exploiting outdated hardware, abusing legitimate tools for financial fraud, and finding new ways to bypass security defenses. Meanwhile, supply chain threats are on the rise, with open-source]]> 2025-03-17T16:55:00+00:00 https://thehackernews.com/2025/03/thn-weekly-recap-router-hacks-pypi.html www.secnews.physaphae.fr/article.php?IdArticle=8656205 False Ransomware,Malware,Tool,Threat None 3.0000000000000000 The Hacker News - The Hacker News est un blog de news de hack (surprenant non?) The latest Palo Alto Networks Unit 42 Cloud Threat Report found that sensitive data is found in 66% of cloud storage buckets. This data is vulnerable to ransomware attacks. The SANS Institute recently reported that these attacks can be performed by abusing the cloud provider\'s storage security controls and default settings. “In just the past few months, I have witnessed two different methods for]]> 2025-03-17T16:30:00+00:00 https://thehackernews.com/2025/03/sans-institute-warns-of-novel-cloud.html www.secnews.physaphae.fr/article.php?IdArticle=8656206 False Ransomware,Threat,Cloud None 3.0000000000000000 InfoSecurity Mag - InfoSecurity Magazine DarkAtlas researchers have uncovered a direct link between BlackLock and the Eldorado ransomware group, confirming a rebranded identity of the notorious threat actor]]> 2025-03-17T16:30:00+00:00 https://www.infosecurity-magazine.com/news/researchers-confirm-blacklock/ www.secnews.physaphae.fr/article.php?IdArticle=8656275 False Ransomware,Threat None 2.0000000000000000 Schneier on Security - Chercheur Cryptologue Américain GPU Cryptanalysis de force brutale de GPRS, GSM, RFID et TETRA: Cryptanalysis de Kasumi, Speck, et TETRA: Résumé: Les longueurs de clés de la cryptographie symétrique sont déterminées en ce qui concerne les attaques de force brute avec la technologie actuelle. Bien que de nos jours, au moins des clés de 128 bits soient recommandées, il existe de nombreuses normes et applications du monde réel qui utilisent des clés plus courtes. Afin d'estimer la menace réelle imposée en utilisant ces clés courtes, les estimations précises des attaques sont cruciales. Dans ce travail, nous fournissons des implémentations optimisées de plusieurs algorithmes largement utilisés sur les GPU, conduisant à des informations intéressantes sur le coût des attaques de force brute sur plusieurs applications réelles ...

---

New paper: “GPU Assisted Brute Force Cryptanalysis of GPRS, GSM, RFID, and TETRA: Brute Force Cryptanalysis of KASUMI, SPECK, and TEA3.” Abstract: Key lengths in symmetric cryptography are determined with respect to the brute force attacks with current technology. While nowadays at least 128-bit keys are recommended, there are many standards and real-world applications that use shorter keys. In order to estimate the actual threat imposed by using those short keys, precise estimates for attacks are crucial. In this work we provide optimized implementations of several widely used algorithms on GPUs, leading to interesting insights on the cost of brute force attacks on several real-word applications...]]> 2025-03-17T15:09:57+00:00 https://www.schneier.com/blog/archives/2025/03/improvements-in-brute-force-attacks.html www.secnews.physaphae.fr/article.php?IdArticle=8656262 False Threat None 3.0000000000000000 Checkpoint Research - Fabricant Materiel Securite Pour les dernières découvertes en cyber Les meilleures attaques et violations de la recherche sur le point de contrôle élaborent sur le groupe hacktiviste pro-palestinien «Dark Storm» qui a revendiqué l'attaque DDOS à grande échelle contre X (anciennement Twitter). L'attaque a perturbé l'accès à la plate-forme, provoquant des pannes pour les utilisateurs […]

---

>For the latest discoveries in cyber research for the week of 17th March, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Check Point Research elaborates about the pro-Palestinian hacktivist group “Dark Storm” which claimed the large-scale DDoS attack against X (formerly Twitter). The attack disrupted access to the platform, causing outages for users […] ]]> 2025-03-17T14:38:43+00:00 https://research.checkpoint.com/2025/17th-march-threat-intelligence-report/ www.secnews.physaphae.fr/article.php?IdArticle=8656258 False Threat None 2.0000000000000000 Checkpoint - Fabricant Materiel Securite Check Point est honoré d'être présenté en tant que gagnant de l'or pour la sécurité du cloud lors des Globee Cybersecurity Awards 2025. La plate-forme CloudGuard de Check Point \\ s'est distinguée pour son approche préventive de la sécurité du cloud, en se concentrant sur l'arrêt des cyberattaques avant d'infiltrer les environnements cloud en premier lieu. La suite de bout en bout de CloudGuard \\ de Solutions de sécurité cloud avancées, y compris le pare-feu d'application Web (WAF), la sécurité automatisée du réseau, la détection et la réponse du cloud (CDR) et la sécurité du code, permet aux organisations de promulguer une approche unique et alimentée par AI qui priorise la gestion des risques et la prévention des menaces, la réduction des profils de risque globaux pour les organisations à l'échelle mondiale. Les Globee® Awards pour la cybersécurité mettent en lumière le […]

---

>Check Point is honored to be featured as a Gold Winner for Cloud Security in the 2025 Globee Cybersecurity Awards. Check Point\'s CloudGuard platform distinguished itself for its preventive approach to cloud security, focusing on stopping cyber attacks before they infiltrate cloud environments in the first place. CloudGuard\'s end-to-end suite of advanced cloud security solutions, including web application firewall (WAF), automated network security, cloud detection and response (CDR), and code security, enables organizations to enact a unique, AI-powered approach that prioritizes risk management and threat prevention, reducing overall risk profiles for organizations globally. The Globee® Awards for Cybersecurity spotlight the […] ]]> 2025-03-17T13:00:25+00:00 https://blog.checkpoint.com/security/check-point-named-gold-winner-for-cloud-security-in-2025-globee-cybersecurity-awards/ www.secnews.physaphae.fr/article.php?IdArticle=8656219 False Threat,Cloud None 2.0000000000000000 Cyble - CyberSecurity Firm Overview The Singapore Police Force (SPF), the Monetary Authority of Singapore (MAS), and the Cyber Security Agency of Singapore (CSA) have jointly issued a public advisory warning about a new series of scams involving digital manipulation. These scams leverage Artificial Intelligence (AI) to create synthetic media, commonly known as deepfakes. This allows scammers to impersonate high-ranking executives and deceive employees into transferring funds from corporate accounts. The Evolution of Digital Manipulation Scams In this emerging scam variant, fraudsters exploit AI-driven technology to manipulate video and audio, convincingly mimicking the facial features, voice, and gestures of senior executives. The technique involves scammers contacting victims via unwanted WhatsApp messages, claiming to be executives from the victims\' own companies. Victims are then invited to a live Zoom video call, during which they encounter fake visuals of their high-ranking executives, sometimes accompanied by individuals impersonating MAS officials or potential investors. Step-by-Step Breakdown of the Scam Initial Contact: Victims receive WhatsApp messages from scammers impersonating company executives. ]]> 2025-03-17T12:18:28+00:00 https://cyble.com/blog/fake-ceos-real-singapore-warns-of-deepfake-fraud/ www.secnews.physaphae.fr/article.php?IdArticle=8656222 False Tool,Threat,Legislation None 3.0000000000000000 Bleeping Computer - Magazine Américain A supply chain attack on the widely used \'tj-actions/changed-files\' GitHub Action, used by 23,000 repositories, potentially allowed threat actors to steal CI/CD secrets from GitHub Actions build logs. [...]]]> 2025-03-17T11:24:46+00:00 https://www.bleepingcomputer.com/news/security/supply-chain-attack-on-popular-github-action-exposes-ci-cd-secrets/ www.secnews.physaphae.fr/article.php?IdArticle=8656264 False Threat None 2.0000000000000000 Cyble - CyberSecurity Firm Le FBI et l'Agence américaine de sécurité de la cybersécurité et de l'infrastructure (CISA) ont publié un avis bien à la fois sur le groupe Ransomware Medusa la semaine dernière, car Cyble a détecté une accélération dans les activités du groupe au cours des derniers mois. medusa Ransomware Attacks ont été un événement presque quotidien jusqu'à présent, fonctionnant près de 45% plus élevé que les niveaux d'attaque du groupe \\ 2024, selon Cyble Threat Intelligence Données. Le cisa-fbi consultatif Examine le groupe Ransomware-as-a-Service (RAAS) du groupe, des techniques, des techniques et des procédures (TTPS). (IOCS), mitre att & ck Techniques, et plus, basé sur des enquêtes récentes du FBI. Les attaques de ransomwares Medusa ont augmenté en février Cyble a enregistré 60 victimes de ransomwares de méduse au cours des 72 premiers jours de 2025, à un rythme de plus de 300 attaques cette année. Ce serait considérablement à partir des 211 attaques de ransomwares MEDUSA enregistrées par Cyble en 2024. Le volume d'attaque a culminé en février, avec 33 victimes revendiquées par le groupe au cours du mois de 28 jours. Février était un mois record pour les attaques de ransomware en général, comme enregistré par les données Cyble. Cyble a e]]> 2025-03-17T11:01:48+00:00 https://cyble.com/blog/medusa-ransomware-surges-as-fbi-share-insight/ www.secnews.physaphae.fr/article.php?IdArticle=8656193 False Ransomware,Tool,Vulnerability,Threat,Patching,Mobile,Medical None 3.0000000000000000 InformationSecurityBuzzNews - Site de News Securite Ever since AI\'s meteoric rise to prominence following the release of ChatGPT in November 2022, the technology has been at the centre of international debate. For every application in healthcare, education, and workplace efficiency, reports of abuse by cybercriminals for phishing campaigns, automating attacks, and ransomware have made mainstream news.  Regardless of whether individuals and [...]]]> 2025-03-17T06:49:07+00:00 https://informationsecuritybuzz.com/threat-of-cyber-risk-during-ai-adoptio/ www.secnews.physaphae.fr/article.php?IdArticle=8656157 False Ransomware,Threat,Medical ChatGPT 2.0000000000000000 InformationSecurityBuzzNews - Site de News Securite The latest Global Threat Index from Check Point Software Technologies has revealed a sharp rise in AsyncRAT attacks, pushing this stealthy remote access Trojan (RAT) into the top four most prevalent malware strains worldwide.   This is a concerning trend: malicious actors are increasingly eyeing and exploiting trusted platforms to slip through security nets and gain [...]]]> 2025-03-17T05:10:37+00:00 https://informationsecuritybuzz.com/asyncrat-surges-global-malware-ranks/ www.secnews.physaphae.fr/article.php?IdArticle=8656149 False Malware,Threat,Prediction None 3.0000000000000000 The State of Security - Magazine Américain If your website is targeting multiple states or countries, by default, you face a double-pronged challenge: adapting to regional regulatory demands while defending against sophisticated cyber threats. Tackling this requires localization. But what does the term actually entail? Localization isn\'t just about tailoring products, services, and infrastructure to meet local market requirements; it has emerged as a critical tool for compliance and cybersecurity threat mitigation. Strategic localization can address supply chain vulnerabilities, enhance regional threat intelligence, and foster...]]> 2025-03-17T05:05:07+00:00 https://www.tripwire.com/state-of-security/role-localization-cybersecurity-threat-mitigation www.secnews.physaphae.fr/article.php?IdArticle=8656176 False Tool,Vulnerability,Threat None 3.0000000000000000 Mandiant - Blog Sécu de Mandiant Executive Summary The Rise of Browser in the Middle (BitM): BitM attacks offer a streamlined approach, allowing attackers to quickly compromise sessions across various web applications. MFA Remains Crucial, But Not Invulnerable: Multi-factor authentication (MFA) is a vital security measure, yet sophisticated social engineering tactics now effectively bypass it by targeting session tokens. Strong Defenses Are Imperative: To counter these threats, organizations must implement robust defenses, including hardware-based MFA, client certificates, and FIDO2. Social Engineering and Multi-Factor Authentication Social engineering campaigns pose a significant threat to organizations and businesses as they capitalize on human vulnerabilities by exploiting cognitive biases and weaknesses in security awareness. During a social engineering campaign, a red team operator typically targets a victim\'s username and password. A common mitigation used to address these threats are security measures like multi-factor authentication (MFA).  MFA is a security measure that requires users to provide two or more methods of authentication when logging in to an account or accessing a protected resource. This makes it more difficult for unauthorized users to gain access to sensitive information even if they have obtained one of the factors, such as a password. Red team operators have long targeted various methods of obtaining user session tokens with a high degree of success. Once a user has completed MFA and is successfully authenticated, the application typically stores a session token in the user\'s browser to maintain their authenticated state. Stealing this session token is the equivalent of stealing the authenticated session, meaning an adversary would no longer need to perform the MFA challenge. This makes session tokens a valuable target for adversaries and red team operators alike. Techniques for Targeting Tokens Red team operators can target these session tokens using a variety of tools and techniques. The most common tool is Evilginx2, a transparent proxy where a red team operator\'s server acts as an intermediary between the victim and the targeted service. Any HTTP requests made by the victim are captured by the phishing server and then forwarded directly to the intended website. However, before returning the responses to the victim, the server subtly modifies them by replacing any references to the legitimate domain with the phishing domain. This manipulation allows operators to not only capture the victim\'s login credentials from POST requests but also to extract session cookies (tokens) from the server\'s response headers after the victim has completed authentication and MFA prompts. During a red team engagement, a consultant working within a constrained time]]> 2025-03-17T05:00:00+00:00 https://cloud.google.com/blog/topics/threat-intelligence/session-stealing-browser-in-the-middle/ www.secnews.physaphae.fr/article.php?IdArticle=8656230 False Tool,Vulnerability,Threat None 2.0000000000000000 IndustrialCyber - cyber risk firms for industrial Evolving cyber threat landscapes have led to OT/ICS incident response priorities being under significant pressure. By stressing the... ]]> 2025-03-16T12:10:24+00:00 https://industrialcyber.co/features/strengthening-ot-ics-incident-response-to-address-growing-complexity-of-cyber-threats-deliver-business-continuity/ www.secnews.physaphae.fr/article.php?IdArticle=8656047 False Threat,Industrial None 2.0000000000000000 Dark Reading - Informationweek Branch Microsoft detailed a sophisticated campaign that relies on a social engineering technique, "ClickFix," in which a phisher uses security verification like captcha to give the target a false sense of safety.]]> 2025-03-14T20:07:52+00:00 https://www.darkreading.com/threat-intelligence/threat-actor-booking-com-clickfix-phishing-scheme www.secnews.physaphae.fr/article.php?IdArticle=8655809 False Threat None 3.0000000000000000 Dark Reading - Informationweek Branch The Mora_001 group uses similar post-exploitation patterns and ransomware customization originated by LockBit.]]> 2025-03-14T17:25:44+00:00 https://www.darkreading.com/cyberattacks-data-breaches/actor-tied-lockbit-ransomware-targets-fortinet-users www.secnews.physaphae.fr/article.php?IdArticle=8655782 False Ransomware,Threat None 3.0000000000000000 Recorded Future - FLux Recorded Future State-sponsored cyber espionage is a bigger threat than ever to Europe\'s telecommunications networks, according to a new assessment from Denmark\'s government.]]> 2025-03-14T12:04:33+00:00 https://therecord.media/europe-increased-cyber-espionage-telecoms-denmark-report www.secnews.physaphae.fr/article.php?IdArticle=8655725 False Threat None 3.0000000000000000 The Hacker News - The Hacker News est un blog de news de hack (surprenant non?) A new malware campaign has been observed leveraging social engineering tactics to deliver an open-source rootkit called r77. The activity, condemned OBSCURE#BAT by Securonix, enables threat actors to establish persistence and evade detection on compromised systems. It\'s currently not known who is behind the campaign. The rootkit "has the ability to cloak or mask any file, registry key or task]]> 2025-03-14T11:07:00+00:00 https://thehackernews.com/2025/03/obscurebat-malware-uses-fake-captcha.html www.secnews.physaphae.fr/article.php?IdArticle=8655674 False Malware,Threat None 3.0000000000000000 InfoSecurity Mag - InfoSecurity Magazine Barracuda observed threat actors impersonating the Clop ransomware group via email to extort payments, claiming to have exfiltrated sensitive data]]> 2025-03-14T11:00:00+00:00 https://www.infosecurity-magazine.com/news/fraudsters-clop-ransomware-extort/ www.secnews.physaphae.fr/article.php?IdArticle=8655716 False Ransomware,Threat None 2.0000000000000000 We Live Security - Editeur Logiciel Antivirus ESET While relatively rare, real-world incidents impacting operational technology highlight that organizations in critical infrastructure can\'t afford to dismiss the OT threat]]> 2025-03-14T10:00:00+00:00 https://www.welivesecurity.com/en/critical-infrastructure/when-it-meets-ot-cybersecurity-physical-world/ www.secnews.physaphae.fr/article.php?IdArticle=8661306 False Threat,Industrial None 3.0000000000000000 InformationSecurityBuzzNews - Site de News Securite Microsoft Threat Intelligence has discovered a new variant of XCSSET, a sophisticated modular macOS malware that targets Xcode projects. The malware was found in the wild during routine threat hunting and is the first known XCSSET variant to surface since 2022.   This new version of XCSSET features stronger obfuscation methods, updated techniques to maintain persistence [...]]]> 2025-03-14T06:11:18+00:00 https://informationsecuritybuzz.com/microsoft-uncover-xcsset-macos-malware/ www.secnews.physaphae.fr/article.php?IdArticle=8655681 False Malware,Threat None 2.0000000000000000 InformationSecurityBuzzNews - Site de News Securite Industrial cybersecurity firm Dragos has revealed that a small electric and water utility in Massachusetts was breached by a sophisticated Chinese Advanced Persistent Threat (APT) group for over 300 days.  The attack targeted Littleton Electric Light and Water Departments (LELWD), which serves the towns of Littleton and Boxborough. According to a Dragos case study, the [...]]]> 2025-03-14T05:30:55+00:00 https://informationsecuritybuzz.com/volt-typhoon-fo-massachusetts-electric/ www.secnews.physaphae.fr/article.php?IdArticle=8655672 False Threat,Studies,Industrial Guam 4.0000000000000000 Silicon - Site de News Francais 2025-03-14T00:00:00+00:00 https://www.silicon.fr/Thematique/cybersecurite-1371/Breves/joaquin-fuentes-ciso-maitrise-prompt-engineering-essentielle-468967.htm#utm_source=IndexThematique&utm_medium=Rss&utm_campaign= www.secnews.physaphae.fr/article.php?IdArticle=8655762 False Threat None 3.0000000000000000 The Hacker News - The Hacker News est un blog de news de hack (surprenant non?) The North Korea-linked threat actor known as ScarCruft is said to have been behind a never-before-seen Android surveillance tool named KoSpy targeting Korean and English-speaking users. Lookout, which shared details of the malware campaign, said the earliest versions date back to March 2022. The most recent samples were flagged in March 2024. It\'s not clear how successful these efforts were. "]]> 2025-03-13T19:53:00+00:00 https://thehackernews.com/2025/03/north-koreas-scarcruft-deploys-kospy.html www.secnews.physaphae.fr/article.php?IdArticle=8655561 False Malware,Tool,Threat,Mobile APT 37 2.0000000000000000 Recorded Future - FLux Recorded Future Experts have speculated that under the Trump administration an agreement which safeguards the flow of commercial data between Europe and the U.S. could be under threat.]]> 2025-03-13T19:20:05+00:00 https://therecord.media/lawmaker-data-transfer-us-mcgrath www.secnews.physaphae.fr/article.php?IdArticle=8655608 False Threat,Commercial None 3.0000000000000000 Netskope - etskope est une société de logiciels américaine fournissant une plate-forme de sécurité informatique Dans le paysage de sécurité d'aujourd'hui, la visibilité et les informations en temps réel sur les données de votre organisation sont essentielles pour la chasse aux menaces et la gestion des incidents efficaces. Pour répondre à ces besoins, NetSkope a développé une intégration native avec Microsoft Sentinel en utilisant les organisations de plate-forme de connecteur sans code pour diffuser facilement toutes les alertes CASB, les incidents DLP et les journaux de menaces dans SIEM de Cloud-Native de Microsoft \\. […]

---

>In today\'s security landscape, visibility and real-time insights into your organization\'s data are critical for effective threat hunting and incident management. To meet these needs, Netskope has developed a native integration with Microsoft Sentinel using the Codeless Connector Platform-allowing organizations to easily stream all CASB alerts, DLP incidents, and threat logs into Microsoft\'s cloud-native SIEM. […] ]]> 2025-03-13T15:59:19+00:00 https://www.netskope.com/blog/unlock-seamless-log-shipping-via-integration-with-microsoft-sentinel www.secnews.physaphae.fr/article.php?IdArticle=8655568 False Threat None 3.0000000000000000 The Register - Site journalistique Anglais 2025-03-13T15:02:01+00:00 https://go.theregister.com/feed/www.theregister.com/2025/03/13/bookingdotcom_phishing_campaign/ www.secnews.physaphae.fr/article.php?IdArticle=8655559 False Malware,Threat None 1.00000000000000000000 Zimperium - cyber risk firms for mobile Zimperium et Crowdstrike ont élargi leur partenariat, intégrant la défense des menaces mobiles de Zimperium (MTD) avec Crowdstrike Falcon® Next-Gen Siem.

---

>Zimperium and CrowdStrike have expanded their partnership, integrating Zimperium\'s Mobile Threat Defense (MTD) with CrowdStrike Falcon® Next-Gen SIEM. ]]> 2025-03-13T14:00:00+00:00 https://zimpstage.wpengine.com/blog/enhancing-mobile-security-zimperium-and-crowdstrike-expand-strategic-partnership/ www.secnews.physaphae.fr/article.php?IdArticle=8656260 False Threat,Mobile None 2.0000000000000000 Zimperium - cyber risk firms for mobile Zimperium et Crowdstrike ont élargi leur partenariat, intégrant la défense des menaces mobiles de Zimperium (MTD) avec Crowdstrike Falcon® Next-Gen Siem.

---

>Zimperium and CrowdStrike have expanded their partnership, integrating Zimperium\'s Mobile Threat Defense (MTD) with CrowdStrike Falcon® Next-Gen SIEM. ]]> 2025-03-13T14:00:00+00:00 https://www.zimperium.com/blog/enhancing-mobile-security-zimperium-and-crowdstrike-expand-strategic-partnership/ www.secnews.physaphae.fr/article.php?IdArticle=8655537 False Threat,Mobile None 2.0000000000000000 IndustrialCyber - cyber risk firms for industrial Researchers from Mandiant identified that threat actors have been deploying custom backdoors on Juniper Networks\' Junos OS routers... ]]> 2025-03-13T12:58:00+00:00 https://industrialcyber.co/critical-infrastructure/mandiant-uncovers-custom-backdoors-on-juniper-junos-os-routers-linked-to-chinese-espionage-group-unc3886mandiant-uncovers-custom-backdoors-on-juniper-junos-os-routers-linked-to-chinese-espionage-grou/ www.secnews.physaphae.fr/article.php?IdArticle=8655527 False Threat None 2.0000000000000000 IndustrialCyber - cyber risk firms for industrial U.S. Les agences ont publié un conseil en cybersécurité collaboratif détaillant les tactiques, les techniques et les procédures (TTPS), les indicateurs du compromis ...

---

>U.S. agencies have released a collaborative cybersecurity advisory detailing the tactics, techniques, and procedures (TTPs), indicators of compromise... ]]> 2025-03-13T08:55:44+00:00 https://industrialcyber.co/cisa/us-exposes-medusa-ransomware-threat-as-over-300-organizations-targeted-across-critical-infrastructure-sector/ www.secnews.physaphae.fr/article.php?IdArticle=8655473 False Ransomware,Threat None 2.0000000000000000 Global Security Mag - Site de news francais Malwares]]> 2025-03-13T08:01:19+00:00 https://www.globalsecuritymag.fr/attention-une-cyberattaque-est-en-cours-en-ce-moment-meme.html www.secnews.physaphae.fr/article.php?IdArticle=8655464 False Threat None 2.0000000000000000 The State of Security - Magazine Américain The Medusa ransomware gang continues to present a major threat to the critical infrastructure sector, according to a newly-released joint advisory from the FBI, Cybersecurity and Infrastructure Security Agency (CISA) and the Multi-State Information Sharing and Analysis Center (MS-ISAC). As of February 2025, the Medusa ransomware operation, which we have previously detailed on the Tripwire State of Security blog, had hit over 300 organisations from a variety of critical infrastructure sectors with affected industries including education, health, legal, insurance, technology, and manufacturing...]]> 2025-03-13T07:55:15+00:00 https://www.tripwire.com/state-of-security/medusa-ransomware-fbi-and-cisa-urge-organizations-act-now-mitigate-threat www.secnews.physaphae.fr/article.php?IdArticle=8655529 False Ransomware,Threat None 2.0000000000000000 Techworm - News ios 18.3, iPados 18.3.2 href = "https://support.apple.com/en-us/122284" data-wpel-kink = "external" rel = "nofollow novener noreferrer"> visionos 2.3.2 , macOS Sequoia 15.3.2 , et safari 18.3.1 . Tous les utilisateurs d'Apple sont fortement recommandés pour mettre à jour leurs appareils iPhones, iPads, Mac et Vision Pro à la dernière version du système d'exploitation pour se protéger de toute attaque potentielle.

---

Apple on Tuesday rolled out an emergency security update to patch a critical WebKit vulnerability that has been actively exploited in “extremely sophisticated” cyberattacks. The zero-day vulnerability, CVE-2025-24201, is an out-of-bounds write issue that affects WebKit, the engine that powers Apple\'s web browser Safari and many other apps and web browsers on macOS, iOS, Linux, and Windows. This flaw allows attackers to maliciously use crafted web content to break out of the Web Content sandbox. “This is a supplementary fix for an attack that was blocked in iOS 17.2. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 17.2,” the Cupertino giant wrote in security advisories issued on Tuesday. Apple has not yet credited any specific researcher with discovering this security vulnerability. It has also not provided any technical details on the zero-day vulnerability or the nature of the attacks. Below is the complete list of models affected by the zero-day vulnerability, which are: iPhone XS and later iPad Pro 13-inch, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 7th generation and later, and iPad mini 5th]]> 2025-03-12T23:06:28+00:00 https://www.techworm.net/2025/03/apple-patch-webkit-zero-day-sophisticated-attacks.html www.secnews.physaphae.fr/article.php?IdArticle=8655345 False Vulnerability,Threat,Technical None 2.0000000000000000 Dark Reading - Informationweek Branch A threat actor leveraged the vulnerability in an "extremely sophisticated" attack on targeted iOS users, the company says.]]> 2025-03-12T20:48:51+00:00 https://www.darkreading.com/mobile-security/apple-drops-another-webkit-zero-day-bug www.secnews.physaphae.fr/article.php?IdArticle=8655377 False Vulnerability,Threat None 2.0000000000000000 Global Security Mag - Site de news francais Investigations]]> 2025-03-12T18:13:16+00:00 https://www.globalsecuritymag.fr/entre-protection-contre-les-menaces-et-integration-de-l-ia-les-entreprises.html www.secnews.physaphae.fr/article.php?IdArticle=8655358 False Threat None 3.0000000000000000 The Hacker News - The Hacker News est un blog de news de hack (surprenant non?) Threat intelligence firm GreyNoise is warning of a "coordinated surge" in the exploitation of Server-Side Request Forgery (SSRF) vulnerabilities spanning multiple platforms. "At least 400 IPs have been seen actively exploiting multiple SSRF CVEs simultaneously, with notable overlap between attack attempts," the company said, adding it observed the activity on March 9, 2025. The countries which]]> 2025-03-12T17:26:00+00:00 https://thehackernews.com/2025/03/over-400-ips-exploiting-multiple-ssrf.html www.secnews.physaphae.fr/article.php?IdArticle=8655284 False Vulnerability,Threat None 3.0000000000000000 Cyble - CyberSecurity Firm aperçu L'Agence de sécurité de la cybersécurité et de l'infrastructure (CISA) a récemment mis à jour son catalogue connu sur les vulnérabilités exploitées (KEV) en ajoutant cinq vulnérabilités exploitées par les cybercriminels.   Ces nouvelles entrées mettent en évidence les défauts critiques dans les systèmes logiciels largement utilisés, y compris ceux qui ont un impact sur le Veracore Advantive et Ivanti Endpoint Manager (EPM).   L'identification de ces vulnérabilités met l'accent Cybersecurity Les risques pour les stratégies fédérales et privées, ainsi que la nécessité de l'urg des organisations.  Dans le cadre de ses efforts en cours pour protéger les infrastructures critiques, CISA a mis en évidence le ]]> 2025-03-12T15:03:52+00:00 https://cyble.com/blog/cisa-adds-5-flaws-to-kev-catalog/ www.secnews.physaphae.fr/article.php?IdArticle=8655309 False Tool,Vulnerability,Threat,Patching None 2.0000000000000000 InfoSecurity Mag - InfoSecurity Magazine Surging machine identities, faster threat detection and fewer vulnerabilities are shaping cloud security according to a new report]]> 2025-03-12T14:30:00+00:00 https://www.infosecurity-magazine.com/news/machine-identities-outnumber/ www.secnews.physaphae.fr/article.php?IdArticle=8655310 False Vulnerability,Threat,Cloud None 3.0000000000000000 Mandiant - Blog Sécu de Mandiant Introduction In mid 2024, Mandiant discovered threat actors deployed custom backdoors on Juniper Networks\' Junos OS routers. Mandiant attributed these backdoors to the China-nexus espionage group, UNC3886. Mandiant uncovered several TINYSHELL-based backdoors operating on Juniper Networks\' Junos OS routers. The backdoors had varying custom capabilities, including active and passive backdoor functions, as well as an embedded script that disables logging mechanisms on the target device. Mandiant worked with Juniper Networks to investigate this activity and observed that the affected Juniper MX routers were running end-of-life hardware and software. Mandiant recommends that organizations upgrade their Juniper devices to the latest images released by Juniper Networks, which includes mitigations and updated signatures for the Juniper Malware Removal Tool (JMRT). Organizations should run the JMRT Quick Scan and Integrity Check after the upgrade. Mandiant has reported on similar custom malware ecosystems in 2022 and 2023 that UNC3886 deployed on virtualization technologies and network edge devices. This blog post showcases a development in UNC3886\'s tactics, techniques and procedures (TTPs), and their focus on malware and capabilities that enable them to operate on network and edge devices, which typically lack security monitoring and detection solutions, such as endpoint detection and response (EDR) agents.  Mandiant previously reported on UNC3886\'s emphasis on techniques to gather and use legitimate credentials to move laterally within a network, undetected. These objectives remained consistent but were pursued with the introduction of a new tool in 2024. Observations in this blog post strengthen our assessment that the actor\'s focus is on maintaining long-term access to victim networks. UNC3886 continues to show a deep understanding of the underlying technology of the appliances being targeted. At the time of writing, Mandiant has not identified any technical overlaps between activities detailed in this blog post and those publicly reported by other parties as Volt Typhoon or Salt Typhoon.  Attribution UNC3886 is a highly adept China-nexu]]> 2025-03-12T14:00:00+00:00 https://cloud.google.com/blog/topics/threat-intelligence/china-nexus-espionage-targets-juniper-routers/ www.secnews.physaphae.fr/article.php?IdArticle=8655317 False Malware,Tool,Vulnerability,Threat,Patching,Prediction,Cloud,Technical Guam 2.0000000000000000 Bleeping Computer - Magazine Américain A new Android spyware named \'KoSpy\' is linked to North Korean threat actors who have infiltrated Google Play and third-party app store APKPure through at least five malicious apps. [...]]]> 2025-03-12T13:35:10+00:00 https://www.bleepingcomputer.com/news/security/new-north-korean-android-spyware-slips-onto-google-play/ www.secnews.physaphae.fr/article.php?IdArticle=8655346 False Threat,Mobile None 2.0000000000000000 IndustrialCyber - cyber risk firms for industrial Following last month\'s research on a new campaign by the Chinese threat actor Silver Fox, which exploited Philips... ]]> 2025-03-12T13:07:40+00:00 https://industrialcyber.co/medical/forescout-widens-research-on-silver-fox-hackers-reveals-malware-clusters-targeting-healthcare-through-dicom-hl7-exploits/ www.secnews.physaphae.fr/article.php?IdArticle=8655279 False Malware,Threat,Medical None 3.0000000000000000 Checkpoint - Fabricant Materiel Securite Le secteur financier sert de squelette de l'économie mondiale, ce qui en fait l'une des industries les plus ciblées pour les cyberattaques. À mesure que la banque en ligne, les transactions mobiles et les innovations fintech se développent, les cyber-menaces continuent d'évoluer. Les cyber-criminels exploitent continuellement les vulnérabilités dans les applications financières, rendant les solides mesures de sécurité essentielles pour protéger les données sensibles des clients, les transactions et les opérations commerciales. Pour atténuer ces risques, les pare-feu efficaces d'application Web (WAF) sont devenus un mécanisme de sécurité crucial pour les services financiers. Dans le récent radar Gigaom pour les applications et le rapport de sécurité des API, Gigaom souligne le rôle essentiel des mesures de sécurité intégrées dans le paysage numérique d'aujourd'hui. Le […]

---

The financial sector serves as the backbone of the global economy, making it one of the most targeted industries for cyber attacks. As online banking, mobile transactions, and fintech innovations expand, cyber threats continue to evolve. Cyber criminals continuously exploit vulnerabilities in financial applications, making strong security measures essential for protecting sensitive customer data, transactions, and business operations. To mitigate these risks, efficient web application firewalls (WAFs) have become a crucial security mechanism for financial services. In recent GigaOm Radar for Application and API Security report, GigaOm emphasizes the critical role of integrated security measures in today’s digital landscape. The […] ]]> 2025-03-12T13:00:05+00:00 https://blog.checkpoint.com/securing-the-cloud/the-role-of-waf-in-fintech-financial-services/ www.secnews.physaphae.fr/article.php?IdArticle=8655294 False Vulnerability,Threat,Mobile None 3.0000000000000000 Cisco - Security Firm Blog Demystify the potential threat that quantum computing poses to encryption and the security of the network.]]> 2025-03-12T12:00:00+00:00 https://blogs.cisco.com/security/understanding-the-quantum-threat-to-network-security/ www.secnews.physaphae.fr/article.php?IdArticle=8655264 False Threat None 2.0000000000000000 HackRead - Chercher Cyber API attacks are constantly on the rise, with a recent alarming study showing that 59% of organizations give…]]> 2025-03-12T11:29:24+00:00 https://hackread.com/rising-threat-of-api-attacks-how-to-secure-apis-2025/ www.secnews.physaphae.fr/article.php?IdArticle=8655269 False Threat,Studies None 3.0000000000000000 Cyble - CyberSecurity Firm aperçu Le National Cyber ​​Security Center (NCSC) a publié son Rapport des Cyber ​​Security Insights Pour le quatrième trimestre de 2024, révélant les tendances de la récentration dans les tendances cybère dans le cyber-sécurité dans le nouveau zèle. Le rapport du NCSC, couvrant la période du 1er octobre au 31 décembre 2024, met en évidence une augmentation notable des pertes financières, les Néo-Zélandais perdant un total de 6,8 millions de dollars contre la cybercriminalité. Cela représente une augmentation de 24% par rapport au trimestre précédent, où les pertes s'élevaient à 5,5 millions de dollars L'une des conclusions les plus intéressantes du rapport est l'augmentation des incidents impliquant des pertes financières substantielles. Il y a eu 17 rapports d'incidents ayant des pertes dépassant 100 000 $, représentant 4,7 millions de dollars du total de 6,8 millions de dollars signalés au NCSC. Selon Tom Roberts, le plomb de la menace de la NCSC \\ et i NCIDENT RESPONSE , c'est le plus grand nombre d'incidents de loss élevés enregistrés dans un seul trimestre. Roberts a déclaré: "Ces incidents sont assez variés de cyberattaques Sur les ordinateurs et les comptes des escroqueries cyber-envelows." Il a également souligné une tendance émergente: bon nombre de ces incidents à forte défaite ont commencé par un appel téléphonique d'un individu imitant une organisation bien connue. Ces appels ont finalement conduit au compromis des ordin]]> 2025-03-12T10:58:48+00:00 https://cyble.com/blog/ncsc-reports-6-8m-losses-in-q4-2024/ www.secnews.physaphae.fr/article.php?IdArticle=8655252 False Malware,Tool,Threat,Prediction None 3.0000000000000000 HackRead - Chercher Cyber Microsoft\'s March 2025 Patch Tuesday fixes six actively exploited zero-day vulnerabilities, including critical RCE and privilege escalation flaws. Learn how these vulnerabilities impact Windows systems and why immediate patching is essential.]]> 2025-03-12T10:56:12+00:00 https://hackread.com/march-2025-patch-tuesday-microsoft-fixes-vulnerabilities-zero-days/ www.secnews.physaphae.fr/article.php?IdArticle=8655253 False Vulnerability,Threat,Patching None 3.0000000000000000 The Hacker News - The Hacker News est un blog de news de hack (surprenant non?) Apple on Tuesday released a security update to address a zero-day flaw that it said has been exploited in "extremely sophisticated" attacks. The vulnerability has been assigned the CVE identifier CVE-2025-24201 and is rooted in the WebKit web browser engine component. It has been described as an out-of-bounds write issue that could allow an attacker to craft malicious web content such that it]]> 2025-03-12T09:32:00+00:00 https://thehackernews.com/2025/03/apple-releases-patch-for-webkit-zero.html www.secnews.physaphae.fr/article.php?IdArticle=8655191 False Vulnerability,Threat None 3.0000000000000000 IndustrialCyber - cyber risk firms for industrial Everfox, un fournisseur mondial de technologies de menace d'initiés, a annoncé sa collaboration avec la division des renseignements et de la sécurité intérieure ...

---

>Everfox, a global provider of insider threat technology, announced its collaboration with the Intelligence and Homeland Security Division... ]]> 2025-03-12T09:12:41+00:00 https://industrialcyber.co/news/everfox-partners-with-gdit-to-enhance-insider-threat-detection-through-linguistic-analysis-solutions/ www.secnews.physaphae.fr/article.php?IdArticle=8655244 False Threat None 3.0000000000000000 WatchGuard - Fabricant Matériel et Logiciels 2025-03-12T00:00:00+00:00 https://www.watchguard.com/fr/wgrd-news/press-releases/watchguard-lance-firecloud-internet-access-le-1er-produit-de-la-nouvelle www.secnews.physaphae.fr/article.php?IdArticle=8655277 False Threat,Cloud None 3.0000000000000000 Silicon - Site de News Francais 2025-03-12T00:00:00+00:00 https://www.silicon.fr/Thematique/cybersecurite-1371/Breves/anssi-politique-etat-468736.htm#utm_source=IndexThematique&utm_medium=Rss&utm_campaign= www.secnews.physaphae.fr/article.php?IdArticle=8655286 False Threat None 3.0000000000000000