Parse notes
Sponsored
With increased regulatory pressures and a growing focus on customer trust, no organization can afford to sleep on compliance. But scaling evidence collection and audit-readiness, across multiple frameworks and complex tech stacks, is a heavy lift that often falls on already-overburdened shoulders. This is where Drata
Tesla filed a data breach notification that two former employees leaked more than 75,000 individuals’ personal information to a foreign media outlet. The leaked data includes social security numbers among other personally identifiable information. Tesla has sued the former employees and the German media outlet that received the data claims that they will not (and cannot) use it.
Ivanti has disclosed the exploitation of a critical MobileIron/Ivanti Sentry gateway authentication bypass bug, CVE-2023-38035. The vulnerability allows the takeover of sensitive network components. It requires access to admin port 8443 and impacts unpatched Sentry v9.18 and earlier.
XLoader malware has re-emerged without Java dependencies, using native Objective-C/C code and signed as a fake "OfficeNote" productivity app. This post examines the new variant’s technical details and threat hunting indicators.
An article discussing how to reduce complexity in SIEM deployments. This article begins with some symptoms of an overly complex SIEM and then discusses helpful questions to try and reduce the complexity to more manageable levels and regain control of it.
The CYFIRMA research team has discovered a new Malware-as-a-service (MaaS) operator that goes by the moniker EVLF DEV. This threat actor is responsible for the development of CypherRAT and CraxsRAT, which in the last 3 years was purchased by over 100 distinct threat actors on a lifetime license. In this research report, they discuss the MaaS operator and the malware being developed by them.
The latest BloodHound CE release brings useful enhancements, but the tool's Neo4j database also enables powerful custom queries to automatically find Active Directory weaknesses. This post demonstrates examples of querying the database directly or via API to uncover basic flaws and augment BloodHound's graph visualizations and attack path planning.
SWAT is a command line tool that is designed for red teaming Google Workspace environments. The tool maps its functionality closely to the MITRE ATT&CK framework and allows for simulating suspicious adversarial behavior.
Envsec is a tool that securely stores environment variables in the cloud of your choice. It is designed with developer experience in mind to be a pleasure to use. It comes with a command line tool and an accompanying Go library.
Tool for obfuscating and deobfuscating data by searching and replacing sensitive data based on regexes pulled from an inputted file.
Kubernetes version 1.28 is now available. In this version, Validating Admission Policy reaches beta status as a more complex and flexible admission controller than Pod Security Admission. This release also adds an authorization API for users to query data about themselves
In this post, Cris Thomas (AKA Space Rogue) from L0pht Heavy Industries discusses the blurry boundary between researchers and hackers, with researchers being a subset of Whitehats. Thomas believes that researchers take a more formal approach to investigations, whereas hackers hack on stuff and experiment with things to see what breaks and what still works.
Ransomware attacks on US local governments rose in 2022, highlighting risks as cities digitize. Hybrid attacks that start digital and eventually impact physical infrastructure will persist without preparation. Cities must find weaknesses, expect threats, and strategically communicate, both internally and externally, to ensure community resilience and recovery.
The UK has introduced several controversial proposals to try to rein in Big Tech. Some companies are saying there is a “tipping point” where they will leave the market instead of complying. The "tipping point" is upcoming UK regulations like the Online Safety Bill that is due to pass in the autumn.
A new State of SaaS Security Posture Management Report from AppOmni indicates that Cybersecurity, IT, and business leaders alike recognize SaaS cybersecurity as an increasingly important part of the cyber threat landscape.
Uptycs published its quarterly threat bulletin that notes a significant increase in the sophistication and complexity of threats faced by organizations globally. It also notes that in Q2 2023, rundll32.exe was the most abused utility for Windows malware. Crontab was the most abused in Linux, while OpenSSL and curl were prevalent in macOS.