Parse notes
Sony Interactive Entertainment has contacted 6,800 current and former employees to warn that their data may have been collected by hackers. Sony launched an investigation last month into a second breach in which hackers acquired 3.14GB of data.
MGM Resorts has confirmed hackers stole an unspecified amount of customers’ personal information during a September cyberattack that will cost the hotel and casino giant an estimated $100 million. MGM has seen no evidence that the data obtained by the criminal actors has been used for identity theft or account fraud yet.
Microsoft security researchers recently identified a campaign where attackers attempted to move laterally to a cloud environment through a SQL Server instance. In this blog post, Microsoft elaborates on the attack flow and focuses on the main technique that was observed: SQL Server to cloud lateral movement. It also shows how to detect this type of threat and help mitigate such attacks.
Dual Ransomware, a sinister dance of encryption and exfiltration, doesn’t just lock you out: it takes your secrets and threatens to spill them into the boundless abyss of the dark web. Your data, once merely shackled, is now a pawn in a high-stakes game of cyber blackmail and espionage. This blog post goes through the history of dual ransomware, how it works, and real life examples.
A tutorial from AWS on how to utilize Secrets Manager in on-prem and multi-cloud workloads utilizing IAM Roles Anywhere. It includes example use cases and works through a sample application.
OpenPubkey adds user generated cryptographic signatures to OpenID Connect (OIDC) to enable users to sign messages or artifacts under their OpenID identity. Verifiers can check that these signatures are valid and associated with the signing OpenID identity.
Crawlector (the name is a combination of Crawler & Detector) is a threat-hunting framework designed for scanning websites for malicious objects.
GitHub introduced secrets scanning in early 2023 and since then added validity checks to the secrets scanning feature. It just announced that validity checks have been expanded to include AWS, Google, Microsoft, and Slack tokens.
The Qakbot malware gang has been staging cyberattacks with Ransom Knight ransomware and the Remcos backdoor via phishing emails, according to Cisco Talos. Despite authorities seizing the gang's infrastructure and financial assets, key members of the group have likely regrouped and continued committing cybercrimes.
The ten most common network misconfigurations, the two agencies say, include default software configurations, improper separation of privileges, lack of network segmentation, insufficient network monitoring, poor patch management, bypass of access controls, poor credential hygiene, improper multi-factor authentication (MFA) methods, insufficient access control lists (ACLs) on network shares, and unrestricted code execution.
An investigation into how scammers utilize Zelle to trick unsuspecting customers into scams. The investigation is told as a story wherein the protagonist was scammed by a Business Email Compromise into sending $31,500 via Zelle.
ZDI has gone public with no less than six 0days in the popular mail server Exim. Ranging from ‘potentially world-ending' through to ‘a bit of a damp squib’, these bugs were apparently discovered way back in June 2022 (!) - but they were published last week.
AWS announced that as of mid 2024, users signing into the AWS management console with root user accounts will be required to use MFA. AWS will communicate this to affected customers through multiple channels. There are plans to expand the MFA requirements but no concrete timelines.
The Modernizing the Acquisition of Cybersecurity Experts Act (MACE Act) aims to address shortages in cybersecurity positions by expanding the pool of eligible applicants. Under the legislation, agencies would only be allowed to consider an applicant’s education if it directly reflects the competencies required for the position. The bill will now move to the Senate for consideration.