Parse notes
A digital break-in has disrupted VF Corp's operations and its ability to fulfill orders, according to the apparel and footwear giant. The threat actor disrupted the company's business operations by encrypting IT systems and stealing data, including personal data. VF Corp aims to reduce disruption to its ability to serve its retail and brand e-commerce consumers and wholesale customers.
Delta Dental of California and its affiliates are warning patients that it suffered a data breach due to MOVEit attacks. The nearly 7 million affected customers had their names, financial information, and social security numbers exposed. This is the third largest MOVEit data breach thus far.
A group of researchers have discovered a novel attack against SSH connections that can downgrade the security of the connection by truncating negotiation messages. The attack requires the attacker to have established a man-in-the-middle position and the SSH connection to be secured with either ChaCha20-Poly1305 or CBC with Encrypt-then-MAC. The researchers have released a scanner to determine if servers are vulnerable.
This blog explores a few advanced KQL (Kusto Query Language) queries designed to identify and track known patterns, files, and other Indicators of Compromise (IOCs) commonly associated with the Cactus ransomware.
Application Security Posture Management is a new Gartner category that refers to tools that provide everything needed to scan for and remediate vulnerabilities in an application. Broadly speaking, an ASPM should be able to track the lifecycle of a vulnerability, suggest where in the code the vulnerability can be fixed, provide a robust set of scanners, and allow for workflow creation. ASPMs typically include a subset of the following scanners: SDLC, SCA, SAST, IaC, container scanning, secret scanning, DAST, and CSPM.
NKAbuse is a new Go-based malware that utilizes NKN technology for stealthy communication. NKN is a new, decentralized protocol that leverages blockchain technology. NKAbuse can function as a RAT or a DDOS botnet with communication that is difficult to track.
Xeol’s focus is to secure software throughout its lifecycle, beginning at the code repository all the way through delivery to customers. Using an agentless system and basing themselves on SBOMs, Xeol manages enterprises' end-of-life software when publishers no longer provide security patches and brings visibility to them.
The free and open-source security platform SecHub has a central API for testing software with different security tools. It supports many free, open-source, and proprietary security tools.
AtlasLdr is a reflective x64 loader that uses dynamic indirect syscalls that can be used to avoid detection by Endpoint Detection and Response(EDR) systems.
A researcher simulated using large language models (LLMs) like ChatGPT to craft personalized spearphishing emails targeting UK Parliament members. His paper reveals LLMs can iterate malicious emails to successfully trick victims at a fraction of a cent per message. The researcher's findings usher in an era of weaponized LLMs posing immense new cyberthreats.
Threat actors exploit public services to conceal command and control infrastructure amongst legitimate traffic. Blending malicious actions through services like GitHub hinders threat detection and allows inexpensive, reliable control of breached systems. This post navigates how malicious actors are using this technology to frustrate incident response and security teams.
The FBI has reportedly seized the ALPHV Blackcat ransomware gang's dark web leak site as part of a coordinated, international effort. The FBI also released a decryption tool that has allowed more than 500 victims to restore their systems. ALPHV and the FBI have gone back and forth seizing and “unseizing” the site since the publication of this article.
The Vulnerability Impact Scoring System, or VISS, is a customizable framework that provides a web-based user interface and algorithms to help organizations assess and prioritize vulnerabilities based on actual demonstrated exploitation rather than theoretical impact.
The Xtreme firmware for Flipper Zero had previously included a BLE spam attack that could DOS an iPhone by causing non-stop Bluetooth popups to overwhelm a device. Apple has added protections to prevent the DOS attack with its latest iOS update.
This blog post talks about how North Korea uses open source package managers and the GitHub platform to orchestrate supply chain attacks.