Parse notes
Sponsored
🚨 The industry's average time before a breach is detected is 196 days. Modern threats slip past EDR, EPP, SIEM, and vulnerability scanners by targeting configuration and system changes these tools miss.
* Block tampering—even from admin-level accounts * Rapidly identify Zero-Day Attacks and Advanced Persistent Threats * Maintain continuous, audit-ready compliance (PCI, SOC2, ISO 27001, NIST CSF, & more)
Pakistan's National Cyber Emergency Response Team (NCERT) issued a critical warning urging citizens to change their passwords following a massive global data breach that exposed 184M unique account credentials. NCERT has issued this warning regarding an infostealer database uncovered last week.
Tiffany & Co. confirmed a data breach affecting customers in South Korea after notifying affected customers via email. This attack involved unauthorized access to a vendor platform using customers' data. The exposed data includes names, addresses, phone numbers, email addresses, internal customer ID numbers, and purchase data.
LexisNexis Risk Solutions disclosed a data breach that affected over 364,000 people after a hacker accessed their GitHub account on December 25. Stolen data includes names, Social Security numbers, and driver's license information. The data broker, which profits from collecting consumer information for fraud detection and risk assessment, was notified of the breach on April 1.
AWS honey tokens are AWS Access Keys strategically placed across a system and used as a digital tripwire to determine when an attack has breached the system. The Canarytokens project by Thinkst is an open-source implementation that utilizes two Lambda functions to create a honey token system that notifies users via CloudWatch of any token usage. This project has two drawbacks: it uses an easily identifiable naming scheme for generating tokens, and it only appends a timestamp when the event is received by CloudWatch, which will have a delay that can hamper event correlation.
As proven by the Anthropic report on the malicious uses of Claude, threat actors are increasingly using LLMs to aid in their activities. Prompts should be classified as IoCs, or LLM TTPs. Prompts can be used to construct NOVA threat hunting rules based on possible prompts for the scenarios identified in the Anthropic report.
This post dives into how consulting firms are changing and creating Shadow AI tools to keep up with demand. Consulting firms are experiencing AI-driven layoffs, cutting thousands of jobs, and fearful employees are creating unauthorized "shadow AI" apps using Python and various AI APIs to stay relevant. An estimated 74,500+ shadow AI tools now exist across consulting firms, creating security risks and governance challenges for IT departments.
Cerby automates identity workflows across over 2,000 applications and is used by organizations across sectors such as healthcare, manufacturing, online collaboration, retail, SaaS, streaming, telecommunications, and workplace training.
The NOVA framework is an open-source prompt pattern matching system combining keyword detection, semantic similarity, and LLM-based evaluation to analyze and detect prompt content.
woodpecker is a modular red teaming tool focused on AI and cloud apps. The tool is designed to discover security weaknesses by experimentation.
Following the major breach on South Korea's SK Telecom, the South Korean government has investigated potential hacking attempts targeting major domestic platform service providers. The government had initially asked these companies to conduct voluntary self-assessments after news of the SK Telecom breach first surfaced. However, the Korea Internet & Security Agency will now take over the investigations.
Cybersecurity researchers discovered a flaw in Microsoft's OneDrive File Picker that could allow websites to access users' entire cloud storage instead of just selected files. The issue affects apps like ChatGPT, Slack, and Trello due to overly broad OAuth permissions and vague consent screens. Microsoft acknowledged the problem but hasn't provided a fix yet.
BeyondTrust researchers found that guest users in Microsoft Azure can create and transfer Azure subscriptions, gaining "Owner" privileges without admin approval. Guests with billing authority can use Microsoft's transfer feature to move subscriptions, bypassing normal access controls. Microsoft states this supports multi-tenant scenarios, but enabling it by default poses significant security risks that organizations need to address with subscription policies and guest account audits.
US healthcare conglomerate Kaiser Permanente announced on Wednesday that its systems were experiencing intermittent outages that affected various patient services, including electronic health records.
Pakistan authorities arrested 21 people linked to “Heartsender,” a notorious spam and malware service that aided organized crime for over a decade.
A botnet named "AyySSHush" has compromised over 9,000 ASUS routers by exploiting CVE-2023-39780 to install persistent SSH backdoors that survive firmware updates, targeting multiple brands like Cisco, D-Link, and Linksys.