Full-text search across article titles and summaries. Refine with sector, year, content type, and reading-time filters.
This article discusses in depth about malware found by ESET researchers in the European Ministry of Foreign Affairs' computers. These two backdoors, LunarWeb and LunarMail, have been associated with the Turla group. The backdoors use techniques like steganography and communicate via HTTP(S) or email.
Sponsored
What's next for AI and compliance? Where is GRC heading, and what does it mean for your business? Join the industry's leading compliance, risk, IT, and cybersecurity professionals [11] at one of the Bay Area's best venues for a day of learning, networking, and so much more. And to ramp up the excitement even more, Tony Hawk [11] is headlining!
DeepKeep's AI-Native Trust, Risk, and Security Management (TRiSM) platform provides data scientists and security leaders a valuable understanding of the risks and challenges that AI systems face while also delivering protection and alerts
Arcjet JS SDKs, Next.js, and Node.js library for rate limiting, bot protection, email verification, and defense against common attacks.
SignSaboteur is a Burp Suite extension for editing, signing, verifying, and attacking signed tokens. It supports a wide variety of different tokens.
The FBI, in collaboration with international law enforcement agencies, seized the notorious cybercrime forum BreachForums on Wednesday. BreachForums has been a popular platform for hackers and cybercriminals to advertise, sell, and trade stolen data.
Microsoft has observed a cybercriminal group called Storm-1811 abusing Quick Assist for social engineering attacks to deploy Black Basta ransomware. The group uses voice phishing to trick victims into installing remote management tools, followed by QakBot, Cobalt Strike, and ultimately the ransomware.
When LLMs and AI agents respond to user inputs, they inherently make certain assumptions to provide context and accurate responses to a user. These assumptions should be explicitly stated in an assumptions_made metadata field. This would provide more insight into improving LLMs and AI agents.
Google demoed a large variety of AI features for Android devices, including the capability for Gemini to notify users if a call seems to be from a scammer.
A new report by VikingCloud reveals that 40% of cyber teams are not reporting breaches due to fear of job loss, highlighting a significant underreporting issue globally.
CISA has published guidance for federal agencies on encrypting DNS traffic to enhance cybersecurity aligned with the zero trust strategy.
Sponsored
Palo Alto Network's premier network security summit is coming up! Join this virtual event [4] to learn from industry leaders, tech visionaries, and cybersecurity professionals.
Apple has backported a fix for CVE-2024-23296, which was disclosed in March, to older devices. The vulnerability was a memory corruption bug that allowed attackers to bypass kernel memory protections. Apple reported that the vulnerability may have been actively exploited.
The Ebury botnet has compromised 400K servers over the past 15 years. Recent attacks show that operators have been targeting hosting providers to perform supply-chain attacks on clients renting virtual servers. The Ebury operators are financially motivated and often deploy credential stealers onto compromised servers.
Christie's auctions worth $840m have been disrupted by a cyber attack, affecting the sale of valuable items like a Van Gogh painting and rare wine. The website is offline, but bids can still be placed over the phone or in person. An alternative website with basic information is available. Auctions continue and there are plans for upcoming sales.
AhnLab Security Intelligence Center has identified a North Korean campaign targeting South Koreans with a malicious LNK file. The file distributes a loader for the RokRAT C2 malware. This article provides a deep dive into the loader and IoCs for the campaign.
Tycoon 2FA is a phishing-as-a-service platform that was recently updated to enhance detection avoidance. The toolkit relies on victims entering their information into attacker-controlled infrastructure. After MFA prompting, session cookies are relayed to the attacker. This article provides some real-world examples and defenses.
This blog post describes the DNS Tunneling attack technique, which is a method for attackers to hide and transport data through DNS traffic. Malicious actors can use DNS tunneling to track user activities and communicate with compromised hosts. Organizations can detect and mitigate DNS tunneling campaigns effectively by analyzing indicators like domains and IP addresses.
Keylime provides an end-to-end solution for bootstrapping hardware rooted cryptographic trust for remote machines, the provisioning of encrypted payloads, and runtime system integrity monitoring.
SharpGraphView is a post-exploitation toolkit that provides modular access to the Microsoft Graph API for cloud security teams.
Trail of Bits discusses how it has worked to add cryptographically verifiable build provenance for all bottles. This feature ensures that each bottle's content is bound to specific build-time metadata, reducing the risk of compromised or malicious installations. While still in early beta, users can verify attestations using the "brew verify" command, but caution is advised until further development is completed.
This blog post discusses techniques used in the XZ backdoor, focusing on locating function addresses, symbol tables, and system information within ELF files. It also explains the process of function hooking and demonstrates a simplified version of the XZ backdoor's logic using library functions and memory address manipulation. The XZ backdoor's method involves finding specific addresses and performing actions based on that information, simulating the process of locating critical functions within programs.
The Black Basta ransomware group is attacking critical infrastructure, affecting over 500 organizations in the past two years, including a healthcare system with 140 hospitals. FBI and security researchers warn that the group is causing severe disruptions and targeting healthcare organizations through novel social engineering tactics.
MITRE has launched EMB3D, a threat-modeling framework for embedded devices in critical infrastructure. EMB3D aims to help device vendors understand and mitigate cyber threats targeting embedded devices. The framework focuses on providing security mechanisms early in the design cycle to create inherently secure devices.
Apple and Google on Monday officially announced the rollout of a new feature that notifies users across both iOS and Android if a Bluetooth tracking device is being used to stealthily keep tabs on them without their knowledge or consent.
Zscaler investigated a recent hacking incident and confirmed that only a test server was compromised, with no impact on customer data.
CISA, DHS, FBI, and international partners have published a guide to help civil society organizations reduce cyber threat risks by protecting high-risk communities.
Sponsored
> Orca is leading the way in AI security with the addition of AI Security [4] to its cloud security platform.
The Ohio Lottery cyberattack conducted by the DragonForce ransomware group in late 2023 impacted over 500,000 individuals. The hackers claim to have obtained over 1.5 million records of employee and player information, including sensitive data like social security numbers, addresses, winnings, and dates of birth, and have leaked over 90GB of stolen files as backups.
Google has released a security update to fix a use-after-free vulnerability in the component that handles rendering of content in the Chrome browser. Google has stated that exploit code is available. Google Chrome updates automatically for security fixes but users can verify that they are on the latest version in Settings.
A malicious Go binary was hidden in a PyPI package named requests-darwin-lite. The binary was concealed within a large PNG image file, allowing the attacker to target specific macOS systems. Versions of the package containing the malicious binary were removed from PyPI after being detected.
This post goes into how curiosity led a pentester to discover a vulnerability that allowed him to track 130,000 cars worldwide. It reminds readers to not download just any random app that uses IoT or GPS as they are wildly insecure.
This blog post walks through the process of fuzzing an Android application using AFL++ in Frida mode. It details the process of building the application and writing a test harness. The post then provides a primer on JNI linking and details the process of building a harness for weak JNI linking and strong JNI linking.
Researchers from KPMG Romania have published this in-depth article about how public AMIs are exposing sensitive data. They collected AMIs from all AWS regions, identified owners with many public AMIs, and accessed the contents to discover secrets like access keys and confidential data. The researchers emphasized responsible disclosure and highlighted the need for companies to secure their public AMIs.
Token Security is a "machine-first" identity security platform that provides visibility and continuous threat exposure management to manage identities. It starts with a list of machines and identifies who can access each machine by integrating into existing infrastructure. It then triages data to extract context, evaluate, and prioritize threat detection
Okta Terrify is a tool to abuse Okta Verify and FastPass. The tool allows an attacker to backdoor an Okta account via a compromised machine.
MS Devblogs Search is a Python script that downloads Microsoft Devblogs articles and searches them. The tool is helpful for learning about Windows development from the perspective of Microsoft developers.
The CISA has announced a new vulnrichment program to enrich vulnerabilities from the CVE database with additional details from testing. The goal of this project is to alleviate some of the load that has plagued databases like the NVD and led to slowdowns in cataloging new CVEs
Six researchers have demonstrated a technique called GhostStripe that can interfere with autonomous vehicles' ability to recognize road signs by exploiting the camera-based computer vision systems and rolling shutters of CMOS sensors used by brands like Tesla and Baidu Apollo.
Researchers have uncovered two new attack methods called Pathfinder, targeting high-performance Intel CPUs, which enable reconstruction of program control flow history and launching high-resolution Spectre attacks.
Threat Researchers have found that Scattered Spider group is targeting various companies in finance and insurance with convincing lookalike domains and login pages and advises defenders to monitor lookalike domains and train employees to detect phishing attacks.
Boeing refused to pay a $200 million ransom demand from the LockBit hacking group after a ransomware attack.
This article discusses software vulnerabilities and exploits, analyzing trends and noteworthy vulnerabilities in Q1 2024.
Sponsored
Are you an expert in all things cloud security? Come prove it at Lacework's virtual Capture the Flag Challenge [4]!
Private healthcare system Ascension reports that it has taken some systems offline to investigate a suspected cyberattack. Ascension has advised all partners to sever connections to its networks and has retained Mandiant for incident response. Clinical operations have also been impacted due to the attack.
The University Systems of Georgia, which administers 26 higher education institutions in the state, sent a letter to 800k victims disclosing that it was a victim of several breaches by the Cl0p gang's campaign. The data obtained may include full SSNs, the last four digits of SSNs, dates of birth, bank account numbers, federal tax documents, and driver's licenses. USG reports that the data will likely be published and offered victims 13 months of credit monitoring.
Dell has warned customers of a data breach affecting 49 million people. The stolen information includes customer names, addresses, and purchase details, but not financial data. Customers should be cautious of potential targeted attacks and verify communications from Dell directly.