The Last Watchdog

MARCH 25, 2024

The National Institute of Standards and Technology (NIST) has updated their widely used Cybersecurity Framework (CSF) — a free respected landmark guidance document for reducing cybersecurity risk. Related: More background on CSF However, it’s important to note that most of the framework core has remained the same. Here are the core components the security community knows: Govern (GV): Sets forth the strategic path and guidelines for managing cybersecurity risks, ensuring harmony with business go

Cybersecurity 203

Cybersecurity Artificial Intelligence Risk Government 203

The Hacker News

MARCH 25, 2024

A new security shortcoming discovered in Apple M-series chips could be exploited to extract secret keys used during cryptographic operations.

Encryption 145

Encryption 145

Trend Micro

MARCH 25, 2024

This blog entry discusses the Agenda ransomware group's use of its latest Rust variant to propagate to VMWare vCenter and ESXi servers.

Ransomware 145

Ransomware 145

The Hacker News

MARCH 25, 2024

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday placed three security flaws to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vulnerabilities added are as follows - CVE-2023-48788 (CVSS score: 9.3) - Fortinet FortiClient EMS SQL Injection Vulnerability CVE-2021-44529 (CVSS score: 9.

Cybersecurity 144

Cybersecurity 144

Advertisement

Keeper Security is transforming cybersecurity for people and organizations around the world. Keeper’s affordable and easy-to-use solutions are built on a foundation of zero-trust and zero-knowledge security to protect every user on every device. Our next-generation privileged access management solution deploys in minutes and seamlessly integrates with any tech stack to prevent breaches, reduce help desk costs and ensure compliance.

Passwords

Bleeping Computer

MARCH 25, 2024

Cybercriminals have been increasingly using a new phishing-as-a-service (PhaaS) platform named 'Tycoon 2FA' to target Microsoft 365 and Gmail accounts and bypass two-factor authentication (2FA) protection. [.

Phishing 143

Phishing Accountability Authentication 143

The Hacker News

MARCH 25, 2024

Unidentified adversaries orchestrated a sophisticated attack campaign that has impacted several individual developers as well as the GitHub organization account associated with Top.gg, a Discord bot discovery site.

Accountability 142

Accountability 142

Penetration Testing

MARCH 25, 2024

Security researcher ma4ter has revealed details of a dangerous security vulnerability (CVE-2024-20767) in Adobe ColdFusion. This flaw originally reported to Adobe, could be exploited to read arbitrary files on an affected server, potentially exposing... The post CVE-2024-20767: Critical Adobe ColdFusion Flaw Exposes Sensitive Files, PoC Published appeared first on Penetration Testing.

Penetration Testing 142

Penetration Testing 142

Security Affairs

MARCH 25, 2024

In recent campaigns, Iran-linked APT group MuddyWater used a legitimate Remote Monitoring and Management (RMM) solution called Atera. Proofpoint researchers observed the Iran-linked APT group MuddyWater (aka SeedWorm , TEMP.Zagros , TA450, and Static Kitten ) was behind a new phishing campaign in March 2024 that attempted to drop a legitimate Remote Monitoring and Management (RMM) solution called Atera on the target systems.

Phishing 142

Phishing Social Engineering Telecommunications Accountability 142

Malwarebytes

MARCH 25, 2024

Skater brand Vans emailed customers last week to tell them about a recent “data incident.” On December 13, 2023, Vans said it detected unauthorized activities on its IT systems, attributed to “external threat actors.” An investigation revealed that the incident involved some personal information of Vans’ customers. The affected information could include: Email address Full name Phone number Billing address Shipping address In certain cases, the affected data may also include order hi

Data breaches 140

Data breaches Phishing Identity Theft Passwords 140

Security Affairs

MARCH 25, 2024

Researchers reported that over 100 organizations in Europe and US were targeted by a wave of large-scale StrelaStealer campaigns Palo Alto Networks’ Unit42 spotted a wave of large-scale StrelaStealer campaigns impacting over 100 organizations across the EU and US. The threat actors sent out spam emails with attachments that eventually launched the StrelaStealer malware.

Malware 140

Malware Encryption Manufacturing Phishing 140

Advertisement

Many software teams have migrated their testing and production workloads to the cloud, yet development environments often remain tied to outdated local setups, limiting efficiency and growth. This is where Coder comes in. In our 101 Coder webinar, you’ll explore how cloud-based development environments can unlock new levels of productivity. Discover how to transition from local setups to a secure, cloud-powered ecosystem with ease.

Software

Bleeping Computer

MARCH 25, 2024

Google's new AI-powered 'Search Generative Experience' algorithms recommend scam sites that redirect visitors to unwanted Chrome extensions, fake iPhone giveaways, browser spam subscriptions, and tech support scams. [.

Scams 140

Scams Malware Software 140

Security Affairs

MARCH 25, 2024

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds FortiClient EMS, Ivanti EPM CSA, Nice Linear eMerge E3-Series bugs to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the following vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. CVE-2023-48788 Fortinet FortiClient EMS SQL Injection Vulnerability CVE-2021-44529 Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) Code Injection Vulne

Hacking 139

Hacking Cybersecurity Software Risk 139

The Hacker News

MARCH 25, 2024

The Iran-affiliated threat actor tracked as MuddyWater (aka Mango Sandstorm or TA450) has been linked to a new phishing campaign in March 2024 that aims to deliver a legitimate Remote Monitoring and Management (RMM) solution called Atera.

Phishing 138

Phishing Surveillance Manufacturing Technology 138

Security Affairs

MARCH 25, 2024

Researchers demonstrated a new side-channel attack, named GoFetch, against Apple CPUs that could allow an attacker to obtain secret keys. A team of researchers from several US universities demonstrated a new microarchitectural side-channel attack named GoFetch that could allow attackers to extract secret keys from systems using Apple CPUs. GoFetch side-channel attack can extract secret keys from constant-time cryptographic implementations via data memory-dependent prefetchers (DMPs).

Engineering 138

Engineering Hacking Software Information Security 138

Advertisement

After a year of sporadic hiring and uncertain investment areas, tech leaders are scrambling to figure out what’s next. This whitepaper reveals how tech leaders are hiring and investing for the future. Download today to learn more!

Security Boulevard

MARCH 25, 2024

With the IRS deadline only weeks away, businesses and individuals are racing to get their taxes filed, and bad actors are doing what they can to keep pace with them. Both Microsoft and Malwarebytes in recent days have outlined various scams being used to steal sensitive information, drop malicious payloads, or make payments to fake. The post Tax Scams Ramping Up as the April 15 Deadline Approaches appeared first on Security Boulevard.

Scams 135

Scams Social Engineering Engineering Phishing 135

The Hacker News

MARCH 25, 2024

In January 2024, Microsoft discovered they’d been the victim of a hack orchestrated by Russian-state hackers Midnight Blizzard (sometimes known as Nobelium). The concerning detail about this case is how easy it was to breach the software giant.

Passwords 135

Passwords Hacking Accountability Software 135

We Live Security

MARCH 25, 2024

Struggle to know how to help children and teens stay safe in cyberspace? A good ol’ fashioned chat is enough to put them on the right track.

Cybersecurity 132

Cybersecurity 132

Bleeping Computer

MARCH 25, 2024

The famous ChatGPT is down for thousands of users on March 25. [.

Technology 129

Technology Software 129

Advertisement

Cloud Development Environments (CDEs) are changing how software teams work by moving development to the cloud. Our Cloud Development Environment Adoption Report gathers insights from 223 developers and business leaders, uncovering key trends in CDE adoption. With 66% of large organizations already using CDEs, these platforms are quickly becoming essential to modern development practices.

Software

Malwarebytes

MARCH 25, 2024

In October 2023, The British Library was attacked by the Rhysida ransomware gang in a devastating cyberattack. The library, a vast repository of over 170 million items, is still deep in the recovery process, but recently released an eighteen page cyber incident review describing the attack, its impact, the aftermath, and the lessons learned. The report is full of useful information, and well worth a read, even if you’re responsible for security in a much smaller organisation.

Ransomware 126

Ransomware Backups Encryption Software 126

Bleeping Computer

MARCH 25, 2024

Since Saturday, U.S. food chain giant Panera Bread has been experiencing a nationwide outage that has impacted its IT systems, including online ordering, POS systems, phones, and various internal systems. [.

125

125

Penetration Testing

MARCH 25, 2024

A bombshell awaits the cybersecurity world at the upcoming t2 Infosec Conference. Security researchers Christer, Claes, and Marcus of signedness.org have uncovered a severe flaw (CVE-2024-29937) in Network File System (NFS) implementations used by... The post CVE-2024-29937: Critical NFS Vulnerability Exposes BSD Systems to Remote Code Execution appeared first on Penetration Testing.

Penetration Testing 124

Penetration Testing InfoSec Cybersecurity 124

Malwarebytes

MARCH 25, 2024

This week on the Lock and Code podcast… Few words apply as broadly to the public—yet mean as little—as “home network security.” For many, a “home network” is an amorphous thing. It exists somewhere between a router, a modem, an outlet, and whatever cable it is that plugs into the wall. But the idea of a “home network” doesn’t need to intimidate, and securing that home network could be simpler than many folks realize.

Network Security 122

Network Security Internet Internet Manufacturing 122

Advertisement

Tech leaders today are facing shrinking budgets and investment concerns. This whitepaper provides insights from over 1,000 tech leaders on how to stay secure and attract top cybersecurity talent, all while doing more with less. Download today to learn more!

Cybersecurity

Graham Cluley

MARCH 25, 2024

In October 2023, the British Library suffered "one of the worst cyber incidents in British history," as described by Ciaran Martin, ex-CEO of the National Cyber Security Centre (NCSC). What lessons can other organisations learn from the ransomware attack? Read more in my article on the Exponential-e blog.

Ransomware 117

Ransomware Data breaches Malware 117

Bleeping Computer

MARCH 25, 2024

The Top.gg Discord bot community with over 170,000 members has been impacted by a supply-chain attack aiming to infect developers with malware that steals sensitive information. [.

Malware 116

Malware 116

Security Boulevard

MARCH 25, 2024

Is your organization feeling stuck using Pivotal Cloud Foundry (PCF), now known as Tanzu Application Service (TAS or sometimes VMware Cloud Foundation)? You're not alone. Broadcom completed its acquisition of VMware in late 2023. To make the most of their acquisition, Broadcom is trying to squeeze money out of VMware — leading to skyrocketing costs for PCF (aka Tanzu) customers.

115

115

Penetration Testing

MARCH 25, 2024

A serious security vulnerability (CVE-2024-1538, CVSS 8.8) has been discovered in the File Manager plugin for WordPress. This plugin, with over 1 million active installations, allows website administrators to manage files and folders directly... The post CVE-2024-1538: Critical WordPress Plugin Flaw Exposes Over 1 Million Sites – Patch Immediately!

Penetration Testing 113

Penetration Testing 113

Advertisement

Explore how enterprises can enhance developer productivity and onboarding by adopting self-hosted Cloud Development Environments (CDEs). This whitepaper highlights the simplicity and flexibility of cloud-based development over traditional setups, demonstrating how large teams can leverage economies of scale to boost efficiency and developer satisfaction.

Security Boulevard

MARCH 25, 2024

Ransomware is not going away. So how can organizations defend against it? Dig deeper to learn how to build cybersecurity resiliency. The post Building Resiliency in the Face of Ransomware appeared first on SafeBreach. The post Building Resiliency in the Face of Ransomware appeared first on Security Boulevard.

Ransomware 113

Ransomware Cybersecurity 113

Bleeping Computer

MARCH 25, 2024

Academic researchers developed ZenHammer, the first variant of the Rowhammer DRAM attack that works on CPUs based on recent AMD Zen microarchitecture that map physical addresses on DDR4 and DDR5 memory chips. [.

113

113

Penetration Testing

MARCH 25, 2024

Security firm Resecurity has uncovered a disturbing development in the world of cybercrime. A new software package called GEOBOX takes the affordable, widely-used Raspberry Pi computer and transforms it into a sophisticated anonymization tool... The post Cybercriminals Turn Cheap Raspberry Pi into Powerful Fraud and Espionage Tool appeared first on Penetration Testing.

Penetration Testing 112

Penetration Testing Cybercrime Software 112

Graham Cluley

MARCH 25, 2024

Nemesis Market, a notorious corner of the darknet beloved by cybercriminals and drug dealers, has been suddenly shut down after German police seized control of its systems. Read more in my article on the Tripwire State of Security blog.

Marketing 111

Marketing Data breaches DDOS Phishing 111

Advertisement

IT leaders are experiencing rapid evolution in AI amid sustained investment uncertainty. As AI evolves, enhanced cybersecurity and hiring challenges grow. This whitepaper offers real strategies to manage risks and position your organization for success.

Cybersecurity