Category: Heimdal Security Blog

How to Complete an IT Risk Assessment (2023)

In a perfect world, you’d have the resources to defend yourself against every possible cybersecurity threat and vulnerability. The reality, however, is that even the largest organizations have limited resources to dedicate to cybersecurity. An effective security strategy, therefore, needs…

Unveiling the Dynamics of Cybersecurity- A Heimdal® Report

The purpose of Heimdal®’s exercise is to analyze the complex dynamics between endpoint-based attacks, code-based vulnerabilities, and cyberattacks that leverage DNS in an attempt to establish a baseline for detection and response framework. To this end, we have analyzed two…

New JaskaGO Malware Stealer Threatens Windows and MacOS Operating Systems

Security researchers discovered a new JaskaGO malware stealer that can infect both Windows and macOS. JaskaGO uses various methods to persist in the infected system. Researchers observed various malware versions impersonating installers for legitimate software like CapCut video editor, AnyConnect,…

LockBit Ransomware Targets German Energy Agency Dena

Dena, the reputed German Energy Agency, is said to have fallen victim to the notorious LockBit ransomware group. The Dena cyberattack was revealed through a post on the threat actor’s dark web platform, where they disclose data breach incidents and…

Toyota Data Breach Compromises Customer`s Financial Data

Toyota Financial Services (TFS) reveals that hackers stole their customers’ sensitive data in the last cyberattack. In November 2023, the Medusa threat group claimed the Toyota data breach and asked for a $8,000,000 ransom. The company did not seem to…

How to build a cyber incident response team (a 2024 playbook)

This post is authored by Heimdal’s Valentin Rusu – Machine Learning Research Engineer and overall cybersecurity guru here at Heimdal. As an incident response manager himself, Valentin regularly coordinates security responses for companies of all shapes and sizes – including…

Heimdal Collaborates with Microsoft to Match Evolving Market Needs

Heimdal in partnership with Microsoft is addressing the needs of our customers and managed service providers through an advanced Next-Gen Antivirus (NGAV) upgrade. By leveraging Microsoft Defender and enhancing it with Heimdal Extended Threat Protection (XTP), our customers are shielded…

Welltok Data Breach Affects Over 8.5 Million Patients

Welltok, a Healthcare SaaS provider, has issued a warning about a significant data breach that compromised the personal information of nearly 8.5 million patients in the U.S. This breach occurred due to a cyberattack on a file transfer program used…

Patch Management Guide

Patch management involves distributing and applying updates to various endpoints, which is crucial in fixing software vulnerabilities or unforeseen system interactions.  60% of cyber incidents leading to covert data theft link to absent, misconfigured, or incompletely implemented patches.  A concerning…

How to Create a Cybersecurity Incident Response Plan?

Organizations that want to avoid a security breach or attack naturally do everything in their power to avoid it from happening in the first place. The more proactive and preventative work you do, the higher your chance of avoiding an…

Vulnerability Prioritization: How to Beat Patching Paralysis

Key Takeaways: Vulnerability prioritization is about deciding what to patch, and in what order.  Many organizations use unsatisfactory methods when prioritizing patches. Learn how a holistic, risk-based approach to vulnerability prioritization can improve patch management.  Find out how automated vulnerability…

Researchers Warn NetSupport RAT Attacks Are on the Rise

Researchers warn of an increase in NetSupport RAT (Remote Access Trojan) infections impacting education, government, and business services sectors. NetSupport Manager is a remote control and desktop management tool by NetSupport Ltd. Its initial role was to aid IT professionals…

Assigning User Privileges in Heimdal [It’s Easy]

Managing user privileges is a critical task for any organization. This article aims to guide you through the process of assigning user privileges in Heimdal, ensuring a secure and efficient management of your cybersecurity infrastructure.  Key Takeaway Summary  Understanding User…

How to Implement an Effective Mac Patch Management Strategy

An effective Mac patch management strategy involves following a series of well-planned steps and best practices. Patch management strategies are not just about bug fixes, closing vulnerabilities, and improving system performance. Meeting compliance requirements is also on the goals list. …

Heimdal Launches Unique AI Feature to Detect Email Fraud

Heimdal has launched “Outliers Detection”, an AI-powered feature that upgrades its Email Fraud Protection platform. This tool uses AI to proactively spot and stop email threats early, keeping businesses safe. Our method is both innovative one-of-a-kind. We use anomaly detection…

Truepill Sued Over Data Breach Exposing 2.3 Million Customers

Truepill data breach exposed sensitive information belonging to 2,364,359 people and risks multiple lawsuits. The B2B-focused pharmacy platform discovered the incident on August 31, 2023. They promptly launched an investigation and took additional security measures to contain the incident. However,…

Samsung UK Online Store Suffers Data Breach

Samsung Electronics has informed its customers about a data breach impacting those who shopped at the Samsung UK online store from July 1, 2019, to June 30, 2020. This breach resulted in unauthorized access to personal information. Breach Traced to…

FBI and CISA Issue Advisory on Rhysida Ransomware

Today, the FBI and the Cybersecurity and Infrastructure Security Agency (CISA) have jointly issued a warning about the Rhysida ransomware group. This gang has been attacking various organizations in different sectors since May 2023. A detailed Cybersecurity Advisory (CSA) has…

The Most Common Healthcare Cyberattacks

In the wrong hands, medical data can be used for a variety of crimes, such as patient identity theft, clinician identity theft, extortion, tax fraud, insurance fraud, and more. Geopolitical agendas further complicate the threat landscape, as cyberattacks such as…

Daixin Threat Group Claims Ransomware Attack on 5 Hospitals in Ontario

Daixin Team claimed responsibility for the ransomware attack that impacted 5 hospitals in Ontario, Canada, on October 23rd. TransForm, the shared service provider of the five healthcare organizations, confirmed the ransomware attack. The stolen database contains information on 5.6 million…

How To Break The Metrics Mirage in Vulnerability Management

Meet Jeff. He’s the CISO of a mid-sized financial services company – and it’s his job to keep the organization safe from security attacks. Every week, he checks the graphs and dashboards in his SIEM (security information and event management)…

Privilege Overreach, the Lurking PAM Security Threat

Managing privileged access to internal resources is a challenge for organizations worldwide. If left unaddressed, it could lead to data breaches, downtime, and financial loss. Statistics show that 80% of data breaches seem to be caused by misuse of privileged…

Silent Safeguards – The Essence of ISO 27001 Controls

ISO 27001, sometimes referred to as ISO/IEC 27001 is an international standard that addresses organizational information security. Issued in 2005 and with a second revision in 2013, the ISO 27001 standard describes the Information Security Management Systems requirements for global…

Toronto Public Library Under Cyberattack

Canada’s largest public library system reported a cyberattack that took down its website, member services pages, and limited access to its digital collections. The Toronto Public Library provides more than 12 million items across 100 branches to more than 1.2…

Separation of Privilege (SoP) 101: Definition and Best Practices

Separation of privilege is splitting up tasks and assigning rights to different parts of a system. It means that user privileges are segmented between various users and accounts, but you can also apply it to applications, system sub-components, tasks, and processes.…

European Governments Email Servers Targeted by Threat Actors

Since at least October 11, the Russian hacker organization Winter Vivern has been using a Roundcube Webmail zero-day vulnerability in attacks against think tanks and government agencies in Europe. According to security researchers, the cyberespionage group (also identified as TA473)…

12 Best Vulnerability Management Systems & Tools 2023

Industry reports highlight the urgency: malicious actors can exploit a vulnerability within just 15 days of its discovery (CISA). The longer you wait, the larger the target on your back grows. Without proper vulnerability management, your business not only risks…

Cybercriminals Target Senior U.S. Executives Using EvilProxy Phishing Kit

Threat actors use EvilProxy phishing-as-a-service (PhaaS) toolkit to target senior executives in the U.S. in massive phishing campaigns. EvilProxy is an adversary-in-the-middle (AiTM) PhaaS designed to steal credentials and take over accounts. It mainly targets companies in the banking, financial…

University of Michigan Faces Data Breach Impacting Many of its Affiliates

The University of Michigan recently announced a data breach that took place in August. Cyber attackers broke into the university’s network, gaining unauthorized access to systems containing data of students, applicants, alumni, donors, employees, patients, and research study participants. This…

Cybersecurity And The Patching Paralysis Problem

Summary: With dozens of apps, systems and devices to keep up to date, many IT departments suffer from ‘patching paralysis’. Find out why patching paralysis happens, and how you can overcome it.  Key takeaways: Patching paralysis is very common It…

Best Patch Management Software & Tools 2023

Choosing the best patch management tool boils down to what your organization needs. Consider how complex your IT setup is and how much you’re willing to spend. For instance, large companies with diverse operating systems and applications will need a…

What Is Phishing-as-a-Service (PhaaS) and How to Protect Against It

Phishing-as-a-service, or PhaaS, platforms have evolved from the classic phishing attacks as a business model. Less experienced hackers embraced the opportunity of leading several phishing campaigns without necessarily owning the technical abilities for it. In this article, we will define Phishing-as-a-Service,…

12 Best Windows Server Patch Management Software & Tools 2023

Considering the inherent complexity of the IT infrastructure, Windows servers stand as critical pillars for many enterprises. Their seamless function is vital, yet they’re susceptible to vulnerabilities. Robust patch management not only mitigates these risks but also ensures optimal performance,…

Employee Clicking on Phishing Link Leads to D-Link Data Breach

D-Link leading global networking equipment company admitted suffering a data breach. Threat actors gained access to the company`s system after an employee clicked on a phishing link. The company discovered the data breach after the threat actors posted about it…

Women Political Leaders Summit Targeted with Backdoor Malware

The Women Political Leaders (WPL) Summit in Brussels, dedicated to the topics of gender equality and female leadership, became the target of a cyber-espionage campaign orchestrated by ‘Void Rabisu’. This group developed a replica of the official WPL site, leading…

XDR vs. EDR vs. NDR: A Comparison

Threat Detection and Response (D&R) Solutions are an important part of the cybersecurity strategy, especially in the face of escalating cyber attacks. These security tools have seen significant evolution, adapting to more sophisticated threats over time. Extended Detection & Response…

Fairfax Healthcare Company Announces Data Breach

Fairfax healthcare organization from the United States has disclosed a data breach that could have compromised the medical records of approximately 250,000 patients. The Virginia-based supplier of facial and dental services announced the conclusion of an investigation, which revealed that…

FBI, CISA: Beware of AvosLocker Ransomware Attacks

In a new joint cybersecurity advisory, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) have released information on the AvosLocker ransomware gang, that has been linked to attacks against critical infrastructure sectors in…

Balada Injector Malware Hits More Than 17,000 WordPress Sites

A new Balada Injector campaign used known WordPress plugin and theme vulnerabilities to hack over 17,000 websites during September 2023. Threat actors exploited the CVE-2023-3169 cross-site scripting (XSS) vulnerability in tagDiv Composer. Composer is a tool for the tagDiv’s Newspaper…

XDR vs EDR – A Comparison

Cybersecurity purchasers and providers must adopt a new way of thinking in response to the more sophisticated cyber threats that keep emerging. The necessity for more thorough and integrated approaches to cyber security is highlighted by the fact that traditional…

What Is Email Spoofing and How to Stay Protected

Email spoofing is a type of cyberattack in which a threat actor sends emails with a fake sender address. In email spoofing, attackers can make it seem like an email is sent by a familiar person such as a colleague,…

NDR vs EDR: A Comparison Between the Two Cybersecurity Solutions

NDR (Network Detection and Response) and EDR (Endpoint Detection and Response) are two approaches to cyber security that are similar but distinct and that address several common problems. NDR and EDR use machine learning and artificial intelligence to defend against…

What Is Privilege Management?

As defined by Jericho Systems, privilege management also referred to as Privileged Account Management (PAM) is “the practice of controlling and administering digital user identities and the rights of those identities to perform actions on specified resources.” For cybercriminals, privileged…

Flagstar Bank Breached for the Third Time in Two Years

Flagstar Bank announced a data breach that affected over 800,000 US customers. The breach, involving a third-party service provider, led to the leak of users’ personal information. Flagstar is a financial services provider with total assets of over $31 billion. New…

PoC Exploits Released for Major Linux Flaw

On the majority of Linux distributions, proof-of-concept attacks for a high-severity vulnerability in the dynamic loader of the GNU C Library have previously been made public online. Details About the Vulnerability The security vulnerability is known as “Looney Tunables” and…

Lyca Mobile Affected by Cyberattack

Lyca Mobile has released a statement about an unexpected disruption on its network caused by a cyberattack that may have also compromised customer data. The British company provides voice IP (VoIP) and mobile telecommunications services in 60 nations, including the…

Windows Patch Management: How It Works and Why It Helps

Windows patching is essential for closing system and application vulnerabilities and certifying that everything works as it should. Read on to find out more about the Microsoft Windows patch management process, how can you implement a proper Windows vulnerability management strategy and…

Drive-by Download Attack – What It Is and How It Works

In today’s digital age, cybersecurity is more important than ever before. Unfortunately, cybercriminals are constantly finding new ways to infiltrate networks and steal data. One of the most insidious methods they use is known as a drive-by download attack. This…

Researchers Found New Rogue npm Package Deploying Open-Source R77 Rootkit

Researchers discovered that a new rogue npm package installed the r77 open-source rootkit. This was the first time that a rogue package was observed delivering rootkit functionality. The “node-hide-console-windows” package forged the legitimate “node-hide-console-window” one. The forgery was first discovered…

ShellTorch Vulnerabilities Expose PyTorch Models to Remote Code Execution

ShellTorch vulnerabilities chain exposes tens of thousands of servers to remote code execution and data exfiltration. Researchers revealed that the TorchServe flaws (including CVE-2023-43654, CVSS: 9.8) can expose sensitive data, compromise AI models, and run a full server takeover. TorchServe…

Top 10 Reasons Mid-sized Businesses Need Zero Trust Security

The focus in this article will be on the challenges faced by midsize companies, defined here as organizations with 100-1000 employees, and how adopting a Zero Trust approach might help solve those problems. Why medium-sized businesses? Because mid-sized businesses are…

Industrial Control System (ICS): Definition, Types, Security

An industrial control system (or ICS) is a type of computer system that monitors and controls industrial processes and infrastructure. ICSs are used in a variety of industries, including oil and gas, chemical, water and wastewater, energy, food and beverage,…

Johnson Controls Faces Ransomware Attack, Risking DHS Security Data

Johnson Controls, a major provider of building automation solutions, has fallen victim to a ransomware attack by the Dark Angels ransomware gang, potentially compromising sensitive information related to the U.S. Department of Homeland Security (DHS). What Happened? Johnson Controls underwent…

New Malware-as-a-Service Gains Traction Among Cybercriminals

Security experts have discovered BunnyLoader, a malware-as-a-service (MaaS) that is rapidly evolving and gaining popularity on different hacker platforms due to its ability to covertly infiltrate systems and manipulate their data, focusing in particular on system clipboards. Unveiled on September…

Linux Patch Management: Benefits and Best Practices

Compared to Windows, Linux it’s different in areas such as features, flexibility, operationality, and ease of use. Naturally, we can assume that there must exist differences between the two operating systems regarding patching. Today, we will take a deep dive…

9 Best Carbon Black Alternatives & Competitors in 2023

A quick search on the Internet retrieved a pack of VMware Carbon Black alternatives for endpoint protection services. I analyzed features, pros, cons and pricing and then I drew conclusions. So, here`s a list of 9 Best Carbon Black Alternatives…

12 Benefits of Zero Trust for Mid-Sized Businesses

Zero Trust security is evolving from “nice to have” to an absolute must for organizations everywhere. Fortunately, Zero Trust offers numerous advantages to companies of all sizes, including medium-sized ones. While achieving full Zero Trust is a long-term goal, even…

Why Organizations Struggle With Vulnerability Management?

Where Do Organizations Struggle With Vulnerability Management? With over 60% of companies having been the victims of cyberattacks in the last year, you can see that companies seem to be struggling with the way in which they manage vulnerabilities. Vulnerability…

Phobos Ransomware: Everything You Need to Know and More

In the ever-evolving landscape of cyber threats, ransomware remains a pervasive and destructive weapon in the arsenal of cybercriminals. Among the various ransomware strains, Phobos has gained notoriety for its sophisticated capabilities and devastating consequences. This article delves into Phobos…

Apple Fixes 3 New Actively Exploited Zero-Day Vulnerabilities

Apple released an emergency security update to patch three newly identified zero-days exploited actively by threat actors. The vulnerabilities affected iPhone and Mac users, and with this, the total zero-days fixed by Apple this year rose to 16. What Do…

Improper Usage of SAS Token Leads to Massive Microsoft Data Leakage

Microsoft researchers leaked 38TB of sensitive data to a public GitHub repository while training open-source AI learning models. The Microsoft data leakage occurred starting July 2020 and white hat hackers only discovered and reported it on June 22nd, 2023. Consequently,…

Cryptocurrency Scams to Heavily Target TikTok Users

Cybercriminals heavily target TikTok users with cryptocurrency giveaway scams. The vast majority of the posts impersonate Elon Musk and relate to Tesla or SpaceX. These types of posts have been on other social media platforms – Instagram and Twitter –…