IT Security News Daily Summary 2024-05-02

• Tips and stories for your team on World Password Day

• Florida man gets 6 years behind bars for flogging fake Cisco kit to US military

• Pro-Russia hackers target critical infrastructure in North America and Europe

• Dropbox Sign customer data accessed in breach

• Patch up – 4 critical bugs in ArubaOS lead to remote code execution

• 4 IoT Trends U.K. Businesses Should Watch in 2024

• Elliptic Shows How an AI Model Can Identify Bitcoin Laundering

• What to Expect at RSA 2024: Will AI Wreak Havoc on Cybersecurity?

• Join Us 05-17-24 for the Capture the CISO Finals

• LayerX Security Raises $26M for its Browser Security Platform, Enabling Employees to Work Securely from Any Browser, Anywhere

• Cisco at NAB2024: Takeaways

• What are passkeys? Experience the life-changing magic of going passwordless

• Top Tech Conferences & Events to Add to Your Calendar in 2024

• 2024 State of Cybersecurity: Reports of More Threats & Prioritization Issues

• HPE Aruba Networking addressed four critical ArubaOS RCE flaws

• Scans Probing for LB-Link and Vinga WR-AC1200 routers CVE-2023-24796, (Thu, May 2nd)

• Tesla Backs Away From Gigacasting Manufacturing – Report

• What can we learn from the passwords used in brute-force attacks?

• What is a potentially unwanted program (PUP)?

• What is role-based access control (RBAC)?

• What is security information and event management (SIEM)?

• EU plan to force messaging apps to scan for CSAM risks millions of false positives, experts warn

• CISA and FBI Release Secure by Design Alert to Urge Manufacturers to Eliminate Directory Traversal Vulnerabilities

• US Urges No AI Control Of Nuclear Weapons

• LayerX Security Raises $24M for Browser Security: Empowering Secure Remote Work

• LayerX Security Raises $26M for its Browser Security Platform, Enabling Employees to Work Securely From Any Browser, Anywhere

• Two years in, Google says passkeys now protect more than 400 million accounts

• Ransomware Defense Startup Mimic Raises Hefty $27M Seed Round

• USENIX Security ’23 – “My Privacy for their Security”: Employees’ Privacy Perspectives and Expectations when using Enterprise Security Software

• Dropbox Hacked: eSignature Service Breached

• North Korean Scammers Lure Developers with Fake Job Offers

• Okta Alert: The Rise of Credential Stuffing Attacks Through Proxy Networks

• Dropbox Sign witnesses data breach

• Microsoft Announces Big Investments In Malaysia, Indonesia, Thailand

• Flatiron Software unveils Snapshot Reviews, an AI tool for analyzing developer code and performance

• Anthropic’s Claude Teams and iOS App: The secure, scalable solution for enterprise AI adoption

• Dropbox discloses data breach involving Dropbox Sign

• Under the Digital Radar: Defending Against People’s Republic of China’s Nation-State Cyber Threats to America’s Small Businesses

• The Breach of a Face Recognition Firm Reveals a Hidden Danger of Biometrics

• Delta Electronics DIAEnergie

• Google expands passkey support to its Advanced Protection Program ahead of the US presidential election

• Watch out for tech support scams lurking in sponsored search results

• Startup Dealflow: New Investments at Resonance, RunReveal, StepSecurity, Insane Cyber

• AI Security Startup Apex Emerges From Stealth With Funding From OpenAI CEO

• Building the Right Vendor Ecosystem – a Guide to Making the Most of RSA Conference

• Popular Android Apps Like Xiaomi, WPS Office Vulnerable to File Overwrite Flaw

• Android Flaw Affected Apps With 4 Billion Installs

• Wordfence Intelligence Weekly WordPress Vulnerability Report (April 22, 2024 to April 28, 2024)

• LastPass Separates From Parent After Security Incidents

• Cuttlefish 0-click Malware Hijacks Routers & Captures Data

• GoldDigger Malware Using Deep Fake AI Photos To Hijack Bank Accounts

• LayerX Security Raises $24M for its Browser Security Platform, Enabling Employees to Work Securely From Any Browser, Anywhere

• Operational Innovations for AI and Cloud-Native Workloads from Cisco and Red Hat

• Threat actors hacked the Dropbox Sign production environment

• Finnish Psychotherapy Center Cyber-Blackmailer Gets Six Years

• Safeguarding Reproductive Health Workers: Addressing Risks Posed by Data Brokers and Doxxing

• VNC Is The Hacker’s New Remote Desktop Tool For Cyber Attacks

• ArubaOS Critical Vulnerability Let Attackers Execute Remote Code

• CyberPower PowerPanel

• Federal frenzy to patch gaping GitLab account takeover hole

• Japan’s Kishida Unveils a Framework for Global Regulation of Generative AI

• Verizon DBIR 2024 Shows Surge in Vulnerability Exploitation, Confirmed Data Breaches

• Network Security Firm Corelight Raises $150 Million

• Key Areas Where Open-Source Security Needs to Evolve

• GM Car Buyers’ Nightmare: The Unveiling of a Program Raising Insurance Rates

• Is ChatGPT Secure? Risks, Data Safety, and Chatbot Privacy Explained

• Hackers Target New NATO Member Sweden with Surge of DDoS Attacks

• LayerX Security Raises $24M for Innovative Browser Security Platform

• 5 Best Password Managers Built for Teams in 2024 (Free & Paid)

• Red Team vs Blue Team vs Purple Team: Differences Explained

• Here’s Your Chance To Own A Decommissioned US Government Supercomputer

• REvil Ransomware Scum Gets 14 Years, $16 Million Fine

• Hacker Free-For-All Fights For Control Of Home And Office Routers Everywhere

• Hackers Compromised Dropbox eSignature Service

• 1,400 GitLab Servers Impacted By Exploited Vulnerability

• Psychotherapy practice hacker gets jail time after extorting patients, publishing personal therapy notes online

• News alert: LayerX Security raises $24M Series A funding for its ‘enterprise browser’ security platform

• Hackers Claiming Breach of UAE Government Servers

• Drop My VPN – Are You Nuts?

• Today’s Security Requires Specialized Processors

• New Goldoon Botnet Targeting D-Link Devices Using Decade-Old Flaw

• 1Password Extended Access Management secures unmanaged applications and devices

• Hyperbole, Misinformation, and CyberMonsters Under the Bed

• Ying Ying Yang finds a new life and career in Australia as a Cisco Networking Academy Instructor

• The Student-Centric Experience: Leadership

• CISA Adds GitLab Flaw to its Known Exploited Vulnerabilities Catalog

• LayerX Security Raises $24M for its Browser Security Platform, Enabling Employees to Work Securely from Any Browser, Anywhere

• Ukrainian REvil Hacker Sentenced to 13 Years and Ordered to Pay $16 Million

• Russian Hackers Target Industrial Systems in North America, Europe

• 1,400 GitLab Servers Impacted by Exploited Vulnerability

• CISA adds GitLab flaw to its Known Exploited Vulnerabilities catalog

• Prisma SASE 3.0 — Securing Work Where It Happens

• HPE Aruba Networking Fixes Four Critical RCE Flaws in ArubaOS

• The Surveillance Invasion: IoT and Smart Devices Stealing Corporate Secrets

• New SOHO router malware aims for cloud accounts, internal company resources

• Security Breach Exposes Dropbox Sign Users

• Three-Quarters of CISOs Admit App Security Incidents

• Deepfakes and AI-Driven Disinformation Threaten Polls

• The UK Bans Default Passwords

• World Password Day 2024: Try Passkeys!

• Vulnerability Exploits Triple as Initial Access Point for Breaches

• Trend Micro expands AI-powered cybersecurity platform

• Russian Hackers Actively Attacking Small-scale Infrastructure Sectors

• Digital fraud detection startup BioCatch hits $1.3B valuation as Permira buys majority stake

• World Password Day 2024: What are the experts saying?

• Proofpoint DLP Transform secures data moving to ChatGPT, copilots, and other GenAI tools

• Secure Code Warrior SCW Trust Score quantifies the security posture of developer teams

• HITRUST updates Cyber Threat Adaptive engine to address emerging cyber threats

• Cyber Security Headlines: Chinese disinformation, NCSC AMS, new State Secrets law

• Scaling Least Privilege for the Cloud

• US To Ban Huawei, ZTE From Certifying Wireless Kit

• SafeBase Raises $33M in Series B to Accelerate Vision for Friction-Free Security Reviews

• Confluent enhances Apache Flink with new features for easier AI and broader stream processing

• Appdome launches MobileEDR, merging MTD and EDR to protect enterprise mobile apps

• New “Goldoon” Botnet Targets D-Link Routers With Decade-Old Flaw

• Dropbox Discloses Breach of Digital Signature Service Affecting All Users

• When is One Vulnerability Scanner Not Enough?

• Cyber Startup Oasis Secures $35 Million Series A Extension, Doubles Valuation

• AI is Creating a New Generation of Cyberattacks

• CalypsoAI introduces customizable generative AI security scanners for enterprises

• Nord Security unveils NordStellar, a platform for advanced cyber threat detection and response

• REvil Ransomware Affiliate Sentenced to Over 13 Years in Prison

• Cybersecurity: The Battle of Wits

• Tripwire Patch Priority Index for April 2024

• US Warns of Russian Hackers Targeting Operational Technology in Water Systems

• Veracode platform enhancements help organizations reduce application risk

• Illumio and Wiz’s integration enhances cyber resilience in the cloud

• Anthropic Launches Enterprise-Focused Claude, Plus iPhone App

• Threat Actors Attacking MS-SQL Servers to Deploy Ransomware

• Understanding Microsoft’s Trusted Signing service

• IAM and Passkeys: 4 Steps Towards a Passwordless Future

• Venafi launches 90-Day TLS Readiness Solution

• Deep Instinct DIANNA provides malware analysis for unknown threats

• Skyhawk Security unveils cloud-native CTEM, streamlining security with AI-powered automation

• Dropbox says attackers accessed customer and MFA info, API keys

• Iranian Hackers Impersonate Journalists in Social Engineering Campaign

• Corelight Gets $150M to Expand Detection, Improve Workflows

• Dropbox Data Breach Impacts Customer Information

• Lineaje OSM improves software supply chain security

• Snyk AppRisk Pro leverages AI and third-party integrations for faster risk mitigation

• US and UK Warn of Disruptive Russian OT Attacks

• Panda Restaurant Group disclosed a data breach

• Virsec releases security tools to offer ransomware protection

• Bitwarden Authenticator protects online services and applications

• Think tank: China’s tech giants refine and define Beijing’s propaganda push

• Virsec releases security tools to provide ransomware protection

• USB Malware Attacks Targeting Industrial Systems Adapts LOL Tactics

• REvil Ransomware Affiliate Sentenced for 13 Years in Prison

• REvil ransomware scum sentenced to almost 14 years inside, ordered to pay $16 million

• Think tank: China’s tech brands refine and define Beijing’s propaganda push

• CISA Warns of Active Exploitation of Severe GitLab Password Reset Vulnerability

• Inside Ukraine’s Killer-Drone Startup Industry

• United Health CEO testifies before senate for ransomware attack

• Attention all Windows Users! The Microsoft April Security Update Could Break Your VPN

• 2024 Data Breach Investigations Report: Most breaches involve a non-malicious human element

• User Privacy Threats Around T-Mobile’s ‘Profiling and Automated Decisions’

• Securing your organization’s supply chain: Reducing the risks of third parties

• New Cuttlefish Malware Hijacks Router Connections, Sniffs for Cloud Credentials

• Bitwarden launches standalone Bitwarden Authenticator app

• Post DBIR 2024: 7 Ways to Reduce Your Cyber Risk

• reNgine: Open-source automated reconnaissance framework for web applications

• Understanding emerging AI and data privacy regulations

• Women rising in cybersecurity roles, but roadblocks remain

• A million Australian pubgoers wake up to find personal info listed on leak site

• AI-driven phishing attacks deceive even the most aware users

• Panda Restaurant Corporate Systems Hacked: Customer Data Exposed

• ISC Stormcast For Thursday, May 2nd, 2024 https://isc.sans.edu/podcastdetail/8964, (Thu, May 2nd)

• Deepfake of Principal’s Voice Is the Latest Case of AI Being Used for Harm

• Change Healthcare Cyberattack Was Due to a Lack of Multifactor Authentication, UnitedHealth CEO says

• Security in the AI Sector: Understanding Infostealer Exposures and Corporate Risks

• Dropbox dropped the ball on security, haemorrhaging customer and third-party info

• Block accused of mass compliance failures that saw digi-dollars reach terrorists

• 4 Easy Ways to Find Free Wi-Fi Anywhere You Go

• Reading the Mandiant M-Trends 2024

• U.S. warns of pro-Russian hacktivist attacks against OT systems

• Lawsuit Claims Facebook Is Required To Give You More Control Of Your Own Feed

• How Cybersecurity Training Lowers Insurance Premiums

• Red Hat’s latest enterprise Linux distro has new features to tackle hybrid cloud complexity

• UnitedHealthcare CEO says ‘maybe a third’ of US citizens were affected by recent hack

• AI’s Offensive & Defensive Impacts

• IT Security News Daily Summary 2024-05-01

• United HealthCare CEO says ‘maybe a third’ of US citizens were affected by recent hack

• Red Hat’s latest enterprise Linux delivers new features to tackle hybrid-cloud complexity

• remote access

• United HealthCare CEO says ‘maybe a third’ of U.S. citizens were affected by recent hack

• 4 Takeaways from Hannover Messe 2024

• Ex-NSA employee sentenced to 262 months in prison for attempting to transfer classified documents to Russia

• Lawsuits After Ransomware on the Rise, Comparitech Says

• TikTok Viewed As Chinese Influence Tool By Most Americans – Poll

• Infosec biz boss accused of BS’ing the world about his career, anti-crime product, customers

• Cuttlefish malware targets enterprise-grade SOHO routers

• Ex-NSA employee sentenced to 262 months for attempting to transfer classified documents to Russia

• Speaking Freely: Rebecca MacKinnon

• Traceable AI Raises $30 Million to Safeguard Cloud APIs

• Oasis Security Raises $35 Million to Tackle Non-Human Identity Management

• Product Release: PreVeil 5.0

• Ofcom Confirms OnlyFans Investigation Over Age Verification

• Which Programming Language to Choose for AI?

• Muddling Meerkat Group Suspected of Espionage via Great Firewall of China

• Quantum Technology: Implications for Digital Security

• Ex Google Staff Fired Over Israel Protest File NLRB Complaint

• US charges 16 over ‘depraved’ grandparent scams

• The US Government Is Asking Big Tech to Promise Better Cybersecurity

• CISA and Partners Release Fact Sheet on Defending OT Operations Against Ongoing Pro-Russia Hacktivist Activity

• A flaw in the R programming language could allow code execution

• What’s hot at RSAC 2024: 8 SSCS talks you don’t want to miss

• Fraudulent npm Packages Deceive Software Developers into Malware Installation

• Vulnerabilities in employee management system could lead to remote code execution, login credential theft

• Cyber-attacks in the APAC region driven by espionage motives

• Cybersecurity Startup Resonance Secures Funding To Meet Its Ambitious Growth Targets

• Tesla Axes Entire Supercharger Team, Plus Senior Executives

• CISA Adds One Known Exploited Vulnerability to Catalog

• Island Raises $175 Million at $3 Billion Valuation

• Zero-Day Nightmare: Palo Alto, Cisco, and MITRE Under Attack

• LockBit, Black Basta, Play Dominate Ransomware in Q1 2024

• Spoofing Shein for Credential Harvesting

• UnitedHealth CEO tells Senate all systems now have multi-factor authentication after hack

• Beyond visibility, there’s observability

• China’s Attacks On Critical Infrastructure Tip Of Iceberg

• London Drugs Pharmacy Closes All Stores To Respond To Cyber Incident

• Google Boosts Bug Bounty Payouts Tenfold In Mobile App Security Push

• Adobe Adds Content Credentials And Firefly To Bug Bounty Program

• Qantas App Glitch Sees Boarding Passes Fly To Other Accounts

• New “Goldoon” Botnet Targeting D-Link Devices

• New Cuttlefish Malware Infects Routers to Monitor Traffic for Credential Theft

• Cuttlefish Malware Targets Routers, Harvests Cloud Authentication Data

• Adobe Adds Content Credentials and Firefly to Bug Bounty Program

• Google Boosts Bug Bounty Payouts Tenfold in Mobile App Security Push

• Redefining Education: The AI Revolution in Classrooms Everywhere

• Dutch Threat Experts Issues Warning to Companies Regarding Ransomware Attack

• UnitedHealth CEO Confirms Breach Tied to Stolen Credentials, No MFA

• Qantas app glitch sees boarding passes fly to other accounts

• CISA Unveils Guidelines for AI and Critical Infrastructure

• Venafi Launches 90-Day TLS Certificate Renewal Initiative

• Bitcoin Forensic Analysis Uncovers Money Laundering Clusters and Criminal Proceeds

• Thinking about a Career in Software Security? Follow This Path

• Microsoft, OpenAI Sued By More Newspaper Publishers

• Learn Cybersecurity Skills From Scratch for Just $40

• New Wpeeper Android Malware Hides Behind Hacked WordPress Sites

• DeepKeep Launches AI-Native Security Platform With $10 Million in Seed Funding

• Machine Identity Firm Venafi Readies for the 90-day Certificate Lifecycle

• Belgium’s Aikido lands $17M Series A for its ‘no BS’ security platform aimed at developers

• A closer look at Apiiro’s SHINE partner program

• Android Malware Wpeeper Uses Compromised WordPress Sites to Hide C2 Servers

• Capture the CISO S2E3: BugProve, Egress, and Zenity

• Identity Verification Payments Challenges in the Age of AI

• Adobe Adds Firefly and AI Watermarking to Bug Bounty Program

• A Vast New Data Set Could Supercharge the AI Hunt for Crypto Money Laundering

• How SaaS-Based Identity Governance Can Help Future-Proof Your Security

• Ransomware Strikes St-Jerome Company: Everest Group Suspected

• HackerOne Survey Reveals Organizations Feel Equipped to Fight AI Threats Despite Security Incidents

• Unpacking the New DHS Guidelines for Securing Critical Infrastructure from AI-related Threats

• Extending SASE Protection Into the Browser

• A Vast New Dataset Could Supercharge the AI Hunt for Crypto Money Laundering

• 1 in 5 US Ransomware Attacks Triggers Lawsuit

• Organizations Need Fully Autonomous Security Powered by Gen-AI

• Wpeeper Android Trojan Uses Compromised WordPress Sites to Shield Command-and-Control Server

• CISO Conversations: Talking Cybersecurity With LinkedIn’s Geoff Belknap and Meta’s Guy Rosen

• Lawsuits and Company Devaluations Await For Breached Firms

• Binance’s Changpeng Zhao Sentenced To Four Months In Prison

• Are VPNs Legal To Use?

• AI Voice Scam

• Intel 471 Acquires Cyborg Security to Expand Its Cyber Threat Intelligence Portfolio with Innovative Threat Hunting Capabilities

• Data Breaches in April 2024 – Infographic

• Protecting Users Against Bugs: Software Providers’ Scalable Attempts

• ZLoader Malware Evolves with Anti-Analysis Trick from Zeus Banking Trojan

• Everyone’s an Expert: How to Empower Your Employees for Cybersecurity Success

• TechRepublic Premium Editorial Calendar: Policies, Checklists, Hiring Kits and Glossaries for Download

• DBIR: Vulnerability Exploits Triple as Initial Access Point for Data Breaches

• Cyber Security Headlines: UnitedHealth Group CEO faces congress, U.S. wireless carriers face majors fine, Marriott backtracks protection claims

• ISC Stormcast For Wednesday, May 1st, 2024 https://isc.sans.edu/podcastdetail/8962, (Wed, May 1st)

• Judge0 Vulnerabilities Could Allow Sandbox Escape

• Wireless carriers fined $200 million after illegally sharing customer location data

• Infosecurity Europe Keynote: Building Strong Teams and Driving Change with F1’s Claire Williams

• Programming Language R Patches Code Execution Security Flaw

• Cyber Security Today, May 1, 2024 – Data may have been stolen in London Drugs cyber attack, Congressional testimony today by UnitedHealth CEO on ransomware attack, and more

• Router Roulette: Cybercriminals and Nation-States Sharing Compromised Networks

• Google Guide! How to Detect Browser Data Theft Using Windows Event Logs

• Muddling Meerkat, a mysterious DNS Operation involving China’s Great Firewall

• NCSC’s New Mobile Risk Model Aimed at “High-Threat” Firms

• Patched Deserialization Flaw in Siemens Product Allows RCE

• US Government Releases New Resources Against AI Threats

• Millions of Malicious “Imageless” Docker Hub Repositories Drop Malware

• New Latrodectus Malware Attacks Use Microsoft, Cloudflare Themes

• Belarus Secret Service Website Still Down After Hackers Claim the Breach

• Ex-NSA Employee Sentenced to 22 Years for Trying to Sell U.S. Secrets to Russia

• RSAC 2024 Innovation Sandbox | VulnCheck: A Solution to the Challenge of Vulnerability Prioritization

• Google blocks millions of apps from Playstore for Mobile Security

• Crafting an Airtight Security Posture Against Ransomware Threats

• Attackers Leverage Sidecar Container Injection Technique To Stay Stealthy

• How space exploration benefits life on Earth: Q&A with David Eicher

• Why cloud vulnerabilities need CVEs

• Making cybersecurity more appealing to women, closing the skills gap

• How to Utilize Azure Logs to Identify Threats: Insights From Microsoft

• Verizon DBIR: Vulnerability exploitation in breaches up 180%

• Building a strong cloud security posture

• Cybersecurity jobs available right now: May 1, 2024

• UnitedHealth CEO Says Hackers Lurked in Network for Nine Days Before Ransomware Strike

• Essential steps for zero-trust strategy implementation

• Linux Trojan – Xorddos with Filename eyshcjdmzg, (Mon, Apr 29th)

• Open source programming language R patches gnarly arbitrary code exec flaw

• Infosec products of the month: April 2024

• Navigating the Future: Insights From the M&A Symposium at Kaseya Connect Global

• Open source programming language R patches critical arbitrary code exec flaw

• PGP Encryption: The Email Security Standard

Generated on 2024-05-02 23:55:14.113081