IT Security News Daily Summary 2024-05-03

• Breaking down Microsoft’s pivot to placing cybersecurity as a top priority

• You get a passkey, you get a passkey, everyone should get a passkey

• Healthcare Needs To Be Laser-Focused on API Security and Its Blind Spots

• Dangerous Militia Groups Are Organizing On Facebook Nationwide

• CCTV Cambridge, Addressing Digital Equity in Massachusetts

• Russia-linked APT28 and crooks are still using the Moobot botnet

• AMSI Write Raid 0day Vulnerability

• CEO Discusses MDR Service With a Risk-Based Approach

• The impact of automating open source dependency management

• Palo Alto Networks Extends SASE Reach to Unmanaged Devices

• Code faster with generative AI, but beware the risks when you do

• UnitedHealth data breach should be a wake-up call for the UK and NHS

• My TED Talks

• Proactive, Responsible Disclosure Is One Crucial Way Fortinet Strengthens Customer Security

• “Dirty Stream” Attack Affects Popular Android Apps

• Microsoft Overhauls Cybersecurity Strategy After Scathing CSRB Report

• Hackers Claim Biggest Attack On UAE in History

• Cyber Criminal Sentenced for Targeting Therapy Patients

• Industrial Cyberattackers Reverting to USB Tactics, Says Honeywell Report

• It may take decade to shore up software supply chain security, says infosec CEO

• More Than Two Dozen Android Vulnerabilities Fixed

• GitLab ‘Perfect 10’ Bug Gets a CISA Warning: PATCH NOW

• U.K., U.S. and Canadian Cyber Authorities Warn of Pro-Russia Hacktivist Attacks on Operational Technology Systems

• Top 5 Global Cyber Security Trends of 2023, According to Google Report

• North Korean Hackers Spoofing Journalist Emails to Spy on Experts

• The U.S. House Version of KOSA: Still a Censorship Bill

• How Are APAC Tech Salaries Faring in 2024?

• Proactive Responsible Disclosure is One Crucial Way Fortinet Strengthens Customer Security

• US Says North Korean Hackers Exploiting Weak DMARC Settings

• LayerX Raises $26 Million for Browser Security Platform

• Understanding the Link Between API Exposure and Vulnerability Risks

• Most of the ransomware incidents invite lawsuits in the United States

• Compare Azure Government vs. commercial cloud offering

• UnitedHealth data breach should be a wakeup call for the UK and NHS

• On World Press Freedom Day (and Every Day), We Fight for an Open Internet

• How remote work is changing patch management

• Apple Working to Patch Alarming iPhone Issue

• Russia Accused Of Cyberattack On Germany’s Ruling Party, Defence Firms

• Unifying Excellence with Strategic Partnerships: Cisco Black Belt Academy and VQ Communications

• DeepKeep Secures $10M in Seed Funding to Boost GenAI Protection Endeavors

• A Closer Look at Top 5 Vulnerabilities of April 2024

• Streamline NIS2 Compliance with Automation

• No MFA, No Defense: Change Healthcare Falls Victim to Citrix Account Hijacking

• What we can learn from the best collegiate cyber defenders

• Europol Op Shutters 12 Scam Call Centers And Cuffs 21 Suspected Fraudsters

• Indonesia Sneakily Buys Spyware, Claims Amnesty International

• Microsoft, Google Do A Victory Lap Around Passkeys

• Lessons From LOCKED SHIELDS 2024 Cyber Exercise

• Botnet Disrupted By FBI Still Used By Russian Spies, Cybercriminals

• reNgine: Open-Source Automated Reconnaissance Framework for Web Applications

• In Other News: Locked Shields 2024, Data Exposure Bugs, NVIDIA Patches

• Bug hunters can get up to $450,000 for an RCE in Google’s Android apps

• Alphabet Axes Hundreds Of Staff From ‘Core’ Organisation

• Mal.Metrica Malware Hijacks 17,000+ WordPress Sites

• tproxy To Monitor gRPC And TCP Connections

• document sanitization

• Dirty stream attack poses billions of Android installs at risk

• Hackers Increasingly Abusing Microsoft Graph API for Stealthy Malware Communications

• Expert-Led Webinar – Uncovering Latest DDoS Tactics and Learn How to Fight Back

• AAPI Heritage Month Spotlight: Jenny Nguyen

• Cybersecurity Consultant Arrested After Allegedly Extorting IT Firm

• Identity Management Challenges

• ArcaneDoor Espionage Campaign Targeting Cisco Firewalls Linked to China

• CISA, FBI Urge Organizations to Eliminate Path Traversal Vulnerabilities

• Botnet Disrupted by FBI Still Used by Russian Spies, Cybercriminals

• Insider Risk Digest: April

• North Korean Hackers Spoofing Journalist Emails to Spy on Policy Experts

• ApacheMQ Authentication Flaw Let Unauthorized Users Perform Multiple Actions

• Hackers Exploit Microsoft Graph API For C&C Communications

• Strengthening our U.S. Public Sector Leadership Team with the Promotion of two Industry Veterans

• Safeguarding Your Employee Data From Identity Theft

• 68% of Data Breach Occurs Due to Social Engineering Attacks

• What is Proxmox VE – and Why You Should Live Patch It

• Microsoft Alerts Users as Russian Hackers Target Windows Systems

• Cyber Security Today, May 3, 2024 – North Korea exploits weak email DMARC settings, and the latest Verizon analysis of thousands of data breaches

• Trellix Wise automates security workflows with AI, streamlining threat detection and remediation

• ZLoader Malware adds Zeus’s anti-analysis feature

• AI-Driven Phishing Attacks Deceive Even the Most Aware Users

• Cyble Vision X covers the entire breach lifecycle

• Microsoft, Google widen passkey support for its users

• Rare Interviews with Enigma Cryptanalyst Marian Rejewski

• Investigation Uncovers Substantial Spyware Exports to Indonesia

• Microsoft Warns of ‘Dirty Stream’ Vulnerability in Popular Android Apps

• Horizon3.ai Introduces AI-Assisted Service to Prioritize and Patch Vulnerabilities Faster

• “Dirty stream” attack: Discovering and mitigating a common vulnerability pattern in Android apps

• Microsoft introduces passkeys for consumer accounts

• Apple Announces Record Share Buyback, Amid iPhone Sales Decline

• RSA Conference 2024 – Where it all started and where to find our team

• FortiGate 200G series boosts campus connectivity for Wi-Fi 7

• BlackBerry CylanceMDR improves cybersecurity defensive strategy

• New Guide Explains How to Eliminate the Risk of Shadow SaaS and Protect Corporate Data

• Cyber Security Headlines: Goldoon exploits D-Link, CISA GitLab warning, Dropbox Sign breach

• How Structured Cabling Can Help With Cyber Security Attacks

• Cybercriminals and Nation-State Actors Found Sharing Compromised Networks

• US Charges 16 Over ‘Depraved’ Grandparent Scams

• Indonesia is a Spyware Haven, Amnesty International Finds

• Essential Steps for Zero-Trust Strategy Implementation

• Lenovo launches AI-based Cyber Resiliency as a Service

• Nokod Security Platform secures low-code/no-code development environments and apps

• NSA, FBI Alert on N. Korean Hackers Spoofing Emails from Trusted Sources

• Attack Report: Custom QR Code Phishing Templates

• White House Issues National Security Memorandum for Critical Infrastructure

• Edgio ASM reduces risk from web application vulnerabilities

• Cyber Security Today, May 3, 2024 – North Korea exploits weak email DMARC settings, and the latest Verizon analysis of thousands of data breaches

• Vulnerability Scanning vs. Penetration Testing

• These Dangerous Scammers Don’t Even Bother to Hide Their Crimes

• U.S. Govt Warns of Massive Social Engineering Attack from North Korean Hackers

• NASA Doesn’t Know if Its Spacecraft Have Adequate Cyber Defenses, GAO Warns

• Ukrainian REvil Ransomware Affiliate Gets 13 Years in US Prison

• Gurucul REVEAL empowers organizations with full control over data

• The Crucial Role of Data in Sustainability

• Using Our Environmental Management System to Create a Sustainable Future

• Mal.Metrica Redirects Users to Scam Sites

• GUEST ESSAY: A primer on how, why ‘dynamic baselining’ fosters accurate DDoS protection

• Orum No Code Verify helps businesses validate bank accounts

• Why Cloud Vulnerabilities Need CVEs

• Essential programming languages to be learnt by Cybersecurity Professionals

• Threat Actors Renting Out Compromised Routers To Other Criminals

• Cisco IP Phone Vulnerability Let Attackers Trigger DoS Attack

• Google Announces Passkeys Adopted by Over 400 Million Accounts

• Microsoft issues cyber threat alert to Google on Vulnerable Mobile Apps

• New “Goldoon” Botnet Hijacking D-Link Routers to Use for Other Attacks

• Europol op shutters 12 scam call centers and cuffs 21 suspected fraudsters

• Four Critical Vulnerabilities Expose HPE Aruba Devices to RCE Attacks

• Indonesia sneakily buys spyware, claims Amnesty International

• Ransom recovery costs reach $2.73 million

• Most companies changed their cybersecurity strategy in the past year

• 97% of security leaders have increased SaaS security budgets

• What is cybersecurity mesh architecture (CSMA)?

• New infosec products of the week: May 3, 2024

• Mitigating breaches on Red Hat OpenShift with the CrowdStrike Falcon Operator

• Simplify hybrid cloud operations with Red Hat Enterprise Linux 9.4

• Beyond the lingo: What does Red Hat Insights and FedRAMP mean for your workload?

• Chinese government website security is often worryingly bad, say Chinese researchers

• ISC Stormcast For Friday, May 3rd, 2024 https://isc.sans.edu/podcastdetail/8966, (Fri, May 3rd)

• Biden Signed the TikTok Ban. What’s Next for TikTok Users?

• Microsoft, Google do a victory lap around passkeys

• Ukrainian REvil gang member sentenced to 13 years in prison

• IT Security News Daily Summary 2024-05-02

• Tips and stories for your team on World Password Day

• Florida man gets 6 years behind bars for flogging fake Cisco kit to US military

• Pro-Russia hackers target critical infrastructure in North America and Europe

• Dropbox Sign customer data accessed in breach

• Patch up – 4 critical bugs in ArubaOS lead to remote code execution

• 4 IoT Trends U.K. Businesses Should Watch in 2024

• Elliptic Shows How an AI Model Can Identify Bitcoin Laundering

• What to Expect at RSA 2024: Will AI Wreak Havoc on Cybersecurity?

• Join Us 05-17-24 for the Capture the CISO Finals

• LayerX Security Raises $26M for its Browser Security Platform, Enabling Employees to Work Securely from Any Browser, Anywhere

• Cisco at NAB2024: Takeaways

• What are passkeys? Experience the life-changing magic of going passwordless

• Top Tech Conferences & Events to Add to Your Calendar in 2024

• 2024 State of Cybersecurity: Reports of More Threats & Prioritization Issues

• HPE Aruba Networking addressed four critical ArubaOS RCE flaws

• Scans Probing for LB-Link and Vinga WR-AC1200 routers CVE-2023-24796, (Thu, May 2nd)

• Tesla Backs Away From Gigacasting Manufacturing – Report

• What can we learn from the passwords used in brute-force attacks?

• What is a potentially unwanted program (PUP)?

• What is role-based access control (RBAC)?

• What is security information and event management (SIEM)?

• EU plan to force messaging apps to scan for CSAM risks millions of false positives, experts warn

• CISA and FBI Release Secure by Design Alert to Urge Manufacturers to Eliminate Directory Traversal Vulnerabilities

• US Urges No AI Control Of Nuclear Weapons

• LayerX Security Raises $24M for Browser Security: Empowering Secure Remote Work

• LayerX Security Raises $26M for its Browser Security Platform, Enabling Employees to Work Securely From Any Browser, Anywhere

• Two years in, Google says passkeys now protect more than 400 million accounts

• Ransomware Defense Startup Mimic Raises Hefty $27M Seed Round

• USENIX Security ’23 – “My Privacy for their Security”: Employees’ Privacy Perspectives and Expectations when using Enterprise Security Software

• Dropbox Hacked: eSignature Service Breached

• North Korean Scammers Lure Developers with Fake Job Offers

• Okta Alert: The Rise of Credential Stuffing Attacks Through Proxy Networks

• Dropbox Sign witnesses data breach

• Microsoft Announces Big Investments In Malaysia, Indonesia, Thailand

• Flatiron Software unveils Snapshot Reviews, an AI tool for analyzing developer code and performance

• Anthropic’s Claude Teams and iOS App: The secure, scalable solution for enterprise AI adoption

• Dropbox discloses data breach involving Dropbox Sign

• Under the Digital Radar: Defending Against People’s Republic of China’s Nation-State Cyber Threats to America’s Small Businesses

• The Breach of a Face Recognition Firm Reveals a Hidden Danger of Biometrics

• Delta Electronics DIAEnergie

• Google expands passkey support to its Advanced Protection Program ahead of the US presidential election

• Watch out for tech support scams lurking in sponsored search results

• Startup Dealflow: New Investments at Resonance, RunReveal, StepSecurity, Insane Cyber

• AI Security Startup Apex Emerges From Stealth With Funding From OpenAI CEO

• Building the Right Vendor Ecosystem – a Guide to Making the Most of RSA Conference

• Popular Android Apps Like Xiaomi, WPS Office Vulnerable to File Overwrite Flaw

• Android Flaw Affected Apps With 4 Billion Installs

• Wordfence Intelligence Weekly WordPress Vulnerability Report (April 22, 2024 to April 28, 2024)

• LastPass Separates From Parent After Security Incidents

• Cuttlefish 0-click Malware Hijacks Routers & Captures Data

• GoldDigger Malware Using Deep Fake AI Photos To Hijack Bank Accounts

• LayerX Security Raises $24M for its Browser Security Platform, Enabling Employees to Work Securely From Any Browser, Anywhere

• Operational Innovations for AI and Cloud-Native Workloads from Cisco and Red Hat

• Threat actors hacked the Dropbox Sign production environment

• Finnish Psychotherapy Center Cyber-Blackmailer Gets Six Years

• Safeguarding Reproductive Health Workers: Addressing Risks Posed by Data Brokers and Doxxing

• VNC Is The Hacker’s New Remote Desktop Tool For Cyber Attacks

• ArubaOS Critical Vulnerability Let Attackers Execute Remote Code

• CyberPower PowerPanel

• Federal frenzy to patch gaping GitLab account takeover hole

• Japan’s Kishida Unveils a Framework for Global Regulation of Generative AI

• Verizon DBIR 2024 Shows Surge in Vulnerability Exploitation, Confirmed Data Breaches

• Network Security Firm Corelight Raises $150 Million

• Key Areas Where Open-Source Security Needs to Evolve

• GM Car Buyers’ Nightmare: The Unveiling of a Program Raising Insurance Rates

• Is ChatGPT Secure? Risks, Data Safety, and Chatbot Privacy Explained

• Hackers Target New NATO Member Sweden with Surge of DDoS Attacks

• LayerX Security Raises $24M for Innovative Browser Security Platform

• 5 Best Password Managers Built for Teams in 2024 (Free & Paid)

• Red Team vs Blue Team vs Purple Team: Differences Explained

• Here’s Your Chance To Own A Decommissioned US Government Supercomputer

• REvil Ransomware Scum Gets 14 Years, $16 Million Fine

• Hacker Free-For-All Fights For Control Of Home And Office Routers Everywhere

• Hackers Compromised Dropbox eSignature Service

• 1,400 GitLab Servers Impacted By Exploited Vulnerability

• Psychotherapy practice hacker gets jail time after extorting patients, publishing personal therapy notes online

• News alert: LayerX Security raises $24M Series A funding for its ‘enterprise browser’ security platform

• Hackers Claiming Breach of UAE Government Servers

• Drop My VPN – Are You Nuts?

• Today’s Security Requires Specialized Processors

• New Goldoon Botnet Targeting D-Link Devices Using Decade-Old Flaw

• 1Password Extended Access Management secures unmanaged applications and devices

• Hyperbole, Misinformation, and CyberMonsters Under the Bed

• Ying Ying Yang finds a new life and career in Australia as a Cisco Networking Academy Instructor

• The Student-Centric Experience: Leadership

• CISA Adds GitLab Flaw to its Known Exploited Vulnerabilities Catalog

• LayerX Security Raises $24M for its Browser Security Platform, Enabling Employees to Work Securely from Any Browser, Anywhere

• Ukrainian REvil Hacker Sentenced to 13 Years and Ordered to Pay $16 Million

• Russian Hackers Target Industrial Systems in North America, Europe

• 1,400 GitLab Servers Impacted by Exploited Vulnerability

• CISA adds GitLab flaw to its Known Exploited Vulnerabilities catalog

• Prisma SASE 3.0 — Securing Work Where It Happens

• HPE Aruba Networking Fixes Four Critical RCE Flaws in ArubaOS

• The Surveillance Invasion: IoT and Smart Devices Stealing Corporate Secrets

• New SOHO router malware aims for cloud accounts, internal company resources

• Security Breach Exposes Dropbox Sign Users

• Three-Quarters of CISOs Admit App Security Incidents

• Deepfakes and AI-Driven Disinformation Threaten Polls

• The UK Bans Default Passwords

• World Password Day 2024: Try Passkeys!

• Vulnerability Exploits Triple as Initial Access Point for Breaches

• Trend Micro expands AI-powered cybersecurity platform

• Russian Hackers Actively Attacking Small-scale Infrastructure Sectors

• Digital fraud detection startup BioCatch hits $1.3B valuation as Permira buys majority stake

• World Password Day 2024: What are the experts saying?

• Proofpoint DLP Transform secures data moving to ChatGPT, copilots, and other GenAI tools

• Secure Code Warrior SCW Trust Score quantifies the security posture of developer teams

• HITRUST updates Cyber Threat Adaptive engine to address emerging cyber threats

• Cyber Security Headlines: Chinese disinformation, NCSC AMS, new State Secrets law

• Scaling Least Privilege for the Cloud

• US To Ban Huawei, ZTE From Certifying Wireless Kit

• SafeBase Raises $33M in Series B to Accelerate Vision for Friction-Free Security Reviews

• Confluent enhances Apache Flink with new features for easier AI and broader stream processing

• Appdome launches MobileEDR, merging MTD and EDR to protect enterprise mobile apps

• New “Goldoon” Botnet Targets D-Link Routers With Decade-Old Flaw

• Dropbox Discloses Breach of Digital Signature Service Affecting All Users

• When is One Vulnerability Scanner Not Enough?

• Cyber Startup Oasis Secures $35 Million Series A Extension, Doubles Valuation

• AI is Creating a New Generation of Cyberattacks

• CalypsoAI introduces customizable generative AI security scanners for enterprises

• Nord Security unveils NordStellar, a platform for advanced cyber threat detection and response

• REvil Ransomware Affiliate Sentenced to Over 13 Years in Prison

• Cybersecurity: The Battle of Wits

• Tripwire Patch Priority Index for April 2024

• US Warns of Russian Hackers Targeting Operational Technology in Water Systems

• Veracode platform enhancements help organizations reduce application risk

• Illumio and Wiz’s integration enhances cyber resilience in the cloud

• Anthropic Launches Enterprise-Focused Claude, Plus iPhone App

• Threat Actors Attacking MS-SQL Servers to Deploy Ransomware

• Understanding Microsoft’s Trusted Signing service

• IAM and Passkeys: 4 Steps Towards a Passwordless Future

• Venafi launches 90-Day TLS Readiness Solution

• Deep Instinct DIANNA provides malware analysis for unknown threats

• Skyhawk Security unveils cloud-native CTEM, streamlining security with AI-powered automation

• Dropbox says attackers accessed customer and MFA info, API keys

• Iranian Hackers Impersonate Journalists in Social Engineering Campaign

• Corelight Gets $150M to Expand Detection, Improve Workflows

• Dropbox Data Breach Impacts Customer Information

• Lineaje OSM improves software supply chain security

• Snyk AppRisk Pro leverages AI and third-party integrations for faster risk mitigation

• US and UK Warn of Disruptive Russian OT Attacks

• Panda Restaurant Group disclosed a data breach

• Virsec releases security tools to offer ransomware protection

• Bitwarden Authenticator protects online services and applications

• Think tank: China’s tech giants refine and define Beijing’s propaganda push

• Virsec releases security tools to provide ransomware protection

• USB Malware Attacks Targeting Industrial Systems Adapts LOL Tactics

• REvil Ransomware Affiliate Sentenced for 13 Years in Prison

• REvil ransomware scum sentenced to almost 14 years inside, ordered to pay $16 million

• Think tank: China’s tech brands refine and define Beijing’s propaganda push

• CISA Warns of Active Exploitation of Severe GitLab Password Reset Vulnerability

• Inside Ukraine’s Killer-Drone Startup Industry

• United Health CEO testifies before senate for ransomware attack

• Attention all Windows Users! The Microsoft April Security Update Could Break Your VPN

• 2024 Data Breach Investigations Report: Most breaches involve a non-malicious human element

• User Privacy Threats Around T-Mobile’s ‘Profiling and Automated Decisions’

• Securing your organization’s supply chain: Reducing the risks of third parties

• New Cuttlefish Malware Hijacks Router Connections, Sniffs for Cloud Credentials

• Bitwarden launches standalone Bitwarden Authenticator app

• Post DBIR 2024: 7 Ways to Reduce Your Cyber Risk

• reNgine: Open-source automated reconnaissance framework for web applications

• Understanding emerging AI and data privacy regulations

• Women rising in cybersecurity roles, but roadblocks remain

• A million Australian pubgoers wake up to find personal info listed on leak site

• AI-driven phishing attacks deceive even the most aware users

• Panda Restaurant Corporate Systems Hacked: Customer Data Exposed

• ISC Stormcast For Thursday, May 2nd, 2024 https://isc.sans.edu/podcastdetail/8964, (Thu, May 2nd)

• Deepfake of Principal’s Voice Is the Latest Case of AI Being Used for Harm

• Change Healthcare Cyberattack Was Due to a Lack of Multifactor Authentication, UnitedHealth CEO says

• Security in the AI Sector: Understanding Infostealer Exposures and Corporate Risks

• Dropbox dropped the ball on security, haemorrhaging customer and third-party info

• Block accused of mass compliance failures that saw digi-dollars reach terrorists

• 4 Easy Ways to Find Free Wi-Fi Anywhere You Go

• Reading the Mandiant M-Trends 2024

Generated on 2024-05-03 23:55:11.941274