In a sweeping global campaign, LinkedIn users are falling victim to a surge of account hijacks, leaving many locked out or held at ransom by threat actors. Rampant Account Hijacking and Extortion LinkedIn, the professional networking platform, is facing a…
Tag: Heimdal Security Blog
Raccoon Stealer 2.3.0 Malware – A Stealthier Comeback
In a notable comeback, the creators of the notorious Raccoon Stealer information-stealing malware have reemerged after a six-month hiatus. This resurgence brings forth an upgraded version tailored to cater to the evolving needs of cybercriminals. Brief Overview Raccoon Stealer has maintained…
Double Extortion Ransomware: The New Normal
With more and more businesses learning how to avoid paying huge amounts of money to ransomware actors by maintaining up-to-date backups and having disaster recovery plans in place, the number of victims forced to pay ransom started to decrease. Even…
Talking Heimdal XDR with Nabil Nistar, Head of Product Marketing
As the new face of Heimdal, I wanted to chat about the ‘product’ with our experts and find out why customers love us. So, I sat down with Nabil Nistar, our Head of Product Marketing, and talked about Heimdal Extended…
Fake Tripadvisor Emails to Distribute Knight Ransomware
An ongoing spam campaign spreads Knight ransomware among users. The fake emails imitate Tripadvisor complaint messages. Knight ransomware is the revamp of the Cyclop Ransomware-as-a-Service, starting with July 2023. The Knight Ransomware Spam Campaign A researcher at Sophos detected this…
What Is Privileged Access Management (PAM)?
To understand what privileged access management is, we need to first understand what privileged access refers to. This article will cover many aspects of PAM, including definition, importance, functionality, statistics, best practices, and why our solution is the best for…
Understanding Risk-Based Authentication (RBA)
Risk-Based Authentication (also known as RBA, context-based authentication, or adaptive authentication) is a security mechanism that looks at the profile (IP address, device, behavior, time of access, history, and so on) of the agent asking for access to the system…
What Is Patch Management as a Service (PMaaS) & What Can It Do For You?
What to do if you don’t have the time, workforce, or knowledge to deal with Patch Management? We’ve got the solution for you. More and more vulnerability management vendors have begun to offer services that do all the heavy lifting.…
The 9 Best XDR Software Solutions and Tools in 2023 [Features, Pricing & Reviews]
Imagine having a superhero shield for your computers, network, users, and clouds. That’s what an XDR software solution does – it keeps a watchful eye on everything, non-stop! XDR solutions bring different security tools into one place, making it easier…
Top Exploit Databases to Use in Bolstering Cybersecurity Posture
Exploit databases are relevant intelligence sources for security specialists that need to keep an eye on the latest exploits and vulnerabilities. They also offer a long-time perspective over the past years’ threat landscape. An improper patch management policy still leads…
Ransomware Prevention Checklist: Safeguarding Your Digital Assets
In an increasingly interconnected digital landscape, the threat of ransomware has emerged as a formidable adversary, targeting organizations of all sizes and industries. Ransomware attacks can wreak havoc on businesses, leading to data breaches, financial losses, and operational disruptions. As…
Rhysida Ransomware: The Rise of a New Threat for Healthcare Organizations
The ransomware operation known as Rhysida has rapidly gained notoriety, especially following a series of attacks on healthcare organizations. This surge has led to heightened vigilance from government agencies and cybersecurity firms, prompting them to closely monitor Rhysida’s activities. Growing…
The Aftermath: Dallas Ransomware Attack- 26K Residents Affected
In a recent development, it has come to light that an APT group managed to infiltrate the city of Dallas’ digital infrastructure, gaining unauthorized access to sensitive personal data belonging to a minimum of 26,212 residents of Texas. The data…
UK Electoral Commission Data Breach Exposes Information of 40 Million Voters
The UK Electoral Commission revealed a cyberattack that exposed the personal data of all registered voters between 2014 and 2022. The attack took place in August 2021, but the Commission only discovered the breach in October 2022. Threat actors had…
Enhancing Cybersecurity with Remote Browser Isolation (RBI)
In an age where the internet is vital for business, cyberattacks, malware, and phishing attempts have evolved to exploit vulnerabilities within web browsers, making them a prime target for malicious actors. In response to this growing menace, cybersecurity experts have…
Downfall Vulnerability Exposes Intel CPUs to Data and Encryption Keys Stealing
Downfall vulnerability impacts various Intel microprocessors and enables encryption keys, passwords, and other sensitive data exfiltration. The flaw was dubbed CVE-2022-40982 and was reported to Intel by security researcher Daniel Moghimi. The researcher provided a proof-of-concept that leverages the Gather…
The FBI Is Investigating a Ransomware Attack that Disrupted Hospital Operations in 4 States
A large healthcare network operating across multiple states recently experienced widespread network disruptions due to a cyberattack, confirmed by the FBI to be a ransomware incident. Prospect Medical Holdings, which oversees 16 hospitals spanning California, Connecticut, Pennsylvania, and Rhode Island,…
New Deep Learning Model Decodes Keyboard Sounds with 95% Accuracy
A team of researchers has introduced an innovative approach referred to as a “deep learning-based acoustic side-channel attack,” designed to accurately classify laptop keystrokes recorded using a nearby smartphone, achieving an impressive 95% accuracy rate. In a recent study published…
Isolated Systems at Risk: How Threat Actors Can Still Infect Your Systems With Malware
You might think that an air-gapped network will keep you safer from attackers, and you are right. It’s pretty obvious that isolating a computer or network and preventing it from establishing an external connection will leave threat actors with fewer…
Patch Tuesday August 2023 – Microsoft Releases 12 Security Patches for Chromium-based Edge Browser
Heimdal® returns with yet another update from the patching and vulnerability management front. So far, Microsoft has slated for release 12 security and non-security improvements, touching upon the Edge browser. Without further ado, here’s what Patch Tuesday August has in…
White House Announces New Actions to Strengthen K-12 Schools’ Cybersecurity
On Monday, the White House unveiled a series of new initiatives and federal resources designed to address cybersecurity concerns in the nation’s K-12 education system. This comes as a response to the increasing wave of cyberattacks that have targeted schools…
What Is a One-Time Password (OTP)?
With cyber threats evolving at an alarming pace, traditional passwords fall short when it comes to protecting our digital data. In the search for a more powerful defense against unauthorized access, an innovative approach has emerged: One-Time Passwords (OTPs), dynamic…
Microsoft Teams Users Targeted by Russian Threat Group
Microsoft believes that Microsoft Teams chats were used into coaxing users to share their credentials with threat actors. The available evidence leads to a Russian government-linked hacking group known as Midnight Blizzard being responsible, after taking aim at dozens of…
Patch Against Exploit Kits. Understanding How Threat Actors Target Your Defenses
Exploit kits (Eks) are collections of exploits – pieces of code or sequences of commands – created to leverage vulnerabilities in software and attack a system. Their goal is to deploy malware onto the victim`s system. These toolkits are usually…
8 Best CrowdStrike Competitors & Alternatives in 2023 [Features, Pricing & Reviews]
CrowdStrike is pretty reliable when it comes to protecting you from attacks. But the thing is, it can be quite challenging to use and almost impossible to tweak to your specific needs. At the same time, the cybersecurity market is…
Locking Out Cybercriminals: Here’s How to Prevent Ransomware Attacks
As cyberattacks become more sophisticated and widespread, ransomware attacks have become one of the most common and costly threats facing companies today. In recent years, ransomware attacks have grown increasingly frequent, causing significant damage to businesses and organizations of all…
Managed Security Service Providers (MSSPs) on the Rise. A Vendor’s View on Current Landscape & Future Trends
We are seeing a landslide in the cybersecurity market, with more and more Managed Security Service Providers (MSSPs) working as intermediaries between cybersecurity vendors and businesses in need of beefing up their security. The global managed security services market was…
Eyes on IDOR Vulnerabilities! US and Australia Release Joint Advisory
Cybersecurity agencies in Australia and the U.S. issued an advisory that warns about security flaws in web applications that could result in large-scale data breaches. The advisory refers to a certain sort of vulnerability called Insecure Direct Object Reference (IDOR).…
Staff at NHS Lanarkshire Exposed Patient`s Data on Unauthorized WhatsApp Group
The Information Commissioner’s Office (ICO) revealed that 26 staff members of NHS Lanarkshire shared patients` information on a WhatsApp group. The group didn`t have the organization`s approval for processing data about the NHS patients. The team got access to the…
Hot Topic Announces Potential Data Breach Due to Stolen Account Credentials
The American clothing company Hot Topic announced they identified suspicious login activity on a series of Reword accounts. Hot Topic warns that a data breach might have compromised users` sensitive information. The retail chain has 675 stores across the U.S.…
New SEC Regulations: US Businesses Must Report Cyberattacks within 4 Days
The U.S. Securities and Exchange Commission (SEC) has approved new rules requiring publicly traded companies to disclose cyberattack details within four days of identifying a “material” impact on their finances, signaling a significant change in breach disclosure practices. SEC Chair…
Canon Advises Users to Reset Wi-Fi Settings When Discarding Inkjet Printers
Canon is cautioning users of home, office, and large format inkjet printers that their devices’ Wi-Fi connection settings are not properly wiped during initialization, posing a security and privacy risk. This flaw could potentially allow unauthorized individuals, such as repair…
8 Best CrowdStrike Competitors [2023]
Due to the constantly changing nature of cyber threats, businesses must implement strong security solutions. Here is where CrowdStrike competitors come into play, providing cutting-edge cybersecurity services and solutions. There is a cybersecurity solution designed to match your specific requirements,…
Fake Android App Used to Exfiltrate Signal and WhatsApp User Data
A fake Android app called ‘SafeChat’ is used by malicious actors to infect devices with spyware malware that allows them to steal call logs, text messages, and GPS locations from phones. The spyware appears to be a variant of “Coverlm,”…
What Is an Exploit? Definition, Types, and Prevention Measures
An exploit is a piece of software or code created to take advantage of a vulnerability. It is not malicious in essence, it is rather a method to prey on a software or hardware security flaw. Threat actors use exploits…
BAZAN Group, Israel’s Largest Oil Refinery, Had Its Website Hit by a DDoS Attack
The BAZAN Group’s website is inaccessible since this weekend due to a DDoS attack. The Iranian hacktivist group, “Cyber Avengers” (“CyberAv3ngers”) claims to have breached the Group’s security systems and managed to exfiltrate data. Israel’s largest oil refinery operator is…
Locky Ransomware 101: Everything You Need to Know
In the fast-evolving landscape of cybersecurity threats, ransomware has consistently remained a top concern for individuals and organizations. Among the myriad ransomware strains, the notorious Locky Ransomware has struck fear into the hearts of victims. Initially appearing in 2016, Locky…
What Is an Exploit? Definition, Types and Prevention Measures
An exploit is a piece of software or code created to take advantage of a vulnerability. It is not malicious in essence, it is rather a method to prey on a software or hardware security flaw. Threat actors use exploits…
How to Prioritize Vulnerabilities Effectively: Vulnerability Prioritization Explained
What Is Vulnerability Prioritization? Vulnerability prioritization is the process of identifying and ranking vulnerabilities based on the potential impact on the business, ease of exploitability, and other contextual factors. It represents one of the key steps in the vulnerability management…
DNS Protection: A Must-Have Defense Against Cyber Attacks
Picture this scenario: you’re browsing the internet, going about your business, when suddenly a malicious website pops up out of nowhere. Your heart races as you realize that your sensitive data and personal information may be at risk. You scramble…
What is Managed Detection and Response (MDR)? Benefits & Capabilities
The term Managed Detection and Response (MDR) refers to an outsourced cybersecurity service that employs advanced technologies and human expertise. It can carry out threat hunting, monitoring, and response at the host, endpoint, and network levels. The vendor usually offers…
40,000 HRM Enterprises Clients Had Their Credit Card Information Stolen Following Cyberattack
HRM Enterprises, Inc., the owner of the US’s largest independent hardware store, was recently the victim of a cyberattack where the credit card information of more than 40,000 clients was stolen. Based in Hartville, Ohio, HRM Enterprises, Inc. is a…
What Is Secure Remote Access?
Secure remote access is an effective approach to cybersecurity that combines multiple technologies, such as encryption, multifactor authentication (MFA), VPNs, and endpoint protection, among others, to safeguard an organization’s network, mission-critical systems, or sensitive data from unauthorized access. Its strength…
Dark Power Ransomware Abusing Vulnerable Dynamic-Link Libraries in Resolved API Flow
In a previously-published material, Heimdal® has analyzed the emergent Dark Power malware – a ransomware strain written in the NIM programming and capable leveraging advanced encryption techniques such as CTR for a better stranglehold on the victim’s device and, implicitly,…
U.S. Government Contractor Maximus Hit by Massive Data Breach
U.S. government service contracting giant Maximus has disclosed a data breach warning that threat actors stole the personal data (including Social Security numbers and protected health information) of 8 to 11 million people by exploiting a vulnerability in MOVEit Transfer.…
The Road to Redemption: Ransomware Recovery Strategies for Businesses
Ransomware attacks have become one of the most significant cybersecurity threats facing businesses and organizations today. These malicious attacks encrypt valuable data, rendering it inaccessible to users until a ransom is paid to the attackers. Despite investing in robust cybersecurity…
Cyberattack Investigation Shuts Down Ambulance Patient Records System
A cyber attack on health software company Ortivus has led to the shutdown of the ambulance patient records system, affecting several UK NHS ambulance organizations. The attack occurred on July 18 and impacted UK customer systems within Ortivus’s hosted data…
Terrestrial Trunked Radio System Vulnerable to Leakage and Message Injection
Dutch researchers revealed 5 vulnerabilities in the Terrestrial Trunked Radio (TETRA) that could expose government organizations and critical infrastructure communication to third parties. Two of the collectively called TETRA:BURST flaws, CVE-2022-22401 and CVE-2022-22402, were rated critical. TETRA is used for…
Norwegian Government`s System Breached over Ivanti EPMM Zero-Day
The Norwegian National Security Authority (NSM) revealed that threat actors exploited the CVE-2023-35078 zero-day vulnerability in Ivanti’s Endpoint Manager Mobile (EPMM) to target the Norwegian Government. According to the Norwegian authorities, the attack did not impact the Prime Minister’s Office,…
Yamaha Confirms Cyber Attack on Its Canadian Division
Yamaha’s Canadian music division has confirmed that it fell victim to a recent cyberattack, as two separate ransomware groups claimed responsibility for targeting the company. Yamaha Corporation, a renowned Japanese manufacturer of musical instruments and audio equipment, experienced unauthorized access…
New Vulnerability Puts 926,000 MikroTik Routers at Risk! Users Urged to Patch
Researchers found a critical ‘Super Admin’ privilege elevation vulnerability that impacts MikroTik devices. Over 900,000 RouterOS routers are at risk and security specialists advise users to apply available patches immediately. CVE-2023-30799 enables remote and authenticated threat actors to escalate privileges…
Lazarus APT Group Targets Windows IIS Web Servers to Distribute Malware
Recently, cybersecurity specialists made a concerning discovery regarding the North Korean state-sponsored Lazarus APT group. The ASEC team found that the group is actively targeting Windows Internet Information Service (IIS) web servers as a means to distribute malware. Lazarus employs…
Open Source Software Supply Chain Attacks Spotted Targeting the Banking Sector
Analysts from Checkmarx uncovered a number of attacks on the banking industry’s open-source software supply chain in the first half of 2023. According to the experts, these attacks targeted specific components of web assets used by banks and employed sophisticated…
Patch Tuesday July 2023 – Microsoft Publishes Bug Fixes for 142 Vulnerabilities [UPDATED]
The second month of summer comes a-calling with a hefty list of bug fixes; throughout July, Microsoft has released no lesst than 142 patches for various types of vulnerabilities, with scores ranging from Important to Critical. Without further ado, here’s…
What Is Mobile Device Management? Role in Endpoint Security and Benefits
Mobile device management (MDM) is software that enables IT teams to supervise and secure all mobile endpoints in a company`s digital perimeter: laptops, tablets, smartphones, etc. In the age of remote & hybrid work, an MDM strategy is an essential…
Stolen Microsoft Key: The Impact Is Higher Than Expected
Earlier this month, Microsoft and CISA disclosed a security incident and attributed it to the Chinese threat group Storm-0558. The threat actors stole a Microsoft consumer signing key, which was initially thought to have provided them with access to Exchange…
Mallox Ransomware Witnessing Alarming Surge in Activity
The Mallox ransomware group, also known as TargetCompany, Fargo, and Tohnichi, has become increasingly active, signaling a significant shift in its operations. According to recent findings, Mallox’s ransomware activities in 2023 have seen a staggering 174% increase compared to the…
Critical Zyxel Firewall Vulnerability Exploited in DDOS Attacks
Multiple DDoS botnets have actively exploited a critical vulnerability discovered in Zyxel firewall models, as revealed by cybersecurity researchers. Tracked as CVE-2023-28771, this flaw explicitly impacts Linux platforms and enables remote attackers to gain unauthorized control over vulnerable systems, effectively…
New Severe Vulnerabilities Found in AMI MegaRAC BMC Software
Security Researchers warn about finding new vulnerabilities in the AMI MegaRAC Baseboard Management Controller (BMC) software. The flaws, rated from high to critical, open the way for threat actors to deploy malware and succeed in remote code execution (RCE). Lots…
XDR vs EDR – A Comparison
Cybersecurity purchasers and providers must adopt a new way of thinking in response to the more sophisticated cyberthreats that keep emerging. The necessity for more thorough and integrated approaches to cybersecurity is highlighted by the fact that traditional cybersecurity solutions…
Adobe Releases Patches to Fix Three New ColdFusion Vulnerabilities
Adobe released an emergency ColdFusion security update meant to fix critical vulnerabilities, including a new zero-day vulnerability. Adobe fixed three vulnerabilities as part of their out-of-band update: CVE-2023-38204: a critical remote code execution (RCE) vulnerability (9.8 rating); CVE-2023-38205: a critical…
BlackCat and Clop Claim Cyberattack on Beauty Giant Estée Lauder
Cosmetic conglomerate Estée Lauder has been listed on the data leak sites of two of the most active threat groups today, ALPHV/BlackCat and Clop. The BlackCat gang mocked the security of Estée Lauder in a message to the company, saying…
Tampa General Hospital Reports Cybercriminals Stole 1.2M Patient Data
Tampa General Hospital announced on Wednesday evening that cybercriminals breached its network and stole files containing the personal health information (PHI) of about 1.2 million patients. Located on Davis Island in Tampa, Florida, Tampa General Hospital (TGH) is a not-for-profit,…
P2PInfect: A New Worm Targets Redis Servers on Linux and Windows
P2PInfect is a new cloud-targeting, peer-to-peer (P2P) worm recently discovered by cybersecurity researchers, that targets vulnerable Redis instances for follow-on exploitation. Researchers William Gamazo and Nathaniel Quist said that P2PInfect exploits Redis servers running on both Linux and Windows OS,…
The Crucial Role of Cyber Essentials in the UK Public Sector
The United Kingdom’s public sector is undergoing a digital transformation, relying increasingly on technology to enhance service delivery, streamline operations, and foster improved engagement with citizens. As government organizations continue to embrace technological advancements, they also face a growing array…
Zero-Day Alert! Critical Flaw in Citrix ADC and Gateway Exploited in the Wild
Citrix urged customers to patch NetScaler ADC and Gateway products after discovering a critical-severity zero-day vulnerability. The flaw was dubbed CVE-2023-3519, ranked 9.8 on the CVSS, and was observed exploited in the wild. The company released updated versions of the…
New Cloud Credential Stealing Campaign Targets Microsoft Azure and Google Cloud
In June 2023, a threat actor was linked to a cloud credential stealing campaign that targeted Microsoft Azure and Google Cloud Platform (GCP) services, expanding the adversary’s scope of attack beyond Amazon Web Services (AWS). After conducting investigations, security researchers…
BlackCat Alphv Ransomware
The ransomware operation known as BlackCat, also referred to as Alphv ransomware, has been utilized by members of the Alphv group since November 2021. During the last few years, BlackCat has demonstrated a clear upward trajectory in its operations. Their…
BlueKeep: Understanding the Critical RDP Vulnerability
What Is the BlueKeep Vulnerability? BlueKeep is a software vulnerability that affects older versions of Microsoft Windows. Also known as CVE-2019-0708, the vulnerability first emerged in 2019 and is a “wormable” remote code execution vulnerability, being noted first by the…
Just-in-Time Access Explained. What It Means, Benefits and Best Practices of JIT
The concept of Just-in-Time Access has been around for decades but it is only recently that it has become popular in the cybersecurity realm. One reason for this popularity is the increase in cyberattacks and data breaches. With more attacks…
Micro-Segmentation: Strengthening Network Security Through Granular Control
In the interconnected realm of digital technology, safeguarding cybersecurity has become an utmost priority for organizations. Traditional security approaches, such as relying solely on perimeter-based defenses, have proven insufficient in defending against sophisticated cyber threats. Consequently, a paradigm shift has…
Zoom Vulnerabilities Allow Attackers to Escalate Privileges
Six high-severity and one low-severity vulnerability patches have been released by Zoom. These flaws, if left unattended, would allow threat actors to escalate privileges and gain access to sensitive data. The vulnerabilities were assigned CVSS Scores ranging from 3.3 (low)…
Chinese Hackers Breach Government Email
Microsoft has revealed that Chinese hackers successfully accessed the email accounts of various government organizations. The breach was reportedly detected only weeks after the activity began. According to Microsoft, an entity based in China, named Storm-0558, managed to gain access…
What Is Advanced Endpoint Protection. Key Features and Benefits
Advanced Endpoint Protection (AEP) is an AI-powered cybersecurity toolkit that focuses on detecting and preventing unknown cyber threats from harming a company`s endpoints. In today`s business landscape, where many employees work remotely, protecting assets turned out to be more and…
International Diplomats Targeted by Russian Hacking Group APT29
Russian state-sponsored hacking group ‘APT29,’ also known as Nobelium or Cloaked Ursa, has employed innovative tactics to target diplomats in Ukraine, using car listings as unconventional lures. APT29, which is associated with the Russian government‘s Foreign Intelligence Service (SVR), has…
11 Million Patients` Data Stolen in HCA Healthcare Data Breach
HCA Healthcare, one of the largest health companies in the USA, announced on July 10th it was the target of a huge data breach. The cyberattack impacted 1,038 hospitals and physician clinics across 20 states. All in all, 11 million…
EU Healthcare: ENISA Reports that 54% of Cyber Threats Are Ransomware
The European Union Agency for Cybersecurity (ENISA) has released its first cyber threat landscape report for the health sector, revealing that ransomware is responsible for 54% of cybersecurity threats in the industry. The comprehensive analysis, based on over two years…
Deutsche Bank, ING, and Postbank Customers` Data Exposed in Breach
Deutsche Bank, ING Bank, Postbank, and Comdirect recently announced they suffered customer data leaks. Reportedly, the four European giant banks were using the same third-party business vendor, who fell victim to a MOVEit data-theft attack. The Attack Revealed On July 3rd,…
Zero-day Alert! Microsoft Unpatched Vulnerability Exploited in NATO Summit Attacks
Microsoft warns that hackers are exploiting an unpatched zero-day present in several Windows and Office products. The bug enables malicious actors to gain remote code execution via malicious Office documents. Researchers claim the vulnerability was observed in attacks targeting organizations…
UK Cyber Extortion Rose by 39% in One Year, International Law Firm Reveals
The number of cases of online extortion reported to the police rose by almost 40% in 2022 compared to the previous year, according to Reynolds Porter Chamberlain, an international commercial law firm from the UK. Action Fraud, the UK’s national…
What Is a DNS Rebinding Attack? Vulnerabilities and Protection Measures
DNS rebinding compromises the way domain names are resolved and is a technique threat actors use in cyberattacks. In this type of DNS attack, a malicious website directs users to launch a client-side script that will attack other devices in…
New Ransomware Strain Discovered: Big Head
A new ransomware strain emerged: Big Head uses fake Windows updates and Microsoft Word installers to spread. Researchers analyzed three samples to establish the infection vector and how the malware executes. Although the variants may differ, they originate from the…
Automated Patch Management Explained: Benefits, Best Practices & More
There are premises outside of economic implications that draw attention to the importance of Automated Patch Management processes. Keeping systems well informed about the newly-released patches is no longer just a recommendation, it’s a necessity. As defined by our Cybersecurity…
A New Banking Trojan on the Rise: TOITOIN Banking Trojan
TOITOIN is a new Windows-based banking trojan active since 2023. The malware targets businesses operating in Latin America (LATAM), researchers at Zscaler say, employing a multi-stage infection chain and custom-made modules. These modules are custom designed to carry out malicious…
StackRot: A New Linux Kernel Flaw Allows Privilege Escalation
A new vulnerability has been found by security researchers. Dubbed StackRot, the Linux Kernel flaw is impacting versions 6.1 through 6.4. The flaw is tracked as CVE-2023-3269 and is a privilege escalation issue. An unprivileged local user can trigger the…
Top Data Breaches in 2023: Alarming Incidents Impacting Companies
The year 2023 has witnessed a surge in data breaches and cyberattacks, posing significant challenges for organizations striving to safeguard sensitive information. Recent high-profile attacks targeting various industries, including healthcare, finance, retail, government, manufacturing, and energy, highlight the evolving threat…
Malicious Insider Explained: The Call is Coming from Inside the House
For the most part, today’s modern workplace has grown accustomed to cyberattacks directed by third parties that are external to the organization. But what can you do when the call is coming from inside the house? How can you successfully…
CISA, FBI: A New Version of the Truebot Malware Is Actively Used in Attacks
A new warning was issued by CISA and the FBI! Organizations across the United States and Canada have been targeted in attacks that use a new variant of the Truebot malware. The malware takes advantage of a remote code execution…
RedEnergy Stealer Ransomware: A New Threat Targeting Critical Infrastructure
A new strain of ransomware called RedEnergy Stealer has recently emerged, posing a significant threat to critical infrastructure systems worldwide. This sophisticated malware has caught the attention of security experts due to its highly targeted approach and potential for devastating…
SMUGX Campaign Targets European Entities
In a recent cyberattack that has raised alarm bells across Europe, several entities in the region have become victims of a sophisticated campaign known as SMUGX. The attackers, believed to be Chinese hackers, have employed a novel technique called HTML…
Internal Threats: A Major Risk to Any Business
As Daniel Wanderson wrote for Security Boulevard, a CEO must consider every aspect of his/her business – and cybersecurity is one of the most important ones since anyone can become the victim of a cyber attack. At any minute, you…
Linux Ransomware Exposed: Not Just a Windows Problem Anymore
In the ever-evolving landscape of cyber threats, ransomware has emerged as a pervasive menace, causing widespread damage to individuals and organizations. While most ransomware attacks have historically targeted Windows systems, the rise of Linux ransomware has thrown a new curveball…
Ransomware Attackers Dump Students’ Data Online After School Hacks
In a disturbing trend, ransomware gangs have escalated their malicious activities by targeting schools and subsequently dumping students’ private files online. This alarming development has raised concerns among parents, educators, and cybersecurity experts worldwide. According to a recent report, these…
New Meduza Infostealer Designed for Windows Collects Users’ and Systems` Data
Security researchers discovered a new Windows-based data-stealing malware dubbed Meduza Stealer. The new info stealer allegedly has detection-evading features and can collect data about both Windows users and systems. However, it can only evade detection in a certain number of…
LockBit Ransomware Attack Freezes Japan`s Largest Port Activities
The Russian-based threat group LockBit targeted the Port of Nagoya in a ransomware attack. Japan’s largest port is currently unable to load and unload containers from trailers. According to the Nagoya Port Authorities, the attack was discovered on Tuesday, July…
What Is Passwordless Authentication?
In today’s interconnected world, where cyber threats loom large, the traditional password-based authentication method has shown its limitations and ceased to provide adequate security. Passwords pose serious challenges as they are difficult to remember, often reused across different apps, and…
Companies Affected by Ransomware [Updated 2023]
The increasing frequency and size of ransomware attacks are becoming a huge concern for thousands of organizations globally. All over the world, threat actors take advantage of security vulnerabilities and encrypt data belonging to all sorts of organizations: from private…
CISA Warning! 8 Actively Exploited Flaws in Samsung and D-Link Devices
The US Cybersecurity and Infrastructure Security Agency (CISA) added 6 flaws affecting Samsung smartphones to its Known Exploited Vulnerabilities Catalog. On the same day, CISA also added 2 other vulnerabilities impacting D-Link devices. Although security specialists released patches for all…
Charming Kitten’s POWERSTAR Malware Boosts its Techniques
Cybersecurity researchers recently published an advisory on the evolution of POWERSTAR backdoor malware and advanced spear-phishing techniques used by Charming Kitten, a threat actor believed to be from Iran. The most recent version of POWERSTAR has improved operational security measures,…
HHS Data at Risk After MOVEit Hack Impacted Third-Party Vendors
A third-party security breach at the Department of Health and Human Services (HHS) may have exposed the personal information of at least 100,000 people, a department official stated last week, making it the latest US government agency to be hit…