Bleeping Computer
The U.S. Department of Health and Human Services (HHS) warned hospitals this week to patch the critical 'Citrix Bleed' Netscaler vulnerability actively exploited in attacks.
HACKRead
The targets included the Equipment used by the Municipal Water Authority of Aliquippa, Pennsylvania and Brewmation, a New York-based company specializing in turnkey brewing and distilling equipment.
SecurityWeek
Members of Congress asked the DoJ to investigate how hackers breached the Municipal Water Authority of Aliquippa in Pennsylvania.
SecurityWeek
The US has announced sanctions against North Korean cyberespionage group Kimsuky over its intelligence gathering activities.
The Hacker News
OFAC sanctions North Korea-linked group Kimsuky and 8 agents for supporting WMD programs.
The Record
The U.S. Department of Health and Human Services is warning hospitals and healthcare facilities across the country to patch a vulnerability known as “Citrix Bleed” that is being used in attacks by ransomware gangs.
The Record
The U.S. partnered with several nations in the Pacific to hand down sanctions on North Korea — particularly the country’s Kimsuky cyber espionage group — after the country launched a surveillance satellite last week.
CSO
Threat actors are combining RustBucket loader with KandyKorn payload to effect an evasive and persistent RAT attack.
The Hacker News
Lazarus Group's evolving cyber tactics target macOS systems by combining elements from multiple malware campaigns for better effectiveness and to avoi
SecurityWeek
Hacktivists should be treated as malicious hackers because the distance between hacking/activism, malevolence, and damage is too small and too vague.
The Record
The AlphV/Black Cat group claimed it breached Fidelity National Financial, a Fortune 500 provider of title insurance for property sales.
The Hacker News
North Korean hackers, aka Diamond Sleet, spread a trojanized version of CyberLink's legit app.
CyberSecurity Dive
LockBit 3.0 affiliates targeted a unit of Boeing and federal authorities have alerted almost 300 organizations they are vulnerable to attack.
Security Affairs
Citrix urges admins to kill NetScaler user sessions after patching their appliances against the CVE-2023-4966 Citrix Bleed vulnerability.
The Hacker News
LockBit ransomware affiliates are exploiting the Citrix NetScaler flaw ("Citrix Bleed") to hijack user sessions and gain unauthorized access.
The Record
Microsoft has uncovered a supply chain attack by North Korean hackers who attached a malicious file to a CyberLink photo and video editing application installer.
Bleeping Computer
Citrix reminded admins today that they must take additional measures after patching their NetScaler appliances against the CVE-2023-4966 'Citrix Bleed' vulnerability to secure vulnerable devices against attacks.
The Record
The bug has caused alarm for weeks as cybersecurity experts warned that many government agencies and major companies were leaving their appliances exposed to the internet — opening themselves up to attacks.
SecurityWeek
Over 250 organizations take part in GridEx VII, the largest North American exercise focusing on the security of the electrical grid.
The Record
Ukraine's anti-corruption agency sent shockwaves through the country's cybersecurity agencies on Monday morning, when it announced that it had launched an investigation into the procurement practices of a handful of its top cyber officials.
DarkReading
The feds seem to know all about the hacking group brazenly breaking into corporate networks; so why are enterprise teams left on their own to stop their cybercrimes?
SecurityWeek
Australian submarines powered by U.S. nuclear technology is a likely target of state-sponsored hackers, the nation’s digital spy agency said.
Bleeping Computer
The Lockbit ransomware attacks use publicly available exploits for the Citrix Bleed vulnerability (CVE-2023-4966) to breach the systems of large organizations, steal data, and encrypt files.
CyberNews
Hackers potentially linked to Russia’s military intelligence carried out a series of highly coordinated cyberattacks on Danish energy infrastructure, a report says.
Security Affairs
The LockBit ransomware group published data allegedly stolen from the aerospace giant Boeing in a recent attack.
DarkReading
Meanwhile, CISA joins the call to patch CVE-2023-4966 immediately amid reports of mass-exploit activity; at least 5,000 orgs remain exposed.
The Hacker News
Russian hackers Sandworm caused a power outage in Ukraine by targeting an electrical substation.
The Hacker News
Iranian hacker group Imperial Kitten launches cyberattacks on transportation, logistics, and tech sectors, including Israel.
CyberScoop
Microsoft and Mandiant researchers believe Iranian hackers were not prepared for the initial Hamas attack.
Bleeping Computer
Russian state hackers have evolved their methods for breaching industrial control systems by adopting living-off-the-land techniques that enable reaching the final stage of the attack quicker and with less resources
CyberScoop
The notorious Russian hacking group known as Sandworm took down a substation that caused a brief outage, according to a new Mandiant report.
Infosecurity News
Sandworm conducted a disruptive cyber-attack targeting a Ukrainian critical infrastructure organization in late 2022
Cyber Security News
Google Calendar RAT is a proof of concept for Command & Control . It's useful when setting up a full red teaming infrastructure.
The Record
Researchers from Mandiant reported on an October 2022 incident involving Russian nation-state hackers that included multiple rare or previously unseen elements.
CSO
Google Cloud forecasts continued use of gen AI to create smarter campaigns while cybersecurity pros will use the same tools to defend and close the skills gap.
CyberSecurity Dive
CISA urged organizations to patch, mitigate and report any positive findings as Citrix NetScaler ADC and NetScaler Gateway users remain exposed to session hijack.
The Record
Two prominent Chinese government hacking groups are targeting at least 24 Cambodian government organizations through cloud backup services, according to a new report.
The Hacker News
Google warns of hackers exploiting its Calendar service to host command-and-control (C2) infrastructure.
DarkReading
Posing as fellow engineers, the North Korean state-sponsored cybercrime group Lazarus tricked crypto-exchange developers into downloading the hard-to-detect malware.
The Record
The zero-day bugs affecting products from Citrix and Apache have critical severity scores and require immediate attention, experts warned.
DarkReading
The obscure Kazuar backdoor used by Russian attack group Turla has resurfaced, and it's more dangerous than ever.
Bleeping Computer
Threat actors are leveraging the 'Citrix Bleed' vulnerability, tracked as CVE-2023-4966, to target government, technical, and legal organizations in the Americas, Europe, Africa, and the Asia-Pacific region.
SecurityWeek
Multiple threat actors are exploiting CVE-2023-4966, aka Citrix Bleed, a critical vulnerability in NetScaler ADC and Gateway.
Ars Technica
By some estimates, 20,000 devices have already been hacked.
CyberSecurity Dive
Microsoft researchers described Octo Tempest, or Oktapus, as one of the most dangerous financial criminal groups currently in operation.
SecurityWeek
Cybersecurity techniques and penetration testing used in the field of weapons systems can provide valuable lessons for ICS/OT security.
The Record
Octo Tempest, a hacking group also known as Scattered Spider, has been in the limelight since its attack on MGM Resorts left parts of Las Vegas paralyzed for days and cost the casino giant an estimated $100 million.
SecurityWeek
Critical infrastructure defenders should urgently work to find and remove traces of Volt Typhoon, a Chinese government-backed hacking team.
Bleeping Computer
A proof-of-concept (PoC) exploit is released for the 'Citrix Bleed' vulnerability, tracked as CVE-2023-4966, that allows attackers to retrieve authentication session cookies from vulnerable Citrix NetScaler ADC and NetScaler Gateway appliances.
The Hacker News
Proof-of-concept (PoC) exploits have been publicly released for the recently discovered vulnerabilities in VMware Aria Operations, Citrix NetScaler.
SecurityWeek
SecurityWeek’s 2023 ICS Cybersecurity Conference kicks off in Atlanta with presentations on a wide range of topics.
CyberSecurity Dive
The company warned of session hijacking and targeted attacks against a critical vulnerability.
Bleeping Computer
Citrix warned admins today to secure all NetScaler ADC and Gateway appliances immediately against ongoing attacks exploiting the CVE-2023-4966 vulnerability.
SecurityWeek
The District of Columbia Board of Elections says full voter roll compromised in a recent data breach at hosting provider DataNet.
Bleeping Computer
The District of Columbia Board of Elections (DCBOE) says that a threat actor who breached a web server operated by the DataNet Systems hosting provider in early October may have obtained access to the personal information of all registered voters.
The Record
Officials at Washington, D.C.’s Board of Elections (DCBOE) confirmed that hackers accessed the city’s voter rolls, which includes personal information such as partial Social Security numbers and driver’s license numbers.
The Hacker News
U.S. government seizes 17 website domains and confiscates $1.5 million linked to North Korean IT workers in a massive global fraud scheme
Ars Technica
If you run a Netscaler ADC or Gateway, assume it's compromised and take action ... fast.
DarkReading
The state-sponsored threat actors (aka APT34, Crambus, Helix Kitten, or OilRig) spent months seemingly taking whatever government data they wished, using never-before-seen tools.
Cyber Security News
Two critical security vulnerabilities, namely CVE-2023-4966 and CVE-2023-4967, have been discovered in NetScaler ADC and NetScaler Gateway.
The Hacker News
Korean hacking group Lazarus Group targets defense industry and nuclear engineers with fake job interviews, using trojanized VNC apps to steal data an
The Hacker News
disclosed critical security flaw in NetScaler ADC and Gateway appliances that can hijack sessions and bypass multi-factor authentication.
Bleeping Computer
A critical vulnerability tracked as CVE-2023-4966 in Citrix NetScaler ADC/Gateway devices has been actively exploited as a zero-day since late August, security researchers announced.
CyberSecurity Dive
Citrix issued the patch on Oct. 10 for critical vulnerabilities in Netscaler ADC and Netscaler Gateway, but Mandiant is urging users to terminate all sessions.
SecurityWeek
Mandiant says the recently patched Citrix NetScaler vulnerability CVE-2023-4966 had been exploited as zero-day since August.
CyberScoop
Beijing's growing sophistication in cyberspace is making China an increasingly potent adversary, according to Kevin Mandia.
The Hacker News
WinRAR users, be alert! Pro-Russian hackers exploited a recent vulnerability in the software. Ensure your version is updated!
DarkReading
Mandiant's John Hultquist says to expect anti-Israel influence and espionage campaigns to ramp up as the war grinds on.
DarkReading
An unprecedented collaboration by various APTs within the DPKR makes them harder to track, setting the stage for aggressive, complex cyberattacks that demand strategic response efforts, Mandiant warns.
SecurityWeek
US, Ukraine, and Israel remain the most heavily attacked by cyberespionage and cybercrime threat actors, Microsoft says.
CyberSecurity Dive
While it might be easier for an organization to build its core cybersecurity system from one company, that may not provide the best option.
SecurityWeek
New RSA encryption attack, Meta’s AI privacy safeguards, and ShinyHunters hackers’ guilty plea in the United States
The Hacker News
BlackTech, a notorious state-backed hackers from China, are using router backdoors to quietly to breach government, tech, and media sectors in the U.S
SecurityWeek
Cloud security firm Sysdig enhanced the cloud detection and response capabilities of its CNAPP offering with a realtime cloud attack graph.
CyberSecurity Dive
A longstanding group, identified as BlackTech, uses custom malware to evade detection and hack into international subsidiaries of U.S. and Japanese firms.
Bleeping Computer
A joint cybersecurity advisory by the FBI, NSA, CISA, and the Japanese NISC (cybersecurity) and NPA (police) sheds light on the techniques the Chinese threat actors known as BlackTech use to attack Japanese and U.S. organizations.
Infosecurity News
Russia-backed cyber-attacks in Ukraine jumped 123% in the first half of 2023 – but were less critical than in 2022
The Hacker News
Researchers uncovered a new advanced backdoor, 'Deadglyph,' by Stealth Falcon hackers, which combines two languages for cyber espionage.
SecurityWeek
Noteworthy stories that might have slipped under the radar: Snowden file analysis, Yubico starts trading, election hacking event.
Infosecurity News
Experts at the mWISE conference discussed who is behind the surge in zero-day exploits
DarkReading
A financially motivated threat actor uses known vulnerabilities, ordinary TTPs, and off-the-shelf tools to exploit the unprepared, highlighting the fact that many organizations still don't focus on the security basics.
CyberSecurity Dive
Forrester's Allie Mellen calls it a massive win for Cisco's security business, but said security leaders are concerned about potential SIEM quality degradation.
The Hacker News
Gold Melody, the financially motivated cyber group, is selling access to compromised organizations for ransomware attacks.
Infosecurity News
A new legal requirement for medical devices in the US will introduce the first-ever SBOM mandate for the consumer market
Cyber Security News
Google aims to change cybersecurity, particularly in security operations (SecOps), where overburdened teams battle with emerging threats with outdated methods and tools.
Infosecurity News
China is sponsoring not just ever more highly sophisticated espionage campaigns, but also venturing into cybercrime and disinformation
Infosecurity News
FBI director Christopher Wray said that partnerships with the private sector have changed the FBI’s approach to fighting cybercrime
The Hacker News
Software company Retool suffered a breach with 27 customer accounts hacked after an SMS-based attack. Google Account sync blamed for the breach, turni
The Hacker News
UNC3944 threat actor now turns to ransomware attacks, targeting critical systems. Understand their tactics, and learn how to protect your organization
The Record
Hackers connected to a group known to researchers by names like "Scattered Spider," "0ktapus," and UNC3944 have moved beyond targeting telecommunication firms and tech companies into attacks on hospitality, retail, media and financial services.
Bleeping Computer
This week's big news is the extortion attacks on the Caesars and MGM Las Vegas casino chains, with one having already paid the ransom and the other still facing operational disruptions.
SecurityWeek
The financially motivated UNC3944 group that hacked MGM has hit at least 100 organizations, mainly in the US and Canada.
CyberSecurity Dive
AlphV may have used tactics similar to social engineering attacks disclosed by Okta in regulatory filing.
Cyber Security News
UNC3944 has frequently employed phone-based social engineering and SMS phishing attacks to gain credentials and escalate access to target organizations.
Bleeping Computer
An affiliate of the BlackCat ransomware group, also known as APLHV, is behind the attack that disrupted MGM Resorts' operations, forcing the company to shut down IT systems.
Bleeping Computer
An affiliate of the BlackCat ransomware group, also known as APLHV, is behind the attack that disrupted MGM Resorts' operations, forcing the company to shut down IT systems.
Ars Technica
Slot machines and hotel room key cards stopped working at MGM casinos on the Strip.
CyberSecurity Dive
Security researchers link the threat group Scattered Spider to a wave of malicious activity as Caesars Entertainment confirms social engineering attack in regulatory filing.
The Hacker News
A high-severity Time-of-Check to Time-of-Use (TOCTOU) (CVE-2023-27470) in N-Able's Take Control Agent could give hackers SYSTEM privileges.
The Record
Without specifying what such a system would look like or how it would behave, members of the Cybersecurity Advisory Committee said the federal government should work toward "the 24/7 consideration and provisioning of cyber alerts."
Ars Technica
With 70 zero-days uncovered so far this year, 2023 is on track to set a new record.
SecurityWeek
APTs exploited vulnerabilities in Zoho ManageEngine and Fortinet VPNs to hack an aerospace organization in early January 2023.
Ars Technica
Google researchers say currently unfixed vulnerability affects a popular software package.
Bleeping Computer
Google's Threat Analysis Group (TAG) says North Korean state hackers are again targeting security researchers in attacks using at least one zero-day in an undisclosed popular software.
The Hacker News
Beware! Okta warns of social engineering attacks aimed at admin credentials. Threat actors are manipulating multi-factor authentication settings.
CyberSecurity Dive
Mandiant uncovered a months-long cyber espionage campaign targeting high value government entities and technology firms in the U.S. and abroad.
The Hacker News
Five Eyes intelligence alliance reveals a Russian state-sponsored actor, Sandworm, behind mobile malware 'Infamous Chisel' targeting Ukrainian
Ars Technica
When UNC4841 infected gov't and military networks, it was just getting started.
Infosecurity News
The campaign deployed many malware families, including Skipjack, DepthCharge, Foxglove and Foxtrot
CSO
New AI-enabled capabilites aim to simplify threat analysis and hunting, and make security personnel more productive.
DarkReading
"Operation Duck Hunt" is not likely to eliminate the initial access botnet forever, but the proactive removal of the malware from victim machines by law enforcement is one of the largest and most significant efforts of its kind.
CyberSecurity Dive
Google Cloud is bringing Mandiant’s threat hunting intelligence to customers’ Chronicle environments and infusing Duet AI across its security portfolio.
The Hacker News
Suspected Chinese hacking group UNC4841 exploited zero-day flaw in Barracuda ESG appliances to target government, military, and tech companies.
SecurityWeek
Chinese threat actor exploiting Barracuda ESG appliances deployed persistence mechanisms in preparation for remediation efforts.
Bleeping Computer
Suspected Chinese hackers disproportionately targeted and breached government and government-linked organizations worldwide in recent attacks targeting a Barracuda Email Security Gateway (ESG) zero-day, with a focus on entities across the Americas.
The Record
Chinese hackers used a recently patched vulnerability in security products from Barracuda Networks to conduct attacks against dozens of government organizations across the U.S. and Asia.
Ars Technica
What's the point of locks when hackers can easily get the keys to unlock them?
Infosecurity News
Feds warn that patching will not rid system of APT group
The Hacker News
Alert! FBI warns that the recent patches for Barracuda Networks Email Security Gateway are ineffective against a critical flaw.
Security Affairs
The FBI warned that patches for a critical Barracuda ESG flaw CVE-2023-2868 are “ineffective” and patched appliances are still being hacked. The Federal Bureau of Investigation warned that security patches for critical vulnerability CVE-2023-2868 in Barracuda Email Security Gateway (ESG) are “ineffective.” According to the feds, threat actors are still hacking the patched appliances in […]
Bleeping Computer
The Federal Bureau of Investigation warned that patches for a critical Barracuda Email Security Gateway (ESG) remote command injection flaw are "ineffective," and patched appliances are still being compromised in ongoing attacks.
Bleeping Computer
We're down to the final weeks of registration for mWISE, the community-focused cybersecurity conference from Mandiant. Learn more from Mandiant about the available attendance options and what you should expect.
SecurityWeek
The FBI says that the patches Barracuda released in May for an exploited ESG zero-day vulnerability (CVE-2023-2868) were not effective.
CyberSecurity Dive
The FBI said users need to isolate and replace affected appliances as threat actors continue to target the remote command injection vulnerability.
The Hacker News
FBI alerts of a potential cash out by North Korean actors, linked to $40M in stolen cryptocurrency. This group is currently holding 1,580 bitcoins
The Record
Symantec says it found abuse of the legitimate Cobra DocGuard software by a previously unknown advanced persistent threat (APT) group that it's labeling as Carderbee.
DarkReading
Cyberattackers are slow to implement AI in their attack chains, according to Mandiant's analysis.
CyberScoop
The use of AI for malign purposes is limited but growing and maturing in key ways, researchers with Google's Mandiant said Thursday.
Cyber Security News
Citrix was previously discovered with a Zero-Day vulnerability on their Citrix NetScaler Application Delivery Controller (ADC) that allowed threat actors to perform remote code execution.
Bleeping Computer
Get ready for the mWISE cybersecurity conference from Mandiant, taking place September 18-20, 2023 in Washington, DC. mWISE just announced new keynote panels focused on Artificial Intelligence (AI) and advanced adversaries.
Security Affairs
A threat actor has compromised roughly 2,000 Citrix NetScaler servers exploiting a remote code execution tracked as CVE-2023-3519. In July Citrix warned customers of a critical vulnerability, tracked as CVE-2023-3519 (CVSS score: 9.8), in NetScaler Application Delivery Controller (ADC) and Gateway that is being actively exploited in the wild The vulnerability CVE-2023-3519 (CVSS score: 9.8) is a code injection that […]
The Hacker News
1,900+ Citrix NetScaler instances breached in a massive attack exploiting critical vulnerability. Hackers used automated methods to install web shells
The Record
Alarms have been raised about several vulnerabilities affecting products from Citrix that are being exploited widely by a variety of threat actors.
Bleeping Computer
A threat actor has compromised close to 2,000 thousand Citrix NetScaler servers in a massive campaign exploiting the critical-severity remote code execution tracked as CVE-2023-3519.
Bleeping Computer
Mandiant has released a scanner to check if a Citrix NetScaler Application Delivery Controller (ADC) or NetScaler Gateway Appliance was compromised in widespread attacks exploiting the CVE-2023-3519 vulnerability.
Infosecurity News
China-linked APT group has been blamed for the attacks
SecurityWeek
MoustachedBouncer is a cyberespionage group that targets foreign diplomats in Belarus via ISP adversary-in-the-middle attacks.
DarkReading
The backdoor is one of several that researchers have observed China's UNC4841 dropping on Barracuda's email security appliances, in a spiraling cyber-espionage campaign that has affected organizations in 16 countries so far.
CSO
The solution enables governments to build cybersecurity skills and capabilities and facilitate knowledge sharing and collaboration.
Security Affairs
The U.S. Cybersecurity & Infrastructure Security Agency (CISA) observed a new backdoor, named Whirlpool, in attacks on Barracuda ESG appliances. The U.S. Cybersecurity & Infrastructure Security Agency (CISA) has discovered a new backdoor, named Whirlpool, that was employed in attacks targeting Barracuda ESG devices. At the end of May, the network security solutions provider Barracuda warned […]
SecurityWeek
Identity-based attacks have soared in the past year, according to CrowdStrike’s 2023 Threat Hunting Report.
Security Affairs
Researchers observed threat actors that are using an open-source rootkit called Reptile in attacks aimed at systems in South Korea. Reptile is an open-source kernel module rootkit that was designed to target Linux systems, unlike other rootkits, it also offers a reverse shell. The malware supports port knocking, it opens a specific port on an infected system […]
The Hacker News
🔒 Threat actors are targeting Linux systems in South Korea using the open-source rootkit Reptile.
DarkReading
The prolific APT, also known as OilRig and MuddyWater, was caught targeting an IT company's government clients in the region, with the aim of carrying out cyber espionage.
Bleeping Computer
What's in store for mWISE 2023? 80+ curated sessions. 90+ hand-picked speakers. 7 session tracks. It's taking place September 18-20, 2023 in Washington, DC. Register now and get $300 off a full conference pass, which includes access to all the sessions, evening receptions, and events.
The Record
A Russia-based hacking group implicated in previous attacks on governments is shifting its tactics due to increased public reporting by security researchers and tech giants like Microsoft and Google.
DarkReading
A China-nexus cyber espionage campaign rages on with the fourth backdoor to surface in the wild that takes advantage of the CVE-2023-2868 zero-day security bug — with severe threat of lateral movement, CISA warns.
Infosecurity News
Chinese threat actor used malware in attacks
Security Affairs
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warns of threat actors deploying the SUBMARINE Backdoor in Barracuda ESG attacks. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) published an alert on a malware variant, tracked as SUBMARINE Backdoor, that was employed in attacks exploiting the flaw CVE-2023-2868 in Barracuda Email Security Gateway (ESG) appliances. The vulnerability […]
The Hacker News
U.S. cybersecurity agency CISA has revealed details of "SUBMARINE," a novel persistent backdoor deployed in the Barracuda Email Security Gateway (ESG)
Bleeping Computer
CISA says new malware known as Submarine was used to backdoor Barracuda ESG (Email Security Gateway) appliances by exploiting a now-patched zero-day bug.
SecurityWeek
Weekly cybersecurity news roundup of noteworthy stories that might have slipped under the radar for the week of July 24, 2023.
CyberSecurity Dive
The incident response firm only has insights into one of a handful of downstream victims, but the research suggests the damage may be limited.
CSO
Mandiant research has attributed the hack to UNC4899, a Democratic People’s Republic of Korea (DPRK) threat actor, with a history of targeting companies within the cryptocurrency vertical.
Infosecurity News
Mandiant said the compromise resulted from a sophisticated spear-phishing campaign
The Hacker News
North Korean state actors linked to the RGB have been identified in the JumpCloud hack! An OPSEC mistake exposed their IP address.
The Record
Researchers at the Australian Strategic Policy Institute, an independent think tank, say social media accounts linked to an online casino also appear to be connected to an influence operation based in China.
DarkReading
A widespread disinformation campaign aimed at Americans wasn't that effective, but it was certainly creative, even slipping in influence articles to legitimate news outlets like AZCentral.com.
DarkReading
KillNet is amassing members, capabilities, and know-how, as it looks to consolidate cybercrime power under its own umbrella.
Bleeping Computer
A hacking unit of North Korea's Reconnaissance General Bureau (RGB) was linked to the JumpCloud breach after the attackers made an operational security (OPSEC) mistake, inadvertently exposing their real-world IP addresses.
The Hacker News
Zero-day vulnerabilities found in Atera remote monitoring software's Windows Installers can lead to privilege escalation attacks
CyberSecurity Dive
Researchers warn thousands of the Citrix NetScaler devices remain vulnerable to attack.
The Record
A new Chinese influence campaign used newswire services, staged protests, and billboard ads to spread pro-Beijing propaganda in the U.S., cybersecurity researchers said Monday.
SecurityWeek
Weekly cybersecurity news roundup that provides a summary of noteworthy stories that might have slipped under the radar
Bleeping Computer
Threat actors have breached the network of a U.S. organization in the critical infrastructure sector after exploiting a zero-day RCE vulnerability currently identified as CVE-2023-3519, a critical-severity issue in NetScaler ADC and Gateway that Citrix patched this week.
Bleeping Computer
The US government is warning that threat actors breached the network of a U.S. organization in the critical infrastructure sector after exploiting a zero-day RCE vulnerability currently identified as CVE-2023-3519, a critical-severity issue in NetScaler ADC and Gateway that Citrix patched this week.
The Hacker News
DDoS botnets are exploiting the CVE-2023-28771 vulnerability in Zyxel devices to gain remote control and launch devastating attacks.
DarkReading
Analysts continue piecing together who breached JumpCloud, why, and what else they've managed to pull off.
CyberScoop
Anonymous Sudan appears to be affiliated with Killnet, a pro-Russian hacktivist persona that emerged in late 2021 or early 2022.
CyberSecurity Dive
Security researchers attributed the highly targeted attack to a cryptocurrency-seeking APT actor linked to the North Korean government.
SecurityWeek
Estée Lauder has confirmed suffering a data breach just as two ransomware groups claimed to have targeted the company
Bleeping Computer
US-based enterprise software company JumpCloud was breached by North Korean Lazarus Group hackers, according to security researchers at SentinelOne and CrowdStrike.
Bleeping Computer
The Chinese state-backed APT41 hacking group is targeting Android devices with two newly discovered spyware strains dubbed WyrmSpy and DragonEgg by Lookout security researchers.
Bleeping Computer
Two ransomware actors, ALPHV/BlackCat and Clop, have listed beauty company Estée Lauder on their data leak sites as a victim of separate attacks.
Bleeping Computer
Two ransomware actors, ALPHV/BlackCat and Clop, have listed beauty company Estée Lauder on their data leak sites as a victim of separate attacks.
The Hacker News
APT41, a China-linked nation-state actor, has been linked to two new Android spyware strains, WyrmSpy and DragonEgg.
The Record
The Russian hacking group Turla is attacking Ukrainian defense forces with spying malware, according to new research from the country’s computer emergency response team (CERT-UA).
DarkReading
The company's AI for security operations centers is now available for technology integrations, as the industry looks to large language models.
DarkReading
Two separate threat actors are using poisoned USB drives to distribute malware in cyber-espionage campaigns targeting organizations across different sectors and geographies.
The Record
Symantec’s Threat Hunter Team said it observed the group deploying a variant of the Sardonic backdoor before delivering ransomware known as Black Cat or AlphV.
Bleeping Computer
The new NoEscape ransomware operation is believed to be a rebrand of Avaddon, a ransomware gang that shut down and released its decryption keys in 2021.
Bleeping Computer
Organizers at mWISE, the anticipated cybersecurity conference from Mandiant, now part of Google Cloud, have released this year's session catalog. Learn more from Mandiant about the upcoming mWise sessions.
The Hacker News
Learn more about the SOGU and SNOWYDRIVE campaigns targeting public and private sector entities worldwide.
SecurityWeek
Weekly cybersecurity news roundup: satellite hacking, security firm lawsuit, cloud attacks, and vulnerability patches.
CyberSecurity Dive
The slow-moving disaster has ensnared some of the world's largest enterprises. Cybersecurity experts expect further damage to come.
Cyber Security News
Russia's invasion of Ukraine on February 24, 2022, followed escalating cyber operations, categorized into six phases, by Russian troops amassed at the border.
The Hacker News
New report reveals a multistage cyber intrusion campaign targeting Ukraine and Poland since April 2022.
Infosecurity News
Mandiant has observed that the same playbook has been used by various Russian threat actors since the breakout of war in Ukraine, making them likely to be part of a GRU-led deliberate strategy
DarkReading
Killnet has been more effective at generating headlines than in executing attacks or wreaking any real damage, experts say.
Infosecurity News
Threat actors forged authentication tokens to access email
The Hacker News
U.S. CISA warns of critical vulnerabilities in Rockwell Automation ControlLogix ENIP modules, allowing remote code execution and DoS attacks.
Bleeping Computer
What's old is new again, with researchers seeing a threefold increase in malware distributed through USB drives in the first half of 2023
DarkReading
Kernel mode driver can download second-stage payload directly to memory, allowing threat actors to evade endpoint detection and response tools.
DarkReading
Foreign state-sponsored actors likely had access to privileged state emails for weeks, thanks to a token validation vulnerability.
Bleeping Computer
SonicWall warned customers today to urgently patch multiple critical vulnerabilities impacting the company's Global Management System (GMS) firewall management and Analytics network reporting engine software suites.
CyberSecurity Dive
U.S. officials alerted Microsoft about what emerged as a targeted, monthlong hacking campaign.
SecurityWeek
Microsoft has revoked signed drivers used for post-exploitation activity, in many cases by Chinese cybercriminals.
DarkReading
Investment will drive company-wide expansion across BloodHound Enterprise, BloodHound FOSS, consulting and training programs, and research and development.
Trend Micro
In this entry, we discuss the findings of our investigation into a piece of a signed rootkit, whose main binary functions as a universal loader that enables attackers to directly load a second-stage unsigned kernel module.
DarkReading
Iran-linked APT35 group crafted specific Mac malware when targeting a member of the media with new tools to add backdoors.