CyberScoop
Arizona woman arrested and charged in North Korean IT worker scheme
Christina Chapman facilitated remote work and financial transfers for North Koreans tied to that nation’s weapons development programs, according to the U.S. government.
The Cyber Express
Russian Hackers Used Two New Backdoors to Spy on European Foreign Ministry
Researchers recently uncovered two new backdoors implanted within the infrastructure of a European Ministry of Foreign Affairs (MFA) and its
SecurityWeek
Palo Alto Networks Teams Up With IBM, Acquires QRadar SaaS Assets
Palo Alto Networks and IBM have announced a significant partnership to jointly provide cybersecurity solutions.
The Cyber Express
Microsoft Addresses Zero-Day Vulnerability Exploited by QakBot Malware
Microsoft patched a zero-day vulnerability exploited by attackers to distribute QakBot and other malware payloads on susceptible Windows systems. Identified
The Hacker News
Microsoft Patches 61 Flaws, Including Two Actively Exploited Zero-Days
Microsoft has patched 61 new security flaws, including two zero-days actively exploited in the wild.
SC Magazine
Microsoft fixes exploited Qakbot-delivering 0-day in May Patch Tuesday
In this month’s release, Redmond patched 60 CVEs including two other zero-days and a SharePoint Server remote code execution vulnerability rated critical.
Cyber Security News
Alert! Microsoft Fixes 60 Vulnerabilities With 2 Actively Exploited Zero-Days
Microsoft fixed 60 vulnerabilities in its Patch Tuesday release in May 2024, including 2 zero-day vulnerabilities actively exploited in the wild
Bleeping Computer
Microsoft fixes Windows zero-day exploited in QakBot malware attacks
Microsoft has fixed a zero-day vulnerability exploited in attacks to deliver QakBot and other malware payloads on vulnerable Windows systems.
Bleeping Computer
Microsoft May 2024 Patch Tuesday fixes 3 zero-days, 61 flaws
Today is Microsoft's May 2024 Patch Tuesday, which includes security updates for 61 flaws and three actively exploited or publicly disclosed zero days.
DarkReading
Dangerous Google Chrome Zero-Day Allows Sandbox Escape
Exploit code is circulating for CVE-2024-4761, disclosed less than a week after a similar security vulnerability was disclosed as being used in the wild.
SecurityWeek
Google Patches Second Chrome Zero-Day in One Week
Google has patched CVE-2024-4761, the second exploited vulnerability addressed by the company within one week.
SecurityWeek
NATO Draws a Cyber Red Line in Tensions With Russia
Weakening liberal democracies and weakening the NATO alliance are conjoined in the hybrid war that Russia is conducting against Ukraine.
.webp)
Cyber Security News
Ascension Healthcare Systems Hacked, Hospitals Diverting Emergency Service
Ascension is one of the most extensive charity healthcare systems in the US. It has been hit hard by a ransomware attack.
The Record
'Russian' hackers deface potentially hundreds of local British news sites
An infiltrator posted a breaking news story titled "PERVOKLASSNIY RUSSIAN HACKERS ATTACK" on websites owned by Newsquest Media Group.
CSO
Google Chrome gets a patch for actively exploited zero-day vulnerability
Details of the use-after-free memory vulnerability were not publicly released, but Google says it’s aware an exploit for the bug exists.
Bleeping Computer
Ascension redirects ambulances after suspected ransomware attack
Ascension, a major U.S. healthcare network, is diverting ambulances from several hospitals due to a suspected ransomware attack that has been causing clinical operation disruptions and system outages since Wednesday.
DarkReading
Ascension Healthcare Suffers Major Cyberattack
The attack cut off access to electronic healthcare records (EHRs) and ordering systems, plunging the organization and its health services into chaos.
SecurityWeek
Healthcare Giant Ascension Hacked, Hospitals Diverting Emergency Service
Ascension is scrambling to contain a significant hack causing disruption and “downtime procedures” at hospitals around the country.
DarkReading
Cybersecurity Races to Unmask New Wave of AI Deepfakes
Kevin Mandia, CEO of Mandiant at Google Cloud, calls for watermarks as the industry braces for a barrage of mind-bending AI-generated fake audio and video.
SecurityWeek
Exploited Chrome Zero-Day Patched by Google
A Chrome 124 update patches the second Chrome zero-day that has been found to be exploited in malicious attacks in 2024.
CyberSecurity Dive
Some Ascension hospitals diverting emergency care after cybersecurity incident
The health system’s electronic health records, MyChart patient portal and several systems for ordering tests and medications are unavailable, Ascension said.
The Cyber Express
Ascension Healthcare Hit by Cyberattack: Patients Wait Hours, Chaos Ensues
Ascension, one of the largest nonprofit healthcare systems in the United States, is facing disruptions in clinical operations due to
CyberSecurity Dive
Ascension hit by cybersecurity incident disrupting clinical operations
The major nonprofit health system detected “unusual activity” on some network systems Wednesday.
The Cyber Express
Google Brings Gemini AI to Cybersecurity
Google has brought together its Gemini AI model with its Mandiant cybersecurity unit and VirusTotal threat Intelligence to enhance threat
CyberNews
Ascension Catholic hospitals in midst of possible cyberattack
Non-profit Ascension health systems tells business partners to disconnect from its networks after a suspected cyberattack disrupts operations at facilities across the US.
SC Magazine
Cybersecurity incident impacts operations at Ascension hospitals
Large Catholic nonprofit hired Mandiant to investigate what’s now an unspecified cybersecurity incident that has reportedly forced hospitals in at least Maryland, Michigan, Kansas, and Wisconsin to shut down its systems.
Bleeping Computer
Ascension healthcare takes systems offline after cyberattack
Ascension, one of the largest private healthcare systems in the United States, has taken some of its systems offline to investigate what it describes as a "cyber security event."
The Record
Catholic health system Ascension warns of disruptions following cyberattack
The nonprofit health provider published a notice saying it discovered unusual activity on network systems and immediately began an investigation.
Security Affairs
MITRE attributes the recent attack to China-linked UNC5221
MITRE published more details on the recent security breach, including a timeline of the attack and attribution evidence.
The Hacker News
APT42 Hackers Pose as Journalists to Harvest Credentials and Access Cloud Data
APT42, an Iranian state-backed hacking group, is leveling up its social engineering tactics. They're posing as journalists and event organizers to bui
The Hacker News
China-Linked Hackers Used ROOTROT Webshell in MITRE Network Intrusion
MITRE, a renowned research firm, has revealed alarming details about a recent cyber attack that dates back to late 2023.
%20(1)%20(1).webp)
Cyber Security News
MITRE Shares Details on Nation-State Hackers' Intrusion into Research Network
The intrusion, believed to have been carried out by a Chinese threat actor group known as UNC5221, exploited two zero-day vulnerabilities.
CyberSecurity Dive
China-linked attackers are successfully targeting network security devices, worrying officials
Espionage groups linked to China are heavily exploiting zero days, focusing on devices that lack endpoint detection and response capabilities, one expert said.
SecurityWeek
MITRE Hack: China-Linked Group Breached Systems in December 2023
MITRE has shared more details on the recent hack, including the new malware and a timeline of the attacker’s activities.
CSO
Google launches Google Threat Intelligence at RSA Conference
The new addition to Google Cloud Security is designed to give security teams information to inform approaches to protecting against external threats, managing attack surfaces, and mitigating digital risks.
Infosecurity News
#RSAC: Threat Actors Weaponizing Hacktivism for Financial Gain
Recorded Future’s Alexander Leslie highlights the increasingly blurred lines between hacktivism, financial cybercrime and nation-state activities during the RSA Conference 2024
SecurityWeek
Google Debuts New Security Products, Hyping AI and Mandiant Expertise
Google rolls out new threat-intel and security operations products and looks to the magic of AI to tap into the booming cybersecurity market.
SecurityWeek
Iranian Cyberspies Hit Targets With New Backdoors
Iranian state-sponsored group APT42 is targeting NGOs, government, and intergovernmental organizations with two new backdoors.
CyberSecurity Dive
Change Healthcare cyberattack: 5 technical takeaways from UnitedHealth CEO’s testimony
Change Healthcare was running on legacy technology, which magnified the ransomware attack’s impact and hampered recovery efforts, Andrew Witty said.
SC Magazine
RSA Conference 2024: What to expect
RSA Conference will tackle everything AI, but will also go deep on government policy, innovative new security solutions and explore "The Art of Possible."
Bleeping Computer
Iranian hackers pose as journalists to push backdoor malware
The Iranian state-backed threat actor tracked as APT42 is employing social engineering attacks, including posing as journalists, to breach corporate networks and cloud environments of Western and Middle Eastern targets.
The Hacker News
Microsoft Outlook Flaw Exploited by Russia's APT28 to Hack Czech, German Entities
Czechia and Germany reveal they were targets of a massive cyber espionage campaign by Russia-linked APT28 hacker group.
DarkReading
DPRK's Kimsuky APT Abuses Weak DMARC Policies, Feds Warn
Organizations can go a long way toward preventing spoofing attacks by changing one basic parameter in their DNS settings.
SecurityWeek
Verizon DBIR 2024 Shows Surge in Vulnerability Exploitation, Confirmed Data Breaches
Verizon 2024 DBIR shows that vulnerability exploitation increased three times and confirmed data breaches doubled compared to 2023.
SecurityWeek
Russian Hackers Target Industrial Systems in North America, Europe
Government agencies are sharing recommendations following attacks claimed by pro-Russian hacktivists on ICS/OT systems.
CSO
Iranian hackers harvest credentials through advanced social engineering campaigns
Mandiant observed several malicious campaigns with threat actors impersonating journalists and harvesting the victim’s cloud environment credentials.
CSO
UnitedHealth hack may impact a third of US citizens: CEO testimony
Despite paying a $22 million ransom in Bitcoin to regain access to encrypted files, the company cannot confirm whether copies of the data were made or published online.
The Record
Iranian state-backed cyber spies continue to impersonate media brands, think tanks
A group tracked as APT42 uses subtle methods to get potential victims to clink on malicious links that look like they belong to newspapers and other organizations, according to Mandiant.
SC Magazine
Pro-Russia hackers target OT weaknesses in critical infrastructure
Government agencies warn industry to improve their operational technology security following breaches of North American and European systems.
Bleeping Computer
US govt warns of pro-Russian hacktivists targeting water facilities
The US government is warning that pro-Russian hacktivists are seeking out and hacking into unsecured operational technology (OT) systems used to disrupt critical infrastructure operations.
CyberScoop
Pro-Russia hacktivists attacking vital tech in water and other sectors, agencies say
Other sectors that the hacktivists — who sometimes pose physical threats — are targeting in North America and Europe include energy and agriculture, according to a Wednesday advisory.
The Record
Critical infrastructure operators urged to harden systems against pro-Russia hackers
The Cybersecurity and Infrastructure Security Agency (CISA) and international partners are warning about weak security practices in operational technology (OT) that could be targeted by pro-Russia hackers.
The Record
UnitedHealth CEO confirms company paid $22 million ransom in heated Senate hearing
CEO Andrew Witty blamed Change Healthcare's legacy technologies and lack of multifactor authentication for the cyberattack, which disrupted the medical industry nationwide.
CyberSecurity Dive
Change Healthcare, compromised by stolen credentials, did not have MFA turned on
AlphV deployed ransomware nine days after it used access to a Citrix portal on Change’s network to move laterally within systems, CEO Andrew Witty said in testimony prepared for a House subcommittee hearing set for Wednesday.
CyberNews
UnitedHealth hackers exploited Citrix bug, CEO says
The massive hack of UnitedHealth Group’s (UHG) tech subsidiary Change Healthcare was the result of an exploit of the Citrix bug, according to UHG CEO Andrew Witty.
The Record
Congress circles UnitedHealth as effects of ransomware attack continue
UnitedHealth Group CEO Andrew Witty is preparing to testify in two separate congressional hearings about the ransomware attack on the company's Change Healthcare unit.
The Hacker News
Ukraine Targeted in Cyberattack Exploiting 7-Year-Old Microsoft Office Flaw
Cybersecurity researchers have uncovered a targeted cyber attack against Ukraine that leveraged a 7-year-old Microsoft Office flaw to deploy Cobalt St
The Cyber Express
Russian State Hackers Biggest Cyber Threat to US, UK and EU Elections
With more than 2 billion voters ready to cast a vote this year across 60 plus nations -including the U.S.,
SecurityWeek
In Other News: China Hacked Volkswagen, DDoS Service Shutdown, Rubrik IPO
Noteworthy stories that might have slipped under the radar: Volkswagen hacked by Chinese threat group, DDoS service shut down, Rubrik IPO.
CyberSecurity Dive
What is success in cybersecurity? Failing less.
Defenders aren’t measured by pure wins or losses. Intrusions will happen, and their job is to keep a bad situation from getting worse.
DarkReading
The Biggest 2024 Elections Threat: Kitchen-Sink Attack Chains
Hackers can influence voters with media, breach campaigns, or try tampering with votes. Or they can combine these tactics to even greater effect.
The Cyber Express
State Spies Exploited Cisco Zero-Days to Intrude Government Networks
Networking giant Cisco warned that a group of state-sponsored hackers exploited zero-days in its firewall appliances to spy on government
CyberScoop
Campaigns and political parties are in the crosshairs of election meddlers
Attacks on elections have become more multifaceted over the past decade, but fears of a hacked election — real or perceived — remain one of the biggest threats.
The Record
DHS asked to consider potentially 'devastating’ impact of hacks on rural water systems
A bipartisan pair of U.S. House members wants more information from the Department of Homeland Security about a Russia-linked group's attack on a water utility in Texas, as well as cybersecurity protections for water supplies in general.
.webp)
Cyber Security News
Russian Hackers Claim Responsibility for Cyber Attack on Indiana Water Plant
A group of Russian-speaking hackers claimed responsibility for a cyber attack on a wastewater treatment plant in Tipton, Indiana.
The Record
Plasma donation company Octapharma slowly reopening as BlackSuit gang claims attack
All plasma centers were closed for six days because of the cyberattack, which the ransomware group BlackSuit has claimed.
The Record
Hackers publish fake story about Ukrainians attempting to assassinate Slovak president
The Czech News Agency (CTK) said the attackers breached its site to post the fake article, but it was not distributed to the service's clients.
Bleeping Computer
US imposes visa bans on 13 spyware makers and their families
The Department of State has started imposing visa restrictions on mercenary spyware makers and peddlers, prohibiting their entry into the United States, as announced earlier in February.
SecurityWeek
The Battle Continues: Mandiant Report Shows Improved Detection But Persistent Adversarial Success
Mandiant's M-Trends 2024 Report unveils mixed signals in cybersecurity. While defenses are improving, attackers still retain the upper hand.
Infosecurity News
Vulnerability Exploitation on the Rise as Attacker Ditch Phishing
Mandiant’s latest M-Trends report found that vulnerability exploitation was the most common initial infection vector in 2023, making up 38% of intrusions
DarkReading
VPNs, Firewalls' Nonexistent Telemetry Lures APTs
State-sponsored groups are targeting critical vulnerabilities in edge devices to make life difficult for incident responders.
CyberSecurity Dive
Enterprises are getting better at detecting security incidents
Google Cloud’s Mandiant saw significant improvements in how organizations track down threats, yet hackers are still abusing common threat vectors.
Infosecurity News
Russian Sandworm Group Hit 20 Ukrainian Energy and Water Sites
Notorious APT44 group Sandworm launched a mass campaign against Ukrainian critical infrastructure in March
The Record
Chinese, Russian espionage campaigns increasingly targeting edge devices
The cybersecurity firm Mandiant saw a more than 50% growth in zero-day usage compared to 2022.
The Record
Russian hackers claim cyberattack on Indiana water plant
The threat actor known as the Cyber Army of Russia posted a video as purported evidence of breaching the systems of the Tipton Wastewater Treatment Plant.
The Record
Russian hackers target 20 energy facilities in Ukraine amid intense missile strikes
Ukraine’s computer emergency response team said it has confirmed the compromise of at least three "supply chains" by the Sandworm hacking group this spring.
SecurityWeek
Rural Texas Towns Report Cyberattacks That Caused One Water System to Overflow
A hack that caused a small Texas town’s water system to overflow in January has been linked to a shadowy Russian hacktivist group.
Bleeping Computer
Russian Sandworm hackers targeted 20 critical orgs in Ukraine
Russian hacker group Sandworm aimed to disrupt operations at around 20 critical infrastructure facilities in Ukraine, according to a report from the Ukrainian Computer Emergency Response Team (CERT-UA).
The Hacker News
MITRE Corporation Breached by Nation-State Hackers Exploiting Ivanti Flaws
MITRE, a top cybersecurity firm, breached by a nation-state. Zero-days and session hijacking were the weapons.
SecurityWeek
MITRE Hacked by State-Sponsored Group via Ivanti Zero-Days
MITRE R&D network hacked in early January by a state-sponsored threat group that exploited an Ivanti zero-day vulnerability.
The Cyber Express
MITRE Hit in Massive Supply Chain Attack: State-Backed Hackers Exploit Zero-Days
The MITRE Corporation revealed on April 19 that it was one of over 1700 organizations compromised by a state-backed hacking
Bleeping Computer
MITRE says state hackers breached its network via Ivanti zero-days
The MITRE Corporation says a state-backed hacking group breached its systems in January 2024 by chaining two Ivanti VPN zero-days.
The Record
Ukrainian soldiers’ apps increasingly targeted for spying, cyber agency warns
CERT-UA is attributing the surge to a group tracked as UAC-0184, which was also recently spotted targeting an unnamed Ukrainian entity in Finland.
Infosecurity News
Russia’s Sandworm Upgraded to APT44 by Google's Mandiant
Mandiant has confirmed that Sandworm is responsible for many cyber-attacks against Ukraine has close ties with a Russian hacktivist group
SC Magazine
Russia’s Sandworm APT linked to attack on Texas water plant
The threat group is best known for its sustained campaign against Ukrainian targets and infrastructure.
DarkReading
Dangerous New ICS Malware Targets Orgs in Russia and Ukraine
"Kapeka" and "Fuxnext" are the latest examples of malware to emerge from the long-standing conflict between the two countries.
SecurityWeek
Kapeka: A New Backdoor in Sandworm’s Arsenal of Aggression
Kapeka is a new backdoor that may be a new addition to Russia-link Sandworm’s malware arsenal and possibly a successor to GreyEnergy.
Bleeping Computer
Russian Sandworm hackers pose as hacktivists in water utility breaches
The Sandworm hacking group associated with Russian military intelligence has been hiding attacks and operations behind multiple online personas posing as hacktivist groups.
SecurityWeek
Recent OT and Espionage Attacks Linked to Russia's Sandworm, Now Named APT44
Mandiant summarizes some of the latest operations of Russia’s notorious Sandworm group, which it now tracks as APT44.
DarkReading
Sandworm Is Russia's Top Cyberattack Unit in Ukraine
But even with that focus, the sophisticated threat group has continued operations against targets globally, including the US, says Google's Mandiant.
The Record
Sandworm hackers play ‘central role’ in Russia’s cyberwar with Ukraine
Mandiant researchers designated the group an advanced persistent threat actor — APT44 — which targets “key political, military, and economic hotspots for Russia.”
DarkReading
Middle East Cyber Ops Intensify, With Israel the Main Target
Cyberattacks tripled over the past year in Israel, making it the most targeted nation in 2023.
Krebs on Security
Who Stole 3.6M Tax Records from South Carolina?
For nearly a dozen years, residents of South Carolina have been kept in the dark by state and federal investigators over who was responsible for hacking into the state's revenue department in 2012 and stealing tax and bank account information…
Infosecurity News
Apple Boosts Spyware Alerts For Mercenary Attacks
The revision points out companies like NSO Group, known for surveillance tools like Pegasus
SecurityWeek
Google Cloud Unveils New AI-Powered Security Capabilities
Google adds AI to cloud security features and announces several other security capabilities for cloud customers.
The Hacker News
Apple Expands Spyware Alert System to Warn Users of Mercenary Attacks
Apple's updated spyware alert system now warns individual users of potential targeting by mercenary spyware attacks.
CyberNews
Google Cloud gets GenAI creating cybersecurity powerhouse
Google is integrating generative AI into the Google Cloud to assist users across its various products and platforms – including its new Gemini-driven security platform.
DarkReading
Google Gives Gemini a Security Boost
Google integrated Mandiant's security offerings into its AI platform to detect, stop, and remediate cybersecurity attacks as quickly as possible.
CyberSecurity Dive
Mandiant spots advanced exploit activity in Ivanti devices
The incident response firm identified eight threat groups targeting the remote access VPNs and observed evolved post-exploitation activity.
%20(1).webp)
Cyber Security News
New Cyber Attack Targeting Hospital IT Helpdesks with Voice Calls
Hospitals across the nation are on high alert as sophisticated cybercriminals target IT help desks with advanced social engineering tactics.
Loading more articles....