DarkReading
When abused by threat actors with sophisticated social-engineering chops, remote-access tools demand that enterprises remain sharp in both defense strategy and employee-awareness training.
Cyber Security News
Remote assist tools are often targeted by hackers as they create a direct channel that can be used to get into desired systems while using
Ars Technica
Ebury backdoors SSH servers in hosting providers, giving the malware extraordinary reach.
SecurityWeek
The Ebury Linux botnet has ensnared over 400,000 Linux systems in 15 years, with roughly 100,000 still infected.
Infosecurity News
The 15-year-old Ebury botnet is more active than ever, as ESET found 400,000 Linux servers compromised for cryptocurrency theft and financial gain
.webp)
Cyber Security News
The botnet, operated by the threat group behind the Ebury malware, has been active since at least 2009 but has evolved over the past decade.
The Hacker News
A new social engineering campaign is targeting enterprises with spam emails to gain initial access. The threat actor overwhelms users' email and calls
DarkReading
Ransomware groups have always created problems for their victims that only they could solve. Black Basta is taking that core idea in a creative, new direction.
Trend Micro
This blog entry aims to highlight the dangers of internet-facing routers and elaborate on Pawn Storm's exploitation of EdgeRouters, complementing the FBI's advisory from February 27, 2024.
SecurityWeek
The Brocade SANnav management application is affected by multiple vulnerabilities, including a publicly available root password.
The Hacker News
Kaspersky has uncovered a concerning threat actor, ToddyCat, targeting government and military entities.
Security Affairs
BlackBerry reported that financially motivated group FIN7 targeted the IT department of a large U.S. carmaker with spear-phishing attacks.
The Hacker News
FIN7, a notorious cybercrime group, is targeting the U.S. automotive industry with spear-phishing attacks.
Bleeping Computer
The financially motivated threat actor FIN7 targeted a large U.S. car maker with spear-phishing emails for employees in the IT department to infect systems with the Anunak backdoor.
Bleeping Computer
A vulnerability tracked as CVE-2024-31497 in PuTTY 0.68 through 0.80 could potentially allow attackers with access to 60 cryptographic signatures to recover the private key used for their generation.
HACKRead
A vulnerability, CVE-2024-3094, was discovered in XZ Utils package. This vulnerability threatens Linux systems with backdoor attacks.
SecurityWeek
Vulnerability (CVE-2024-28085) in core Linux system utilities package util-linux allows attackers to leak user passwords using fake prompts.
SecurityWeek
Major Linux distributions have been impacted by a supply chain attack involving backdoored versions of the XZ Utils data compression library.
CyberSecurity Dive
With a CVSS of 10, CISA urged users and developers to downgrade to an uncompromised version, search for any malicious activity and report findings back to the agency.
%20--%20Supply%20Chain%20Backdoor%20(1).webp)
Cyber Security News
Fedora Linux 40 beta users have been urged to take immediate action after an Upstream supply chain attack that has compromised SSH protocol.
SC Magazine
The critical supply chain threat affects beta releases of Red Hat Fedora, Debian and more.
Cyber Security News
Threat actors hijack routers to gain unauthorized access to network traffic. This enables them to monitor, manipulate, or intercept sensitive
SecurityWeek
The US government says Russia’s APT28 group compromised Ubiquiti EdgeRouters to run cyberespionage operations worldwide.
HACKRead
Russian hackers from APT28 are using hacked Ubiquiti EdgeRouters to build extensive botnets, steal credentials and other malicious activities.
Security Affairs
Russian cyberspies are compromising Ubiquiti EdgeRouters to evade detection, warns a joint advisory published by authorities.
The Hacker News
Nations unite to warn against the MooBot botnet threat targeting Ubiquiti EdgeRouters.
The Hacker News
U.S. government disrupted a botnet comprised of SOHO routers used by the Russia-linked APT28 group for malicious activities.
Ars Technica
Terrapin isn't likely to be mass-exploited, but there's little reason not to patch.
Bleeping Computer
Almost 11 million internet-exposed SSH servers are vulnerable to the Terrapin attack that threatens the integrity of some SSH connections.
Security Affairs
Researchers discovered an SSH vulnerability, called Terrapin, that could allow an attacker to downgrade the connection's security.
Latest Hacking News
Researchers have devised a new attack strategy, called “Terrapin,” that exploits vulnerabilities in the SSH protocol. While vendors are moving on with mitigating the flaws, it may take some time for the patches to be
The Hacker News
Researchers uncover a critical SSH protocol vulnerability, "Terrapin" (CVE-2023-48795), allowing attackers to compromise secure connections.
Security Affairs
Ukraine's CERT (CERT-UA) warned of a new phishing campaign by the APT28 group to deploy previously undocumented malware strains.
HACKRead
The 8220 Gang is exploiting multiple vulnerabilities, including the Oracle WebLogic Server vulnerability, to propagate cryptojacking malware in the Americas, Europe, and Africa.
CyberNews
77% of SSH servers on the internet supported at least one mode that can be exploited in practice by the new attack.
Ars Technica
Novel Terrapin attack uses prefix truncation to downgrade the security of SSH channels.
Bleeping Computer
Academic researchers developed a new attack called Terrapin that manipulates sequence numbers during the handshake process to breaks the SSH channel integrity when certain widely-used encryption modes are used.
Bleeping Computer
A team of academic researchers from universities in California and Massachusetts demonstrated that it's possible under certain conditions for passive network attackers to retrieve secret RSA keys from naturally occurring errors leading to failed SSH (secure shell) connection attempts.
Cyber Security News
CacheWarp, is a new software-based fault attack that allows attackers to gain access to encrypted virtual machines (VMs).
Bleeping Computer
A new software-based fault injection attack, CacheWarp, can let threat actors hack into AMD SEV-protected virtual machines by targeting memory writes to escalate privileges and gain remote code execution.
The Hacker News
Researchers uncover new "CacheWarp" attack on AMD's SEV technology. It could lead to privilege escalation in encrypted VMs.
SecurityWeek
CacheWarp is a new attack method affecting a security feature present in AMD processors that can pose a risk to virtual machines.
Infosecurity News
CISA highlights links to newer Blacksuit variant
CyberNews
Royal Ransomware, which emerged in early 2022, already has at least 350 known victims under its belt, added since September 2022.
The Record
The leading cybersecurity agencies in the U.S. released startling new data on the Royal ransomware gang on Monday, confirming previous reports that the gang may be preparing for a rebrand.
Ars Technica
An error as small as a single flipped memory bit is all it takes to expose a private key.
The DFIR Report
NetSupport Manager is one of the oldest third-party remote access tools still currently on the market with over 33 years of history. This is the first time we will report … Read More
Cyber Security News
The top 5 security vulnerabilities for 2023 have been revealed by a recent study, with Apache and OpenSSH services being the most vulnerable.
Bleeping Computer
Threat actors are actively targeting exposed instances of the Redis open-source data store with a peer-to-peer self-replicating worm with versions for both Windows and Linux that the malware authors named P2Pinfect.
Security Affairs
A new round of the weekly SecurityAffairs newsletter arrived! Every week the best security articles from Security Affairs are free for you in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including the international press. Now Abyss Locker also targets VMware ESXi servers Russian APT BlueBravo targets diplomatic entities with GraphicalProton […]
Naked Security
You need to turn on a special setting to stop (the code you wrote to stop [the code you wrote to improve performance] from reducing performance) from reducing security.
Security Affairs
A new flaw in OpenSSH could be potentially exploited to run arbitrary commands remotely on compromised hosts under specific conditions. Researchers from the Qualys Threat Research Unit (TRU) have discovered a remote code execution vulnerability in OpenSSH’s forwarded ssh-agent. OpenSSH (Open Secure Shell) is a set of open-source tools and utilities that provide secure encrypted […]
The Hacker News
A recently patched flaw in OpenSSH (CVE-2023-38408) could allow remote attackers to run arbitrary commands on vulnerable hosts.
Cyber Security News
Our weekly vulnerability roundup will provide coverage of newly discovered vulnerabilities, as well as those exploited to compromise organizations.
SecurityWeek
Weekly cybersecurity news roundup that provides a summary of noteworthy stories that might have slipped under the radar
Cyber Security News
The flaw exists in OpenSSH's forward ssh-agent. This flaw allows an attacker to execute arbitrary commands on vulnerable OpenSSH’s forwarded ssh-agent.
Cyber Security News
It has been identified that the exploit employs custom and open-source tools to gain control of the impacted devices and install cryptomining malware on them by leveraging the patched OpenSSH.
The Hacker News
Internet-facing Linux systems and IoT devices are under attack! Discover how threat actors hijack SSH credentials, deploy crypto mining malware.
Bleeping Computer
Microsoft says Internet-exposed Linux and Internet of Things (IoT) devices are being hijacked in brute-force attacks as part of a recently observed cryptojacking campaign.
Cyber Security News
Metasploit is an Open Source Penetration Testing Framework created that enables security professionals to simulate attacks.
Security Affairs
Cybercriminal gang FIN7 returned with a new wave of attacks aimed at deploying the Clop ransomware on victims’ networks. Researchers at Microsoft Security Intelligence team published a series of tweets to warn of a new wave of attacks aimed at distributing the Clop ransomware and linked it to the financially motivated cybercriminal group Sangria Tempest […]
The Hacker News
The infamous cybercrime syndicate FIN7 is back in business, launching their first ransomware campaign in years.
Bleeping Computer
A financially motivated cybercriminal group known as FIN7 resurfaced last month, with Microsoft threat analysts linking it to attacks where the end goal was the deployment of Clop ransomware payloads on victims' networks.
Naked Security
Latest epsiode. Listen now!
Naked Security
7 memory mismanagements and a timing attack. We explain all the jargon bug terminology in plain English…
Security Affairs
The maintainers of OpenSSH address multiple security issues, including a memory safety bug in the OpenSSH server (sshd). The maintainers of OpenSSH have addressed a number of security vulnerabilities with the release of version 9.2. One of the issues addressed by the maintainers is a memory safety bug in the OpenSSH server (sshd) tracked as […]
The Hacker News
OpenSSH releases update to fix multiple security bugs, including a pre-authentication double free vulnerability (CVE-2023-25136). Upgrade now!
Naked Security
It’s a bug fix for a bug fix. A memory leak was turned into a double-free that has now been turned into correct code…
SecurityWeek
Siemens and Schneider Electric address over 140 vulnerabilities with their December 2022 Patch Tuesday updates.
Ars Technica
This modular malware framework for Linux has gone undocumented until now.
ZDNet
The headlines went to the long-anticipated arrival of RHEL 9, but for more pragmatic Linux users, Red Hat Enterprise Linux 8.6 has arrived as well.
SecurityWeek
White House national security memo warns of severe risks from a quantum computer of sufficient size and sophistication.
ZDNet
Whoever wins the quantum computing race could undermine national security systems and the nation.
Bleeping Computer
Canonical has announced the general availability of version 22.04 of the Ubuntu Linux distribution, codenamed 'Jammy Jellyfish', which brings better hardware support and an improved security baseline.
SecurityWeek
Adobe releases fixes for at least 78 documented security vulnerabilities, some serious enough to expose businesses to remote code execution attacks.
SecurityWeek
OpenSSH 9.0 has been fitted with new defaults to prevent "capture now, decrypt later" attacks linked to advancements in quantum computing.
ZDNet
Investment is expected to increase but existing cybersecurity strategies are lacking.
Naked Security
Useful quantum computers might not actually be possible. But what if they are? And what if they arrive, say, tomorrow?
ZDNet
Changes made to protect against attacks that ciphertext now, in order to decrypt later.
DarkReading
Study shows more than 97% have exposed assets on AWS — among a wide range of other issues.
SecurityWeek
Tens of cybersecurity companies have been found to expose more than 200,000 assets during a two-week study conducted by Reposify.
Infosecurity News
Study uncovers 200,000 such assets across a 35-vendor sample
Bleeping Computer
The TrickBot malware operation has shut down after its core developers move to the Conti ransomware gang to focus development on the stealthy BazarBackdoor and Anchor malware families.
Bleeping Computer
The TrickBot malware operation has shut down after its core developers move to the Conti ransomware gang to focus development on the stealthy BazarBackdoor and Anchor malware families.
ZDNet
The malware is said to pose a "great danger" to the customers of 60 finance and tech giants.
ThreatPost
The resurgent trojan has targeted 60 top companies to harvest credentials for a wide range of applications, with an eye to virulent follow-on attacks.
Security Affairs
TrickBot malware is targeting customers of 60 financial and technology companies with new anti-analysis features. The infamous TrickBot malware was employed in attacks against customers of 60 financial and technology companies with new anti-analysis features. The news wave of attacks aimed at cryptocurrency firms, most of them located in the U.S.. Trickbot is a sophisticated, […]
The Hacker News
Trickbot malware has been targeting customers of 60 high-profile companies since 2020, including cryptocurrency and technology companies.
Bleeping Computer
A newly discovered malware family has been infecting Linux systems concealed in legitimate binaries. Dubbed FontOnLake, the threat delivers backdoor and rootkit components.