πŸ›‘ Cybersecurity & Privacy πŸ›‘ - News
25.1K subscribers
88.5K links
πŸ—ž The finest daily news on cybersecurity and privacy.

πŸ”” Daily releases.

πŸ’» Is your online life secure?

πŸ“© lalilolalo.dev@gmail.com
Download Telegram
πŸ–‹οΈ Researchers Uncover TLS Bootstrap Attack on Azure Kubernetes Clusters πŸ–‹οΈ

Cybersecurity researchers have disclosed a security flaw impacting Microsoft Azure Kubernetes Services that, if successfully exploited, could allow an attacker to escalate their privileges and access credentials for services used by the cluster. "An attacker with command execution in a Pod running within an affected Azure Kubernetes Services cluster could download the configuration used to.

πŸ“– Read more.

πŸ”— Via "The Hacker News"

----------
πŸ‘οΈ Seen on @cibsecurity
πŸ–‹οΈ Iranian Cyber Group TA453 Targets Jewish Leader with New AnvilEcho Malware πŸ–‹οΈ

Iranian statesponsored threat actors have been observed orchestrating spearphishing campaigns targeting a prominent Jewish figure starting in late July 2024 with the goal of delivering a new intelligencegathering tool called AnvilEcho. Enterprise security company Proofpoint is tracking the activity under the name TA453, which overlaps with activity tracked by the broader cybersecurity.

πŸ“– Read more.

πŸ”— Via "The Hacker News"

----------
πŸ‘οΈ Seen on @cibsecurity
πŸ–‹οΈ Blind Eagle Hackers Exploit Spear-Phishing to Deploy RATs in Latin America πŸ–‹οΈ

Cybersecurity researchers have shed light on a threat actor known as Blind Eagle that has persistently targeted entities and individuals in Colombia, Ecuador, Chile, Panama, and other Latin American nations. Targets of these attacks span several sectors, including governmental institutions, financial companies, energy and oil and gas companies. "Blind Eagle has demonstrated adaptability in.

πŸ“– Read more.

πŸ”— Via "The Hacker News"

----------
πŸ‘οΈ Seen on @cibsecurity
πŸ–‹οΈ Thousands of Oracle NetSuite Sites at Risk of Exposing Customer Information πŸ–‹οΈ

Cybersecurity researchers are warning about the discovery of thousands of externallyfacing Oracle NetSuite ecommerce sites that have been found susceptible to leaking sensitive customer information. "A potential issue in NetSuite's SuiteCommerce platform could allow attackers to access sensitive data due to misconfigured access controls on custom record types CRTs," AppOmni's Aaron Costello.

πŸ“– Read more.

πŸ”— Via "The Hacker News"

----------
πŸ‘οΈ Seen on @cibsecurity
πŸ–‹οΈ CISA Warns of Critical Jenkins Vulnerability Exploited in Ransomware Attacks πŸ–‹οΈ

The U.S. Cybersecurity and Infrastructure Security Agency CISA has added a critical security flaw impacting Jenkins to its Known Exploited Vulnerabilities KEV catalog, following its exploitation in ransomware attacks. The vulnerability, tracked as CVE202423897 CVSS score 9.8, is a path traversal flaw that could lead to code execution. "Jenkins Command Line Interface CLI contains a.

πŸ“– Read more.

πŸ”— Via "The Hacker News"

----------
πŸ‘οΈ Seen on @cibsecurity
πŸ“” Vermin Cyber-Attacks Target Ukraine, Exploiting Kursk Battle πŸ“”

Ukraine detected cyberattacks using malicious emails containing photos of alleged prisoners of war from the Kursk direction.

πŸ“– Read more.

πŸ”— Via "Infosecurity Magazine"

----------
πŸ‘οΈ Seen on @cibsecurity
πŸ“” Iran Behind Trump Campaign Hack, US Government Confirms πŸ“”

The ODNI, FBI and CISA confirmed Iran was behind a reported hack of a Trump campaign website as part of efforts to stoke discord and undermine the US elections.

πŸ“– Read more.

πŸ”— Via "Infosecurity Magazine"

----------
πŸ‘οΈ Seen on @cibsecurity
πŸ“” Former Congressman Santos Admits Identity Theft and Fraud πŸ“”

Former US Representative George Santos pleads guilty to multiple fraud and identity theft charges.

πŸ“– Read more.

πŸ”— Via "Infosecurity Magazine"

----------
πŸ‘οΈ Seen on @cibsecurity
πŸ“” Jewish Home Lifecare Notifies 100,000 Victims of Ransomware Breach πŸ“”

Healthcare organization Jewish Home Lifecare has revealed that a 2024 data breach hit over 100,000 customers.

πŸ“– Read more.

πŸ”— Via "Infosecurity Magazine"

----------
πŸ‘οΈ Seen on @cibsecurity
🦿 Three-Quarters of Companies Retain An Increasing Amount of Sensitive Data, Report Finds 🦿

Perforce reveals that companies are struggling with increased sensitive data in nonproduction environments, leading to higher breach risks and compliance challenges.

πŸ“– Read more.

πŸ”— Via "Tech Republic"

----------
πŸ‘οΈ Seen on @cibsecurity
❀1
🦿 Most Ransomware Attacks Occur When Security Staff Are Asleep, Study Finds 🦿

ThreatDown 2024 Report Malwarebytes reveals ransomware trends, showing most attacks occur at night when security staff are off duty.

πŸ“– Read more.

πŸ”— Via "Tech Republic"

----------
πŸ‘οΈ Seen on @cibsecurity
🧠 Cost of a data breach: The industrial sector 🧠

Industrial organizations recently received a report card on their performance regarding data breach costs. And theres plenty of room for improvement. According to the 2024 IBM Cost of a Data Breach CODB report, the average total cost of a data breach in the industrial sector was 5.56 million. This reflects an 18 increase for the The post Cost of a data breach The industrial sector appeared first on Security Intelligence.

πŸ“– Read more.

πŸ”— Via "Security Intelligence"

----------
πŸ‘οΈ Seen on @cibsecurity
πŸ¦… Cyble Recognized in Gartner’s Report on Digital Risk Protection Services: Hype Cycle for Cyber-Risk Management, 2024. πŸ¦…

Gartner's Hype Cycle Report, published on July 22, 2024, identified Cyble as a sample vendor in Digital Risk Protection Services for Cyber Risk Management.  The report emphasizes Cyberrisk management, which is now a top concern for executives and regulators. This provides a comprehensive overview of how different methods and techniques are being utilized to support governance, risk management, and compliance in todays fastevolving cyber landscape.  Cyble is setting new benchmarks in Digital Risk Protection Services DRPS for Cyber Risk Management.  Key Insights from Gartners July 2024 Hype Cycle Report  The rapid adoption of AI in cybersecurity during 2023 and 2024 is seen as both a potential cybersecurity risk and a valuable tool for enhancing security practices. This perspect...

πŸ“– Read more.

πŸ”— Via "CYBLE"

----------
πŸ‘οΈ Seen on @cibsecurity
🦿 National Public Data Breach: Only 134 Million Unique Emails Leaked and Company Acknowledges Incident 🦿

In August, 2.7 billion records from National Public Data, including Social Security numbers, were leaked on a dark web forum.

πŸ“– Read more.

πŸ”— Via "Tech Republic"

----------
πŸ‘οΈ Seen on @cibsecurity
πŸ“’ Hackers are flocking to a new SMS spam tool – β€˜Xeon Sender’ exploits cloud APIs and exposed credentials to supercharge phishing campaigns πŸ“’

The Xeon Sender tool has been repurposed by numerous threat actor actors since its initial sighting in 2022.

πŸ“– Read more.

πŸ”— Via "ITPro"

----------
πŸ‘οΈ Seen on @cibsecurity
πŸ“’ How to implement identity and access management (IAM) effectively in your business πŸ“’

With pressure from the board and a new wave of threats, security leaders looking to implement IAM should start small and lean on the data.

πŸ“– Read more.

πŸ”— Via "ITPro"

----------
πŸ‘οΈ Seen on @cibsecurity
πŸ‘1
πŸ“” New DNS-Based Backdoor Threat Discovered at Taiwanese University πŸ“”

The Msupedge backdoor communicates with a commandandcontrol server by using DNS traffic.

πŸ“– Read more.

πŸ”— Via "Infosecurity Magazine"

----------
πŸ‘οΈ Seen on @cibsecurity
πŸ“” Iranian Group TA453 Launches Phishing Attacks with BlackSmith πŸ“”

TA453, also known as Charming Kitten, launched a targeted phishing attack using PowerShell malware BlackSmith.

πŸ“– Read more.

πŸ”— Via "Infosecurity Magazine"

----------
πŸ‘οΈ Seen on @cibsecurity
πŸ¦… Widespread Cloud Exposure: Extortion Campaign Used Exposed AWS ENV Files to Target 110,000 Domains πŸ¦…

Key Takeaways A sophisticated cloud extortion campaign used misconfigured AWS .env files to target 110,000 domains, steal credentials and ransom cloud storage data. The threat actors obtained AWS Identity and Access Management IAM access keys by scanning for exposed .env files hosted on unsecured web applications. These environment variable files .env files define configuration variables within applications and platforms and often contain secrets. Cybles threat intelligence platform suggests that .env exposures PS1 may be more common than even this largescale attack suggests. The IAM credentials uncovered by the attackers had permissions to create new IAM roles and attach IAM policies to existing roles, which they used to create new IAM resources with unlimited access. Ove...

πŸ“– Read more.

πŸ”— Via "CYBLE"

----------
πŸ‘οΈ Seen on @cibsecurity
πŸ–‹οΈ Detecting AWS Account Compromise: Key Indicators in CloudTrail Logs for Stolen API Keys πŸ–‹οΈ

As cloud infrastructure becomes the backbone of modern enterprises, ensuring the security of these environments is paramount. With AWS Amazon Web Services still being the dominant cloud it is important for any security professional to know where to look for signs of compromise. AWS CloudTrail stands out as an essential tool for tracking and logging API activity, providing a comprehensive.

πŸ“– Read more.

πŸ”— Via "The Hacker News"

----------
πŸ‘οΈ Seen on @cibsecurity
πŸ–‹οΈ Czech Mobile Users Targeted in New Banking Credential Theft Scheme πŸ–‹οΈ

Mobile users in the Czech Republic are the target of a novel phishing campaign that leverages a Progressive Web Application PWA in an attempt to steal their banking account credentials. The attacks have targeted the Czechbased eskoslovensk obchodn banka CSOB, as well as the Hungarian OTP Bank and the Georgian TBC Bank, according to Slovak cybersecurity company ESET. "The phishing.

πŸ“– Read more.

πŸ”— Via "The Hacker News"

----------
πŸ‘οΈ Seen on @cibsecurity