πŸ›‘ Cybersecurity & Privacy πŸ›‘ - News
25.9K subscribers
89.2K links
πŸ—ž The finest daily news on cybersecurity and privacy.

πŸ”” Daily releases.

πŸ’» Is your online life secure?

πŸ“© lalilolalo.dev@gmail.com
Download Telegram
πŸ–‹οΈ Nation-State Attackers Exploiting Ivanti CSA Flaws for Network Infiltration πŸ–‹οΈ

A suspected nationstate adversary has been observed weaponizing three security flaws in Ivanti Cloud Service Appliance CSA a zeroday to perform a series of malicious actions. That's according to findings from Fortinet FortiGuard Labs, which said the vulnerabilities were abused to gain unauthenticated access to the CSA, enumerate users configured in the appliance, and attempt to access the.

πŸ“– Read more.

πŸ”— Via "The Hacker News"

----------
πŸ‘οΈ Seen on @cibsecurity
πŸ–‹οΈ 5 Steps to Boost Detection and Response in a Multi-Layered Cloud πŸ–‹οΈ

The link between detection and response DR practices and cloud security has historically been weak. As global organizations increasingly adopt cloud environments, security strategies have largely focused on "shiftleft" practicessecuring code, ensuring proper cloud posture, and fixing misconfigurations. However, this approach has led to an overreliance on a multitude of DR tools spanning.

πŸ“– Read more.

πŸ”— Via "The Hacker News"

----------
πŸ‘οΈ Seen on @cibsecurity
πŸ–‹οΈ Supply Chain Attacks Can Exploit Entry Points in Python, npm, and Open-Source Ecosystems πŸ–‹οΈ

Cybersecurity researchers have found that entry points could be abused across multiple programming ecosystems like PyPI, npm, Ruby Gems, NuGet, Dart Pub, and Rust Crates to stage software supply chain attacks. "Attackers can leverage these entry points to execute malicious code when specific commands are run, posing a widespread risk in the opensource landscape," Checkmarx researchers Yehuda.

πŸ“– Read more.

πŸ”— Via "The Hacker News"

----------
πŸ‘οΈ Seen on @cibsecurity
πŸ–‹οΈ THN Cybersecurity Recap: Top Threats, Tools and Trends (Oct 7 - Oct 13) πŸ–‹οΈ

Hey there, it's your weekly dose of "what the heck is going on in cybersecurity land" and trust me, you NEED to be in the loop this time. We've got everything from zeroday exploits and AI gone rogue to the FBI playing crypto kingpin it's full of stuff they don't want you to know. So let's jump in before we get FOMO. Threat of the Week GoldenJackal Hacks AirGapped Systems Meet.

πŸ“– Read more.

πŸ”— Via "The Hacker News"

----------
πŸ‘οΈ Seen on @cibsecurity
❀1
πŸ“” US DoD Tightens Cybersecurity Standards for Defense Contractors πŸ“”

The US DoD has finalized the Cybersecurity Maturity Model Certification CMMC Program, which defense contractors must pass to bid for government contracts.

πŸ“– Read more.

πŸ”— Via "Infosecurity Magazine"

----------
πŸ‘οΈ Seen on @cibsecurity
πŸ“” PokΓ©mon Developer Game Freak Suffers Data Breach πŸ“”

Personal data of over 2600 employees has been exposed and insider information about the Switch 2 and future Pokmon games leaked.

πŸ“– Read more.

πŸ”— Via "Infosecurity Magazine"

----------
πŸ‘οΈ Seen on @cibsecurity
πŸ“” Casio Confirms Ransomware Outage and Data Breach πŸ“”

Japanese electronics firm Casio has reported a ransomware attack and data breach.

πŸ“– Read more.

πŸ”— Via "Infosecurity Magazine"

----------
πŸ‘οΈ Seen on @cibsecurity
πŸ¦… Hidden in Plain Sight: ErrorFather’s Deadly Deployment of Cerberus πŸ¦…

Key Takeaways Cyble Research and Intelligence Labs CRIL identified a campaign called ErrorFather that utilized an undetected Cerberus Android Banking Trojan payload. ErrorFather employs a sophisticated infection chain involving multiple stages sessionbased droppers, native libraries, and encrypted payloads, complicating detection and removal efforts. The campaign ramped up in activity in September and October 2024, with more samples and ongoing campaigns suggesting active targeting and scaling by the Threat Actors TAs behind the ErrorFather campaign. The final payload employs keylogging, overlay attacks, VNC, and Domain Generation Algorithm DGA to perform malicious activities. ErrorFather's incorporation of a Domain Generation Algorithm DGA ensures resilience by enabling ...

πŸ“– Read more.

πŸ”— Via "CYBLE"

----------
πŸ‘οΈ Seen on @cibsecurity
πŸ“’ Phishing tactics: The top attacks trends in 2024 πŸ“’

Phishing is evolving beyond email as advances such as AI drive targeted attacks leaders must keep up with the latest tactics to mount an effective defense.

πŸ“– Read more.

πŸ”— Via "ITPro"

----------
πŸ‘οΈ Seen on @cibsecurity
πŸ•΅οΈβ€β™‚οΈ Why Your Identity Is the Key to Modernizing Cybersecurity πŸ•΅οΈβ€β™‚οΈ

Ultimately, the goal of creating a trusted environment around all digital assets and devices is about modernizing the way you do business.

πŸ“– Read more.

πŸ”— Via "Dark Reading"

----------
πŸ‘οΈ Seen on @cibsecurity
πŸ•΅οΈβ€β™‚οΈ PokΓ©mon Gaming Company Employee Info Leaked in Hack πŸ•΅οΈβ€β™‚οΈ

The gaming company reports that the server has been rebuilt after the leak, but has not confirmed if its insider video game data was leaked.

πŸ“– Read more.

πŸ”— Via "Dark Reading"

----------
πŸ‘οΈ Seen on @cibsecurity
πŸ•΅οΈβ€β™‚οΈ Microsoft: Schools Grapple With Thousands of Cyberattacks Weekly πŸ•΅οΈβ€β™‚οΈ

Education, including K12 schools and universities, has become the third most targeted sector due to the high variety of sensitive data it stores in its databases.

πŸ“– Read more.

πŸ”— Via "Dark Reading"

----------
πŸ‘οΈ Seen on @cibsecurity
πŸ•΅οΈβ€β™‚οΈ ConfusedPilot Attack Can Manipulate RAG-Based AI Systems πŸ•΅οΈβ€β™‚οΈ

Attackers can introduce a malicious document in systems such as Microsoft 365 Copilot to confuse the system, potentially leading to widespread misinformation and compromised decisionmaking processes.

πŸ“– Read more.

πŸ”— Via "Dark Reading"

----------
πŸ‘οΈ Seen on @cibsecurity
πŸ•΅οΈβ€β™‚οΈ Fighting Crime With Technology: Safety First πŸ•΅οΈβ€β™‚οΈ

By combining human and nonhuman identity management in one solution, Flock Safety is helping law enforcement solve an impressive number of criminal cases every day.

πŸ“– Read more.

πŸ”— Via "Dark Reading"

----------
πŸ‘οΈ Seen on @cibsecurity
🦿 Surfshark VPN Review (2024): Is it a Safe and Trustworthy VPN? 🦿

With a healthy mix of features, performance, and value, Surfshark VPN makes a strong case for those looking for a highquality VPN at an affordable price.

πŸ“– Read more.

πŸ”— Via "Tech Republic"

----------
πŸ‘οΈ Seen on @cibsecurity
πŸ“” Telekopye Scammers Target Booking.com and Airbnb Users πŸ“”

Online scammers are targeting Booking.com and Airbnb users with Telekopye, a Telegrambased toolkit.

πŸ“– Read more.

πŸ”— Via "Infosecurity Magazine"

----------
πŸ‘οΈ Seen on @cibsecurity
πŸ“” CISA Urges Encryption of Cookies in F5 BIG-IP Systems πŸ“”

CISA urged organizations to tackle security risks from unencrypted cookies in F5 BIGIP LTM systems.

πŸ“– Read more.

πŸ”— Via "Infosecurity Magazine"

----------
πŸ‘οΈ Seen on @cibsecurity
πŸ•΅οΈβ€β™‚οΈ Southeast Asian Cybercrime Profits Fuel Shadow Economy πŸ•΅οΈβ€β™‚οΈ

With cybercriminal gangs raking in at least 18 billion regionally and much more globally law enforcement and policymakers are struggling to keep up as the syndicates innovate and entrench themselves in national economies.

πŸ“– Read more.

πŸ”— Via "Dark Reading"

----------
πŸ‘οΈ Seen on @cibsecurity
πŸ•΅οΈβ€β™‚οΈ Serious Adversaries Circle Ivanti CSA Zero-Day Flaws πŸ•΅οΈβ€β™‚οΈ

Suspected nationstate actors are spotted stringing together three different zerodays in the Ivanti Cloud Services Application to gain persistent access to a targeted system.

πŸ“– Read more.

πŸ”— Via "Dark Reading"

----------
πŸ‘οΈ Seen on @cibsecurity
πŸ–‹οΈ WordPress Plugin Jetpack Patches Major Vulnerability Affecting 27 Million Sites πŸ–‹οΈ

The maintainers of the Jetpack WordPress plugin have released a security update to remediate a critical vulnerability that could allow loggedin users to access forms submitted by others on a site. Jetpack, owned by WordPress maker Automattic, is an allinone plugin that offers a comprehensive suite of tools to improve site safety, performance, and traffic growth. It's used on 27 million.

πŸ“– Read more.

πŸ”— Via "The Hacker News"

----------
πŸ‘οΈ Seen on @cibsecurity
πŸ–‹οΈ Researchers Uncover Hijack Loader Malware Using Stolen Code-Signing Certificates πŸ–‹οΈ

Cybersecurity researchers have disclosed a new malware campaign that delivers Hijack Loader artifacts that are signed with legitimate codesigning certificates. French cybersecurity company HarfangLab, which detected the activity at the start of the month, said the attack chains aim to deploy an information stealer known as Lumma. Hijack Loader, also known as DOILoader, IDAT Loader, and.

πŸ“– Read more.

πŸ”— Via "The Hacker News"

----------
πŸ‘οΈ Seen on @cibsecurity