πŸ›‘ Cybersecurity & Privacy πŸ›‘ - News
26K subscribers
89.2K links
πŸ—ž The finest daily news on cybersecurity and privacy.

πŸ”” Daily releases.

πŸ’» Is your online life secure?

πŸ“© lalilolalo.dev@gmail.com
Download Telegram
πŸ–‹οΈ A Comprehensive Guide to Finding Service Accounts in Active Directory πŸ–‹οΈ

Service accounts are vital in any enterprise, running automated processes like managing applications or scripts. However, without proper monitoring, they can pose a significant security risk due to their elevated privileges. This guide will walk you through how to locate and secure these accounts within Active Directory AD, and explore how Silverforts solutions can help enhance your.

πŸ“– Read more.

πŸ”— Via "The Hacker News"

----------
πŸ‘οΈ Seen on @cibsecurity
πŸ–‹οΈ Bumblebee and Latrodectus Malware Return with Sophisticated Phishing Strategies πŸ–‹οΈ

Two malware families that suffered setbacks in the aftermath of a coordinated law enforcement operation called Endgame have resurfaced as part of new phishing campaigns. Bumblebee and Latrodectus, which are both malware loaders, are designed to steal personal data, along with downloading and executing additional payloads onto compromised hosts. Tracked under the names BlackWidow, IceNova, Lotus,.

πŸ“– Read more.

πŸ”— Via "The Hacker News"

----------
πŸ‘οΈ Seen on @cibsecurity
πŸ–‹οΈ Malicious npm Packages Target Developers' Ethereum Wallets with SSH Backdoor πŸ–‹οΈ

Cybersecurity researchers have discovered a number of suspicious packages published to the npm registry that are designed to harvest Ethereum private keys and gain remote access to the machine via the secure shell SSH protocol. The packages attempt to "gain SSH access to the victim's machine by writing the attackers SSH public key in the root users authorizedkeys file," software supply.

πŸ“– Read more.

πŸ”— Via "The Hacker News"

----------
πŸ‘οΈ Seen on @cibsecurity
πŸ“” Phishing Attack Impacts Over 92,000 Transak Users πŸ“”

A phishing attack targeting Transak employees led to a data breach, compromising the information of 92,554 users.

πŸ“– Read more.

πŸ”— Via "Infosecurity Magazine"

----------
πŸ‘οΈ Seen on @cibsecurity
πŸ“” Meta to Fight Celeb-Bait Scams with Facial Recognition πŸ“”

Meta is testing facial recognition technology to tackle celebbait ad scams and enable the recovery of compromised accounts.

πŸ“– Read more.

πŸ”— Via "Infosecurity Magazine"

----------
πŸ‘οΈ Seen on @cibsecurity
πŸ“” Think Tanks Urge Action to Curb Misuse of Spyware and Hack-for-Hire πŸ“”

RUSI and Chatham House recommended global standards to combat commercial cyber tool abuse.

πŸ“– Read more.

πŸ”— Via "Infosecurity Magazine"

----------
πŸ‘οΈ Seen on @cibsecurity
πŸ¦… Bitdefender Total Security Vulnerabilities: Recent Patches and Recommendations πŸ¦…

Overview Bitdefender has issued a security advisory detailing critical vulnerabilities within its flagship products, Bitdefender Total Security and SafePay. These vulnerabilities pose significant risks to users and require urgent patching.  Bitdefender Total Security serves as a cybersecurity solution designed to protect devices across various platforms against malware, ransomware, and numerous other cyber threats. Its key features include realtime threat detection, privacy safeguards, and performance enhancements. A standout feature, SafePay, is a secure browser that isolates users online activitiessuch as banking and shoppingencrypts transactions to prevent unauthorized access and ensure safe financial interactions. The vulnerability classification is based on the Common V...

πŸ“– Read more.

πŸ”— Via "CYBLE"

----------
πŸ‘οΈ Seen on @cibsecurity
πŸ¦… Cyble Sensors Detect Attacks on Java Framework, IoT Devices πŸ¦…

Overview Cybles weekly sensor intelligence report detailed more than 30 active attack campaigns against known vulnerabilities. New attacks were observed against a vulnerability in the Spring Java framework, and more than 400,000 attacks were observed exploiting a known IoT vulnerability. Cybles Vulnerability Intelligence unit also observed thousands of bruteforce attacks and hundreds of phishing campaigns. Here are some highlights from Cybles October 17 sensor report sent to clients. CVE202438816 Spring Java Framework Exploit CVE202438816 is a highseverity Path Traversal vulnerability in the popular Spring Java framework that is still undergoing NVD assessment. Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vul...

πŸ“– Read more.

πŸ”— Via "CYBLE"

----------
πŸ‘οΈ Seen on @cibsecurity
πŸ•΅οΈβ€β™‚οΈ What Today's SOC Teams Can Learn From Baseball πŸ•΅οΈβ€β™‚οΈ

There are more similarities between developing a professional athlete and developing a cybersecurity pro than you might expect.

πŸ“– Read more.

πŸ”— Via "Dark Reading"

----------
πŸ‘οΈ Seen on @cibsecurity
πŸ–‹οΈ Security Flaw in Styra's OPA Exposes NTLM Hashes to Remote Attackers πŸ–‹οΈ

Details have emerged about a nowpatched security flaw in Styra's Open Policy Agent OPA that, if successfully exploited, could have led to leakage of New Technology LAN Manager NTLM hashes. "The vulnerability could have allowed an attacker to leak the NTLM credentials of the OPA server's local user account to a remote server, potentially allowing the attacker to relay the authentication or.

πŸ“– Read more.

πŸ”— Via "The Hacker News"

----------
πŸ‘οΈ Seen on @cibsecurity
πŸ–‹οΈ Cybercriminals Exploiting Docker API Servers for SRBMiner Crypto Mining Attacks πŸ–‹οΈ

Bad actors have been observed targeting Docker remote API servers to deploy the SRBMiner crypto miner on compromised instances, according to new findings from Trend Micro. "In this attack, the threat actor used the gRPC protocol over h2c to evade security solutions and execute their crypto mining operations on the Docker host," researchers Abdelrahman Esmail and Sunil Bharti said in a technical.

πŸ“– Read more.

πŸ”— Via "The Hacker News"

----------
πŸ‘οΈ Seen on @cibsecurity
πŸ“” 75% of US Senate Campaign Websites Fail to Implement DMARC πŸ“”

75 of US Senate campaign sites lack DMARC, risking cybersecurity and email safety.

πŸ“– Read more.

πŸ”— Via "Infosecurity Magazine"

----------
πŸ‘οΈ Seen on @cibsecurity
🧠 What NIST’s post-quantum cryptography standards mean for data security 🧠

Data security is the cornerstone of every business operation. Today, the security of sensitive data and communication depends on traditional cryptography methods, such as the RSA algorithm. While such algorithms secure against todays threats, organizations must continue to look forward and begin to prepare against upcoming risk factors. The National Institute of Standards and Technology The post What NISTs postquantum cryptography standards mean for data security appeared first on Security Intelligence.

πŸ“– Read more.

πŸ”— Via "Security Intelligence"

----------
πŸ‘οΈ Seen on @cibsecurity
πŸ•΅οΈβ€β™‚οΈ Swarms of Fake WordPress Plug-ins Infect Sites With Infostealers πŸ•΅οΈβ€β™‚οΈ

GoDaddy flagged a ClickFix campaign that infected 6,000 sites in a oneday period, with attackers using stolen admin credentials to distribute malware.

πŸ“– Read more.

πŸ”— Via "Dark Reading"

----------
πŸ‘οΈ Seen on @cibsecurity
πŸ•΅οΈβ€β™‚οΈ Tricky CAPTCHA Caught Dropping Lumma Stealer Malware πŸ•΅οΈβ€β™‚οΈ

The persistent infostealer's latest campaign inserts fake CAPTCHA pages into legitimate applications, fooling users into executing the malicious payload, researchers find.

πŸ“– Read more.

πŸ”— Via "Dark Reading"

----------
πŸ‘οΈ Seen on @cibsecurity
πŸ–‹οΈ Gophish Framework Used in Phishing Campaigns to Deploy Remote Access Trojans πŸ–‹οΈ

Russianspeaking users have become the target of a new phishing campaign that leverages an opensource phishing toolkit called Gophish to deliver DarkCrystal RAT aka DCRat and a previously undocumented remote access trojan dubbed PowerRAT. "The campaign involves modular infection chains that are either Maldoc or HTMLbased infections and require the victim's intervention to trigger the.

πŸ“– Read more.

πŸ”— Via "The Hacker News"

----------
πŸ‘οΈ Seen on @cibsecurity
πŸ“” LLMjacking and Open-Source Tool Abuse Surge in 2024 Cloud Attacks πŸ“”

Cloud attacks surged in 2024 as attackers exploited cloud resources at unprecedented levels.

πŸ“– Read more.

πŸ”— Via "Infosecurity Magazine"

----------
πŸ‘οΈ Seen on @cibsecurity
πŸ“” SEC Charges Tech Firms Over Misleading SolarWinds Hack Disclosures πŸ“”

Four current and former publicly trading tech companies have agreed to pay civil penalties in relation to the SEC charges.

πŸ“– Read more.

πŸ”— Via "Infosecurity Magazine"

----------
πŸ‘οΈ Seen on @cibsecurity
πŸ‘1
πŸͺ– IoT Assignment Completed! Report on Barriers to U.S. IoT Adoption πŸͺ–

The 16 members of the NISTmanaged Internet of Things IoT Advisory Board have completed their report on barriers to the U.S. receiving the benefits of IoT adoption, along with their recommendations for overcoming those barriers. As Benson Chan Chair and Dan Caprio Vice Chair of the IoT Advisory Board state in the report The United States is in the early stages of a profound transformation, one that is driven by economic, societal, and cultural innovations brought about by the IoT. These innovations intertwine connectivity and digital innovation with the opportunity to drive a.

πŸ“– Read more.

πŸ”— Via "NIST"

----------
πŸ‘οΈ Seen on @cibsecurity
πŸ•΅οΈβ€β™‚οΈ Samsung Zero-Day Vuln Under Active Exploit, Google Warns πŸ•΅οΈβ€β™‚οΈ

If exploited, bad actors can execute arbitrary code while evading detection thanks to a renamed process.

πŸ“– Read more.

πŸ”— Via "Dark Reading"

----------
πŸ‘οΈ Seen on @cibsecurity
πŸ•΅οΈβ€β™‚οΈ OPA for Windows Vulnerability Exposes NTLM Hashes πŸ•΅οΈβ€β™‚οΈ

The vulnerability affects all versions prior to v0.68.0 and highlights the risks organizations assume when consuming open source software and code.

πŸ“– Read more.

πŸ”— Via "Dark Reading"

----------
πŸ‘οΈ Seen on @cibsecurity