Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

April 2024

Shamane Tan on cyber resilience - Cyber Security Decoded

Apr 30, 2024 By Rubrik In Rubrik
Bouncing back from a cyber incident, data breach or #ransomware attack is a great accomplishment…but how can you bounce forward? A complete Cyber Resilience strategy is mission-critical. Security teams should be proactive and have response plans in place for when #CyberAttacks hit, rather than attempting to prevent attacks from occurring. With a #CyberResilience strategy, your team will be equipped with a plan when a cyber incident occurs while also having tools to identify those malicious attacks before they happen.
View Video

The 443 Podcast, Ep. 286 - BatBadBut What?

Apr 30, 2024 By WatchGuard In WatchGuard
This week on #the443podcast, we cover a research post describing a code injection vulnerability caused by how nearly every high-level programming language runs on Windows. We also discuss a series of vulnerabilities in LG televisions that allow remote attackers to root the device before ending with a chat about new adversarial tactics for delivering malware via GitHub.
View Video
Arctic Wolf

CVE-2024-20353 and CVE-2024-20359: Cisco ASA and FTD Vulnerabilities Exploited by State-Sponsored Threat Actor in Espionage Campaign "ArcaneDoor"

Apr 29, 2024 By Andres Ramos In Arctic Wolf
On April 24, 2024, Cisco Talos and several government security agencies published details on a sophisticated threat campaign focused on espionage and gaining unauthorized access to sensitive information from targeted government entities and organizations in critical infrastructure. As part of that publication, Cisco disclosed CVE-2024-20353 and CVE-2024-20359, affecting Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) devices, which were actively exploited in the documented campaign.
Read Post
Trustwave

Trustwave SpiderLabs Reveals the Ransomware Threats Targeting Latin American Financial and Government Sectors

Apr 25, 2024 By Trustwave In Trustwave
Ransomware-as-a-service (RaaS) threat groups are placing severe and continuous pressure on the financial and government services sectors in Latin America, according to data compiled by the elite Trustwave SpiderLabs team. RaaS is where developers working for threat actors manage and update the malware while affiliates carry out the actual ransomware attacks.
Read Post
foresiet

Unveiling Sharp Stealer: A New Threat to Gamers

Apr 23, 2024 By Foresiet In Foresiet
In the ever-evolving landscape of cybersecurity threats, the recent breach by the notorious hacker group R00TK1T serves as a stark reminder of the vulnerabilities faced by even the most established organizations. As the Foresight Threat Team delves into the details of this alarming incident, it becomes imperative to shed light on the implications and lessons to be learned from this breach.
Read Post
cato networks

CVE-2024-3400: Critical Palo Alto PAN-OS Command Injection Vulnerability Exploited by Sysrv Botnet's XMRig Malware

Apr 21, 2024 By Vitaly Simonovich In Cato Networks
On Friday, April 12, 2024, Palo Alto Networks PAN-OS was found to have an OS command injection vulnerability (CVE-2024-3400). Due to its severity, CISA added it to its Known Exploited Vulnerabilities Catalog. Shortly after disclosure, a PoC was published.
Read Post
foresiet

Unveiling the Nestle Data Breach: A Deep Dive into R00TK1T's Threat

Apr 19, 2024 By Foresiet In Foresiet
In the ever-evolving landscape of cybersecurity threats, the recent breach by the notorious hacker group R00TK1T serves as a stark reminder of the vulnerabilities faced by even the most established organizations. As the Foresight Threat Team delves into the details of this alarming incident, it becomes imperative to shed light on the implications and lessons to be learned from this breach.
Read Post
kroll

Akira Ransomware Makes a Play for VPNs Without Multi-Factor Authentication

Apr 19, 2024 By Kroll In Kroll
Learn about careers with us and search open job opportunities here. In Q4 2023, Kroll identified an uptick in engagements involving Akira ransomware, a trend that has continued into 2024. Kroll observed that in the majority of cases, initial activity could be tracked back to a Cisco ASA VPN service.
Read Post
safebreach

SafeBreach Coverage for AA24-109A (Akira Ransomware)

Apr 19, 2024 By Kaustubh Jagtap In SafeBreach
On April 18th, the United States’ Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), Europol’s European Cybercrime Centre (EC3), and the Netherlands’ National Cyber Security Centre (NCSC-NL) issued an urgent advisory about Akira ransomware’s recently exhibited malicious behavior (as of February 2024). Detailed information about these threats and the associated IOCs and TTPs can be seen on #StopRansomware: Akira Ransomware.
Read Post

Essential backup solutions to secure from ransomware attacks

Apr 18, 2024 By Parablu In Parablu
Learn the essential data backup requirements to protect your business from ransomware attacks with a robust backup strategy. Anand Prahlad, CEO, Parablu Inc., outlines the fundamental conditions that a good backup solution should feature: First, your backup solution should create a second, separate copy of your data, not just extend the retention of the exact copy.
View Video
netskope

Netskope Threat Coverage: Evil Ant Ransomware

Apr 16, 2024 By Ghanashyam Satpathy In Netskope
Netskope Threat Labs recently analyzed a new ransomware strain named Evil Ant. Evil Ant ransomware is a Python-based malware compiled using PyInstaller that looks to encrypt all files stored on the victim’s personal folders and external drives. This ransomware strain requires process continuity from encryption until file recovery. Rebooting, shutting down, or ending the ransomware process will make affected files unrecoverable.
Read Post
splunk

From Water to Wine: An Analysis of WINELOADER

Apr 16, 2024 By Splunk Threat Research Team In Splunk
In late February 2024, Mandiant identified APT29, a Russian state-sponsored threat group, deploying a new backdoor called WINELOADER to target German political parties. This campaign marks a significant shift in APT29's targeting, as they have traditionally focused on government and diplomatic entities. The expansion to political parties suggests an evolution in the group's intelligence gathering priorities, likely influenced by the current geopolitical climate.
Read Post
Trustwave

Law Enforcement Must Keep up the Pressure on Cybergangs

Apr 16, 2024 By Craig Searle In Trustwave
The (apparent) takedown of major ransomware players like Blackcat/ALPHV and LockBit and the threat groups’ (apparent) revival is a prime example of the Whack-a-Mole nature of combating ransomware gangs that often takes place. However, this level of difficulty doesn’t mean the pressure should be relieved.
Read Post
cyberint

The New Ransomware Trend - Targeting SMBs

Apr 16, 2024 By Adi Bleih In Cyberint
The ransomware landscape is evolving with increased competition among threat groups and the emergence of new ransomware operations. However, victim organizations and potential targets are strengthening their security measures and procedures to prepare for potential ransomware attacks. Our latest quarterly report for Q1 2024 shows a significant decrease in ransomware incidents, down to 1,048 cases, representing a 22% decline compared to Q4 2023.
Read Post
CrowdStrike

CrowdStrike Falcon Next-Gen SIEM Unveils Advanced Detection of Ransomware Targeting VMware ESXi Environments

Apr 15, 2024 By Christopher Miller In CrowdStrike
CrowdStrike Falcon Next-Gen SIEM, the definitive AI-native platform for detecting, investigating and hunting down threats, enables advanced detection of ransomware targeting VMware ESXi environments. CrowdStrike has observed numerous eCrime actors exploiting ESXi infrastructure to encrypt virtual machine volumes from the hypervisor to deploy ransomware in organizations. Access to ESXi infrastructure typically takes place as part of lateral movement.
Read Post

Shamane Tan on rising up - Cyber Security Decoded

Apr 15, 2024 By Rubrik In Rubrik
Inspirational words from Shamane Tan on Cyber Security Decoded…as you climb your personal ladder to success, you should be your biggest cheerleader! There won’t always be someone there to recommend you for promotions or point you in the right direction. People come and go, and opportunities arise and vanish. That’s why in order to grow, whether it’s in the #CyberSecurity industry, the broader #Technology industry, or elsewhere, you must always be proactive in seeking out new ways to grow personally and professionally!
View Video
Rubrik

Analysis: FBI's FY23 Cybercrime Report Shows Two Tactics Are On The Rise

Apr 15, 2024 By Brian Boyd In Rubrik
I started my career as a Counterintelligence Special Agent in the U.S. Army, quickly learning how to decode the complex signals of security threats. Next, I sharpened my skills in state law enforcement, investigating (and preventing) cybercrime by identifying and mitigating digital threats.
Read Post
tripwire

DragonForce Ransomware - What You Need To Know

Apr 11, 2024 By Graham Cluley In Tripwire
A relatively new strain of ransomware called DragonForce has making the headlines after a series of high-profile attacks. Like many other ransomware groups, DragonForce attempts to extort money from its victims in two ways - locking companies out of their computers and data through encryption, and exfiltrating data from compromised systems with the threat of releasing it to others via the dark web.
Read Post
foresiet

Nitrogen Campaign: A Threat Targeting Tech and Non-Profit Sectors in North America

Apr 11, 2024 By Foresiet In Foresiet
Foresiet Security Intelligence has recently uncovered the Nitrogen campaign, which has set its sights on numerous organizations within the technology and non-profit sectors across North America. While Foresiet managed to intercept the infections before significant hands-on-keyboard activity took place, there are strong indications that threat actors are leveraging this infection chain to establish compromised environments for deploying ransomware.
Read Post
knowbe4

Malvertising Campaigns Surged in 2023

Apr 11, 2024 By Stu Sjouwerman In KnowBe4
Researchers at BlueVoyant observed a 50% increase in large-scale malvertising campaigns in 2023 compared to 2022. “Fraudulent search engine ads appear as benign advertisements, almost indistinguishable from legitimate ones,” the researchers write. “This makes ads a highly effective distribution mechanism since users often rely on the top search result rather than directly typing in a domain.
Read Post
Rubrik

Accelerating Ransomware Recovery with Rubrik Threat Hunting for U.S. Government

Apr 10, 2024 By Alok Shah In Rubrik
At this point, it is clear: cyber attacks from nation-state adversaries persistently threaten local, state, and federal governments, as well as educational institutions. It is not a matter of if bad actors can penetrate existing security controls, as they are already doing so and will continue to do so. Whether it is due to one unpatched machine or one user clicking on a link in an email, we believe cyberattacks are inevitable.
Read Post
komodo consulting

Is SSRF A New Disease Targeting Doctors?

Apr 10, 2024 By Komodo Research In Komodo Consulting
Our healthcare client faced a security threat through PDF generation on their platform. We discovered a flaw that allowed harmful code to be included in PDFs, enabling us to access internal server files and services as well as obtaining AWS credentials. Taking proactive steps is vital to protect healthcare systems from such vulnerabilities.
Read Post
knowbe4

New Phishing-as-a-Service (PhaaS) platform, 'Tycoon 2FA', Targets Microsoft 365 and Gmail Accounts

Apr 9, 2024 By Stu Sjouwerman In KnowBe4
A new PhaaS service brings the power of bypassing multi-factor authentication (MFA) to the world’s most-used email platforms. At its core, Tycoon 2FA isn’t doing anything new. It uses a reverse proxy server to host a phishing web page that impersonates the legitimate email platform in question. Then it intercepts the victim's input and relays them to the legitimate service. But it’s how this platform does it that is sophisticated.
Read Post
knowbe4

Large-Scale StrelaStealer Campaign Impacts Over 100 Organizations Within the E.U. and U.S.

Apr 8, 2024 By Stu Sjouwerman In KnowBe4
A new campaign of StrelaStealer attacks identified by security analysts at Unit42 has been spotted targeting E.U. and U.S. organizations. This somewhat new infostealer has evolved to be even better at evading detection in a new string of campaigns aimed at stealing email credentials from well-known email clients.
Read Post
cyberint

CL0P Ransomware: The Latest Updates

Apr 7, 2024 By Cyberint Research In Cyberint
Responsible for a number of infamous ‘big game hunter’ ransomware attacks and believed active since at least 2019, the ransomware threat group dubbed ‘CL0P‘ is thought to be a Russian-language cybercriminal gang and have been widely reported as associated with, or their malware adopted by, other cybercriminal groups including ‘FIN11’, a part of the larger financially-motivated ‘TA505’ group, and ‘UNC2546’.
Read Post
cyberint

The Uptick in RA Group Ransomware's Activity

Apr 7, 2024 By Adi Bleih In Cyberint
In April 2023, Researchers uncovered a new ransomware actor named RA Group, demonstrating a connection to the Babuk ransomware through the utilization of leaked source code. Following the full disclosure of Babuk’s ransomware source code by an alleged group member in September 2021, various ransomware families have emerged, incorporating this leaked code into their attacks.
Read Post
foresiet

Foresiet Threat Research Alert: Caution! Cybercriminals Posing as NordVPN Infect Millions through Google and Bing Ads!

Apr 5, 2024 By Foresiet In Foresiet
Google has historically served as a prominent platform for such malicious advertisements. However, Bing is now increasingly susceptible to becoming a target due to its tight integration with the Windows ecosystem and the Edge browser. Bing searches are being manipulated to redirect users to a counterfeit website closely resembling the legitimate NordVPN site. To further deceive users, the threat actors attempted to digitally sign a malicious installer and hosted it on Dropbox.
Read Post

Shamane Tan on professional growth - Cyber Security Decoded

Apr 5, 2024 By Rubrik In Rubrik
On Cyber Security Decoded, Shamane Tan reflects on those who have shown her support during her career, and emphasizes the importance of giving back to others who are just starting out in #CyberSecurity. If you’re getting started in the #technology industry, seeking out mentorship can be vital for your career and building a ladder. And if you’re a leader, giving back by sharing your experiences by those looking to find a career path can be very rewarding and contribute to the overall success and growth of your organization.
View Video
11:11 systems

How To Get The Jump On Ransomware: Address Cyberthreats With Comprehensive Business Continuity Planning

Apr 5, 2024 By Darion Wisely In 11:11 Systems
Confucius once said famously, “A man who does not plan long ahead will find trouble at his door.” No truer words could be spoken about today’s cyberthreat landscape. According to Cybersecurity Magazine, ransomware attacks are predicted to surge from occurring every 11 seconds now, to every two seconds over the next decade. As such, business continuity planning has never been more significant to individuals and organizations.
Read Post
Trustwave

Phishing Deception - Suspended Domains Reveal Malicious Payload for Latin American Region

Apr 5, 2024 By Trustwave In Trustwave
Recently, we observed a phishing campaign targeting the Latin American region. The phishing email contained a ZIP file attachment that when extracted reveals an HTML file that leads to a malicious file download posing as an invoice. Figure 1. Phishing email sample with zip file attachment Upon checking the email header, we see that it has an email address format that uses the domain ‘temporarylink’.
Read Post

Find Lurking Threats Early with Rubrik Threat Monitoring

Apr 4, 2024 By Rubrik In Rubrik
Your backup data hosts valuable information that can be used to identify potential attacks. In this demo, we will show you how Rubrik Threat Monitoring combines intelligence from third-party threat feeds with proprietary intelligence from Rubrik Zero Labs and Rubrik’s InfoSec team to automatically identify indicators of compromise (IOCs) within backup data.
View Video
Rubrik

Shielding Your Kubernetes Kingdom: Safeguarding with Rubrik Protection

Apr 4, 2024 By Alpika Singh In Rubrik
In the landscape of modern application development and deployment, Kubernetes has transcended its adoption phase to become a cornerstone technology for organizations worldwide. According to the Cloud Native Computing Foundation (CNCF), a staggering 96% of organizations are actively using or evaluating Kubernetes, with over 5.6 million developers worldwide embracing its capabilities.
Read Post

Anand's insight on Ransomware Threats

Apr 4, 2024 By Parablu In Parablu
Listen to Anand Prahlad, CEO, Parablu Inc., share crucial insights into ransomware threats and how they impact SaaS companies of all sizes. Anand explains the reasons behind the increasing cybersecurity problem, focusing on industries frequently targeted. Anand also sheds light on: Watch this video to learn how to protect your business data against potential threats. Tune in now!
View Video
knowbe4

Malicious App Impersonates McAfee to Distribute Malware Via Text and Phone Calls

Apr 3, 2024 By Stu Sjouwerman In KnowBe4
A trojanized version of the McAfee Security app is installing the Android banking Trojan “Vultur,” according to researchers at Fox-IT. The attackers are spreading links to the malicious app via text messages and phone calls. “In order to deceive unsuspecting individuals into installing malware, the threat actors employ a hybrid attack using two SMS messages and a phone call,” the researchers write.
Read Post
manageengine

RaaS attacks are on the rise: Top 5 tips to protect your organization

Apr 2, 2024 By General In ManageEngine
Over the years, we have seen a substantial amount of cyberattacks happening around the globe. The most infamous of them is the RaaS attack, which is taking over organizations of all sizes. An employee’s sheer negligence and lack of cybersecurity solutions put organizations at higher risk. In this article, we will share some tips that every organization needs to know in order to stay away from cyberattacks. Ransomware attacks have become prevalent in recent years and can happen to any organization.
Read Post

Ransomware Reality Check: Investing in Cybersecurity Pays Off | Razorthorn Security

Apr 2, 2024 By Razorthorn In Razorthorn
Dive into the intriguing world of cybersecurity and ransomware recovery in this thought-provoking video. As news broke about a $100 million ransomware operation being halted, initial reactions ranged from skepticism to amusement. However, the swift return of these cybercriminals highlights the resilience and adaptability of such groups.
View Video

Security & IT: Better Together!

Apr 2, 2024 By Rubrik In Rubrik
PB & J 🥜… Bacon & Eggs 🍳… Mac & Cheese🧀… Movies & Popcorn 🍿… IT & Security 🔒! One of the hottest topics in #CyberSecurity is how organizations can bounce back from a #CyberAttack. The truth is, organizations must accept that it’s only a matter of time before their networks are breached by hackers. Fortunately, new tools like generative #AI can now be used to even the playing field when combatting #BadActors. 🤖
View Video
tripwire

Oops, Malware! Now What? Dealing with Accidental Malware Execution

Apr 2, 2024 By Dilki Rathnayake In Tripwire
On an ordinary day, you're casually surfing the web and downloading some PDF files. The document icons seem pretty legitimate, so you click without a second thought. But, to your surprise, nothing happens. A closer look reveals that what you believed to be a harmless PDF was, in fact, an executable file. Panic sets in as your settings lock up, and even accessing the task manager becomes impossible. Unknown pop-ups invade your screen, telltale signs of malware execution.
Read Post

Copyright © 2024 OpsMatters™. All rights reserved.