Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

June 2024

securitysenses

How to Navigate the Digital Landscape Safely

Jun 28, 2024 By SecuritySenses In SecuritySenses
As cyber threats become increasingly sophisticated, it is essential to be proactive about protecting your personal information and ensuring your online activities remain secure. From social networking and online banking to telecommuting and e-learning, the digital realm offers unparalleled convenience and opportunities. However, this convenience comes with its own set of risks. Understanding how to protect yourself online is crucial for maintaining privacy, security, and overall well-being. We are listing below some essential tips for safely navigating the digital landscape.
Read Post
tripwire

Better Resilience Sees More Extorted Companies Refuse To Pay Their Ransomware Attackers

Jun 28, 2024 By Graham Cluley In Tripwire
There's some possibly good news on the ransomware front. Companies are becoming more resilient to attacks, and the ransom payments extorted from businesses by hackers are on a downward trend. That's one of the findings of insurance broker Marsh, which conducted an analysis of the more than 1800 cyber claims it received during 2023 from its clients in the United States and Canada. According to Marsh, ransomware attacks were linked to less than 20% of all claims made to the firm during the last year.
Read Post
foresiet

Chinese APT Groups Use Ransomware for Espionage and Diversion

Jun 28, 2024 By Foresiet In Foresiet
Cyberespionage groups are increasingly using ransomware not just for financial gain but also as a tactic to complicate attack attribution, distract defenders, or serve as a secondary objective to data theft. A recent report highlights the activities of ChamelGang, a suspected Chinese advanced persistent threat (APT) group, which uses the CatB ransomware strain to target high-profile organizations globally.
Read Post
keeper

Can iPads Get Malware?

Jun 28, 2024 By Keeper In Keeper
Not only can iPads get malware but so can the rest of your devices. Although the chances of your iPad getting malware are small, it is still possible. To understand exactly what the implications of your iPad getting malware are, first we need to learn what malware is. Malicious software, more commonly referred to as malware, is a type of software that infects your device in many different ways.
Read Post
Rubrik

The Real-World Threat of Cyberattacks on Water infrastructure

Jun 27, 2024 By Laine Cavazos In Rubrik
Do you remember the last time you didn’t have water? Reliable water delivery is something many of us take for granted. Our local water treatment plant sits at the edge of our neighborhood, and I pass it every day on my way to take the kids to school. Not a lot seems to go on there, so it never occurred to me that I should be concerned about an attack on this critical infrastructure. What does occur to me is the possibility of a cyberattack on our water system.
Read Post

Are Businesses Taking Ransomware Seriously Essential Protection Tips for SMBs

Jun 27, 2024 By Parablu In Parablu
Join Anand Prahlad, CEO & President of Parablu, and Venkatesh Sagare, Co-founder and CTO of Giniminds and Cloudigy, as they discuss the critical issue of ransomware attacks. They explore whether businesses, especially small and medium-sized ones, understand the real threat of ransomware. Venkatesh shares some compelling stats.
View Video
Trustwave

Ransomware, Supply Chain & Tech Threats Explode - 2024 Trustwave SpiderLabs Report

Jun 26, 2024 By Trustwave In Trustwave
Trustwave SpiderLabs, in its just-released report 2024 Professional Services Threat Landscape: Trustwave Threat Intelligence Briefing and Mitigation Strategies, has uncovered an increasing number of ransomware, third-party supplier, and technology-based attacks targeting the professional services sector.
Read Post
safebreach

FakePenny Ransomware, Qilin Ransomware, and More: Hacker's Playbook Threat Coverage Round-up: June 2024

Jun 26, 2024 By Kaustubh Jagtap In SafeBreach
In this version of the Hacker’s Playbook Threat Coverage round-up, we are highlighting attack coverage for newly discovered or analyzed threats by the SafeBreach Labs team. SafeBreach customers can select and run these attacks and more from the SafeBreach Hacker’s Playbook to ensure coverage against these advanced threats.
Read Post
foresiet

Rising Trend of Ransomware Attacks in Healthcare: Complications from Supply Chain Attacks in Healthcare

Jun 26, 2024 By Foresiet In Foresiet
Incident Overview In a significant breach of healthcare data security, the Qilin ransomware gang has leaked 400GB of NHS and patient data on Telegram. The group, identified as the Qilin ransomware gang, claimed responsibility for the exfiltration and demanded a $50 million ransom, threatening to release the data if their demands were not met. Following failed negotiations, the gang followed through on their threat and made the entire dataset public.
Read Post
Rubrik

Enhancing your Clean Room with Rubrik Security Cloud and Cyber Recovery

Jun 26, 2024 By Joshua Stenhouse In Rubrik
Properly architecting and designing solutions for clean room recovery is a crucial step for any organization looking to become more resilient to cyber threats. Clean rooms provide organizations with an isolated environment where data integrity and recovery processes are insulated from external threats. By providing a clean room environment, organizations can expedite security investigations and recovery timelines in the event of a cyber attack.
Read Post
Rubrik

Rubrik Wins Microsoft Healthcare and Life Sciences Partner of the Year

Jun 26, 2024 By Mike Tornincasa In Rubrik
Have you ever wondered what it takes to ensure that the data behind every life-saving surgery, every critical care decision, and every patient record is not only secure but also instantly recoverable in the face of cyber threats? In the world of healthcare, where every second can mean the difference between life and death, this isn't just a technical challenge - it's a mission.
Read Post
Trustwave

Atlas Oil: The Consequences of a Ransomware Attack

Jun 25, 2024 By Trustwave In Trustwave
Atlas Oil, a major player in the oil and fuel distribution industry, fell victim to a ransomware attack orchestrated by the Black Basta group. This attack not only compromised sensitive company data but also exposed a variety of documents that could potentially harm the company’s operations and reputation. Overall, Black Basta claims to have exfiltrated approximately 730 GB of data.
Read Post
foresiet

Emerging Rust Malware Uses PowerShell to Evade UAC and Steal Data

Jun 24, 2024 By Foresiet In Foresiet
A new Rust-based information-stealing malware named Fickle Stealer has been identified, using multiple attack vectors to compromise systems and extract sensitive information. According to Fortinet FortiGuard Labs, Fickle Stealer is being distributed through four different methods: VBA dropper, VBA downloader, link downloader, and executable downloader. Some of these methods employ a PowerShell script to bypass User Account Control (UAC) and execute the malware.
Read Post

Deep Dive into Application Security: Understanding Firewalls, Malware, and APIs

Jun 21, 2024 By Cloudflare In Cloudflare
In this week’s episode, we explore how Cloudflare handles application security, current trends, vulnerabilities, and future expectations. Host João Tomé is joined by Michael Tremante, Director of Product from our Application Security team. We discuss the evolution of application security and its increasing relevance today. We also go into specific use cases, covering firewall security, malware, supply chain risks, and the critical task of monitoring various vulnerabilities, including zero-day threats.
View Video
bitsight

Evaluating dependence on NVD

Jun 20, 2024 By Ben Edwards In BitSight
As I mentioned at the beginning of this year, I am trying to do a monthly blog post on what might be termed “Major Security Events”. In particular this year, I’ve written about the Ivanti meltdown, Lockbit ransomware, and the xz backdoor. These events usually emerge cacophonously and suddenly into the cybersecurity landscape, and generally get everyone’s attention “real quick”.
Read Post
graylog

Destructive Malware: Threat Detection and Incident Response

Jun 20, 2024 By The Graylog Team In Graylog
Imagine that you have a snack you want to eat while watching a movie on a Friday night. You look in your kitchen, only to find the snack missing. Whether a roommate hid the snack or ate it, you no longer have access to it, disrupting your evening plans. This destructive behavior interrupts your weekend objectives, but it’s pretty low stakes overall.
Read Post
Featured Post
ThreatQuotient

Why Manufacturers are in the Crosshairs of Threat Actors

Jun 19, 2024 By Chris Jacob, Vice President, Threat Intelligence Engineering In ThreatQuotient
In today's modern digitised environment, the manufacturing industry faces multiple interwoven challenges that can have a serious impact on their overall performance and sustainability. These challenges include supply chain disruptions, with events such as natural disasters, geopolitical issues, and pandemics disrupting the global supply chain, affecting the timely delivery of raw materials and components. These disruptions put pressure on manufacturing organisations to better plan for potential supply chain uncertainty, while responding quickly to changes in customer demand, and also trying to keep costs low.
Read Post
WatchGuard

Endpoint malware detection rises by 75%

Jun 19, 2024 By The Editor In WatchGuard
Cybersecurity continues to be unfinished business for many companies. In a context where digitalization reigns in almost all areas, cybercriminals have more and more resources to draw on and continue to threaten the cybersecurity of millions of organizations. To guide companies and industry professionals through the ever-changing habits of malware, WatchGuard has released a new edition of our Internet Security Report (ISR).
Read Post
levelblue

LevelBlue Labs Discovers Highly Evasive, New Loader Targeting Chinese Organizations

Jun 19, 2024 By Fernando Dominguez In LevelBlue
LevelBlue Labs recently discovered a new highly evasive loader that is being delivered to specific targets through phishing attachments. A loader is a type of malware used to load second-stage payload malware onto a victim’s system. Due to the lack of previous samples observed in the wild, LevelBlue Labs has named this malware “SquidLoader,” given its clear efforts at decoy and evasion.
Read Post
WatchGuard

What is Glupteba and how can you protect your customers from this malware?

Jun 18, 2024 By Carlos Arnal In WatchGuard
Over time, cybercriminals find ways to exploit new cybersecurity breaches, leading to the creation of malware that compromises users' security. Every year, one or more malware variants stand out as new, evasive, or dangerous. According to our Internet Security Report (ISR), last year it was Glupteba.
Read Post
Rubrik

Rubrik Announces Integration With Microsoft Information Protection (MIP) Sensitivity Labels

Jun 18, 2024 By Filip Verloy In Rubrik
We are excited to announce that Rubrik DSPM now supports Microsoft Information Protection (MIP) sensitivity labels. This integration helps our joint customers to better track and secure files with sensitive data – both within and outside of Microsoft environments. MIP labels are used by organizations to map sensitive data within their Microsoft environment, control access to that data, and enable protection settings such as encryption.
Read Post
foresiet

Beyond Detection: The Rise of Legitimate Software Abuse in Malware Attacks

Jun 18, 2024 By Foresiet In Foresiet
Cybersecurity researchers have identified an increasing trend where threat actors are abusing legitimate and commercially available packer software, such as BoxedApp, to evade detection and distribute malware, including remote access trojans and information stealers. Targeted Industries and Geographical Spread According to Check Point security researcher Jiri Vinopal, the majority of malicious samples have targeted financial institutions and government sectors.
Read Post
knowbe4

Phishing Campaign Abuses Windows Search to Distribute Malware

Jun 17, 2024 By Stu Sjouwerman In KnowBe4
Researchers at Trustwave warn that a phishing campaign is distributing malware via HTML attachments disguised as invoices. Notably, the HTML files abuse the Windows Search protocol to launch Windows Explorer and trick users into installing the malware. “Trustwave SpiderLabs has detected a sophisticated malware campaign that leverages the Windows search functionality embedded in HTML code to deploy malware,” the researchers state.
Read Post
Rubrik

Amazon S3 Data Protection: The Myths and the Facts

Jun 14, 2024 By Daniel Lu In Rubrik
So, you’re all set up with Amazon Simple Storage Service (Amazon S3), because you’re looking for best-in-class solutions for your company’s structured and unstructured data. Smart. But there’s more to do. Here are some myths about your Amazon S3 data, the real story behind them. Phew! We’re glad you agree that your Amazon S3 data needs strong protection. Wise decision. Here’s where we can help with a faster, cheaper, better solution.
Read Post
foresiet

FBI Recovers 7,000 LockBit Decryption Keys, Urges Ransomware Victims to Come Forward

Jun 14, 2024 By Foresiet In Foresiet
The FBI has made a significant breakthrough in the fight against LockBit ransomware by recovering over 7,000 decryption keys, which can now be used by victims to restore their encrypted data at no cost. FBI's Efforts Against LockBit Ransomware During the 2024 Boston Conference on Cyber Security, FBI Cyber Division Assistant Director Bryan Vorndran announced the recovery of these keys, emphasizing the agency's commitment to assisting past LockBit victims.
Read Post
knowbe4

Phishing Campaign Targets Job Seekers With WARMCOOKIE Backdoor

Jun 14, 2024 By Stu Sjouwerman In KnowBe4
A phishing campaign is impersonating recruiting firms to target job seekers with a new strain of malware, according to researchers at Elastic Security. “Since late April 2024, our team has observed new phishing campaigns leveraging lures tied to recruiting firms,” the researchers write.
Read Post
foresiet

VMware ESXi Systems with Admin Rights Targeted by New Mallox Ransomware Variant

Jun 13, 2024 By Foresiet In Foresiet
Novel Attack Vector Uses Custom Shell for Payload Delivery and Execution A fresh variant of the Mallox ransomware has emerged, specifically targeting VMware ESXi environments with administrative privileges. This advanced attack method, discovered by researchers at Trend Micro, demonstrates the evolving sophistication of ransomware tactics. Mallox Ransomware: An Overview Mallox, also known as Fargo and Tohnichi, first emerged in June 2021.
Read Post
knowbe4

Cybercriminals Use New V3B Phishing Kit to Mimic 54 Different Banks in the European Union

Jun 13, 2024 By Stu Sjouwerman In KnowBe4
A new phishing-as-a-service toolkit that leverages credential interception and anti-detection capabilities has put EU banks at severe risk of fraud. One of the growing dangers of the cyber crime economy is the phishing toolkit. Putting well-designed, expertly-coded webpages, authentication services, and obfuscation features into the hands of even a would-be cybercriminal creates havoc for the intended victim organizations.
Read Post
keeper

How Are People Targeted With Malware?

Jun 13, 2024 By Jaryeong Kim In Keeper
Malware, short for malicious software, is a program that is intentionally designed to harm computer systems and devices. In 2022, 5.5 billion malware attacks occurred around the world. Cybercriminals often use malware to cause damage to a system, take control of your device, spy on your web activity or steal personal data for financial gain. Individuals are targeted with malware through methods such as phishing, smishing and vishing which are types of social engineering.
Read Post
Rubrik

Hunt for Threats Within Backups to Minimize Data Loss and Downtime

Jun 12, 2024 By Vir Choksi In Rubrik
Mike Tyson famously said, “Everybody has a plan until they get punched in the mouth.” After falling victim to a cyberattack, it is crucial for organizations to respond promptly and effectively to minimize damage, recover operations, and prevent future incidents. One of the most critical elements of responding to an incident is the recovery and restoration of affected systems so that business as usual can be restored as quickly and safely as possible.
Read Post
knowbe4

DarkGate Malware Being Spread Via Excel Docs Attached To Phishing Emails

Jun 11, 2024 By Stu Sjouwerman In KnowBe4
A phishing campaign is spreading the DarkGate malware using new techniques to evade security filters, according to researchers at Cisco Talos. “The DarkGate malware family is distinguished by its covert spreading techniques, ability to steal information, evasion strategies, and widespread impact on both individuals and organizations” the researchers explain.
Read Post
Trustwave

Search & Spoof: Abuse of Windows Search to Redirect to Malware

Jun 11, 2024 By Trustwave In Trustwave
Trustwave SpiderLabs has detected a sophisticated malware campaign that leverages the Windows search functionality embedded in HTML code to deploy malware. We found the threat actors utilizing a sophisticated understanding of system vulnerabilities and user behaviors. Let’s break down the HTML and the Windows search code to better understand their roles in the attack chain.
Read Post
Rubrik

Rubrik Expands Data Access Governance (DAG) Solution with New Identity Inventory

Jun 10, 2024 By Filip Verloy In Rubrik
In a recent Fortune article, Amazon’s chief security officer, Steve Schmidt, suggests 6 questions every company's board should ask its CISOs to understand how robust their cybersecurity preparation is. One of the most challenging questions for CISOs was: “Who has access to what data? Why do they need it, and for how long?” This question is critical because cyberattacks often begin with weak, leaked, or stolen passwords.
Read Post
securitysenses

The Most Common Ways Cyber Criminals Will Target Your Business

Jun 6, 2024 By SecuritySenses In SecuritySenses
Businesses face an ever-growing array of security threats from cybercriminals. Scammers and hackers employ increasingly sophisticated techniques to infiltrate corporate networks, steal sensitive information, and disrupt operations. In 2023, consumers and businesses in the United States reported losing more than $10 billion to fraud and online scams, marking the first time that fraud losses have reached that benchmark. This is a 14% increase over reported losses in 2022.
Read Post
tripwire

Hit by LockBit? The FBI is waiting to help you with over 7,000 decryption keys

Jun 6, 2024 By Graham Cluley In Tripwire
Did your company fall victim to the LockBit ransomware? Have cybercriminals left gigabytes of your data encrypted, with no easy route for recovery that doesn't involve paying a ransom? Well, don't fear. The FBI announced this week that it had obtained over 7,000 decryption keys for the LockBit ransomware and is urging victims to come forward for free assistance.
Read Post
senseon

Into the Rat's Nest: A SenseOn Analysis of the NetSupport RAT

Jun 6, 2024 By Isabel Carter In SenseOn
Threat actors prefer deploying tools which appear genuine and expected in a business IT environment. This provides camouflage for their toolset, blending into organisations' application portfolios. NetSupport Manager, a remote access tool, has been utilised by system administrators since its release in 1989 and has been used by threat actors since at least 2016.
Read Post
CrowdStrike

EMBERSim: A Large-Scale Databank for Boosting Similarity Search in Malware Analysis

Jun 6, 2024 By Drago Corlătescu - Alexandru Dinu - Mihaela Găman - Paul Sumedrea In CrowdStrike
CrowdStrike is constantly researching, working and innovating to stay at the cutting edge of threat detection and response. Recently, these efforts include EMBERSim, a large-scale dataset developed to address limitations in binary code similarity (BCS), improve malware detection and facilitate future work in this area.
Read Post
foresiet

Surge in CatDDoS Attacks: Exploiting Vulnerabilities to Spread Mirai Variant

Jun 6, 2024 By Foresiet In Foresiet
The cybersecurity landscape has recently been shaken by a surge in activity involving a Mirai distributed denial-of-service (DDoS) botnet variant known as CatDDoS. Over the past three months, threat actors have aggressively exploited more than 80 vulnerabilities to spread this malware. In this blog, we explore the recent CatDDoS attacks, the targeted sectors, and the implications for cybersecurity practices.
Read Post
Trustwave

Fake Advanced IP Scanner Installer Delivers Dangerous CobaltStrike Backdoor

Jun 5, 2024 By Trustwave In Trustwave
During a recent client investigation, Trustwave SpiderLabs found a malicious version of the Advanced IP Scanner installer, which contained a backdoored DLL module. Our client had been searching for the Advanced IP Scanner tool online and inadvertently downloaded the compromised installer from a typo-squatted domain that appeared in their search results. Figure 1. Search results for Advanced IP Scanner may direct users to a malicious domain.
Read Post
Arctic Wolf

Lost in the Fog: A New Ransomware Threat

Jun 4, 2024 By Stefan Hostetler, Steven Campbell, Christopher Prest In Arctic Wolf
On May 2, 2024, Arctic Wolf Labs began monitoring deployment of a new ransomware variant referred to as Fog. The ransomware activity was observed in several Arctic Wolf Incident Response cases, each exhibiting similar elements. All victim organizations were located in the United States, 80% of which were in the education sector and 20% in the recreation sector. We are sharing details of this emerging variant to help organizations defend against this threat.
Read Post
keeper

Locker vs Crypto Ransomware: What's the Difference?

Jun 4, 2024 By Aranza Trevino In Keeper
While both locker and crypto ransomware are types of ransomware, there is one key difference between the two. The main difference between locker and crypto ransomware is that locker ransomware locks an entire device whereas crypto ransomware only encrypts files and data stored on the infected device. Keep reading to learn more about locker and crypto ransomware and how your organization can prevent these and other ransomware attacks.
Read Post
kroll

Building Cyber Resilience Amid Azure Migration

Jun 3, 2024 By Kroll In Kroll
With ransomware increasing and a complex, business-critical cloud migration on the horizon, BSM, one of the world’s largest shipping companies, was seeking a solution to monitor its environment for potential threats, both now and in the future. Working with Kroll gives the company greater visibility across its global network of offices and ships to better detect and respond to threats.
Read Post
Rubrik

Understanding and Mitigating Snowflake Data Risks Amid Increased Cyber Threat Activity

Jun 3, 2024 By Drew Russell In Rubrik
In today's digital landscape, data security is more crucial than ever. Recently, Snowflake, a leading cloud data platform, has observed a significant uptick in cyber threat activity targeting some of its customers' accounts. This development has prompted an in-depth investigation to understand and mitigate these risks.
Read Post

Copyright © 2024 OpsMatters™. All rights reserved.