In today's digital age, the threat of data breaches and online scams looms large. Restorecord.com, a prominent bot service known for its data management solutions, has recently been at the center of a significant security breach, impacting approximately 2,871 users. This alarming incident has exposed sensitive data, including Next.js and PHP source codes, emails, usernames, browser data, and IPs, leaving users vulnerable to exploitation by malicious actors.

Brand impersonation attacks are a type of phishing attack where a scammer pretends to be a trusted company or brand. The goal is to trick victims into believing they're interacting with the company so they'll be more willing to share their personal information. Brand impersonation attacks can target both individuals and large groups of people. Scammers may use phony websites, mobile apps, or social media pages, as well as bogus emails, voicemails, or text messages.

When a large data company decided to migrate their systems fully to the cloud, their cybersecurity team knew it would be a challenge. The company’s senior security architect put it succinctly: “Our CTO said, we’re going completely to cloud. Everyone buckle up.” Though the organization had assets in the cloud for many years, the team wasn’t sure they were ready to be 100% in the cloud from a security standpoint.

Researchers at Lookout have discovered a sophisticated phishing kit that’s targeting employees at the US Federal Communications Commission (FCC), as well as employees of cryptocurrency exchanges Binance and Coinbase. The kit also targets users of cryptocurrency platforms, including Binance, Coinbase, Gemini, Kraken, ShakePay, Caleb & Brown and Trezor.

A recent great article by BleepingComputer about domain hijacking and DMARC abuse reminded me that many companies and people do not understand DMARC well enough to understand what it does and how it helps to prevent phishing. And look-alike and neglected domains challenge its protective value to unknowledgeable email recipients. This article is about how to understand and proactively use DMARC. DMARC.

The Kroll CTI team observed a campaign using a new malware that appears to be very similar to BABYSHARK, previously reported to have been developed and used by the APT group Kimsuky (KTA082). The malware was deployed as part of an attempted compromise that was detected and stopped by the Kroll Responder team. The activity started with exploitation of a recently addressed authentication bypass in the remote desktop software ScreenConnect, developed by ConnectWise.

In 2022, Gartner coined the term and concept of continuous threat exposure management (CTEM) — a five-stage approach that continuously exposes an organization’s networks, systems, and assets to simulated attacks to identify vulnerabilities and weaknesses.

In the intricate realm of cybersecurity, the relentless surge of cyber threats demands a constant reassessment of defensive strategies. Amidst this dynamic landscape, a subtle yet indispensable player takes center stage — Security Configuration Management (SCM). This blog embarks on an insightful journey into the critical role played by SCM in the ongoing battle against cyberattacks, shedding light on its ability to pinpoint and rectify system misconfigurations.