ONNX Store targets the financial industry, Boolka delivers the BMANAGER trojan via SQLi attacks, and SneakyChef deploys SpiceRAT and SugarGh0st.

1. Limited Scope of Security Metrics Microsoft Secure Score assesses security configurations and behaviors within the Microsoft 365 ecosystem but does not account for external threats. MSPs need a holistic security approach that includes network security, endpoint protection, and third-party integrations, which Secure Score does not cover (S:1).

As organizations increasingly adopt a mix of cloud-based and on-premises systems, they face unique challenges in securing their hybrid infrastructures. Unlike traditional IT setups, where everything is managed within the confines of a single data center, hybrid infrastructures combine the agility of the cloud with the control of on-premises systems. While this blend offers flexibility and scalability, it also introduces security complexity and a broader attack surface.

A recent cyberattack on Lurie Children's Hospital in Chicago has resulted in a significant data breach, exposing the personal information of 791,000 patients. Despite the hospital's refusal to pay a ransom, a vast amount of sensitive medical data is now at risk. Details of the Attack The cybercriminals infiltrated the hospital's systems, causing severe disruptions to its patient portal, communications, and access to medical records.

All Surface Monitoring users can configure Attack Surface Policies directly from the new Domains page, enabling various combinations of characteristics that were previously unavailable. Users are now alerted when policy breaches occur directly through their integrated tools, such as Slack and Jira.

Held in Breda, Netherlands, this year’s Cyber Resilience Day convened industry leaders and cybersecurity experts to address the topic of supply chain attacks and the latest digital threats. The event showcased a series of keynote speeches, panel discussions, and interactive workshops, equipping attendees with valuable insights and actionable strategies to strengthen their organizations’ cyber resilience.

For years, we as security practitioners were promised that AI and machine learning would change our lives for the better, but time and time again, the companies that touted this technology disappointed us. In the first decade or so of AI-branded security tools, we saw plenty of products that demoed well, but were completely undeployable.

For over a decade, a massive vulnerability that could have unleashed a huge supply chain attack lay dormant. Luckily the good guys found it first or so it seems. This month we are taking a look at CVE-2024-38368.