Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

September 2024

netskope

Netskope Threat Labs Uncovers New XWorm's Stealthy Techniques

Sep 30, 2024 By Jan Michael Alcantara In Netskope
XWorm is a relatively new versatile tool that was discovered in 2022. It enables attackers to carry out a variety of functions, which include accessing sensitive information, gaining remote access, and deploying additional malware. The multifaceted nature of XWorm is appealing to threat actors, as evidenced by its alleged use earlier this year by threat actors such as NullBulge and TA558. Through Netskope Threat Labs hunting efforts, we uncovered XWorm’s latest version in the wild.
Read Post
knowbe4

The Number of Ransomware Attacks Around the World Increased by 73% in 2023

Sep 30, 2024 By Stu Sjouwerman In KnowBe4
The number of ransomware attacks around the world increased by 73% in 2023, according to a new report by the Institute for Security and Technology’s Ransomware Task Force (RTF). These attacks opportunistically target organizations across all industries, but the hardest-hit sectors over the past two years have been construction, hospitals and health care, government, IT services and consulting, and financial services.
Read Post
Rubrik

Rubrik powers Okta with critical user context to safeguard against identity attacks

Sep 30, 2024 By Seema Kathuria In Rubrik
Identity-based cyber attacks continue to prevail and impact organizations. Stealing credentials was the top initial action in breaches, according to Verizon. Plus, 84% of identity stakeholders surveyed said identity-related incidents directly impacted their business, resulting in reputational damages, distraction from core business, and increased recovery costs.
Read Post
Rubrik

Multi-Region Redundancy for Stronger Data Resilience

Sep 30, 2024 By Alok Shah In Rubrik
Rubrik Cloud Vault already provides a high level of cyber resiliency against data deletion, encryption, and exfiltration through air-gapped, immutable, access-controlled backup and archival copies stored in an isolated environment. Now, for added resilience against regional failures and natural disasters, Rubrik Cloud Vault supports Zone-redundant storage (ZRS) and Geo-redundant storage (GRS), complementing our existing Local-redundant storage (LRS) option.
Read Post
SecurityScorecard

How the U.S. Department of Justice Can Improve Its Approach to Combat Ransomware Attacks

Sep 30, 2024 By SecurityScorecard In SecurityScorecard
Earlier this month, the U.S. Department of Justice’s Office of the Inspector General released a report on how the Department could improve its approach to combat ransomware attacks. The report included an audit and evaluated the Department’s strategy to respond and counter ransomware attacks during a two-and-a-half-year period from April 2021 through September 2023.
Read Post
netskope

DCRat Targets Users with HTML Smuggling

Sep 26, 2024 By Nikhil Hegde In Netskope
DCRat (also known as Dark Crystal RAT) is a modular remote access Trojan (RAT) which is offered as malware-as-a-service (MaaS) and has been around since 2018. It is written in C# and has typical RAT and information stealing capabilities, such as executing shell commands, logging keystrokes, exfiltrating files and credentials, among others.
Read Post
Rubrik

Rubrik and Pure Storage Join Forces to Deliver Complete Cyber Resilience of Mission-Critical Data

Sep 26, 2024 By Justin Ruiz In Rubrik
Data has become organizations' lifeblood. However, with the exponential growth of data comes unprecedented challenges in securing it across both short-term and long-term storage. To make matters worse, cyber threats are evolving rapidly, and businesses need robust solutions to safeguard their critical data. We're excited to announce a groundbreaking partnership between Rubrik and Pure Storage.
Read Post
safeaeon

CDK Ransomware Attack: What It Is and How to Protect Your Business

Sep 26, 2024 By SafeAeon Inc. In SafeAeon
Software platforms are being used more and more by companies to run their operations, store private data, and talk to customers. Ransomware attacks are becoming more common because people depend on them so much. One of the scariest types of hacks is the CDK ransomware attack, which is aimed at companies that use software from CDK Global.
Read Post
Tines

From advisory to action: automate the FBI's RansomHub recommendations with Tines

Sep 26, 2024 By Amber Langdon In Tines
The Federal Bureau of Investigation (FBI), the Cybersecurity and Infrastructure Security Agency (CISA), the Multi-State Information Sharing and Analysis Center (MS-ISAC), and the Department of Health and Human Services (HHS) recently issued a joint advisory on the RansomHub ransomware. RansomHub is a ransomware-as-a-service variant, previously known as Cyclops and Knight. Since February 2024, it has encrypted and exfiltrated data from over 210 victims spanning multiple industries.
Read Post
fidelis security

Best Practices for Preventing BlackSuit Ransomware Infections

Sep 25, 2024 By Fidelis Security In Fidelis Security
Are you confident that your security tools are foolproof? Think again. BlackSuit ransomware is exploiting overlooked vulnerabilities, slipping through defenses even in 53 well-protected organizations. This isn’t just another cyber threat—it’s a sophisticated adversary that rewrites the rules. Your firewalls, antivirus, and strict protocols might not be enough to stop it. BlackSuit is engineered to find gaps you didn’t know existed, bypassing even advanced security postures.
Read Post

Why DORA Is a Game-Changer for Financial Services

Sep 25, 2024 By Rubrik In Rubrik
In this episode of CISO Conversations: EU Data Regulations, Richard Cassidy, EMEA Field CISO at Rubrik, is joined by Anna Delaney, Director of Productions at Information Security Media Group (ISMG), to explore why the Digital Operational Resilience Act (DORA) makes operational resilience a priority for financial services organizations. They discuss how DORA will impact your financial institution, how to best prepare for DORA and improve operational resilience, and how to increase oversight and accountability of third parties in the supply chain.
View Video
keeper

How To Detect Spyware on an Android Phone

Sep 25, 2024 By Ashley D'Andrea In Keeper
You can detect spyware on an Android phone by recognizing the following signs: your phone suddenly becomes slow, the battery drains quickly, unfamiliar apps appear, it overheats frequently, you receive strange messages or it makes weird noises during phone calls. Spyware is a form of malware installed onto your device without your knowledge. Once spyware is installed, a cybercriminal can spy on you and collect private information like passwords or credit card numbers.
Read Post
Rubrik

How Government Agencies Can Regain Control Over Who Has Access to Sensitive Public Data

Sep 25, 2024 By Alok Shah In Rubrik
We’re thrilled to announce the availability of User Intelligence on Rubrik Security Cloud - Government. Rubrik User Intelligence empowers Fed and SLED organizations with visibility into user activities, access patterns, and potential risks. This level of insight is critical for enforcing least-privilege access to sensitive data, before it results in breaches.
Read Post
foresiet

Chinese Hackers Target APAC Governments with EAGLEDOOR Malware Exploiting GeoServer Flaw

Sep 24, 2024 By Foresiet In Foresiet
In a sophisticated cyber espionage campaign, a group of Chinese hackers has exploited a critical vulnerability in GeoServer to target government organizations across the Asia-Pacific (APAC) region. This operation, linked to the advanced persistent threat (APT) group known as Earth Baxia, highlights the evolving landscape of cyber threats facing sensitive sectors, including government and energy.
Read Post
knowbe4

McAfee Discovers New Phishing Campaign Targeting GitHub Users

Sep 24, 2024 By Stu Sjouwerman In KnowBe4
A phishing campaign is targeting GitHub users with phony CAPTCHA pages, according to researchers at McAfee. The phishing emails ask users to address a security vulnerability in a GitHub repository that they recently contributed to, and contain a link to find more information about the alleged vulnerability. This link leads to a fake CAPTCHA page that attempts to trick them into installing malware.
Read Post
tripwire

Warnings After New Valencia Ransomware Group Strikes Businesses and Leaks Data

Sep 24, 2024 By Graham Cluley In Tripwire
A new ransomware operation has started to leak information it claims has been stolen from organisations it has compromised around the world. In recent days Valencia Ransomware has posted on its dark web leak site's so-called "Wall of shame" links to gigabytes of downloadable information that has seemingly been exfiltrated from a Californian municipality, a pharmaceutical firm, and a paper manufacturer.
Read Post
Rubrik

Why the CISO & CIO Must Partner for Cyber Resilience

Sep 24, 2024 By Seema Kathuria In Rubrik
In today’s interconnected world, where the digital landscape is constantly evolving, the threats to an organization’s cybersecurity posture are more sophisticated and pervasive than ever before. Relying on traditional, largely prevention-focused cybersecurity tools and approaches is not enough. Cyber attacks are inevitable.
Read Post
parablu

Closing the Gap in Ransomware Defense: Protecting Critical Business Data

Sep 22, 2024 By Parablu
Ransomware attacks have emerged as a significant threat to organizations of various sizes and sectors, spanning regions worldwide, with the potential to cause severe financial and reputational harm. In the event of a ransomware attack, enterprises could lose control over valuable data assets, which can result in severe disruption of business operations. Usually, attackers target crucial data or information,
Get White Paper
Rubrik

Rubrik Leads the Way in Cyber Resilience: Ranked Highest for Ransomware Protection, Detection, and Recovery by Gartner

Sep 19, 2024 By Justin Ruiz In Rubrik
We are thrilled to announce that Rubrik has been ranked highest for the ransomware protection, detection, and recovery use case in the 2024 Gartner Critical Capabilities for Enterprise Backup and Recovery Software Solutions1. This recognition underscores our unwavering commitment to innovation that empowers customers with robust cyber resilience solutions in an increasingly complex digital landscape.
Read Post
foresiet

Infostealers: An Early Indicator of Ransomware Attacks

Sep 19, 2024 By Foresiet In Foresiet
Cybersecurity experts are beginning to notice a recurring pattern: many companies that fall victim to ransomware attacks first experience infections from infostealers. These malicious tools are designed to siphon sensitive information from systems, but they might also serve as an early warning for defenders, providing the opportunity to act before a full-scale ransomware attack occurs.
Read Post
Featured Post
11:11 systems

Data Resilience and Protection in the Ransomware Age

Sep 18, 2024 By Sam Woodcock, Director of Cloud Strategy and Enablement In 11:11 Systems
Data is the currency of every business today, but it is under significant threat. As companies rapidly collect and store data, it is driving a need to adopt multi-cloud solutions to store and protect it. At the same time, ransomware attacks are increasing in frequency and sophistication. This is supported by Rapid7's Ransomware Radar Report 2024 which states, "The first half of 2024 has witnessed a substantial evolution in the ransomware ecosystem, underscoring significant shifts in attack methodologies, victimology, and cybercriminal tactics."
Read Post
knowbe4

North Korean Hackers Target Software Developers With Phony Coding Tests

Sep 18, 2024 By Stu Sjouwerman In KnowBe4
Researchers at ReversingLabs warn that North Korea’s Lazarus Group is targeting software developers with phony job interviews. The threat actors are posing as employees of major financial services firms and send coding assessment tests as part of the interview process. Our team recently recorded a webinar that covers this exact topic, as our cybersecurity experts discuss how we spotted the red flags and stopped it before any damage was done.
Read Post

Securing Digital Health: Cybersecurity Challenges in Rapid Healthcare Transformation #shorts

Sep 18, 2024 By Rubrik In Rubrik
The healthcare industry, traditionally slow in digital transformation due to stringent regulations, is now experiencing rapid change. As digitization accelerates, vast amounts of personal and professional data are being stored across healthcare systems—making them prime targets for cybercriminals. This sector’s rich data environment, coupled with evolving cybersecurity practices, creates a unique challenge. Unlike the well-established security measures in banking and financial services, healthcare's cyber defenses are still maturing.
View Video

Measuring Your Data's Risk Exposure with Bipul Sinha, CEO, Chairman, and Co-Founder of Rubrik

Sep 17, 2024 By Rubrik In Rubrik
Welcome to the Data Security Decoded podcast, brought to you by Rubrik Zero Labs. In each installment, we discuss cybersecurity with thought leaders and industry experts, and get their take on trends, themes, and where they see the sector going next. This is a must-listen for security and IT leaders looking to better understand trends shaping data security and how they can achieve cyber resilience.
View Video

Embracing Resilience in Cybersecurity: Preparing for Recovery and Thriving Post-Attack #shorts

Sep 17, 2024 By Rubrik In Rubrik
In cybersecurity, the real challenge isn’t just preventing attacks; it's about how you rebound and continue delivering your digital products and services when an attack hits. The crucial focus must be on preparedness and resilience, not just avoidance. It's natural to want to ignore the possibility of a breach—our minds prefer to focus on positive scenarios. But effective planning requires embracing the pessimistic side of our intellect.
View Video
Trustwave

ALPHV BlackCat Ransomware: A Technical Deep Dive and Mitigation Strategies

Sep 17, 2024 By Trustwave In Trustwave
ALPHV, also known as BlackCat or Noberus, is a sophisticated ransomware group targeting critical infrastructure and various organizations, including being the most active group used to attack the financial services sector. ALPHV first appeared in November 2021 and operates on a Ransomware-as-a-Service (RaaS) model, allowing affiliates to use its malware for their own attacks in exchange for a cut of the ransom payments.
Read Post
keeper

How To Detect and Remove a Keylogger

Sep 17, 2024 By Ashley D'Andrea In Keeper
You can detect a keylogger if you notice unfamiliar apps on your device, slower performance speeds, a lag in mouse movements or strange background noises on phone calls. A keylogger is a type of malware that requires an entry point, such as an email or cloud program, to be installed on your device. Once it is on your device, a cybercriminal can monitor every keystroke you make to learn your login credentials and private information.
Read Post
knowbe4

New Ransomware Threat Group, RansomHub, is so Effective, the NSA is Already Warning You About Them

Sep 16, 2024 By Stu Sjouwerman In KnowBe4
The latest evolution of the ransomware service model, RansomHub, has only been around since February of this year, but its affiliates are already successfully exfiltrating data. You know you’re a problem when the U.S. government puts out a notice about you. That’s the case for RansomHub — the latest iteration of a ransomware as a service group formerly working under the names Cyclops and Knight.
Read Post
Rubrik

Defending Against Attacks on Data with Rubrik and the CrowdStrike Falcon Platform

Sep 12, 2024 By Zoltan Deak In Rubrik
In today's digital landscape, cyber attacks are an ever-present threat, and they all ultimately target one thing: data. For most organizations, the challenge lies not only in protecting this data but also in understanding the full scope of what they have. Many organizations struggle to identify how much sensitive data they possess, where it resides, and who has access to it.
Read Post
sedara

Inside the Cloud: Cloud-Based Ransomware

Sep 12, 2024 By Courtney Bell In Sedara
This is the second in a series of articles about cloud-based attack vectors. Check out our last article about admin takeovers! Inside the Cloud: Attacks & Prevention – Administrative Account Compromise Ransomware has long been associated with takeovers of endpoints. However, attackers are evolving to target cloud environments – and the effects can be devastating.
Read Post
outpost 24

Crystal Rans0m: Emerging hybrid ransomware with stealer capabilities

Sep 12, 2024 By Lidia López Sanz In Outpost 24
Crystal Rans0m is a previously undocumented hybrid ransomware family developed in Rust programming language seen for the first time in the wild on September 2nd, 2023. Interestingly, it does not only encrypt victim’s files, demanding a ransom for their release, but also steals sensitive information from the infected systems. This dual-threat approach means that attackers can double their leverage over victims, potentially increasing their chances of monetizing their attacks.
Read Post

Defend Your Data Against Cyberattacks with Rubrik & CrowdStrike

Sep 12, 2024 By Rubrik In Rubrik
With the growing volume of data and increasing cost of breaches, organizations must find ways to manage and protect their ever-expanding datasets. To address this escalating threat landscape, Rubrik and CrowdStrike have joined forces to redefine cyber defense with several integration points between our platforms. This video walks you through the latest integration between Rubrik Security Cloud and CrowdStrike Falcon Insight XDR, from installing and configuring, through how the Rubrik data context can be used by a security operator when investigating an incident.
View Video

Trailer: Measuring Your Data's Risk Exposure #CyberSecuritypodcast #CyberSecurity #shorts

Sep 12, 2024 By Rubrik In Rubrik
Mike Tyson famously said, 'Everybody has a plan till they get punched in the face.' In cybersecurity, traditional strategies focus on preventing attacks—essentially planning for the punch. But what happens when the punch lands? It’s not just about the breach itself; it’s about how an organization responds. True resilience is measured by how swiftly and effectively you rebound. Strengthening infrastructure, refining processes, and enhancing talent are crucial steps in not just surviving but thriving after an incident.
View Video
knowbe4

Your Lawyers Are Increasingly Targeted by Phishing Attacks, Ransomware

Sep 11, 2024 By Stu Sjouwerman In KnowBe4
Researchers at Bitdefender warn that law firms are high-value targets for ransomware gangs and other criminal threat actors. Attackers frequently use phishing to gain initial access to an organization’s networks. “Phishing is one of the most common attacks in the legal field,” the researchers write. “Cybercriminals pose as legitimate entities, tricking employees into divulging sensitive information or clicking malicious links.
Read Post
ThreatQuotient

Ransomware in the Global Healthcare Industry

Sep 10, 2024 By Leon Ward In ThreatQuotient
The World Health Organisation (WHO) recently hosted a webinar to discuss the critical importance of cybersecurity in the healthcare sector, which highlighted the severity of the situation the industry is currently facing. Healthcare organisations are increasingly relying on digital systems to facilitate their daily workflow, but the prevalence of outdated legacy technology in the sector is rendering it vulnerable to cyberattacks with severe consequences.
Read Post

Preparing for Breaches: the Importance of Incident Response Plans and Exercises

Sep 10, 2024 By Rubrik In Rubrik
Welcome to the Data Security Decoded podcast, brought to you by Rubrik Zero Labs. In each installment, we discuss cybersecurity with thought leaders and industry experts, and get their take on trends, themes, and where they see the sector going next. This is a must-listen for security and IT leaders looking to better understand trends shaping data security and how they can achieve cyber resilience.
View Video

The Power of Backups: A Key Defense Against Ransomware and Data Breaches #shorts

Sep 10, 2024 By Rubrik In Rubrik
Backup, backup, backup. That’s the message from Heather Hughes from Aon Cyber Solutions, who emphasizes the crucial role of robust backups in cybersecurity. Effective backups can eliminate the need for a decryptor and ensure business continuity, even when faced with ransomware. Heather highlights that, with strong backups, companies can avoid paying ransoms and focus on assessing potential data exfiltration.
View Video
foresiet

Crimson Palace APT: How China's Tag-Team Cyber Espionage Units Are Targeting Asian Governments

Sep 10, 2024 By Foresiet In Foresiet
Advanced Persistent Threat (APT) groups have long been key players in global cyber espionage, and in 2024, a Chinese-linked threat cluster known as "Crimson Palace" continues to demonstrate its effectiveness. This collective of three distinct APT units has managed to breach multiple organizations across Asia, including a prominent government agency in Southeast Asia, proving their ability to evade detection and extract sensitive information.
Read Post
knowbe4

Use of Malicious Links Surges by 133% in Q1, Setting the Tone for the First Half of 2024

Sep 9, 2024 By Stu Sjouwerman In KnowBe4
Threat actors are opting for malicious links over attachments in email-based attacks because it gives them a critical advantage that many solutions can’t address. Given that a malicious email is the very first step (or close to it) in an attack, it’s critically important that the attack maintain its’ stealth; detecting an attack at this point means an early (and well-deserved) death to the attack itself – something threat actors don’t want to see.
Read Post
Rubrik

Backup is Back

Sep 9, 2024 By Eddie Wlazlowski In Rubrik
Flannel shirts, acid-washed jeans, Polaroid cameras, and vinyl records—these items which were once out of style are now emerging as popular must-haves among the younger generation. In the realm of IT, data backup has always been a necessity. Initially, it represented a compelling concept—storing data in an alternate location to ensure redundancy and failover capabilities in preparation for natural disasters.
Read Post
parablu

Parablu's Guide to 2024 Ransomware Playbook

Sep 9, 2024 By Parablu In Parablu
Ransomware incident response is the need of the hour. Let me explain you why- Ransomware attacks have evolved to become a critical threat in 2024, while recovery from such an attack increased drastically from $1.82 million in 2023 to a whopping $2.73 million this year—which is sans any ransom paid out. Healthcare organizations have fallen victim quite badly, where the cost of data breaches increased by 53.3% since 2020.
Read Post
gitguardian

How Popular Malware Is Stealing Credentials and What You Can Do About It

Sep 6, 2024 By Guillaume Valadon In GitGuardian
Credentials are prime targets for attackers, as they make it easy to access resources as legitimate users without discovering vulnerabilities or using technical exploits. Malware authors know how interesting these low-hanging fruits are and are coming after your secrets!
Read Post
Arctic Wolf

Arctic Wolf Observes Akira Ransomware Campaign Targeting SonicWall SSLVPN Accounts

Sep 6, 2024 By Stefan Hostetler In Arctic Wolf
On August 22, 2024, a remote code execution vulnerability (CVE-2024-40766) was disclosed in SonicOS, affecting a selection of SonicWall firewall devices. At the time of disclosure, active exploitation was not known and no proof-of-concept exploit was publicly available. As of September 6, 2024, however, the security advisory has been updated with additional details, indicating that the vulnerability is potentially being actively exploited.
Read Post
Rubrik

It's Time to Press Play on the AI Pause: Data Security Insights for a New Era

Sep 5, 2024 By Noam Perel In Rubrik
This past summer was the first time I watched the Olympics since moving to the U.S. Besides appreciating the sheer greatness of the American Olympic spirit, there was also another thing that could not go missed - AI! Filling up every commercial slot seemed to be AI. And mainly, the commercials focused on harnessing AI for business productivity and operations. No matter your take on the greatest Olympic moment or greatest AI commercial, one could not overlook this overwhelming trend.
Read Post
Rubrik

Achieving Complete Cyber Resilience in Healthcare

Sep 5, 2024 By Rick Bryant In Rubrik
Ahead of Rubrik’s inaugural Healthcare Summit on September 12th, I thought it was appropriate to set the stage for what’s coming. Threat actors aren’t going to wait for you to get ready before they launch their attack. They’re banking on you not being able to recover your data—or not being able to recover fast enough—to maximize the damage they leave in their wake.
Read Post
foresiet

Revival Hijack: How Abandoned PyPI Package Names Are Being Exploited to Deliver Malware

Sep 5, 2024 By Foresiet In Foresiet
Security researchers have uncovered a novel and concerning method for cybercriminals to distribute malware using public code repositories. Known as "Revival Hijack," this technique involves the re-registration of previously abandoned package names on the PyPI repository. By taking advantage of the fact that PyPI allows the reuse of names from removed packages, attackers are able to slip malicious code into unsuspecting organizations.
Read Post
Trustwave

Phishing and Ransomware: How Threat Actors Attack the Financial Services Sector

Sep 4, 2024 By Trustwave In Trustwave
Trustwave SpiderLabs is prepped to launch its newest threat intelligence research, the 2024 Trustwave Risk Radar Report: Financial Services Sector. The upcoming report, which is set to be released on September 10, promises to be an indispensable resource for cybersecurity professionals. This comprehensive report not only sheds light on the modus operandi of a dominant ransomware gang but also delves into the persistent use of phishing and brute-force attacks to compromise credentials.
Read Post
cyberint

A Deep-Dive Into Initial Access Brokers: Trends, Statistics, Tactics and more

Sep 3, 2024 By Adi Bleih In Cyberint
Initial Access Brokers (IABs) are threat actors who infiltrate networks, systems, or organizations and sell this unauthorized access to other malicious actors. Instead of executing the entire cyberattack, IABs focus on the initial breach and monetize it by selling access to compromised systems. They assist ransomware operations, particularly RaaS schemes, by streamlining attacks and reducing workload at the start.
Read Post
Trustwave

Your Money or Your Data: Ransomware Readiness Planning

Sep 2, 2024 By David Broggy In Trustwave
Today’s blog installment brings us to the end of our 30-week journey that covered 30 cybersecurity topics that I felt would be of interest to a wide variety of security practitioners, such as Security Architects, Security Admins, and Security Auditors. I hope everyone found it as helpful as I found it to write. So, let’s move on with our last topic.
Read Post

Copyright © 2024 OpsMatters™. All rights reserved.