Skip to main content
To Customer Support To Customer Support

Security Industry News

We'll post what we hear. You post what you hear!

  • 35,493 Topics
  • 25,914 Replies
35493 Topics
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Global Campaign Targets PlugX Malware with Innovative Portal

January 2, 2025 By Alessandro Mascellino A groundbreaking malware disinfection campaign targeting the PlugX worm has been executed with the collaboration of international authorities.Led by the Sekoia Threat Detection & Research team, the operation disinfected compromised systems across multiple countries.The PlugX worm, often linked to Mustang Panda, can spread through infected flash drives, making it highly pervasive. After gaining control of a key command-and-control (C2) server in 2023, Sekoia researchers Charles Meslay and Félix Aimé analyzed the malware and proposed two potential disinfection methods. >>Full Article<<

10
Jasper_The_Rasper
Moderator
11 hours ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Hackers can steal your accounts, and all it takes is a double-click — don’t fall for this new form of clickjacking

January 2, 2025 By Anthony Spadafora Whatever you do, don’t double-click on that CAPTCHA (Image credit: Shutterstock) While you always want to be careful where you click online, a new variation on the classic clickjacking attack should give you pause when a site asks you to double-click on something.As reported by Cybernews, Amazon security engineer Paulos Yibelo has shed light on a new version of this attack that can be used to disable security settings, delete an account or even take over your existing accounts.As the name suggests, clickjacking is an attack method where hackers, scammers or other cybercriminals hijack your clicks on one website to perform malicious actions on another site. For instance, you might think you’re clicking a button on the site you’re currently browsing, and that click will then be used to buy something on another entirely different site.Now, hackers have added another click to this attack method to get around the fact that modern browsers no longer send 

10
Jasper_The_Rasper
Moderator
11 hours ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Volkswagen Breach Exposes Data of 800K EV Customers

Ethical hacking group Chaos Computer Club uncovered exposed data of electrical vehicle owners across the company's VW, Audi, Seat, and Skoda brands. January 2, 2025 By Kristina Beek Volkswagen Group experienced a data breach last month, exposing sensitive personal information of roughly 800,000 electrical vehicle owners across its brands, including Volkswagen, Audi, Seat, and Skoda.Initially reported by German publication Speigel, the breach has been attributed to an Amazon cloud storage system misconfiguration, which is managed by software subsidiary Cariad. The group reportedly left personal and location data openly accessible online for months on end, prompting the breach.The anonymous hacker who discovered the breach reported it to Chaos Computer Club (CCC), a well known organization of ethical hackers in Europe. The CCC tested the open, insecure access before informing Cariad and Volkswagen. >>Full Article<<

10
Jasper_The_Rasper
Moderator
11 hours ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
DoubleClickjacking allows clickjacking on major websites

January 2, 2025 By Pierluigi Paganini  The “DoubleClickjacking” exploit bypasses protections on major websites, using a double-click sequence for clickjacking and account takeover attacks.DoubleClickjacking is a technique that allows attackers to bypass protections on major websites by leveraging a double-click sequence.Attackers can exploit the technique to facilitate clickjacking attacks and account takeovers on almost all major websites.Clickjacking attacks trick users into unintended clicks, this practice has declined as modern browsers enforce “SameSite: Lax” cookies, blocking cross-site authentication.DoubleClickjacking, exploiting double-click sequences, bypasses clickjacking protections like X-Frame-Options and SameSite cookies, potentially allowing platform account takeovers. >>Full Article<<

10
Jasper_The_Rasper
Moderator
12 hours ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Over 3 million mail servers without encryption exposed to sniffing attacks

January 2, 2025 By Sergiu Gatlan  Over three million POP3 and IMAP mail servers without TLS encryption are currently exposed on the Internet and vulnerable to network sniffing attacks.IMAP and POP3 are two methods for accessing email on mail servers. IMAP is recommended for checking emails from multiple devices, such as phones and laptops because it keeps your messages on the server and synchronizes them between devices. POP3, on the other hand, downloads emails from the server, making them accessible only from the device where they were downloaded.The TLS secure communication protocol helps secure users' information while exchanging and accessing their emails over the Internet through client/server applications. However, when TLS encryption is not enabled, their messages' contents and credentials are sent in clear text, exposing them to eavesdropping network sniffing attacks. IMAP and POP3 mail servers without TLS (Shadowserver) >>Full Article<<

10
Jasper_The_Rasper
Moderator
12 hours ago
TripleHelix
Moderator
TripleHelixModerator
posted in Security Industry News
Microsoft December 2024 Security Updates (Patch Tuesday)

This release consists of the following 72 Microsoft CVEs:Tag CVE Base Score CVSS Vector Exploitability FAQs? Workarounds? Mitigations?System Center Operations Manager CVE-2024-43594Microsoft Office CVE-2024-43600Microsoft Edge (Chromium-based) CVE-2024-49041Microsoft Defender for Endpoint CVE-2024-49057Microsoft Office CVE-2024-49059Microsoft Office SharePoint CVE-2024-49062GitHub CVE-2024-49063Microsoft Office SharePoint CVE-2024-49064Microsoft Office Word CVE-2024-49065Microsoft Office SharePoint CVE-2024-49068Microsoft Office Excel CVE-2024-49069Microsoft Office SharePoint CVE-2024-49070Windows Task Scheduler CVE-2024-49072Windows Mobile Broadband CVE-2024-49073Windows Kernel-Mode Drivers CVE-2024-49074Windows Remote Desktop Services CVE-2024-49075Windows Virtualization-Based Security (VBS) Enclave CVE-2024-49076Windows Mobile Broadband CVE-2024-49077Windows Mobile Broadband CVE-2024-49078Microsoft Office Publisher CVE-2024-49079Windows IP Routing Management Snapin CVE-2024-49080Win

5410
TripleHelix
Moderator
2 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
US Treasury Department breached through remote support platform

December 30, 2024 By Lawrence Abrams Chinese state-sponsored threat actors hacked the U.S. Treasury Department after breaching a remote support platform used by the federal agency.In a letter sent to lawmakers and seen by the New York Times, the Treasury Department warned lawmakers it was first notified of the breach on December 8th by its vendor BeyondTrust.BeyondTrust is a privileged access management company that also offers a remote support SaaS platform that can be used to access computers remotely."Based on available indicators, the incident has been attributed to a China state-sponsored Advanced Persistent Threat (APT) actor," reads the letter seen by the New York Times."In accordance with Treasury policy, intrusions attributable to an APT are considered a major cybersecurity incident." >>Full Article<<

40
Jasper_The_Rasper
Moderator
3 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
ZAGG disclosed a data breach that exposed its customers’ credit card data

December 30, 2024 By  Pierluigi Paganini ZAGG Inc. notifies customers of credit card data breach, after threat actors hacked a third-party app from its e-commerce provider.ZAGG Inc. disclosed a data breach that exposed its customers’ credit card data after threat actors hacked a third-party application from its e-commerce provider BigCommerce. The company has not disclosed the number of impacted customers were impacted by this security breach.ZAGG Inc. is a consumer electronics accessories company based in the United States. It is best known for producing products like screen protectors, mobile device cases, power banks, wireless charging devices, and other smartphone and tablet accessories.ZAGG notified law enforcement authorities and told impacted customers that threat actors gained access to their data via BigCommerce’s FreshClick app. Compromised customer payment data includes names, addresses, and card details. >>Full Article<<

30
Jasper_The_Rasper
Moderator
3 days ago
TripleHelix
Moderator
TripleHelixModerator
posted in Security Industry News
Vulnerability Summary for the Week of December 23, 2024 Released Dec 30, 2024

Document IDSB24-365 The CISA Vulnerability Bulletin provides a summary of new vulnerabilities that have been recorded in the past week. In some cases, the vulnerabilities in the bulletin may not yet have assigned CVSS scores.Vulnerabilities are based on the Common Vulnerabilities and Exposures (CVE) vulnerability naming standard and are organized according to severity, determined by the Common Vulnerability Scoring System (CVSS) standard. The division of high, medium, and low severities correspond to the following scores:High: vulnerabilities with a CVSS base score of 7.0–10.0 Medium: vulnerabilities with a CVSS base score of 4.0–6.9 Low: vulnerabilities with a CVSS base score of 0.0–3.9Entries may include additional information provided by organizations and efforts sponsored by CISA. This information may include identifying information, values, definitions, and related links. Patch information is provided when available. Please note that some of the information in the bulletin is comp

70
TripleHelix
Moderator
3 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Over 600,000 Chrome users at risk after 16 browser extensions compromised by hackers — what you need to know

December 30, 2024 By  Anthony Spadafora  Hackers are adding malicious code to legitimate Chrome extensions to steal user data (Image credit: Shutterstock)In the same way that malicious apps can end up on your phone, your browser and by extension your computer can be infected after installing a risky extension in Chrome. Likewise, even legitimate extensions can turn malicious when tampered with by hackers.As reported by The Hacker News, a dangerous new campaign targeting browser extensions has been spotted online. So far, at least 16 extensions have been compromised with over 600,000 Chrome users now at risk of having their browsing data and their account credentials exposed online.Here’s everything you need to know about this new campaign including a full list of all the compromised extensions so far along with some tips and tricks on how you can protect yourself from falling victim to these now malicious Chrome extensions. >>Full Article<<

60
Jasper_The_Rasper
Moderator
3 days ago
TripleHelix
Moderator
TripleHelixModerator
posted in Security Industry News
Alert CISA Adds One Known Exploited Vulnerability to Catalog Release Date December 30, 2024

CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation.CVE-2024-3393Palo Alto Networks PAN-OS Malformed DNS Packet VulnerabilityThese types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the Known Exploited Vulnerabilities Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the BOD 22-01 Fact Sheet for more information.Although BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing time

50
TripleHelix
Moderator
3 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Catching "EC2 Grouper"- no indicators required!

By Chris Hall | December 30, 2024Through the years of analyzing identity compromises in the cloud, we’ve seen the same attackers pop up regularly, some more frequently than others. Among the more prolific ones we’ve come to know is one we’ve dubbed “EC2 Grouper”. Over the past couple of years, we’ve seen this actor in several dozen customer environments, making them one of the more active groups we’ve tracked. This usual suspect is attributed by their penchant for using similar user agents and the same security group naming convention in their attacks. While indicators such as user agents and even security group names can assist in attribution and hunting, we have found them unreliable for comprehensive threat detection. In this blog, we’ll detail tactics associated with EC2 Grouper and how Lacework FortiCNAPP can be leveraged to detect this threat, among others. More importantly, we will showcase how this is achieved without relying on actor-specific indicators, which can be transient

20
Jasper_The_Rasper
Moderator
3 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Threat actors attempt to exploit a flaw in Four-Faith routers

December 30, 2024 By Pierluigi Paganini VulnCheck researchers warn that threat actors are attempting to exploit a high-severity vulnerability impacting some Four-Faith routers.Cybersecurity firm VulnCheck warns that a high-severity flaw, tracked as CVE-2024-12856 (CVSS score: 7.2), in Four-Faith routers is actively exploited in the wild.The vulnerability is an operating system (OS) command injection vulnerability that impacts Four-Faith router models F3x24 and F3x36.“At least firmware version 2.0 allows authenticated and remote attackers to execute arbitrary OS commands over HTTP when modifying the system time via apply.cgi.” reads the advisory. “Additionally, this firmware version has default credentials which, if not changed, would effectively change this vulnerability into an unauthenticated and remote OS command execution issue.”VulnCheck researchers reported that authenticated attackers exploited default router credentials to execute unauthenticated remote command injections. >

20
Jasper_The_Rasper
Moderator
3 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Atos database reportedly breached by hackers

December 30, 2024 By Craig Hale Atos threatened with potential ransomware attack  Ransomware group Space Bears claims ransomware attack on Atos No evidence has been found and no ransom demands received Space Bears, a new group, has already targeted many companiesFrench tech giant Atos has confirmed it has been hit by a cyberattack, but has noted the threat might just be a false alarm.The company shared details of a threat by ransomware group Space Bears, which claimed to have compromised an internal Atos database.However, Atos said that initial investigations revealed no evidence of any compromise or ransomware affecting any of its systems in any country, or those of its subsidiary Eviden. >>Full Article<<

10
Jasper_The_Rasper
Moderator
3 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Novel malware leveraged in Cloud Atlas attacks

December 30, 2024 By SC Staff (Adobe Stock)Attacks with the new VBCloud malware have been deployed by Russian state-backed threat operation Cloud Atlas, also known as Clean Ursa, Oxygen, Inception, and Red October, to facilitate data theft against dozens of users, most of whom are in Russia, reports The Hacker News.Cloud Atlas distributed phishing emails with a Microsoft Office document that downloads a malicious RTF template, which then leverages an Equation Editor vulnerability, tracked as CVE-2018-0802, to execute an HTML Application file that establishes launcher and cleaner files for the VBShower backdoor, an analysis from Kaspersky revealed.Aside from enabling additional Visual Basic Script payload retrieval, VBShower also allowed the deployment of PowerShower, which acts as a downloader for up to seven PowerShell payloads, and VBCloud, which allows gathering of disk information, system metadata, documents of various formats, and Telegram-related files. >>Full Article<&l

10
Jasper_The_Rasper
Moderator
3 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Palo Alto Networks Patches Firewall Zero-Day Exploited for DoS Attacks

See Also - Hackers exploit DoS flaw to disable Palo Alto Networks firewalls Palo Alto Networks has patched CVE-2024-3393, a vulnerability that has been exploited for DoS attacks against the company’s firewalls. December 30, 2024 By Eduard Kovacs Palo Alto Networks informed customers late last week that it has patched a zero-day vulnerability that has been exploited to launch denial-of-service (DoS) attacks against its firewalls.The security hole, tracked as CVE-2024-3393, impacts the DNS Security feature of the PAN-OS software that runs on Palo Alto Networks firewalls. The flaw allows an unauthenticated attacker to cause the firewall to reboot by sending a specially crafted packet through the data plane.“Repeated attempts to trigger this condition will cause the firewall to enter maintenance mode,” the company warned. >>Full Article<<

50
Jasper_The_Rasper
Moderator
3 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Cisco states that the second data leak is linked to the one from October

December 30, 2024 By Pierluigi Paganini Cisco confirmed the authenticity of the 4GB of leaked data, the data was compromised in a recent security breach, marking the second leak in the incident.Cisco confirmed the authenticity of the 4GB of leaked data, which was compromised in a recent security breach, marking it as the second leak in the incident.“We are aware of some recent social media posts made by the actor. Based on information available to us at this time, we believe that the files referenced in the posts are files that we had previously identified during our investigation and reported on. On Wednesday, December 25, 2024, at 17:07 EST, the threat actor IntelBroker posted on X about releasing more data. At 17:40 EST, IntelBroker released 4.45 GB of data for free on BreachForums. We have analyzed the post data, and it aligns with the known data set from October 14, 2024.” reads the update published by Cisco. >>Full Article<<

20
Jasper_The_Rasper
Moderator
3 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Microsoft issues urgent dev warning to update .NET installer link

December 30, 2024 By Zo Ahmed  Microsoft is forcing .NET developers to quickly update their apps and developer pipelines so they do not use 'azureedge.net' domains to install .NET components, as the domain will soon be unavailable due to the bankruptcy and imminent shutdown of CDN provider Edgio.Specifically, the domains "dotnetcli.azureedge.net" and "dotnetbuilds.azureedge.net" will be taken offline in the next few months, which could break the functionality of projects relying on the domains.This includes developers using .NET installers residing on the affected domains, organizations using GitHub Actions or Azure DevOps with custom pipelines using those domains, Docker and script users with files and code referencing the retired domains, and more."We maintain multiple Content Delivery Network (CDN) instances for delivering .NET builds. Some end inazureedge.net. These domains are hosted by edg.io, which will soon cease operations due to bankruptcy. We are required to migrate to a new

20
Jasper_The_Rasper
Moderator
3 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Health care giant Ascension says 5.6 million patients affected in cyberattack

See Also - Ascension Healthcare Suffers Major Cyberattack Intrusion caused medical errors and diversion of emergency services.Dan Goodin – 23 Dec 2024  Health care company Ascension lost sensitive data for nearly 5.6 million individuals in a cyberattack that was attributed to a notorious ransomware gang, according to documents filed with the attorney general of Maine.Ascension owns 140 hospitals and scores of assisted living facilities. In May, the organization was hit with an attack that caused mass disruptions as staff was forced to move to manual processes that caused errors, delayed or lost lab results, and diversions of ambulances to other hospitals. Ascension managed to restore most services by mid-June. At the time, the company said the attackers had stolen protected health information and personally identifiable information for an undisclosed number of people. >>Full Article<<

71
Jasper_The_Rasper
Moderator
6 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
A new Mirai botnet variant targets DigiEver DS-2105 Pro DVRs

December 26, 2024 By Pierluigi Paganini Akamai researchers discovered a new Mirai botnet variant targeting a vulnerability in DigiEver DS-2105 Pro DVRs.Akamai researchers spotted a Mirai-based botnet that is exploiting an remote code execution vulnerability in DigiEver DS-2105 Pro NVRs.The experts pointed out that this Mirai variant has been modified to use improved encryption algorithms. The Mirai variant incorporates ChaCha20 and XOR decryption algorithms. In November 2024, the Akamai Security Intelligence Research Team (SIRT) observed increased activity targeting the URI /cgi-bin/cgi_main.cgi, linked to a Mirai-based malware campaign exploiting an unassigned RCE vulnerability in DVR devices, including DigiEver DS-2105 Pro.“Further investigation into this campaign revealed a new botnet that calls itself the “Hail Cock Botnet” that’s been active since at least September 2024.” reads the analysis published by Akamai. “Using a Mirai malware variant that incorporates ChaCha20 and XOR dec

50
Jasper_The_Rasper
Moderator
6 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Cybersecurity firm's Chrome extension hijacked to steal users' data

December 27, 2024 By Bill Toulas At least five Chrome extensions were compromised in a coordinated attack where a threat actor injected code that steals sensitive information from users.One attack was disclosed by Cyberhaven, a data loss prevention company that alerted its customers of a breach on December 24 after a successful phishing attack on an administrator account for the Google Chrome store.Among Cyberhaven's customers are Snowflake, Motorola, Canon, Reddit, AmeriHealth, Cooley, IVP, Navan, DBS, Upstart, and Kirkland & Ellis.The hacker hijacked the employee’s account and published a malicious version (24.10.4) of the Cyberhaven extension, which included code that could exfiltrate authenticated sessions and cookies to the attacker's domain (cyberhavenext[.]pro).Cyberhaven's internal security team removed the malicious package within an hour since its detection, the company says in an email to its customers. >>Full Article<<

40
Jasper_The_Rasper
Moderator
6 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Microsoft warns of Windows 11 24H2 installation issue that blocks all future security updates

December 27, 2024 By Sofia Elizabella Wyciślik-Wilson Microsoft is vocal about the importance of ensuring that Windows users have all of the latest security updates installed, and rightly so. Now the company has warned that using certain installation media to install Windows 11 24H2 could result in not being able to receive any further security updates.The root cause of the problem has not been revealed as Microsoft is still investigating, but the issue can occur when using media such as CDs or USB drives to install the latest version of Windows 11. While the cause is not known, and there is no specific fix, there is a workaround. >>Full Article<<

101
TripleHelix
Moderator
6 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Japan Airlines Was Hit by a Cyberattack, Delaying Flights During the Year-End Holiday Season

Japan Airlines was hit by a cyberattack, causing delays to more than 20 domestic flights, but there was no threat to flight safety. December 26, 2024 By Associated Press Japan Airlines said it was hit by a cyberattack Thursday, causing delays to more than 20 domestic flights but the carrier said it was able to stop the onslaught and restore its systems hours later. There was no impact on flight safety, it said.JAL said the problem started Thursday morning when the company’s network connecting internal and external systems began malfunctioning.The airline said it was able to identify the cause as an attack intended to overwhelm the network system with massive transmissions of data. Such attacks flood a system or network with traffic until the target cannot respond or crashes. >>Full Article<<

40
Jasper_The_Rasper
Moderator
6 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Experts warn of a surge in activity associated FICORA and Kaiten botnets

December 27, 2024 By Pierluigi Paganini FortiGuard Labs observed increased activity from two botnets, the Mirai variant “FICORA” and the Kaiten variant “CAPSAICIN”.FortiGuard Labs researchers observed a surge in activity associated with two botnets, the Mirai variant “FICORA” and the Kaiten variant “CAPSAICIN,” in late 2024. Both botnets target vulnerabilities in D-Link devices, particularly through the HNAP interface, allowing remote command execution. Some of the vulnerabilities exploited by the botnets are CVE-2015-2051,  CVE-2019-10891, CVE-2022-37056, and CVE-2024-33112.“According to our IPS telemetry, attackers frequently reuse older attacks, which accounts for the continued spread of the “FICORA” and “CAPSAICIN” botnets to victim hosts and infected targets.” reads the report published by Fortinet. “This article looks at their infected traffic and offers insights into these botnets.” >>Full Article<<

20
Jasper_The_Rasper
Moderator
6 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Hackers exploit DoS flaw to disable Palo Alto Networks firewalls

December 27, 2024 By Bill Toulas Palo Alto Networks is warning that hackers are exploiting the CVE-2024-3393 denial of service vulnerability to disable firewall protections by forcing it to reboot.Leveraging the security issue repeatedly, however, causes the device to enter maintenance mode and manual intervention is required to restore it to normal operations."A Denial of Service vulnerability in the DNS Security feature of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to send a malicious packet through the data plane of the firewall that reboots the firewall," reads the advisory. >>Full Article<<

40
Jasper_The_Rasper
Moderator
6 days ago

Badges

Show all badges

Join the Conversation

Terms & Conditions