Passkeys: What they are and how to use them
For the first time, we’ve begun rolling out passkeys, the easiest and most secure way to sign in to apps and websites and a major step toward a “passwordless future.”
Bad Actors Are Joining the AI Revolution: Here’s What We’ve Found in the Wild
Follow security researchers as they uncover malicious packages on open-source registries, trace bad actors to Discord, and unveil AI-assisted code.
AI-Powered 'BlackMamba' Keylogging Attack Evades Modern EDR Security
Researchers warn that polymorphic malware created with ChatGPT and other LLMs will force a reinvention of security automation.
SolarWinds: The Untold Story of the Boldest Supply-Chain Hack
It was late 2019, and Adair, the president of the security firm Volexity, was investigating a digital security breach at an American think tank. The intrusion was nothing special. Adair figured he and his team would rout the attackers quickly and be done with the case—until they noticed something strange. A second group of hackers was active in the think tank’s network. They were going after email, making copies and sending them to an outside server. These intruders were much more skilled, and they were returning to the network several times a week to siphon correspondence from specific executives, policy wonks, and IT staff.
What is a Rapid Security Response (RSR)
Intended to be lightweight, timely and quick to install, the first RSR has now been provided for Ventura. Did you know you can also uninstall it easily?
BouldSpy: Android Spyware Tied to Iranian Police Targets Minorities
Researchers at the Lookout Threat Lab have discovered a new Android surveillance tied to the Law Enforcement Command of the Islamic Republic of Iran (FARAJA).
Apple uses iOS and macOS Rapid Security Response feature for the first time
When it announced iOS 16, iPadOS 16, and macOS Ventura at its Worldwide Developers Conference last summer, one of the features Apple introduced was something called "Rapid Security Response." The feature is meant to enable quicker and more frequent security patches for Apple's newest operating systems, especially for WebKit-related flaws that affect Safari and other apps that use Apple's built-in browser engine.
FIN7 tradecraft seen in attacks against Veeam backup servers
WithSecure Intelligence identified attacks which occurred in late March 2023 against internet-facing servers running Veeam Backup & Replication software. Our research indicates that the intrusion set used in these attacks has overlaps with those attributed to the FIN7 activity group. It is likely that initial access & execution was achieved through a recently patched Veeam Backup & Replication vulnerability, CVE-2023-27532.
Investigating ChatGPT phishing detection capabilities
Kaspersky research on ChatGPT capabilities to tell a phishing link from a legitimate one by analyzing the URL, as well as extract target organization name.
AI Chatbots Have Been Used to Create Dozens of News Content Farms
The news-rating group NewsGuard has found dozens of news websites generated by AI chatbots proliferating online, according to a report published Monday, raising questions about how the technology may supercharge established fraud techniques.
Comparison of password strength across top hacking forums (of users that were infected with info-stealing malware)
Comparing the password strength of 5 hacking forum users that were compromised with info-stealers - Hackforums.net,...
LockBit and Cl0p ransomware gangs actively exploiting Papercut vulnerabilities
Vulnerabilities in PaperCut printing management are being used in ransomware attacks.
Magecart threat actor rolls out convincing modal forms
To ensnare new victims, criminals will often devise schemes that attempt to look as realistic as possible. Having said that, it is not every day that we see the fraudulent copy exceed the original piece. While following up on an ongoing Magecart credit card skimmer campaign, we were almost fooled by a payment form that looked so well done we thought it was real. The threat actor used original logos from the compromised store and customized a web element known as a modal to perfectly hijack the checkout page.
Hackers Leaked Minneapolis Students' Psychological Reports, Allegations of Abuse
In a hacking episode that is spiraling from bad to worse, cybercriminals have leaked highly sensitive documents related to droves of Minneapolis students.
RTM Locker Ransomware as a Service (RaaS) Now on Linux - Uptycs
Uptycs threat research team discovered a new ransomware Linux binary attributed to the RTM group Locker, a known Ransomware-as-a-Service (RaaS) provider.
Never Connect to RDP Servers Over Untrusted Networks
Did you know that RDP is unsafe without the use of additional protection like a VPN? In this blog post we will explain why and demonstrate the impact.
Mirai Botnet Attackers Exploit TP-Link Router Bug
Researchers began to detect exploit attempts in the wild targeting the patched, high-severity flaw in TP-Link routers starting on April 11.
Attackers Use Containers for Profit via TrafficStealer
We found TrafficStealer abusing open container APIs in order to redirect traffic to specific websites and manipulate engagement with ads.
Cyble — Threat Actor Selling New Atomic macOS (AMOS) Stealer on Telegram
CRIL analyzes AMOS, a stealthy new information stealer targeting macOS and disseminating stolen information via Telegram.
VMware Patches Critical Vulnerability Disclosed at Pwn2Own Hacking Contest
VMware this week released patches for a critical vulnerability disclosed at the Pwn2Own Vancouver 2023 hacking contest.
Gootloader Unloaded: Researchers Launch Multi-Pronged Offensive Against Gootloader, Cutting Off Traffic to Thousands of Gootloader Web Pages and Using the Operator’s Very Own Tactics to Protect End-Users
eSentire’s Threat Response Unit (TRU), led by researchers Joe Stewart and Keegan Keplinger, have launched a multi-pronged offensive against a growing cyberthreat: the Gootloader Initial Access-as-a-Service Operation. The Gootloader Operation is an expansive cybercrime business, and it has been active since 2018. For the past 15 months, the Gootloader Operator has been launching ongoing attacks targeting legal professionals working for both law firms and corporate legal departments in the U.S., Canada, the U.K. and Australia. Between January and March 2023, TRU shut down Gootloader attacks against 12 different organizations, seven of which were law firms.
New high-severity vulnerability (CVE-2023-29552) discovered in the Service Location Protocol (SLP)
Researchers from Bitsight and Curesec have jointly discovered a high-severity vulnerability — tracked as CVE-2023-29552 — in the Service Location Protocol (SLP)
Smartphones With Popular Qualcomm Chip Secretly Share Private Information With US Chip-Maker
During our security research we found that smart phones with Qualcomm chip secretly send personal data to Qualcomm. This data is sent without user consent, unencrypted, and even when using a Google-free Android distribution. This is possible because the Qualcomm chipset itself sends the data, circumventing any potential Android operating system setting and protection mechanisms. Affected smart phones are Sony Xperia XA2 and likely the Fairphone and many more Android phones which use popular Qualcomm chips.
Meet the hacker armies on Ukraine's cyber front line
How links between ‘hacktivists’ and official military are becoming blurred on both sides in the war.
Analysis of Pre-Auth RCE in Sophos Web Appliance (CVE-2023-1671)
CVE-2023-1671 is a pre-authenticated command injection in Sophos Web Appliance. In this blog post, VulnCheck researchers analyze the vulnerability and develop a proof of concept (PoC) for it.
Software Maker 3CX Was Compromised in First-of-its-Kind Threaded Supply-Chain Hack
Hackers first compromised a different software maker and embedded malware in one of its programs. 3CX got compromised when a worker downloaded that program. It's not known why worker downloaded it.
World's largest cyber defense exercise Locked Shields brings together over 3000 participants
Tallinn, Estonia – From 18 to 21 April, the NATO Cooperative Cyber Defense Center of Excellence (CCDCOE) is hosting Locked Shields 2023, the world’s largest live-fire cyber defense exercise. Over 3,000 participants from 38 nations are taking part in the exercise, which involves protecting real computer systems from real-time attacks and simulating tactical and strategic decisions in critical situations.
X_Trader Supply Chain Attack Affects Critical Infrastructure Organizations in U.S. and Europe
North Korean-linked operation affected more organizations beyond 3CX, including two critical infrastructure organizations in the energy sector.
Critical Vulnerabilities in PaperCut Print Management Software
Our team is tracking in-the-wild exploitation of zero-day vulnerabilities against PaperCut MF/NG which allow for unauthenticated remote code execution due to an authentication bypass.
'RustBucket' malware targets macOS
Learn how APT group, BlueNoroff, targets Apple with malware variant to compromise macOS devices.