enterprise - Security Ticks

Google Workspace: New account security, DLP capabilities announced

access control, data loss prevention, Don't miss, enterprise, Google Workspace, Hot stuff, News, security controls, SMBs / SecurityTicks

Google Workspace: New account security, DLP capabilities announced 25/08/2023 at 07:47 By Zeljka Zorz New capabilities in Google Workspace will help enterprises improve account and data security, by making unauthorized takeover of admin and user accounts and exfiltration of sensitive data more difficult. Some of these options are already available in preview and others will […]

React to this headline:

Google Workspace: New account security, DLP capabilities announced Read More »

Bogus OfficeNote app delivers XLoader macOS malware

botnet, consumer, Don't miss, enterprise, Hot stuff, macOS, Malware, News, SentinelOne / SecurityTicks

Bogus OfficeNote app delivers XLoader macOS malware 23/08/2023 at 14:33 By Helga Labus A new macOS-specific variant of the well known XLoader malware is being delivered disguised as the “OfficeNote” app. “Multiple submissions of this sample have appeared on VirusTotal throughout July, indicating that the malware has been widely distributed in the wild,” SentinelOne researchers

React to this headline:

Bogus OfficeNote app delivers XLoader macOS malware Read More »

Ivanti Sentry zero-day vulnerability fixed, patch ASAP! (CVE-2023-38035)

0-day, enterprise, gateway, Ivanti, Mnemonic, News, security update / SecurityTicks

Ivanti Sentry zero-day vulnerability fixed, patch ASAP! (CVE-2023-38035) 22/08/2023 at 13:48 By Zeljka Zorz Ivanti is urging administrators of Ivanti Sentry (formerly MobileIron Sentry) gateways to patch a newly discovered vulnerability (CVE-2023-38035) that could be exploited to change configuration, run system commands, or write files onto the vulnerable system. “As of now, we are only

React to this headline:

Ivanti Sentry zero-day vulnerability fixed, patch ASAP! (CVE-2023-38035) Read More »

Citrix ShareFile vulnerability actively exploited (CVE-2023-24489)

Citrix, Citrix ShareFile, Don't miss, enterprise, file-sharing, Hot stuff, News, PoC, security update, vulnerability / SecurityTicks

Citrix ShareFile vulnerability actively exploited (CVE-2023-24489) 17/08/2023 at 14:16 By Zeljka Zorz CVE-2023-24489, a critical Citrix ShareFile vulnerability that the company has fixed in June 2023, is being exploited by attackers. GreyNoise has flagged on Tuesday a sudden spike in IP addresses from which exploitation attempts are coming, and the Cybersecurity and Infrastructure Agency (CISA)

React to this headline:

Citrix ShareFile vulnerability actively exploited (CVE-2023-24489) Read More »

(Re)check your patched NetScaler ADC and Gateway appliances for signs of compromise

backdoor, Citrix, Don't miss, enterprise, Fox-IT, Hot stuff, Mandiant, News, vulnerability, web shell / SecurityTicks

(Re)check your patched NetScaler ADC and Gateway appliances for signs of compromise 16/08/2023 at 13:49 By Zeljka Zorz Administrators of Citrix NetScaler ADC and Gateway appliances should check for evidence of installed webshells even if they implemented fixes for CVE-2023-3519 quickly: A recent internet scan by Fox-IT researchers has revealed over 1,800 backdoored NetScaler devices,

React to this headline:

(Re)check your patched NetScaler ADC and Gateway appliances for signs of compromise Read More »

Attackers can turn AWS SSM agents into remote access trojans

AWS, cloud computing, cloud security, Don't miss, enterprise, Hot stuff, Mitiga, News, Remote Access Trojan, research / SecurityTicks

Attackers can turn AWS SSM agents into remote access trojans 02/08/2023 at 16:02 By Zeljka Zorz Mitiga researchers have documented a new post-exploitation technique attackers can use to gain persistent remote access to AWS Elastic Compute Cloud (EC2) instances (virtual servers), as well as to non-EC2 machines (e.g., on-premises enterprise servers and virtual machines, and

React to this headline:

Attackers can turn AWS SSM agents into remote access trojans Read More »

Ivanti fixes second zero-day exploited by attackers (CVE-2023-35081)

0-day, Don't miss, endpoint management, enterprise, Hot stuff, Ivanti, Mnemonic, MobileIron, News, security update, vulnerability / SecurityTicks

Ivanti fixes second zero-day exploited by attackers (CVE-2023-35081) 31/07/2023 at 16:32 By Helga Labus Another actively exploited zero-day vulnerability (CVE-2023-35081) affecting Ivanti Endpoint Manager Mobile (EPMM) has been identified and fixed. The first zero-day spotted Last week, we reported on a remote unauthenticated API access vulnerability (CVE-2023-35078) affecting Ivanti EPMM having been exploited to target

React to this headline:

Ivanti fixes second zero-day exploited by attackers (CVE-2023-35081) Read More »

Ivanti zero-day exploited to target Norwegian government (CVE-2023-35078)

0-day, data theft, Don't miss, endpoint management, enterprise, Government, Hot stuff, Ivanti, MobileIron, News, Norway, security update / SecurityTicks

Ivanti zero-day exploited to target Norwegian government (CVE-2023-35078) 25/07/2023 at 13:37 By Zeljka Zorz A zero-day vulnerability (CVE-2023-35078) affecting Ivanti Endpoint Manager Mobile (EPMM) has been exploited to carry out an attack that affected 12 Norwegian ministries, the Norwegian National Security Authority (NSM) has confirmed on Tuesday. What is known about the attacks? On Monday,

React to this headline:

Ivanti zero-day exploited to target Norwegian government (CVE-2023-35078) Read More »

Has the MOVEit hack paid off for Cl0p?

Coveware, cybercrime, data theft, Don't miss, Emsisoft, enterprise, extortion, file-sharing, hack, Hot stuff, KonBriefing Research, News / SecurityTicks

Has the MOVEit hack paid off for Cl0p? 24/07/2023 at 17:18 By Zeljka Zorz The number of known Cl0p victims resulting from its Memorial Day attack on vulnerable internet-facing MOVEit Transfer installations has surpassed 420, according to IT market research company KonBriefing Research. The cyber extortion group has lately switched to setting up company-specific leak

React to this headline:

Has the MOVEit hack paid off for Cl0p? Read More »

Thanks Storm-0558! Microsoft to expand default access to cloud logs

APT, CISA, cloud security, Don't miss, enterprise, Government, government-backed attacks, Hot stuff, logging, Microsoft, Microsoft 365, News / SecurityTicks

Thanks Storm-0558! Microsoft to expand default access to cloud logs 20/07/2023 at 13:31 By Zeljka Zorz Starting in September 2023, more federal government and commercial Microsoft customers will have access to expanded cloud logging capabilities at no additional charge, Microsoft and the Cybersecurity and Infrastructure Security Agency (CISA) have announced on Wednesday. The announcements come

React to this headline:

Thanks Storm-0558! Microsoft to expand default access to cloud logs Read More »

VirusTotal leaked data of 5,600 registered users

Data leak, Don't miss, enterprise, Google, Government, Hot stuff, News, social engineering, spear-phishing, user data, VirusTotal / SecurityTicks

VirusTotal leaked data of 5,600 registered users 18/07/2023 at 15:47 By Helga Labus VirusTotal has suffered a data leak that exposed the names and email addresses of 5,600 of its registered users. The leaked data reportedly includes information about employees of US and German intelligence agencies (among others). VirusTotal data leak exposed exploitable information Google-owned

React to this headline:

VirusTotal leaked data of 5,600 registered users Read More »

Malware delivery to Microsoft Teams users made easy

collaboration, Don't miss, enterprise, Hot stuff, Malware, Microsoft 365, Microsoft Teams, News, red team, SMBs, vulnerability / SecurityTicks

Malware delivery to Microsoft Teams users made easy 10/07/2023 at 14:33 By Zeljka Zorz A tool that automates the delivery of malware from external attackers to target employees’ Microsoft Teams inbox has been released. TeamsPhisher (Source: Alex Reid) About the exploited vulnerability As noted by Jumpsec researchers Max Corbridge and Tom Ellson, Microsoft Teams’ default

React to this headline:

Malware delivery to Microsoft Teams users made easy Read More »

PoC for Arcserve UDP authentication bypass flaw published (CVE-2023-26258)

Arcserve, backup, Data Protection, Don't miss, enterprise, Hot stuff, MDSec, News, PoC, vulnerability / SecurityTicks

PoC for Arcserve UDP authentication bypass flaw published (CVE-2023-26258) 29/06/2023 at 14:17 By Zeljka Zorz An authentication bypass vulnerability (CVE-2023-26258) in the Arcserve Unified Data Protection (UDP) enterprise data protection solution can be exploited to compromise admin accounts and take over vulnerable instances, MDSec researchers Juan Manuel Fernández and Sean Doherty have found – and

React to this headline:

PoC for Arcserve UDP authentication bypass flaw published (CVE-2023-26258) Read More »

Microsoft Teams vulnerability allows attackers to deliver malware to employees

collaboration, Don't miss, enterprise, Hot stuff, Jumpsec, Malware, Microsoft 365, Microsoft Teams, News, red team, SMBs, vulnerability / SecurityTicks

Microsoft Teams vulnerability allows attackers to deliver malware to employees 23/06/2023 at 15:24 By Zeljka Zorz Security researchers have uncovered a bug that could allow attackers to deliver malware directly into employees’ Microsoft Teams inbox. “Organisations that use Microsoft Teams inherit Microsoft’s default configuration which allows users from outside of their organisation to reach out

React to this headline:

Microsoft Teams vulnerability allows attackers to deliver malware to employees Read More »

VMware Aria Operations for Networks vulnerability exploited in the wild (CVE-2023-20887)

Don't miss, enterprise, GreyNoise, Hot stuff, News, patch, VMWare, vulnerability / SecurityTicks

VMware Aria Operations for Networks vulnerability exploited in the wild (CVE-2023-20887) 21/06/2023 at 11:42 By Zeljka Zorz CVE-2023-20887, a pre-authentication command injection vulnerability in VMware Aria Operations for Networks (formerly vRealize Network Insight), has been spotted being exploited in the wild. There are no workarounds to mitigate the risk of exploitation – enterprise admins are

React to this headline:

VMware Aria Operations for Networks vulnerability exploited in the wild (CVE-2023-20887) Read More »

VMware fixes critical flaws in Aria Operations for Networks (CVE-2023-20887)

Don't miss, enterprise, Hot stuff, News, PoC, security update, Tenable, VMWare, vulnerability / SecurityTicks

VMware fixes critical flaws in Aria Operations for Networks (CVE-2023-20887) 15/06/2023 at 13:01 By Helga Labus VMware has fixed two critical (CVE-2023-20887, CVE-2023-20888) and one important vulnerability (CVE-2023-20889) in Aria Operations for Networks (formerly vRealize Network Insight), its popular enterprise network monitoring tool. About the vulnerabilities (CVE-2023-20887, CVE-2023-20888,CVE-2023-20889) CVE-2023-20887 is a pre-authentication command injection vulnerability

React to this headline:

VMware fixes critical flaws in Aria Operations for Networks (CVE-2023-20887) Read More »

Switzerland under cyberattack

Data leak, data theft, DDoS, Don't miss, enterprise, Government, Hot stuff, News, Ransomware, Switzerland / SecurityTicks

Switzerland under cyberattack 14/06/2023 at 14:18 By Helga Labus Swiss government websites are under DDoS attacks, but several ransomware gangs have also turned their sights on Swiss government organizations, cantonal governments, cities and companies in the last few months. Government sites under DDoS attacks “Several Federal Administration websites are/were inaccessible on Monday 12 June 2023,

React to this headline:

Switzerland under cyberattack Read More »

The multiplying impact of BEC attacks

BEC scams, Don't miss, enterprise, FBI, Hot stuff, Microsoft, News, phishing, SMBs, social engineering / SecurityTicks

The multiplying impact of BEC attacks 12/06/2023 at 16:22 By Helga Labus The 2023 Verizon Data Breach Investigations Report (DBIR) has confirmed what FBI’s Internet Crime Complaint Center has pointed out earlier this year: BEC scammers are ramping up their social engineering efforts to great success. BEC attackers targeting the real estate sector The FBI

React to this headline:

The multiplying impact of BEC attacks Read More »

MOVEit Transfer hack fallout: BBC, Aer Lingus, Boots among the victims

0-day, British Airways, cybercrime, data theft, Don't miss, enterprise, extortion, Hot stuff, News, Orange Cyberdefense, Progress, Rapid7, SMBs, supply chain attacks / SecurityTicks

MOVEit Transfer hack fallout: BBC, Aer Lingus, Boots among the victims 06/06/2023 at 13:50 By Zeljka Zorz The fallout of the MOVEit Transfer hack via CVE-2023-34362 by the Cl0p gang is expanding, as several UK-based companies have now confirmed that some of their data has been stolen. Victimized organizations The confirmed victims so far are

React to this headline:

MOVEit Transfer hack fallout: BBC, Aer Lingus, Boots among the victims Read More »

MOVEit Transfer zero-day was exploited by Cl0p gang (CVE-2023-34362)

0-day, data theft, Don't miss, enterprise, extortion, file-sharing, Hot stuff, Mandiant, News, Rapid7, vulnerability / SecurityTicks

MOVEit Transfer zero-day was exploited by Cl0p gang (CVE-2023-34362) 05/06/2023 at 15:10 By Zeljka Zorz The zero-day vulnerability attackers have exploited to compromise vulnerable Progress Software’s MOVEit Transfer installations finally has an identification number: CVE-2023-34362. Based on information shared by Mandiant, Rapid7 and other security researchers, the attackers seem to have opportunistically targeted as many

React to this headline:

MOVEit Transfer zero-day was exploited by Cl0p gang (CVE-2023-34362) Read More »