News - Security Ticks

New Buhti ransomware uses leaked payloads and public exploits

cybercrime, Don't miss, Hot stuff, Linux, Malware, News, Ransomware, Symantec, Windows / SecurityTicks

New Buhti ransomware uses leaked payloads and public exploits 26/05/2023 at 08:09 By Helga Labus A newly identified ransomware operation has refashioned leaked LockBit and Babuk payloads into Buhti ransomware, to launch attacks on both Windows and Linux systems. Use of public exploits One notable aspect of the attackers leveraging the Buhti ransomware is their […]

React to this headline:

New Buhti ransomware uses leaked payloads and public exploits Read More »

Phishers use encrypted file attachments steal Microsoft 365 account credentials

cybercrime, Don't miss, Encryption, Hot stuff, Microsoft 365, News, phishing, Trustwave / SecurityTicks

Phishers use encrypted file attachments steal Microsoft 365 account credentials 26/05/2023 at 08:09 By Helga Labus Phishers are using encrypted restricted-permission messages (.rpmsg) attached in phishing emails to steal Microsoft 365 account credentials. “[The campaigns] are low volume, targeted, and use trusted cloud services to send emails and host content (Microsoft and Adobe),” say Trustwave

React to this headline:

Phishers use encrypted file attachments steal Microsoft 365 account credentials Read More »

New infosec products of the week: May 26, 2023

Axiado, Delinea, Netscout, News, Radware, Veriff / SecurityTicks

New infosec products of the week: May 26, 2023 26/05/2023 at 07:36 By Help Net Security Here’s a look at the most interesting products from the past week, featuring releases from Axiado, Delinea, Netscout, Radware, and Veriff. Delinea Cloud Suite updates reduce the risk of lateral movement in cybersecurity breaches Delinea Cloud Suite updates include

React to this headline:

New infosec products of the week: May 26, 2023 Read More »

Threat actors exploit new channels for advanced phishing attacks

Artificial Intelligence, attacks, BEC scams, browser, Cloud, cloud storage, cybercriminals, Email, Employees, machine learning, News, Perception Point, phishing, report, scams, social engineering / SecurityTicks

Threat actors exploit new channels for advanced phishing attacks 26/05/2023 at 07:36 By Help Net Security Perception Point’s team has identified a 356% increase in the number of advanced phishing attacks attempted by threat actors in 2022. Overall, the total number of attacks increased by 87%, highlighting the growing threat that cyber attacks now pose

React to this headline:

Threat actors exploit new channels for advanced phishing attacks Read More »

Cybercriminals masquerading as MFA vendors

attacks, cybercriminals, email security, MFA, News, phishing, spam, VIPRE Security / SecurityTicks

Cybercriminals masquerading as MFA vendors 26/05/2023 at 07:20 By Help Net Security Cybercriminals are increasingly posing as multi-factor authentication vendors and small businesses are becoming more popular targets, according to VIPRE. Attachment-based malspam is on the rise Financial institutions (48%) are still the most targeted sector by a wide margin. Insider attacks now take on

React to this headline:

Cybercriminals masquerading as MFA vendors Read More »

Fresh perspectives needed to manage growing vulnerabilities

Cloud, NetSPI, News, NIST, penetration testing, remediation, report, vulnerability / SecurityTicks

Fresh perspectives needed to manage growing vulnerabilities 26/05/2023 at 06:03 By Help Net Security In its inaugural 2023 Offensive Security Vision Report, NetSPI unveils findings that highlight vulnerability trends across applications, cloud, and networks. Vulnerability patterns The report offers a look back — and forward — at some of the most significant vulnerability patterns of

React to this headline:

Fresh perspectives needed to manage growing vulnerabilities Read More »

Five Eyes agencies detail how Chinese hackers breached US infrastructure

critical infrastructure, government-backed attacks, Hot stuff, Microsoft, News, NSA, SecureWorks, USA / SecurityTicks

Five Eyes agencies detail how Chinese hackers breached US infrastructure 25/05/2023 at 14:16 By Help Net Security The National Security Agency (NSA) and Five Eyes partner agencies have identified indicators of compromise associated with a People’s Republic of China (PRC) state-sponsored cyber actor dubbed Volt Typhoon, which is using living off the land techniques to

React to this headline:

Five Eyes agencies detail how Chinese hackers breached US infrastructure Read More »

Phishing campaign targets ChatGPT users

ChatGPT, Don't miss, Hot stuff, identity theft, Inky, News, phishing / SecurityTicks

Phishing campaign targets ChatGPT users 25/05/2023 at 14:05 By Helga Labus A clever phishing campaign aimed at stealing users’ business email account credentials by impersonating OpenAI, the company behind the ChatGPT chatbot, has been spotted by Inky researchers. The attack ChatGPT has quickly gained popularity and is used widely by individuals and organizations. That’s enough

React to this headline:

Phishing campaign targets ChatGPT users Read More »

Barracuda email security appliances hacked via zero-day vulnerability (CVE-2023-2868)

0-day, Barracuda Networks, Don't miss, email security, Hot stuff, News, vulnerability / SecurityTicks

Barracuda email security appliances hacked via zero-day vulnerability (CVE-2023-2868) 25/05/2023 at 13:07 By Zeljka Zorz A vulnerability (CVE-2023-2868) in Barracuda Networks’ Email Security Gateway (ESG) appliances has been exploited by attackers, the company has warned. About CVE-2023-2868 CVE-2023-2868 is a critical remote command injection vulnerability affecting only physical Barracuda Email Security Gateway appliances, versions 5.1.3.001

React to this headline:

Barracuda email security appliances hacked via zero-day vulnerability (CVE-2023-2868) Read More »

12 vulnerabilities newly associated with ransomware

Cyware, dark web, exploit, Ivanti, News, Ransomware, report, Securin, vulnerability / SecurityTicks

12 vulnerabilities newly associated with ransomware 25/05/2023 at 06:04 By Help Net Security In March 2023, the total number of breaches reported was higher than those reported in the previous three years combined, according to Ivanti. Ransomware groups are continuously weaponizing vulnerabilities and adding them to their arsenal to mount crippling and disruptive attacks on

React to this headline:

12 vulnerabilities newly associated with ransomware Read More »

IT employee piggybacked on cyberattack for personal gain

Don't miss, Hot stuff, Insider Threat, News, Ransomware, UK / SecurityTicks

IT employee piggybacked on cyberattack for personal gain 24/05/2023 at 14:34 By Helga Labus A 28-year-old former IT employee of an Oxford-based company has been convicted of blackmailing his employer and unauthorized access to a computer with intent to commit other offences, after pleading guilty during a hearing at Reading Crown Court, England. IT employee

React to this headline:

IT employee piggybacked on cyberattack for personal gain Read More »

Microsoft, GitHub announce application security testing tools for Azure DevOps

Application Security, Azure, DevOps, Don't miss, GitHub, News, scanning, software development / SecurityTicks

Microsoft, GitHub announce application security testing tools for Azure DevOps 24/05/2023 at 14:34 By Zeljka Zorz GitHub has announced that its application security testing tools are now more widely available for subscribers of Microsoft’s Azure DevOps Services. Enabling GitHub Advanced Security for Azure DevOps (Source: Microsoft) What is GitHub Advanced Security for Azure DevOps? GitHub

React to this headline:

Microsoft, GitHub announce application security testing tools for Azure DevOps Read More »

Legitimate Android app transforms into data-snooping malware

Android, cybercrime, Don't miss, ESET, Google Play, Malware, News, Privacy, trojan / SecurityTicks

Legitimate Android app transforms into data-snooping malware 24/05/2023 at 11:16 By Help Net Security ESET researchers have discovered a trojanized Android app named iRecorder – Screen Recorder. It was available on Google Play as a legitimate app in September 2021, with malicious functionality most likely added in August 2022. During its existence, the app was

React to this headline:

Legitimate Android app transforms into data-snooping malware Read More »

Navigating the quantum leap in cybersecurity

CISO, cyber risk, cybersecurity, Don't miss, Features, Hot stuff, ISARA, News, opinion, quantum computing / SecurityTicks

Navigating the quantum leap in cybersecurity 24/05/2023 at 07:17 By Mirko Zorz In this Help Net Security interview, we sit down with Dr. Atsushi Yamada, the newly appointed CEO of ISARA, a security solutions company specializing in creating quantum-safe cryptography. With over two decades of experience in cryptography and cybersecurity, Dr. Yamada discusses his vision

React to this headline:

Navigating the quantum leap in cybersecurity Read More »

6 ChatGPT risks for legal and compliance leaders

Artificial Intelligence, ChatGPT, Compliance, cybersecurity, Gartner, News, Privacy, risk / SecurityTicks

6 ChatGPT risks for legal and compliance leaders 24/05/2023 at 06:12 By Help Net Security Legal and compliance leaders should address their organization’s exposure to six specific ChatGPT risks, and what guardrails to establish to ensure responsible enterprise use of generative AI tools, according to Gartner. “The output generated by ChatGPT and other large language

React to this headline:

6 ChatGPT risks for legal and compliance leaders Read More »

Simple OSINT techniques to spot AI-fueled disinformation, fake reviews

Artificial Intelligence, ChatGPT, Don't miss, Hot stuff, News, OSINT, ShadowDragon / SecurityTicks

Simple OSINT techniques to spot AI-fueled disinformation, fake reviews 23/05/2023 at 12:20 By Helga Labus Error messages that ChatGPT and other AI language models generate can be used to uncover disinformation campaigns, hate speech and fake reviews via OSINT collection and analysis, says Nico Dekens, director of intelligence at ShadowDragon. AI-generated content found via Google

React to this headline:

Simple OSINT techniques to spot AI-fueled disinformation, fake reviews Read More »

Online scams target bargain-hunting holiday travelers

cybercrime, cybersecurity, fraud, McAfee, News / SecurityTicks

Online scams target bargain-hunting holiday travelers 23/05/2023 at 06:01 By Help Net Security 30% of adults have fallen victim or know someone who has fallen victim to an online scam while trying to save money when booking travel, according to McAfee. 34% of those who had money stolen have lost over $1,000 before their trip

React to this headline:

Online scams target bargain-hunting holiday travelers Read More »

Vulnerability in Zyxel firewalls may soon be widely exploited (CVE-2023-28771)

Don't miss, enterprise, firewall, firmware, Hot stuff, News, PoC, Rapid7, security update, SMBs, vulnerability, Zyxel / SecurityTicks

Vulnerability in Zyxel firewalls may soon be widely exploited (CVE-2023-28771) 22/05/2023 at 14:05 By Zeljka Zorz A recently fixed command injection vulnerability (CVE-2023-28771) affecting a variety Zyxel firewalls may soon be exploited in the wild, Rapid7 researchers have warned, after publishing a technical analysis and a PoC script that triggers the vulnerability and achieves a

React to this headline:

Vulnerability in Zyxel firewalls may soon be widely exploited (CVE-2023-28771) Read More »

Wireless Broadband Alliance CEO on key drivers for Wi-Fi adoption in enterprise networks

5G, Don't miss, Features, Hot stuff, networking, News, opinion, wireless, Wireless Broadband Alliance / SecurityTicks

Wireless Broadband Alliance CEO on key drivers for Wi-Fi adoption in enterprise networks 22/05/2023 at 07:47 By Mirko Zorz The demand for robust, reliable, and high-speed connectivity is increasing rapidly in the era of relentless digital transformation. This Help Net Security interview with Tiago Rodrigues, CEO at Wireless Broadband Alliance (WBA), delves into the future

React to this headline:

Wireless Broadband Alliance CEO on key drivers for Wi-Fi adoption in enterprise networks Read More »

Malicious links and misaddressed emails slip past security controls

Armorblox, cybercrime, Email, email security, ESG, News, survey, threats / SecurityTicks

Malicious links and misaddressed emails slip past security controls 22/05/2023 at 06:33 By Help Net Security The majority of organizations use six or more communication tools, across channels, with email remaining the channel seen as the most vulnerable to attacks (38%), according to Armorblox. Respondents mentioned multi-channel attacks are gaining momentum and frequency. More than

React to this headline:

Malicious links and misaddressed emails slip past security controls Read More »