News

Deepfaked video conference call makes employee send $25 million to scammers

Asia, deepfakes, Don't miss, enterprise, Hot stuff, News, scams, video conferencing /

Deepfaked video conference call makes employee send $25 million to scammers 2024-02-05 at 17:01 By Zeljka Zorz A deepfake video conference call paired with social engineering tricks has led to the theft of over US$25 million from a multinational firm, the South China Morning Post has reported. The scheme and the deepfake video conference call […]

Deepfaked video conference call makes employee send $25 million to scammers Read More »

AnyDesk has been hacked, users urged to change passwords

AnyDesk, certificates, credentials, CrowdStrike, data breach, Don't miss, Hot stuff, News, remote access, Resecurity /

AnyDesk has been hacked, users urged to change passwords 2024-02-05 at 14:31 By Zeljka Zorz AnyDesk Software GmbH, the German company behind the widely used (and misused) remote desktop application of the same name, has confirmed they’ve been hacked and their production systems have been compromised. The statement was published on Friday evening and lacks

AnyDesk has been hacked, users urged to change passwords Read More »

Latio Application Security Tester: Use AI to scan your code

Artificial Intelligence, cybersecurity, Don't miss, GitHub, Hot stuff, News, open source, OpenAI, software /

Latio Application Security Tester: Use AI to scan your code 2024-02-05 at 08:02 By Mirko Zorz Latio Application Security Tester is an open-source tool that enables the usage of OpenAI to scan code from the CLI for security and health issues. Features and future plans James Berthoty, the creator of Latio Application Security Tester, told

Latio Application Security Tester: Use AI to scan your code Read More »

Researchers discover exposed API secrets, impacting major tech tokens

API security, AWS, cybersecurity, Data leak, Escape, GitHub, News, Slack, Stripe /

Researchers discover exposed API secrets, impacting major tech tokens 2024-02-05 at 07:33 By Help Net Security Escape’s security research team scanned 189.5 million URLs and found more than 18,000 exposed API secrets. 41% of exposed secrets were highly critical, i.e. could lead to financial risks for the organizations. Exposed API secrets The exposed secrets include

Researchers discover exposed API secrets, impacting major tech tokens Read More »

Businesses banning or limiting use of GenAI over privacy risks

Artificial Intelligence, Cisco, CISO, Don't miss, generative AI, News, Privacy, report, survey /

Businesses banning or limiting use of GenAI over privacy risks 2024-02-05 at 07:01 By Help Net Security Privacy is much more than a regulatory compliance matter. Findings from a new Cisco study highlight the growing Privacy concerns with GenAI, trust challenges facing organizations over their use of AI, and the attractive returns from privacy investment.

Businesses banning or limiting use of GenAI over privacy risks Read More »

Migrating to the cloud: An overview of process and strategy

Center for Internet Security, Cloud, cloud security, cybersecurity, Don't miss, Expert analysis, Hot stuff, News, opinion /

Migrating to the cloud: An overview of process and strategy 2024-02-05 at 06:01 By Help Net Security Over the next few years, the number of organizations navigating to the cloud to advance their business goals is expected to grow exponentially. According to Gartner, more than 70% of enterprises will use cloud platforms to accelerate their

Migrating to the cloud: An overview of process and strategy Read More »

Week in review: Windows Event Log zero-day, exploited critical Jenkins RCE flaw

News, Week in review /

Week in review: Windows Event Log zero-day, exploited critical Jenkins RCE flaw 2024-02-04 at 11:01 By Help Net Security Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Prioritizing cybercrime intelligence for effective decision-making in cybersecurity In this Help Net Security interview, Alon Gal, CTO at Hudson Rock, discusses

Week in review: Windows Event Log zero-day, exploited critical Jenkins RCE flaw Read More »

New infosec products of the week: February 2, 2024

BackBox, News, ProcessUnity, SentinelOne, Vade Secure /

New infosec products of the week: February 2, 2024 2024-02-02 at 08:01 By Help Net Security Here’s a look at the most interesting products from the past week, featuring releases from BackBox, ProcessUnity, SentinelOne, and Vade. ProcessUnity unveils all-in-one platform for third-party risk management With a single, configurable platform, ProcessUnity helps organizations manage the increasing

New infosec products of the week: February 2, 2024 Read More »

NIS2 Directive raises stakes for security leaders

cyber hygiene, cyber resilience, cyberattacks, cybersecurity, Don't miss, EU, Features, framework, Hot stuff, News, opinion, regulation, Risk Management, standards, Sumo Logic /

NIS2 Directive raises stakes for security leaders 2024-02-02 at 08:01 By Mirko Zorz In this Help Net Security interview, Roland Palmer, VP Global Operations Center at Sumo Logic, discusses key challenges and innovations of the NIS2 Directive, aiming to standardize cybersecurity practices across sectors. NIS2 mandates minimal cybersecurity requirements for member companies, encompassing policies on

NIS2 Directive raises stakes for security leaders Read More »

DDoS attack power skyrockets to 1.6 Tbps

attacks, cybercrime, cybersecurity, DDoS, Gcore, News, report, survey /

DDoS attack power skyrockets to 1.6 Tbps 2024-02-02 at 07:31 By Help Net Security DDoS attack trends for the second half of 2023 reveal alarming developments in their scale and sophistication, according to Gcore. The maximum attack power rose from 800 Gbps (1H 2023) to 1.6 Tbps. UDP floods continue to dominate, constituting 62% of

DDoS attack power skyrockets to 1.6 Tbps Read More »

Crowdsourced security is not just for tech companies anymore

bug bounty, Bugcrowd, crowdsourced security, cybersecurity, News, report, survey /

Crowdsourced security is not just for tech companies anymore 2024-02-02 at 07:01 By Help Net Security There is a misconception that only software and technology companies leverage crowdsourced security. However, data contradicts this belief. Companies across various sectors are increasingly adopting crowdsourced security, as reported by Bugcrowd. The government industry sector saw the fastest growth

Crowdsourced security is not just for tech companies anymore Read More »

EU adopts first cybersecurity certification scheme for safer tech

certification, cybersecurity, ENISA, EU, Europe, framework, News /

EU adopts first cybersecurity certification scheme for safer tech 2024-02-02 at 06:33 By Help Net Security The European Commission adopted the implementing regulation concerning the EU cybersecurity certification scheme on Common Criteria (EUCC). The outcome aligns with the candidate cybersecurity certification scheme on EUCC that ENISA drafted in response to a request issued by the

EU adopts first cybersecurity certification scheme for safer tech Read More »

Malicious logins from suspicious infrastructure fuel identity-based incidents

cybercrime, cybersecurity, Expel, identity, News, report, survey /

Malicious logins from suspicious infrastructure fuel identity-based incidents 2024-02-02 at 06:01 By Help Net Security 69% of identity-based incidents involved malicious logins from suspicious infrastructure, which are hosting providers or proxies that aren’t expected for a user or organization, according to Expel. Identity-based incidents accounted for 64% of all incidents investigated by the Expel SOC,

Malicious logins from suspicious infrastructure fuel identity-based incidents Read More »

FritzFrog botnet exploits Log4Shell, PwnKit vulnerabilities

Akamai, botnet, Don't miss, exploit, Hot stuff, Linux, Log4j, Malware, News, vulnerability /

FritzFrog botnet exploits Log4Shell, PwnKit vulnerabilities 2024-02-01 at 17:31 By Helga Labus The FritzFrog cryptomining botnet has new potential for growth: a recently analyzed variant of the bot is exploiting the Log4Shell (CVE-2021-44228) and PwnKit (CVE-2021-4034) vulnerabilities for lateral movement and privilege escalation. The FritzFrog botnet The FritzFrog botnet, initially identified in August 2020, is

FritzFrog botnet exploits Log4Shell, PwnKit vulnerabilities Read More »

FBI disrupts Chinese botnet used for targeting US critical infrastructure

botnet, China, critical infrastructure, Don't miss, FBI, Hot stuff, News, USA /

FBI disrupts Chinese botnet used for targeting US critical infrastructure 2024-02-01 at 15:17 By Helga Labus The FBI has disrupted the KV botnet, used by People’s Republic of China (PRC) state-sponsored hackers (aka “Volt Typhoon”) to target US-based critical infrastructure organizations. A botnet for probing critical infrastructure organizations The threat actors used the KV botnet

FBI disrupts Chinese botnet used for targeting US critical infrastructure Read More »

Trustwave MailMarshal Now Available on the Microsoft Azure Marketplace

News /

Trustwave MailMarshal Now Available on the Microsoft Azure Marketplace 2024-02-01 at 15:02 By Trustwave MailMarshal is now listed on the Microsoft Azure Marketplace, an online store for solutions that are built on or built for Azure and intended for IT professionals and developers. Trustwave MailMarshal joins an illustrious list of IT software applications and services

Trustwave MailMarshal Now Available on the Microsoft Azure Marketplace Read More »

Threat actor used Vimeo, Ars Technica to serve second-stage malware

cybercrime, Don't miss, EU, Hot stuff, Malware, Mandiant, News, theft, USB devices /

Threat actor used Vimeo, Ars Technica to serve second-stage malware 2024-02-01 at 12:31 By Zeljka Zorz A financially motivated threat actor tracked as UNC4990 is using booby-trapped USB storage devices and malicious payloads hosted on popular websites such as Ars Technica, Vimeo, GitHub and GitLab to surreptitiously deliver malware. Another interesting detail about UNC4990 it’s

Threat actor used Vimeo, Ars Technica to serve second-stage malware Read More »

Zero trust implementation: Plan, then execute, one step at a time

access management, authentication, Don't miss, Hot stuff, News, strategy, tips, zero trust /

Zero trust implementation: Plan, then execute, one step at a time 2024-02-01 at 08:02 By Helga Labus 82% of cybersecurity professionals have been working on implementing zero trust last year, and 16% should be on it by the end of this year. The challenges of zero trust implementation You’ve probably heard it before: zero trust

Zero trust implementation: Plan, then execute, one step at a time Read More »

Custom rules in security tools can be a game changer for vulnerability detection

cybersecurity, Don't miss, Features, Hot stuff, News, opinion, scanning, Semgrep, software development, strategy, tips /

Custom rules in security tools can be a game changer for vulnerability detection 2024-02-01 at 07:32 By Mirko Zorz In this Help Net interview, Isaac Evans, CEO at Semgrep, discusses the balance between speed and thoroughness in CI/CD pipeline security scanning. Stressing the need to avoid slowing down the process, he recommends a nuanced approach,

Custom rules in security tools can be a game changer for vulnerability detection Read More »

CVEMap: Open-source tool to query, browse and search CVEs

CISA, CVE, cybersecurity, Don't miss, GitHub, HackerOne, Hot stuff, News, open source, Project Discovery, software /

CVEMap: Open-source tool to query, browse and search CVEs 2024-02-01 at 07:01 By Mirko Zorz CVEMap is an open-source command-line interface (CLI) tool that allows you to explore Common Vulnerabilities and Exposures (CVEs). It’s designed to offer a streamlined and user-friendly interface for navigating vulnerability databases. Although CVEs are crucial for pinpointing and discussing security

CVEMap: Open-source tool to query, browse and search CVEs Read More »

Scroll to Top