The US Department of Transportation (USDOT) recently revealed threat actors breached its system in a cyberattack. The data breach compromised the personal information of roughly 237,000 current and former agency employees. While it remains unclear when the attack happened or…
Category: Heimdal Security Blog
UNC3944 Uses Azure Serial Console for Stealthy Access to Virtual Machines
Researchers revealed that the UNC3944 threat actors use phishing and SIM-swapping attacks to get control over Microsoft Azure admin accounts. Hackers maliciously used the Azure Serial Console on Azure Virtual Machines (VM) to deploy remote management software within client environments.…
Capita Recommends Its Customers to Assume Their Data Was Stolen
At the end of March, a cyberattack affected Capita’s systems, resulting in the theft of customer data. Six weeks after the attack was revealed, Capita warned Universities Superannuation Scheme (USS), the largest private pension scheme in the UK, to assume…
PharMerica Cyber Incident Exposes 5.8 M People’s Data
PharMerica, the second largest provider of institutional pharmacy services in the United States, confirmed that it suffered a data breach that exposed the personal information of 5,815,591 people. The company started sending notices to the impacted individuals on the 12th…
Discord Announces a Data Breach Involving a Support Agent
Discord messaging platform announced a data breach. The incident involved a third-party support agent whose account has been compromised. The notification warned customers about unauthorized access to the agent’s support ticket queue. The Exposed Data & Security Measures This incident…
What Is Endpoint Privilege Management?
While this article aims to define what is endpoint privilege management, I will first begin to explain the circumstances of this process. Within any organization, privileges are usually split between two levels of hierarchy: standard users and administrators. The highest…
Toyota Disclosed a Ten-Year Long Data Breach
Toyota Motor Corporation issued a notice on the company’s Japanese newsroom disclosing a data breach of ten years. A database misconfiguration in its cloud environment leads to exposing of the car-location data of 2,150,000 customers. Details from the Data Breach…
Third-Party Patch Management: A Comprehensive Guide
In today’s digital age, software vulnerabilities are on the rise, and cyber threats are becoming more sophisticated. As a result, businesses must be proactive in their approach to cybersecurity to minimize the risk of a data breach. One way to…
What Is a Remote Code Execution Attack? Definition, Risks, and Mitigation Measures
A remote code execution (RCE) attack consists of adversaries remotely running code on an enterprise`s assets. Threat actors remotely inject and execute code in the victim`s device or system by using local (LAN), or wide area networks (WAN). The code…
Black Basta Ransomware Attacks Global Technology Company ABB
ABB, a leading provider of electrification and automation technology, has been hit by a Black Basta ransomware attack, which has reportedly affected business operations. As part of its services, ABB develops industrial control systems (ICS) and SCADA systems for manufacturers…
What Is Privileged Identity Management (PIM)?
When we talk about Privileged Access Management (PAM), Privileged Identity Management (PIM), Identity and Access Management (IAM), and other access management terms, we think of technologies for protecting a company’s critical assets. These phrases refer to maintaining the security of…
XDR vs SIEM vs SOAR: A Comparison
With the “detect early” and “respond fast” capabilities in your mind, you may wonder what to choose from the XDR vs SIEM vs SOAR options. A good Detection and Response (D&R) solution is essential for your company’s cybersecurity posture. As…
Operation MEDUSA Brings Down ‘Snake’ – Russia’s Cyberespionage Malware
The Federal Bureau of Investigation disrupted a Russian government-controlled Snake malware network that compromised hundreds of computers belonging to NATO-member governments and other Russian targets. According to the Justice Department, the disruption effort, called Operation MEDUSA, took the malware offline…
Linux Kernel Vulnerability Gives Cybercriminals Root Privileges
There is a new Linux NetFilter kernel flaw that allows unprivileged local users to escalate their privileges to root level, giving them complete control over the system. The vulnerability has been assigned the CVE-2023-32233 identifier, but its severity level has not…
Fake Windows Update Used to Push Aurora Info-Stealer
The Aurora information-stealing malware was delivered through an in-browser Windows update simulation in a recent malvertising campaign. For more than a year, Aurora has been advertised on various hacker forums as an info stealer with extensive capabilities and low antivirus…
Cactus Ransomware Infiltrates Networks by Exploiting VPN Flaws
Researchers warn Cactus Ransomware exploits VPN Flaws to compromise networks and encrypts itself to avoid detection. The new ransomware strain targets large commercial entities that use remote access services and scans after unpatched vulnerabilities for initial access. How Is Cactus…
Warning! New DDoS Botnet Malware Exploits Critical Ruckus RCE Vulnerability
AndoryuBot new malware aims to infect unpatched Wi-Fi access points to enlist them in DDoS attacks. To this end, threat actors exploit a critical Ruckus vulnerability in the Wireless Admin panel. The flaw is tracked as CVE-2023-25717 and enables hackers…
Sysco`s System Breached, Customers` and Employees` Data Stolen
Sysco food distributor announced recently that its network was breached, and business, customer, and employee data was compromised. According to an internal memo the company sent to its employees on May 3rd, data belonging to customers and suppliers in the…
Alert: NextGen Data Breach Puts 1 Million User Identities at Risk
NextGen Healthcare, a U.S.-based provider of electronic health record software, notified its clients that threat actors breached its systems and stole the personal data of more than 1 million patients. The company reported a data breach to the Maine attorney…
Patch Tuesday May 2023 – Microsoft Slates for Release 11 Security Fixes for Edge Browser Vulnerabilities
Heimdal® returns with yet another rendition of its monthly Patch Tuesday updates. Our May edition includes security releases for vulnerabilities that impact Microsoft’s Chromium-based Edge browser. In total, 11 fixes have launched, each tackling a different operational area. Enjoy and…
Heimdal® Takes Home Top Honors at Security Excellence Awards for Risk Management
We are thrilled to announce that Heimdal® has been awarded the Risk Management Award at the Security Excellence Awards 2023 for our innovative Patch and Asset Management solution! This award recognizes our commitment to providing cutting-edge cybersecurity solutions that help…
Iranian Threat Groups Mango Sandstorm and Mint Sandstorm Join the PaperCut Attack Spree
As reported by Microsoft, Iranian state-backed threat groups have joined the ongoing assault targeting vulnerable PaperCut MF/NG print management servers. The groups in question are tracked as Mango Sandstorm (aka Mercury or Muddywater) and Mint Sandstorm (also known as Phosphorus…
Twitter Confirms a “Security Incident” that Led to Exposing Private Circle Tweets
Twitter recognized a security error regarding Twitter Circles in a statement sent to affected users on 5 May 2023. The company mentioned a “security incident” some weeks after the users noticed the initial problem. The Circle Tweets Twitter users reported…
A New Ransomware Operation Threatens Your Business: Akira
Researchers spotted a new ransomware operation in March 2023. It is called Akira and targets businesses worldwide, breaching corporate networks, stealing and encrypting data. Threat actors claim to already have sixteen companies in their portfolio of victims from areas like…
Royal Ransomware Targets the City of Dallas in Ransomware Attack
Officials from Dallas, Texas declared that Royal Ransomware gang is responsible for a cyberattack that shut down most of the city’s services and knocked the Dallas Police and Fire Rescue departments offline this week. Since the ransomware group’s Wednesday morning…
What Is Patch Management? Definition, Importance, Key Steps, and Best Practices
What Is Patch Management? Patch management is the process of identifying and deploying software updates. It is an important process that involves the acquisition, review, and deployment of ‘patches’ to IT infrastructure. The ‘patches’ are pieces of software code that…
Identity and Access Management Best Practices
Identity and Access Management is a critical component of modern-day cybersecurity. Often abbreviated as IAM, it refers to a collection of technologies, policies, and procedures that assist organizations in managing and verifying the identities of individuals and devices, granting access…
ReconShark – Kimsuky’s Newest Recon Tool
Kimsuky, a North Korean hacking group, has been observed employing a new version of its reconnaissance malware called “ReconShark” in a cyberespionage campaign with global reach. According to security analysts, the threat actor has broadened the range of targets it…
What Is IPAM in Networking and Cybersecurity?
Managing thousands of IP-connected devices can become a great challenge for many organizations. But imagine trying to keep track of which IP Address is assigned to each device, which DHCP lease is up, or when the IP has changed? In this…
SECURITY ALERT: Danish Customers Targeted by Active PostNord DK Phishing Campaign
Heimdal® has recently discovered what can very well be the debut of a massive phishing campaign unfolding in the Nordics. According to a tip sent to us by an anonymous reader, the APT’s choice in phishing is an email in…
New Decoy Dog Malware Toolkit Targets Enterprise Networks
A new, sophisticated malware toolkit called Decoy Dog was discovered after cybersecurity researchers analyzed more than 70 billion DNS records belonging to enterprise networks. To avoid detection, Decoy Dog uses stealthy methods like strategic domain aging and DNS query dribbling,…
CISA Issues Warning About Serious Flaws in Illumina DNA Sequencing Systems
A critical flaw affecting Illumina medical devices has been announced in an Industrial Control Systems (ICS) medical advisory issued by the United States Cybersecurity and Infrastructure Security Agency (CISA). The flaws affect the Universal Copy Service (UCS) software in the…
What Is Privilege Escalation?
Privilege escalation might be a confusing cybersecurity term for many. That’s why in this article we’re going to shed a little bit more light on this topic. Keep reading to find out more about what is privilege escalation, how many…
SECURITY ALERT: Heimdal® Identifies Active Phishing Campaign Singleing Out Romanian Telecom Users
On the 28th of April, acting on a tip received from an anonymous source, Heimdal®’s SOC team has come across an active phishing campaign that appears to specifically target Romanian telecom customers. The preliminary analysis of all of the evidence…
RTM Locker Ransomware Gang Targets VMware ESXi Servers
RTM Locker is now the most recent enterprise-targeting ransomware operation found to be using a Linux encryptor to target virtual machines on VMware ESXi systems. The RTM (Read The Manual) cybercrime group, which is well-known for disseminating a unique banking…
Managed Threat Hunting: The Next Step from Traditional Cybersecurity
As the world becomes increasingly digital, cybersecurity threats continue to evolve and become more sophisticated. Traditional cybersecurity measures are no longer enough to protect organizations from malicious attacks. That’s where managed threat hunting comes in – a proactive approach that…
What Is a Ping Flood and How to Prevent It?
Imagine sitting at your computer, ready to work or browse the internet, only to find that your connection is suddenly sluggish or completely non-existent. You may have fallen victim to a ping flood attack – one of the most common…
What Is Cyber Threat Hunting? Process, Types and Solutions
Cyber threat hunting is a proactive search for malicious actors and contents in your system. Threat hunting is a must-have part of the defense strategy which focuses to detect and respond rapidly to unknown, undetected, and unresolved threats. This means…
TP-Link High-Severity Flaw Added to Mirai Botnet Arsenal
A TP-Link Archer A21 (AX1800) consumer-grade WiFi router vulnerability has been used by Mirai botnet to launch DDoS attacks against IoT devices. The flaw in the TP-Link Archer AX21 firmware was discovered back in December 2022, and the company released a patch in…
New LOBSHOT Malware Deployed Via Google Ads
Google advertisements have been exploited to distribute various types of malware over the past few months. To trick unsuspecting users into downloading malware onto their systems, threat actors often used the platform to promote fake websites on legit software and…
Chinese APT Alloy Taurus Is Back – Linux Variant of PingPull Malware Is Active
Across Southeast Asia, Europe and Africa, a new Linux variant of the PingPull malware used by Chinese APT group Alloy Taurus (Gallium) has been reported as an active threat to telecommunications, finance and government organizations. Alloy Taurus is a Chinese…
What Is SOC-as-a-Service (SOCaaS) and How Could Your Company Benefit?
When building an organization’s cybersecurity posture, there are many decisions that will ultimately lead you to the best result for your specific company. One of these decisions is having an in-house SOC team or choosing a managed SOC solution like…
IMA Financial Group Targeted in Cyberattack. Confidential Consumer Data Spilled
IMA Financial Group (IMA) announced on April 19th it had experienced a data breach resulting in confidential consumer data leakage. The insurance and wealth management solutions company filed a notice of the data security incident with the Attorney General of…
7,413 People Were Impacted by Alaska Railroad Data Breach
Alaska Railroad Corporation reported a data breach incident that occurred in December 2022 and they discovered it on March 18th, 2023. According to ARCC, a third party gained unauthorized access to the internal network system. Further on, threat actors accessed…
New Type of Side-Channel Attack Impacts Intel CPUs and Allows Data Leakage
Researchers discovered a new kind of side-channel attack that affects several versions of Intel CPUs and enables data exfiltration. Attackers could leak the data through the EFLAGS register. The discovery was made by researchers at Tsinghua University, the University of…
Yellow Pages Canada Suffered a Cyberattack
Yellow Pages Group, a Canadian entity that specializes in directory publishing, has officially confirmed that it has fallen victim to a cyberattack. Black Basta, a group known for spreading ransomware and engaging in extortion, has taken credit for the attack…
PaperCut Flaw Exploited to Hijack Servers, Fix Released
Attackers are taking advantage of critical flaws in the widely used PaperCut MF/NG print management software to install Atera remote management software and take control of servers. The software is used by more than 100 million people from over 70,000…
What Is Privileged Account and Session Management (PASM)?
Privileged Account and Session Management (PASM) is a new PAM (Privileged Access Management) that focuses on privileged account monitoring and management for compliance, security, and data integrity purposes. Whereas PAM covers user account, on rights escalation demands, PASM and PEDM…
DNS Layer Security Explained. How It Stops Ransomware and Other Cyberattacks
DNS-Layer Security protects users from threats that arise from inbound and outbound traffic. It refers to monitoring communications between endpoints and the internet at a DNS-layer level. Imagine the DNS layer security as a gatekeeper who makes sure that all…
The Incidence of EvilExtractor Malware Rises Across Europe and the U.S.
The number of cyberattacks spreading EvilExtractor malware across Europe and the U.S. is raising. Researchers warn that threat actors used the data theft tool in a massive phishing campaign in March 2023. Hackers designed this malicious program to extract data…
Threat Actors Can Use Old Routers’ Data to Breach Corporate Networks
Discarded routers that are for sale on the secondary market are usually improperly wiped, an experiment shows. Threat actors can reboot sensitive data that haven’t been completely erased from them. Cybercriminals can use information about network configuration and details about…
Stay Ahead of Cyberthreats with Proactive Threat Hunting
In today’s digital age, cyber threats are an ever-present danger to organizations of all sizes. From ransomware attacks to data breaches, the consequences of a successful cyberattack can be devastating. That’s why it’s essential for businesses to adopt a proactive…
US Medical Service Data Breach Impacts 2.3M People
Shields Health Care Group (SHCG), a medical service provider in the United States, announced a data breach that compromised the personal information of more than 2.3 million people. Shields reported the breach to the Maine Attorney General on April 19,…
Cybercriminals Abusing an Abandoned WordPress Plugin for Malicious Code Injection
Threat actors found a new method to inject malicious code into websites. They are now using an abandoned WordPress plugin, Eval PHP. The plugin is still available in the WordPress plugins repository and had approximately 4,000 malicious installations per day…
Millions of Records With Sensitive Data Leaked by ICICI Bank
ICICI Bank, an Indian multinational valued at more than $76 billion, with over 5,000 branches operating across India and 15 other countries worldwide has leaked millions of records with sensitive data, including financial information and personal documents of the bank’s…
SECURITY ALERT: Heimdal® Detects Massive MitID Smishing Campaign Targeting Nordea Bank Customers
On the 20th of April, Heimdal®’s SOC team has discovered that an unknown APT has been launching smishing attacks against Nordea Bank customers. The data analyzed so far suggests that the threat actor takes advantage of the MitID authentication mechanism…
Companies Affected by Ransomware [2022-2023]
The increasing frequency and size of ransomware attacks are becoming a huge concern for thousands of organizations globally. All over the world, threat actors take advantage of security vulnerabilities and encrypt data belonging to all sorts of organizations: from private…
Iranian Hackers Target U.S. Energy and Transit Systems
Mint Sandstorm, an Iranian government-backed actor, has been linked to attacks on critical infrastructure in the United States between late 2021 and mid-2022. The entities that were targeted include seaports, energy companies, transit systems, and a major U.S. utility and…
Russian Hacktivists Shifting Interest to Business Sector, UK Cyber-agency Warns
The National Cyber Security Centre (NCSC) from the UK issued a warning about state-aligned Russian hacktivists shifting their interest to the business sector. Authorities recommend that all companies in the country tighten their security measures. The Russian Hacktivists Threat Usually,…
Trigona Ransomware Deployed Through Vulnerable Microsoft SQL Servers
Attackers are breaking into Microsoft SQL (MS-SQL) servers to install Trigona ransomware payloads and encrypt all files. These servers are not well protected and are exposed to the Internet. By using account credentials that are simple to guess, brute-force or…
SIEM vs XDR: A Comparison of Two Advanced Detection and Response Solutions
When trying to tie up your organization’s cybersecurity posture, you look for the perfect detection and response solution to keep you safe. With all the options available nowadays, this is when it can get confusing. In this article, we will…
APT28 Russian Hackers Inject Routers with Jaguar Tooth Custom Malware
Researchers in US and UK warn that Russian state sponsored APT28 hackers deploy ”Jaguar Tooth” custom malware on routers in order to obtain unauthorized access. The APT28 threat group is known for a wide range of attacks and cyberespionage activities…
US Company CommScope Hit by Ransomware
Following a ransomware attack back in March, sensitive employee data was compromised at CommScope, a major US telecommunications and IT infrastructure company. The Vice Society ransom gang claims to have published CommScope employee data on its dark web leak site. The…
Privilege Elevation and Delegation Management (PEDM) Explained: Definition, Benefits and More
A game-changer in the PAM market, PEDM is now on everybody’s lips when talking about more efficient methods to mitigate cybersec risk by properly controlling privileged permissions. Featuring three essential elements: appropriate privileges for appropriate users just at the appropriate…
Rheinmetall Suffers Another Cyberattack – Company Operations Still Functional
Rheinmetall, a leading German armaments and technology company, was targeted by a cyberattack over the weekend. The attack, however, did not affect company operations, according to officials. Rheinmetall, the largest arms company in Germany and one of the top three Western…
New ”Domino” Malware Strain Targets Corporate Networks
Researchers recently discovered a new malware family named “Domino”, allegedly created by ITG14, also known as the FIN7 threat group. Reportedly, ex-Conti hackers have been using it since at least February 2023 to spread Project Nemesis info stealer or Cobalt…
Windows Admins Warned About a Critical MSMQ QueueJumper Vulnerability
Security researchers and experts warn Windows admins about a critical vulnerability discovered in the Windows Message Queuing (MSMQ) middleware service, that can expose hundreds of thousands of systems to attacks. The vulnerability has been patched by Microsoft in this month’s…
Warning: Threat Actors Compromise 3CX Desktop App in a Supply Chain Attack (Updated)
An ongoing supply chain attack allegedly uses a digitally signed and trojanized variant of the 3CX Voice Over Internet Protocol (VoIP) desktop client to target the company’s clients. The 3CX Phone System engineered by the VoIP IPBX software development company…
Balada Injector Infects Nearly 1 Million WordPress Sites
A malware distribution operation known as Balada Injector has been active since 2017, and it is believed that it has infected over a million WordPress sites. According to GoDaddy’s Sucuri, the massive campaign “leverages all known and recently discovered theme…
Two New Emergency Patches from Apple
Apple is backporting two security patches released on Friday. The updated patches address zero-day vulnerabilities on iPhones, iPads, and Macs. Details About the Vulnerabilities The first flaw, tracked as CVE-2023-28206, is an out-of-bounds write issue. This bug may permit threat…
SD Worx Shuts Down its UK & Ireland IT Systems Following Cyberattack
Belgian company SD Worx shut down all IT systems for its UK and Ireland services after suffering a cyberattack. The European HR and payroll management company services 5.2 million employees for over 82,000 companies. The company started notifying customers that…
XDR vs MDR: A Comparison of Two Detection and Response Solutions
Ensuring an efficient threat detection and response (D&R) strategy for your organization is vital for every sector of its activity. But growing workloads and limited resources are only two of the problems you encounter in your search for the best…
Round-Robin DNS Explained. What It Is and How It Works
The Round-robin DNS is a load-balancing technique that helps manage traffic and avoid overloading servers. Multiple IP addresses are assigned to a single domain name; each time the domain name is resolved, the returned IP address is picked in a…
Oldest Law Practice in NYC Hacked, over 90,000 Clients Impacted
Almost 90,000 clients’ personal information was compromised in the cyberattack on the prestigious law firm Cadwalader, Wickersham & Taft. The law firm informed its clients on March 30, 2023, that on November 15, 2022, an unauthorized third party acquired remote…
Dutch Government to Adopt RPKI on All Its Networks for Safety Reasons
The Government of the Netherlands announced last week its intention to implement the Resource Public Key Infrastructure (RPKI) standard on all its networks. The measure is meant to upgrade de Internet routing safety, protecting the networks against route hijacks and…
Five New Actively Exploited Vulnerabilities Added by CISA to its KEV Catalog
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added five new actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. Three of the added vulnerabilities were found in the Veritas Backup Exec Agent software and were used by threat…
Best Patch Management Practices to Follow to Keep Your Business Secured
Patch management is an essential practice for businesses to maintain the security and stability of their IT infrastructure. Patches are released by software vendors to fix vulnerabilities and enhance performance, and failing to manage these patches can lead to security…
Cyber Incident Cripples UK Criminal Records Office
After weeks of silence, the UK’s Criminal Records Office (ACRO) has issued a statement saying that the issues with the website that have been ongoing since January 17 were caused by a “cyber security incident.” ACRO manages criminal record information,…
MSI Breach Claimed By Money Message Ransomware Gang
A recent data breach affecting Taiwanese PC parts maker MSI (Micro-Star International) has been listed on the extortion portal of a new ransomware gang known as ‘Money Message’. The threat actors claim to have stolen source code from the company’s…
What Is a Software Restriction Policy?
In today’s digital age, it is crucial for businesses to protect their sensitive data and computer systems from cyber threats. One effective way of doing so is by implementing a software restriction policy. But what exactly is a software restriction…
Designing Your Threat Hunting Framework from Scratch – Core Essentials
A threat hunting framework is a collation of data-driven adversarial scenarios, backed up by hypothetical, field-tested, or time-honored TTPs (i.e., Tactics, Techniques, and Procedures). Serving a wide array of security-wise needs such as baselining, forecasting, threat modeling, vulnerability discovery, and…
Typhon Info-Stealing Malware Comes Back Harder to Detect
Threat actors upgraded Typhon info-stealer to a version that has improved evading features against analysis and anti-virtualization mechanisms. The new Typhon Reborn V2 malware is currently advertised on a dark web forum. Typhon was first discovered in August 2022 and…
What Is Scareware and How to Prevent It?
Are you one of those people who get easily scared by pop-up ads and warning messages on your computer? If so, then beware! You might be falling for a common cybercrime tactic known as scareware. Scareware is a type of…
International Cyber Operation Shuts Down Notorious Genesis Market
A global law enforcement crackdown, dubbed Operation Cookie Monster, has led to the take down of one of the world’s biggest criminal marketplaces used by online fraudsters to buy passwords – Genesis Market. An FBI-led operation involving more than a…
New Threat Uncovered: Rorschach Ransomware – The Fastest Encryptor
Researchers have unveiled a sophisticated and fast ransomware strain called Rorschach, previously undocumented. Malware experts discovered the new ransomware strain after a cyberattack on a U.S.-based company and described it as having “technically unique features”. Among the capabilities observed was the encryption…
New Rilide Malware Strikes Chromium-Based Browsers to Steal Cryptocurrency
Researchers discovered a new malware that fakes legitimate Google Drive extensions to inject malicious scripts and steal cryptocurrency. The new Rilide malware targets Chromium-based browsers like Google Chrome, Microsoft Edge, Brave, and Opera. How Is Rilide Different Just like other…
My Cloud Goes Down While Data Storage Giant Announces Network Breach
Western Digital announced that they discovered a network breach had affected their systems, starting March 26th. Threat actors managed to obtain unauthorized access to several of the Company’s systems. While law authorities are still investigating, Western Digital claims the intruder…
15 Million Systems Are Vulnerable to CISA KEV Flaws
Using the Shodan database, IT security researchers were able to track down 15 million vulnerable systems with vulnerabilities from the US cyber security authority CISA’s Known-Exploited-Vulnerabilities-Catalog (KEV). When KEV vulnerabilities are discovered, updates are usually available from the software manufacturer…
Microsoft Addresses a New Azure AD Vulnerability Affecting Bing Search & Key Apps
Microsoft has patched a misconfiguration issue affecting the Azure Active Directory (AAD) identity and access management service that allowed unauthorized access to many “high-impact” applications. The vulnerabilities were reported to Microsoft in January and February 2022, after which the company…
Money Message: The Newest Ransomware Gang that Threatens Organizations
A new online threat actor has emerged: the Money Message ransomware gang. These cybercriminals are attacking companies all over the world, demanding millions of dollars in ransom for the decryption key and not leaking the stolen data. When Did Money…
Elementor Pro Vulnerability Actively Exploited by Threat Actors
Threat actors are actively exploiting a high-severity vulnerability discovered in the popular plugin Elementor Pro. Elementor Pro is a WordPress page builder plugin with multiple functions that helps users to build professional-looking websites easily, without the need to know how…
SCCM Alternative for Patch Management
In today’s cybersecurity space, properly patching the machines and servers in your company can make the difference between a well-secured organization and a vulnerable one. SCCM is one of the most popular system management solutions on the market and has…
NATO and Diplomats’ Email Portals Targeted by Russian APT Winter Vivern
Winter Vivern (aka TA473), a Russian hacking group, has been exploiting vulnerabilities (CVE-2022-27926) in unpatched Zimbra instances to access the emails of NATO officials, governments, military people, and diplomats. The CVE-2022-27926 flaw affects versions 9.0.0 of Zimbra Collaboration, which is…
Ukrainian Authorities Stop a Phishing Scam Worth $4.3 million
Ukraine’s Cyberpolice Department announced an operation during which they busted a phishing gang. The police arrested two scammers and confiscated equipment used for phishing frauds. Threat actors managed to steal $4,300,000 from over a thousand victims across the EU. The…
Smart Grid Fragility, a Constant Threat for the European and American Way of Living
In today’s world, a multitude of smart devices helps us to improve our lives, as we rely more and more on technology for a comfortable and efficient lifestyle – smart appliances, smart cars, smartwatches. Life as we know it is…
Warning: Threat Actors Compromise 3CX Desktop App in a Supply Chain Attack
An ongoing supply chain attack allegedly uses a digitally signed and trojanized variant of the 3CX Voice Over Internet Protocol (VoIP) desktop client to target the company’s clients. The 3CX Phone System engineered by the VoIP IPBX software development company…
Best Practices for Effective Identity Lifecycle Management (ILM)
In today’s fast-paced world, identity management has become a crucial aspect of every organization. From securing sensitive data to ensuring compliance with regulations, effective Identity Lifecycle Management (ILM) is essential for businesses of all sizes. However, implementing an ILM strategy…
The UK Government Shares New Strategy to Boost NHS Cybersecurity by 2030
The Department of Health and Social Care has established a cyber security program aimed at improving cyber resilience across the NHS and social care sectors in England over the next seven years. The use of technology to access health and…
Companies Affected by Ransomware [2022-2023]
The increasing frequency and size of ransomware attacks are becoming a huge concern for thousands of organizations globally. All over the world, threat actors take advantage of security vulnerabilities and encrypt data belonging to all sorts of organizations: from private…
What Is User Provisioning?
User provisioning (also known as account provisioning) is a digital Identity and Access Management (IAM) process that involves creating employee/user accounts and their profiles and giving them appropriate rights and permissions across IT infrastructure and enterprise applications and systems. In…