IT Security News Daily Summary 2024-07-31

• An In-Depth Look at the Cisco CCDE-AI Infrastructure Certification

• More than 83K certs from nearly 7K DigiCert customers must be swapped out now

• Russia takes aim at Sitting Ducks domains, bags 30,000+

• Security review for Microsoft Edge version 127

• USENIX Security ’23 – Oops..! I Glitched It Again! How to Multi-Glitch the Glitching-Protections on ARM TrustZone-M

• Identifying a BOLA Vulnerability in Harbor, a Cloud-Native Container Registry

• What is CrowdStrike? Everything You Need to Know

• The Cisco Store Patching Station

• Introducing the MSRC Researcher Resource Center

• Microsoft: DDoS Attack on Azure Services Exacerbated by Defense Error

• WhatsApp Allows Python, PHP Script Execution on Windows Without Warnings

• Mandrake Android Malware Creeps Up On Google Play Store Again

• Recent SideWinder Campaign Targets Ports And Maritime Facilities

• The big cybersecurity themes at Black Hat 2024 — and why they matter

• State of SaaS Security Report 2024: Key Findings & Tips from Deployments at Scale

• Why You Should Clear Your Android Browser’s Cache and Cookies

• Increased Activity Against Apache OFBiz CVE-2024-32113, (Wed, Jul 31st)

• Microsoft Says Ransomware Groups Are Exploiting the Newly-Patched VMware ESXi Flaw

• Ransomware Attack Hits OneBlood Blood Bank, Disrupts Medical Operations

• US To Exempt Allies From Expanded China Chip Equipment Export Rules

• Global SMS Stealer Targeting Android Users via Malicious Apps and Ads

• Australian Organisations Experiencing Highest Rate of Data Breaches, Reports Rubrik

• Microsoft confirms DDoS attack disrupted cloud services

• Cost of Data Breach in 2024: $4.88 Million, Says Latest IBM Study

• Urgent Email Alert from Amazon UK Customers Must Act Now

• Over 8,000 Exploit Attempts Already Blocked For Recently Patched Unauthenticated Arbitrary File Upload Vulnerability in 简数采集器 (Keydatas) WordPress Plugin

• CISA and FBI Release Joint PSA: Putting Potential DDoS Attacks During the 2024 Election Cycle in Context

• X Leverages Users’ Posts For Training Its Grok AI

• 6 Best Vulnerability Management Software & Systems in 2024

• Texas Wins $1.4 Billion Biometric Settlement Against Meta. It Would Have Happened Sooner With Consumer Enforcement

• Chrome adopts app-bound encryption to stymie cookie-stealing malware

• Report: Amount of Data Being Analyzed by Cybersecurity Teams Rises

• Analysis of Top Infostealers: Redline, Vidar and Formbook

• Meta to pay $1.4 billion over unauthorized facial recognition image capture

• Five takeaways from Forrester’s 2024 state of application security

• Hackers Exploit Vmware ESXi Vulnerability in Ransomware Attacks

• Source Code of Phorpiex Botnet with Anti-AV Capabilities on Sale

• Navigating the Evolving Landscape of Cybersecurity

• CrowdStrike Sued? — Delta Dials David Boies

• Out-of-bounds read vulnerability in NVIDIA driver; Open-source flashcard software contains multiple security issues

• Microsoft Slowdown In Cloud Growth Worries Wall Street

• Oracle challenges cloud giants with new Nvidia AI hardware offerings

• Nearly 7% of Internet Traffic Is Malicious

• Multiple SMTP Servers Vulnerable to Spoofing Attacks, Let Hackers Bypass Authentication

• Our Last Chance to Stop KOSA | EFFector 36.10

• The CISO: A Cornerstone of Private Equity Success

• Urgent Blood Appeal Issued in US After Ransomware Attack

• VMware vulnerability leads ransomware to encrypt mass virtual machines

• Microsoft 365 subscriptions now include a free VPN – here’s how to use it

• What is cyber attribution?

• Unlocking the Future of MSSP Operations with Cisco CDO APIs

• Security Researchers and Journalists at Risk: Why You Should Hate the Proposed UN Cybercrime Treaty

• Embedding AI security from the get go

• Black Hat Preview: CrowdStrike, Disinformation Lead The Narrative

• Passwords Vanish for 15 Million Windows Users, Google Says “Sorry”

• New SMS Stealer Malware Targets Over 600 Global Brands

• UK Investigates Alphabet Partnership With AI Firm Anthropic

• Vulnerabilities Enable Attackers to Spoof Emails From 20 Million Domains

• The Concerning Rise of AI “Undressing” Apps: A Violation of Privacy and Ethics

• SMS Stealer malware targeting Android users: Over 105,000 samples identified

• Take Cover: Securing Games Truly Is a Battle Royale

• Bridging the skills gap to build a secure future for the cloud

• Five months after takedown, LockBit is a shadow of its former self

• Cyberse and the Marketplace Era of Cybersecurity Purchasing

• DigiCert to Revoke 83,000+ SSL Certificates Due to Domain Validation Oversight

• CrowdStrike Shares Plunge Amid Delta Compensation Report

• PR vs cybersecurity teams: Handling disagreements in a crisis

• California digitizes car titles, putting 42 million vehicles on the blockchain

• Malwarebytes vs Bitdefender: Best Cybersecurity Software of 2024

• Addressing communication roadblocks to overcome cybersecurity threats

• Malicious Packages Hidden in PyPI

• Data Breaches for the Month July 2024

• Google Backs Messaging Layer Security for Enhanced Privacy and Interoperability

• North Korea-Linked Malware Targets Developers on Windows, Linux, and macOS

• Meta to Pay Texas $1.4bn for Unlawful Biometric Data Capture

• World Wide Web Consortium Opposed Google’s Decision on Third-party cookies

• Vulnerability Management in DevOps Environments

• Apple fixes Siri vulnerabilities that could have allowed sensitive data theft from locked device. Update now!

• Are You Getting the Most Value from Your Existing CNAPP Solution?

• City of Columbus Says Data Compromised in Ransomware Attack

• New PyPI Package Zlibxjson Steals Discord, Browser Data

• ‘Error’ in Microsoft’s DDoS defenses amplified 8-hour Azure outage

• Can GPT-4o Be Trusted With Your Private Data?

• Apple fixed dozens of vulnerabilities in iOS and macOS

• How to Best Secure Banking Applications – Top Tips from a Mobile Security Expert

• The Challenges and Responsibilities of CISOs with Halcyon

• New Specula Tool Turning Outlook as a C2 Server by Leveraging Registry

• The best travel VPNs of 2024: Expert tested and reviewed

• Don’t Let Your Domain Name Become a “Sitting Duck”

• Tenable Considering a Potential Sale: Report

• “There is no business school class that would ever sit down and design Talos”

• Protect Against Adversary-in-the-Middle with Cisco’s User Protection Suite

• The Transformational Opportunity of AI on ICT Jobs

• DigiCert Revokes 83,267 TLS Certificates Due to DNS Check Problem

• Top CVEs of July 2024: Key Vulnerabilities and Mitigations

• How To Get the Most From Your Security Team’s Email Alert Budget

• Chinese Hackers Target Japanese Firms with LODEINFO and NOOPDOOR Malware

• Tesla Using Full Self Driving In Crash Kills Biker, Amid Another Recall

• Phishing Attack Steals Donations from Trump Voters Using Fake Websites

• Meta paid a $1.4 Billion Settlement for the Unauthorized Capture of Personal Biometric Data

• Cybercriminals Target Polish Businesses with Agent Tesla and Formbook Malware Delivered by ModiLoader

• DigiCert Revoking Many Certificates Due to Verification Issue

• Microsoft: DDoS defense error amplified attack on Azure, leading to outage

• Clutch Security launches to transform management of NHIs

• GDPR Consent Request Forms: Sample Text

• Can ChatGPT-4o Be Trusted With Your Private Data?

• New Specula Tool Uses Outlook for Remote Code Execution in Windows

• Report: 40% of Environments Exposed to Full Take Over

• How Bots and AI are Fueling Disinformation

• Fortanix expands Key Insight to enhance cryptographic security across hybrid environments

• Cyber Espionage Group XDSpy Targets Companies in Russia and Moldova

• Cybercriminals Deploy 100K+ Malware Android Apps to Steal OTP Codes

• Join Us 08-16-24 for “Hacking the Demo” – Super Cyber Friday

• Intel To Cut Thousands Of Jobs – Report

• AI-powered ‘narrative attacks’ a growing threat: 3 defense strategies for business leaders

• Phishing campaigns target SMBs in Poland, Romania, and Italy with multiple malware families

• How AI is Shaping Fraud: VIPRE Reveals 40% of BEC Emails Are Now AI-Generated

• Cost of a Data Breach Surges 10% on Shadow Data Challenge

• DDoS Attack Triggers New Microsoft Global Outage

• Cybersecurity News: Delta’s legal maneuver, Record-breaking ransom, Meta $1.4B settlement

• 6% of All Published CVEs Have Been Exploited in the Wild, Report Finds

• AnimeLeague – 192,134 breached accounts

• From Geopolitics to Boardrooms: The Impact of the Kaspersky Ban

• Cycode unveils Cycode AI to enhance ASPM platform with advanced security features

• #TripwireBookClub – From its Origins to its Future: How AI Works

• IBM: Cost of a Breach Reaches Nearly $5 Million, With Healthcare Being Hit the Hardest

• UK Electoral Commission slapped for basic cybersecurity fails

• Innovative approach promises faster bug fixes

• Researchers Uncover Largest Ever Ransomware Payment of $75m

• Lineaje secures $20 million in funding to address software supply chain issues

• Enabling new service models with SSDP

• Chrome Security Update: Patch for Critical Flaw that Leads to Exploitation

• Bumble and Hinge allowed stalkers to pinpoint users’ locations down to 2 meters, researchers say

• Building bridges, feeding people and empowering students: How new technologies are changing lives

• A Fortune 50 company paid a record-breaking $75 million ransom

• Email Attacks Surge, Ransomware Threat Remains Elevated

• Meta Agrees to $1.4B Settlement With Texas in Privacy Lawsuit Over Facial Recognition

• Can Negotiations Yield Success in Ransomware Attacks

• Devo Technology launches data orchestration and SOC enhancements

• DDoS Attack on Microsoft Azure Cloud leads to another global IT Outage

• Cohesity unveils enhanced GenAI capabilities for faster threat detection and recovery

• Microsoft world wide outage: Cybersecurity Today for Wednesday, July 31, 2024

• How AI is Shaping Fraud: Vipre Reveals 40% of BEC Emails Are Now AI-Generated

• IBM: Cost of Data Breach on Average Reaches $4.9 Million

• If You are Reachable, You Are Breachable, and Firewalls & VPNs are the Front Door

• NSFOCUS RSAS New Features Unleashed

• Proficio launches ProBAS service to help organizations better prepare and respond to cyber attacks

• Meta Settles for $1.4 Billion with Texas Over Illegal Biometric Data Collection

• Dark Angels gang scores a record-breaking $75 million ransom

• What CISOs need to keep CEOs (and themselves) out of jail

• Leveraging dynamic configuration for seamless and compliant software changes

• Cybersecurity jobs available right now: July 31, 2024

• Secretive: Open-source app for storing and managing SSH keys in the Secure Enclave

• ISC Stormcast For Wednesday, July 31st, 2024 https://isc.sans.edu/podcastdetail/9076, (Wed, Jul 31st)

• DigiCert gives unlucky folks 24 hours to replace doomed certificates after code blunder

• Ubook – 699,908 breached accounts

• Lineaje raises $20M to help organizations combat software supply chain threats

• ThreatLabz Ransomware Report: Unveiling a $75M Ransom Payout Amid Rising Attacks

• DigiCert Certificate Revocations

• Calls Mount—from Principal UN Human Rights Official, Business, and Tech Groups—To Address Dangerous Flaws in Draft UN Surveillance Treaty

• CISA adds VMware ESXi bug to its Known Exploited Vulnerabilities catalog

• Certbot Use Continues to Grow

• IT Security News Daily Summary 2024-07-30

• Proofpoint Platform Exploited to Send Millions of Spoofed Phishing Emails

• How to Get Started in Cybersecurity: Steps, Skills & Resources

• Mandrake Android spyware found in five apps in Google Play with over 32,000 downloads since 2022

• Building A SOC: Key Considerations And Strategies

• Google Workspace Authentication Vulnerability Allowed Thousands of Emails to be Compromised

• It took some serious nerve for Wiz to walk away from Google’s $23B offer

• AI Pulse: Brazil Gets Bold with Meta, Interpol’s Red Flag & more

• AI-Powered Deepfake Tools Becoming More Accessible Than Ever

• Delta Air Lines dials up Microsoft’s legal nemesis over CrowdStrike losses

• Empowering WordPress Bug Bounty Hunters: Meet the New Wordfence Bug Bounty Program Researcher Dashboard

• Microsoft need to be transparent about customer impacting DDoS attacks

• Ransomware Attacks Are Attracting Record Payouts in Australia. Should You Pay the Ransom?

• Microsoft, SecOps pros weigh kernel access post-CrowdStrike

• Cloud Security Challenges Extend Beyond Technology

• The best Bluetooth trackers of 2024: Expert tested

• HealthEquity data breach affects 4.3M people

• Apple Patches Everything. July 2024 Edition, (Tue, Jul 30th)

• $75 Million Ransom Paid to Dark Angels Ransomware Group

• Threat actor impersonates Google via fake ad for Authenticator

• Meta’s AI Safety System Manipulated by Space Bar Characters to Enable Prompt Injection

• The KOSA Internet Censorship Bill Just Passed The Senate—It’s Our Last Chance To Stop It

• NTLM Deprecation is Giving Us XP EOL Flashbacks: Are You Protected?

• US State Department Says UN Cybercrime Treaty Must Include Human Rights Protections

• With the Olympics underway, Attendees and Spectators at Risk of Cyberattacks

• SAFECOM Releases New Resource for Cloud Adoption

• IT leaders worry the rush to adopt Gen AI may have tech infrastructure repercussions

• SideWinder Utilizes New Infrastructure to Target Ports and Maritime Facilities in the Mediterranean Sea

• Ransomware actors pivot away from major brands in Q2 2024

• Extending Resilience: Reducing Stress and Burnout for Cybersecurity Teams

• Crypto Exchange Gemini Confirms Third-Party Data Breach

• Balancing Privacy and Authenticity in the Digital Age

• Google’s New Feature to Protect Users From Fake Calls

• How to deploy an Amazon OpenSearch cluster to ingest logs from Amazon Security Lake

• Proficio Launches New ProBAS Breach and Attack Simulation Service

• Food Fraud: The Top Three Scams Impacting the Food Delivery Industry

• Apple Releases Security Updates for Multiple Products

• CISA Adds One Known Exploited Vulnerability to Catalog

• SideWinder phishing campaign targets maritime facilities in multiple countries

• New PowerShell Backdoor Linked to Zloader Malware

• Change Healthcare Begins to Notify Millions Affected by Hack

• Western Maryland Community Colleges Receive Edwards Fund Grant for Cyber Ranges

• The US States Most at Risk of Cyberattacks

• Australia wants companies disclose ransomware payments

• Microsoft: Ransomware gangs exploiting VMware ESXi flaw

• European Central Bank Concludes Banking Cyber Stress Test

• Cowbell Secures $60 Million Series C Funding From Zurich Insurance Group

• Google Cloud CISO Phil Venables: ‘I’m short-term pessimistic, long-term optimistic’

• Sophisticated Phishing Campaign Targets Microsoft OneDrive Users

• Crowdstrike preliminary report as sourced from Richard Ford

• Salvador Technologies sees growth in maritime cybersecurity

• Price Drop: This Complete Ethical Hacking Bundle is Now $40

• HealthEquity data breach affects 4.3 million people

• HealthEquity Data Breach Compromises Customer Information

• Massive Phishing Campaign Exploiting Proofpoint’s Email Protection to Dispatch Millions of Perfectly Spoofed Emails

• Crafty ClickFix-Style Phishing Campaign Targets Microsoft OneDrive Users

• ‘LockBit of phishing’ EvilProxy used in more than a million attacks every month

• Adaptive Shield Showcases New ITDR Platform for SaaS at Black Hat USA

• Why (and How) APIs and Web Applications Are Under Siege

• Google Workspace Vulnerability Allowed Hackers to Access 3rd-Party Services

• A Senate Bill Would Radically Improve Voting Machine Security

• The Unyielding Struggle of Cybersecurity and Its Paradoxical Dilemma

• Indian APT Targeting Mediterranean Ports and Maritime Facilities

• New Mandrake Spyware Found in Google Play Store Apps After Two Years

• Stolen GenAI Accounts Flood Dark Web With 400 Daily Listings

• Progress Patched New MOVEit File Transfer Flaw that Allows Privilege Escalation

• Weak Human Rights Protections: Why You Should Hate the Proposed UN Cybercrime Treaty

• Fortanix Extends Encyption Key Discovery to On-Premises IT Platforms

• Ukraine Hacks ATMs Across Russia in Massive Cyberattack

• Listening to the Voice of the Customer: Cisco’s 2024 State of Industrial Networking Report

• Accenture and SandboxAQ Expand Cybersecurity Partnership

• The Power and Peril of RMM Tools

• ubook Suffered Data Breach, 710,000 Users’ Data Exposed

• Why Do We Need to Keep Our Builds Green?

• Embracing Diversity and Growth: My Cisco Internship Experience

• Average data breach cost jumps to $4.88 million, collateral damage increased

• Critical OpenSSH “regreSSHion” Vulnerability Impacted macOS  Systems, Patch Now

• Threat Actor Allegedly Claiming Hack of Microsoft Employee’s Device

• Hackers Exploiting ESXi Hypervisor Auth Bypass Flaw For Ransomware Attacks

• Proofpoint’s Email Protection Let Attackers Send Millions Of Phishing Emails

• Microsoft Warns of Ransomware Gangs Abusing VMware ESXi Authentication Bypass in Attacks

• OCI Customers Can Now Externally Manage Encryption Keys from a Cloud-Based Service

• Adaptive Shield unveils ITDR platform for SaaS

• SocGholish Malware Attacking Windows Users Using Fake Browser Update

• Providing Security Updates to Automobile Software

• The Most Common DNS Security Risks in 2024 (And How to Mitigate Them)

• Ransomware gangs are loving this dumb but deadly make-me-admin ESXi vulnerability

• Cyber Threat Intelligence: Illuminating the Deep, Dark Cybercriminal Underground

• Cybercriminals Target Polish Businesses with Agent Tesla and Formbook Malware

• ICO Slams Electoral Commission for Basic Security Failings

• South Korea To Support Businesses Amidst E-Commerce Crisis

• China Sees Slowdown In Foreign-Branded Smartphone Growth

• Telegram-Controlled TgRat Trojan Targets Linux Servers

• Threat Actor Allegedly Claiming Breach of Cyepr

• AcidPour Malware Attacking Linux Data Storage Devices To Wipe Out Data

• IPVanish vs NordVPN (2024): Which VPN Is Better?

• 16-30 April 2024 Cyber Attacks Timeline

• VMware ESXi auth bypass zero-day exploited by ransomware operators (CVE-2024-37085)

• Hacker Attacking Bank Users With AI-powered Phishing Tools and Android Malware

• Surging data breach disruption drives costs to record highs

• What is sudo in Linux and why is it so important?

• Cyber Insurance Provider Cowbell Raises $60 Million

• Incident Response Is So Important We Might Try Getting Good At It

• 8 Daily Practices to Avoid Cybersecurity Burnout

• Re-Extortion: How Ransomware Gangs Re-Victimize Victims

• Just One in 10 Attacks Flagged By Security Tools

• Cybersecurity News: HealthEquity data breach, CrowdStrike impact grows, Proofpoint exploit

• Microsoft Expected To Report 31 Percent Azure Growth Amidst AI Pressure

• People Overconfident in Password Habits, Overwhelmed by Too Many Passwords

• Attackers Bypassed Google’s Email Verification to Create Workspace Accounts, Access Third-Party Services

• Ubuntu Fixes Two OpenVPN Vulnerabilities

• HealthEquity Breach Hits 4.3 Million Customers

• Millions of Spoofed Emails Bypass Proofpoint Security in Phishing Campaign

• SpaceX ‘In Talks’ To Recover Starship Rocket In Australia

• Silicon UK In Focus Podcast: Connecting the Machines

• A crafty phishing campaign targets Microsoft OneDrive users

• Apple Rolls Out Security Updates for iOS, macOS

• Xiaomi Buys $116m Plot To Expand Bejing EV Factory

• HPE $14bn Juniper Acquisition Set For ‘Unconditional’ EU Approval

• Microsoft 365 Users Targeted by Phishers Abusing Microsoft Forms

• New SideWinder Cyber Attacks Target Maritime Facilities in Multiple Countries

• 5 Bitwarden features that make it my favorite password manager

• Malware Campaign Lures Users With Fake W2 Form

• ZeroTier Raises $13.5 Million in Series A Funding

• Report: An 18% Increase in Ransomware Attacks Includes $75M Payment

• Hacked Blood Testing Provider Expects Autumn Recovery Date

• DigiCert to Revoke Thousands of Certificates Following Domain Validation Error

• The Critical Role of Response Time in Cybersecurity

• Ostrich Cyber-Risk Recognized in 2024 Gartner® Hype Cycle™ for Cyber-Risk Management

• Detecting Externally Facing Resources

• OneDrive Phishing Scam Tricks Users into Running Malicious PowerShell Script

• Ostrich Cyber-Risk Recognized in 2024 Gartner® Hype Cycle™ for Cyber-Risk Management

• Proofpoint phishing palaver plagues millions with ‘perfectly spoofed’ emails from IBM, Nike, Disney, others

• Ostrich Cyber-Risk Recognized in 2024 Gartner® Hype Cycle™ for Cyber-Risk Management

• VMware ESXi Flaw Exploited by Ransomware Groups for Admin Access

• X allows users to turn off GROK AI Training due to data concerns

• Ostrich Cyber-Risk Recognized in 2024 Gartner® Hype Cycle™ for Cyber-Risk Management

• Ostrich Cyber-Risk Recognized in 2024 Gartner® Hype Cycle™ for Cyber-Risk Management

• 2024-07-30 – Traffic analysis exercise: You dirty rat!

• Ostrich Cyber-Risk Recognized in 2024 Gartner® Hype Cycle™ for Cyber-Risk Management

• Ostrich Cyber-Risk Recognized in 2024 Gartner® Hype Cycle™ for Cyber-Risk Management

• Review: Action1 – Simple and powerful patch management

• Ostrich Cyber-Risk Recognized in 2024 Gartner® Hype Cycle™ for Cyber-Risk Management

• Coding practices: The role of secure programming languages

• Securing remote access to mission-critical OT assets

• Ostrich Cyber-Risk Recognized in 2024 Gartner® Hype Cycle™ for Cyber-Risk Management

• Insecure file-sharing practices in healthcare put patient privacy at risk

• Malaysia is working on an internet ‘kill switch’, says minister

• Ostrich Cyber-Risk Recognized in 2024 Gartner® Hype Cycle™ for Cyber-Risk Management

• Ostrich Cyber-Risk Recognized in 2024 Gartner® Hype Cycle™ for Cyber-Risk Management

• ISC Stormcast For Tuesday, July 30th, 2024 https://isc.sans.edu/podcastdetail/9074, (Tue, Jul 30th)

• Ostrich Cyber-Risk Recognized in 2024 Gartner® Hype Cycle™ for Cyber-Risk Management

• Hacker Scrapes and Publishes 100,000-Line CrowdStrike IoC List

Generated on 2024-07-31 23:55:12.796496