More than half of M&A security incidents in 2024 were non-malicious, resulting instead from integration-induced investigation delays, policy and compliance challenges, and issues baselining internal tools, a report from ReliaQuest has revealed. These findings suggest that inherited assets present a…
Tag: Information Security Buzz
Brand Impersonations Surge 2000% During Black Friday
Phishing scams impersonating major holiday brands like Walmart, Target, and BestBuy increased by more than 2000% during Black Friday week, new research from Darktrace has revealed. These findings come as part of a wider increase in phishing activity during the…
The Next Frontier: Predictions Driving Tech and Security in 2025
As we unveil the third edition of Information Security Buzz’s 2025 predictions, we are thrilled by the incredible response. In this installment, we dive even deeper into the evolving cybersecurity landscape, where advancements in AI, quantum computing, and cloud technologies…
Data Governance and the Mandate for Tougher Security in 2025
The challenges around data governance are evolving rapidly, driven by the rapid adoption of generative AI, stringent regulatory requirements, and heightened cybersecurity risks. As we approach 2025, organisations are realising that traditional approaches to data governance are no longer sufficient.…
The EU Cyber Resilience Act: Enhancing Digital Security in the AI Era
On 20 November 2024, the EU Cyber Resilience Act (CRA) was published in the Official Journal of the EU, kicking off the phased implementation of the CRA obligations. The European Union has introduced the Cyber Resilience Act to bolster the cybersecurity…
New Report Highlights Open Source Trends and Security Challenges
The Linux Foundation, in collaboration with the Laboratory for Innovation Science at Harvard, has unveiled a comprehensive study, “Census III of Free and Open Source Software – Application Libraries (Census III).” The report identifies the most widely used free and…
Developing Responsible AI in 2025: The Path to Trust and Compliance
Artificial intelligence (AI) is transforming industries at an unprecedented pace, offering solutions to some of the world’s most complex challenges. But with its immense potential come significant risks—bias, discrimination, data privacy breaches, and security vulnerabilities. Governments worldwide have enacted AI…
Kiteworks 2025 Cybersecurity Report Unveils Critical Trends and Strategies for Protecting Sensitive Data
As 2025 approaches, the cybersecurity landscape is set to face a new slew of challenges fueled by evolving threats and stringent regulations. According to Kiteworks’ newly released “2025 Forecast for Managing Private Content Exposure Risk” report, there are 12 transformative…
Avoiding cyber complacency as a small business
As a small business owner reading endless news stories about cyberattacks against well-known enterprise names, it can be easy to think it won’t happen to you. In reality, hackers don’t discriminate: businesses of all sizes can and do find themselves…
Critical Vulnerabilities Found in Veeam Service Provider Console
Two critical vulnerabilities (CVE-2024-42448 and CVE-2024-42449) have been identified in Veeam Service Provider Console (VSPC), prompting an urgent call for users to update their systems. According to Veeam’s latest security advisory, the vulnerabilities affect all builds of VSPC versions 7…
SmokeLoader Malware Targets Companies in Taiwan
A sophisticated cyberattack using the SmokeLoader malware targeted multiple industries in Taiwan in September 2024, new research from FortiGuard Labs has revealed. SmokeLoader is notorious for its versatility, advanced evasion techniques, and modular design, which allow it to perform a…
Navigating Australia’s Evolving Cyber Threat Landscape: Insights on AI-Driven Scams, Ransomware, and more
Cyber threats evolve rapidly in our current digital world—and Australia is no exception. AI-driven scams, ransomware, and social engineering tactics are only getting more sophisticated. In this interview with Gaidar Magdanurov, President of Acronis, we explore the latest trends in…
APIs and the Demise of Direct Database Access: A Safer World?
When they’re building an application, developers have to consider how that application will connect to the data sources that will help it function. To date, the most common options have been to build and use an API that connects to…
Iranian “Dream Job” Cyber Campaign Targets Aerospace Sector
In a new and sophisticated cyber campaign dubbed the “Iranian Dream Job Campaign,” the Iranian threat group TA455 is using deceptive job offers to infiltrate the aerospace industry, ClearSky Cyber Security reported. The campaign relies on distributing SnailResin malware, which…
Google Debuts Online Fraud and Scams Advisory
Google has launched a regular fraud and scams advisory to combat the growing volume and sophistication of online scams. Multinational crime entities are increasingly using advanced technology and complex schemes to target victims worldwide. To protect users and the broader…
Ransomware Attacks on Healthcare Sector Surge in 2024
Ransomware attacks on the healthcare sector surged in 2024, analysis from SafetyDetectives reveals. The year has already seen 264 attacks on healthcare providers by September, nearly surpassing the 268 attacks recorded for all of 2023. Escalating Cyber Threats SafetyDetectives argues…
Examining the Role of Asset Recovery in Safeguarding Data: Ten Points IT Professionals Should Know
As cybersecurity threats evolve, it’s become even more important to protect data at every point in its life cycle — including on decommissioned assets that may still hold sensitive information. IT asset recovery, the practice of securely managing retired devices,…
Machine Identities Outnumber Human Ones: 69% of Companies Face Rising Security Risks”
Sixty-nine percent of organizations now manage more machine identities than human ones, with nearly half handling ten times as many. Machine identities—ranging from applications, databases, and bots to IoT devices and SaaS tools—are becoming more prevalent, with nearly three-quarters (72%)…
Cyware Attains FedRAMP Ready Status
Cyware, a provider of threat intelligence management and cyber fusion solutions, has attained Federal Risk and Authorization Management Program (FedRAMP) Ready status. With FedRAMP Ready status, Cyware says it is positioned to accelerate the authorization process, facilitate broader implementation of…
Horizon3.ai Debuts NodeZero Kubernetes Pentesting to Strengthen Critical Infrastructure Defense
Horizon3.ai, a provider of autonomous security solutions, has debuted NodeZero Kubernetes Pentesting, a feature designed to empower entities with advanced offensive security capabilities within Kubernetes environments. Available to all NodeZero users, this tool helps security teams simulate real-world attacks within…
Volt Typhoon Gang and Botnet Re-Emerge Targeting Critical Infrastructure
Volt Typhoon, a stealthy and resilient state-sponsored cyber-espionage group has re-emerged as a severe and silent threat to critical infrastructure worldwide, demonstrating increased sophistication and determination. In January this year, the US Department of Justice said it disrupted the People’s…
Sophisticated Infostealers Top Malware Rankings
Cybercriminals are leveraging increasingly sophisticated attack methods, including the strategic deployment of infostealers, research from Check Point Software’s October 2024 Global Threat Index reveals. The report also notes that the ‘Lumma Stealer’ malware, which leverages fake CAPTCHA pages to infiltrate…
New Tool “GoIssue” Unleashes Advanced Phishing Threat to GitHub Users
A newly discovered tool named “GoIssue,” marketed on a prominent cybercrime forum, is bringing fresh concerns to the cybersecurity community with its ability to mine email addresses from GitHub profiles and send bulk phishing emails to targeted inboxes. Discovered by…
New Wave of Phishing Attacks Exploits Microsoft Visio Files for Two-Step Credential Theft
Researchers at cybersecurity firm Perception Point have identified a new type of two-step phishing attack that exploits Microsoft Visio files (.vsdx) and Microsoft SharePoint. This strategy uses the .vsdx format to embed malicious URLs, effectively bypassing conventional security measures and…
New Phishing Campaign Delivers Advanced Remcos RAT Variant
Fortinet’s FortiGuard Labs has uncovered a sophisticated phishing campaign distributing a new variant of the Remcos Remote Access Trojan (RAT). The campaign begins with a phishing email containing a malicious Excel document designed to exploit vulnerabilities and deliver the Remcos…
Six Questions to Ask Your Would-Be SIEM Provider
Gathering and deciphering data insights for usable solutions forms the foundation of a strong cybersecurity strategy. However, organizations are swimming in data, making this task complex. Traditional Security Information and Event Management (SIEM) tools are one method that organizations have…
An Ultimate Guide to Exchange Server Database Recovery
Databases in Exchange Server play a crucial role in the smooth functioning of an organization as all the critical information, such as emails, contacts, tasks, notes, calendars, etc., is stored in them. Sometimes, databases become corrupted due to server failure…
Malicious PyPI Package Steals AWS Credentials
A malicious package on the Python Package Index (PyPi) has been quietly exfiltrating Amazon Web Service credentials from developers for over three years, a new report from cybersecurity researchers at Socket has revealed. The package “fabrice” is a typosquat of the…
Ciso Playbook: Cyber Resilience Strategy
In this era of advanced technology, cyber threats are on the rise, and they’re evolving with cutting-edge finesse. As we continue to witness a rise in the frequency and sophistication of cyber-attacks, recent hacker incursions into high-profile enterprises like Equifax, Uber, Facebook, and Capital…
Credential Abuse Market Flourishes Despite Setbacks
Despite the recent takedown of the RedLine malware variant and a crackdown on “problematic” Telegram content, the credential abuse market is as vibrant as ever. This was revealed by new research from ReliaQuest. According to the company, cybercriminals appear undeterred by…
Large-Scale Phishing Campaign Exposed Using New Version of Rhadamanthys Malware
Check Point Research has uncovered a sophisticated phishing campaign that uses a newly updated version of the Rhadamanthys Stealer, a notorious malware that steals sensitive data from infected systems. The campaign, identified as “Rhadamanthys.07,” deceives victims through emails that appear…
Network Penetration Testing in the Age of Automation: A Conversation with an Ethical Hacker
For decades, businesses have employed penetration testing, simulating cyberattacks on their IT systems—to uncover vulnerabilities that hackers could exploit. Traditionally, this process was manual, requiring skilled professionals to probe defenses meticulously, look for any chink in the security armor, and…
New Malware Campaign Targets Windows Users Through Gaming Apps
A new malware strain, Winos4.0, is actively used in cyberattack campaigns. Discovered by FortiGuard Labs, this advanced malicious framework, which evolved from the infamous Gh0strat, is equipped with modular components enabling a range of malicious activities on compromised devices. These…
JFrog Uncovers Critical Vulnerabilities in Machine Learning Platforms
Software supply chain company JFrog revealed on Monday that it had discovered 22 software vulnerabilities across 15 machine learning-related open-source software projects. The results, presented in JFrog’s latest ML Bug Bonanza blog, shed light on the security challenges organizations face…
Fry Another Day: The Hidden Surveillance Powers of Smart Appliances
A new investigation by the consumer advocacy group Which? reveals a worrying trend: everyday smart devices, from air fryers to televisions, are collecting excessive amounts of user data, often with no clear explanation or transparency on how it will be…
Google Cloud to Mandate Multi-Factor Authentication for All Users by 2025
In a move to improve account security, Google Cloud has announced that it will require multi-factor authentication (MFA) for all users worldwide by the end of 2025. This decision aims to enhance security, especially as cloud environments become increasingly vulnerable…
CISA’s Cyber Hygiene Services
We all know CISA as the governing agency for federal cybersecurity and the national operating hub for critical infrastructure security. But what are the free critical cyber hygiene services provided by the Cybersecurity and Infrastructure Security Agency (CISA), and how…
Google’s Big Sleep AI Tool Finds Zero-Day Vulnerability
In a major breakthrough, Google’s AI-powered research tool, Big Sleep, discovered a vulnerability in SQLite, one of the most widely used database engines in the world. The Google Project Zero and Google DeepMind teams recently shared this milestone in an…
Attackers Exploit DocuSign API to Send Fraudulent Invoices, Bypassing Security Filters
Attackers are leveraging DocuSign’s API to distribute authentic-looking invoices at scale, exploiting legitimate business channels to bypass traditional security measures. Using paid DocuSign accounts and customized templates, malefactors mimic reputable companies, such as Norton, to send convincing invoices through the…
500,000 Affected in Columbus Data Breach, Followed by Lawsuit Against Security Researcher
In July 2024, the City of Columbus, Ohio, experienced a ransomware attack that exposed the personal information of approximately 500,000 residents. While officials quickly took systems offline to contain the incident and reported halting the attack before ransomware encryption could…
AI & API Security
Artificial Intelligence (AI) and Application Programming Interfaces (APIs) are integral to technological advancement in today’s digital age. As gateways allowing different software applications to communicate, APIs are crucial in AI’s evolution, powering everything from cloud computing to machine learning models.…
Proactive Ways To Bridge The Cybersecurity Talent Gap
The need for robust cybersecurity measures has never been greater in a time when cyber threats are evolving rapidly, and breaches have become an inevitability for businesses in every sector. Managing this complex threat landscape requires advanced solutions and skilled experts who…
Advanced Variant of FakeCall Malware Targets Mobile Users with Sophisticated Vishing Attacks
Mobile security company Zimperium’s zLabs team has uncovered an advanced variant of the FakeCall malware that employs “Vishing” (voice phishing) to deceive mobile users into sharing sensitive information, such as login credentials and banking details. This sophisticated malware campaign highlights…
Microsoft Warns of Major Credential Theft by Chinese Hackers Via Covert Network Attacks
Since August last year, Microsoft has identified a surge in intrusion activity with attackers using sophisticated password spray techniques to steal credentials from multiple customers. The company has linked this wave of attacks to a network of compromised devices known…
The Invisible Shield: Beyond Wrap-around Cyber Protection
Cyber threats are evolving at an unprecedented pace. AI-driven malware, sophisticated phishing schemes, and adaptive attack methods are outmaneuvering standard security measures. Traditional defenses are no longer sufficient. Businesses need an invisible shield that offers comprehensive, proactive protection to stay…
Redline Stealer Dominates: VIPRE’s Q3 Report Highlights Sophisticated BEC Tactics and Evolving Malware Trends
VIPRE Security Group’s Q3 2024 Email Threat Trends Report reveals the increasing sophistication of email-based threats, particularly business email compromise (BEC) and malspam campaigns, which have intensified across industries. Analyzing 1.8 billion emails globally, of which 208 million were identified…
Russian Actor Midnight Blizzard Conducts Massive Spear-Phishing Campaign Using RDP Files
Microsoft Threat Intelligence has issued an alert following the detection of a sophisticated spear-phishing campaign orchestrated by the Russian threat actor known as Midnight Blizzard. Active since 22 October this year, this operation has distributed spear-phishing emails aimed at government…
A Halloween Haunting: Unveiling Cybersecurity’s Scary Stats
This Halloween, it’s not just ghosts and goblins sending chills down our spines—this season brings some truly spine-tingling stats about the state of cybersecurity in 2024. In our “Spooky Security Stats” roundup, we’re revealing findings from several reports published over…
3 Key DSPM Takeaways from the Latest Gartner Report
Data Security Posture Management (DSPM) is a rising star in the cybersecurity world, and for good reason. With so many diverse environments, complex pipelines, and random repositories, important data often ends up in the wrong places, or worse – lost…
US Joins International Crackdown on RedLine and META Infostealers
The US Department of Justice, in collaboration with international law enforcement partners, has launched a major crackdown on RedLine and META, two of the world’s most prolific infostealer malware variants responsible for stealing sensitive data from millions of victims worldwide.…
Cyware and ECS Partner to Enhance Government Cybersecurity with Advanced Threat Intel Exchange
Cyware, a provider of threat intelligence management and cyber fusion solutions, has teamed up with ECS, a player in technology solutions for US public sector and defense organizations, to bolster government cybersecurity through an enhanced Intel Exchange platform. This partnership…
Malicious npm Packages Found to Distribute BeaverTail Malware
Three malicious packages uploaded to the npm registry were discovered to harbor BeaverTail, a JavaScript downloader and information stealer associated with a continuing North Korean campaign known as Contagious Interview. The packages—passports-js, bcrypts-js, and blockscan-api collectively amassed 323 downloads, and…
Combatting Human Error: How to Safeguard Your Business Against Costly Data Breaches
It’s no secret that human error accounts for a disproportionate number of data breaches. Last year, it accounted for 74%; this year, the Verizon 2024 Data Breach Investigations Report noted that it rose to 76% per the same criteria. States…
Enhancing Email Security: The Pivotal Role of AI in Defending Against Evolving Cyber Threats
Malware‘s rise presents a rigorous challenge for organizations, meaning their security teams must remain ever-vigilant. Unfortunately, business email compromise (BEC), which takes advantage of communication channel vulnerabilities, has become a significant attack vector that has impacted many organizations. For example,…
Safely Scale Your Data Center With These Five Cybersecurity Measures
Datacenter cybersecurity is critical because of the vast industries using these facilities. Healthcare, finance, education, and other sectors rely on this storage solution to protect records and sensitive information. Companies may adjust their storage needs based on demand, so understanding…
US Energy Sector Faces Growing Cybersecurity Threats
A recent cybersecurity report by SecurityScorecard and KPMG reveals that the US energy sector remains at high risk of cyber threats, particularly from third-party sources. This analysis, evaluating 250 top US energy companies, highlights vulnerabilities across the energy supply chain—from…
A Dangerous Alliance: Scattered Spider, RansomHub Join Forces
ReliaQuest has released a detailed investigation into a cyber intrusion that impacted a manufacturing company in October 2024. The attack has been attributed with high confidence to the predominantly English-speaking cyber collective “Scattered Spider,” now partnering with the notorious “RansomHub”…
Cybersecurity Awareness Month 2024: Wrapping Up with Actionable Insights to Secure Our World
As we wrap up our Cybersecurity Awareness Month series, we’d like to extend a huge thank you to everyone who contributed their insights and expertise. The response to this series has been incredible, and we’re grateful for the valuable advice…
WhatsApp Debuts New Features for Contact Management with Enhanced Privacy Protections
WhatsApp is rolling out a series of updates aimed at making it easier for users to manage their contacts privately across devices. Previously, users could only add contacts via their mobile device by entering a phone number or scanning a…
The Lazarus APT Strikes Again: New Zero-Day Exploit Targets Investors through DeFi Games
In a new and sophisticated campaign, the infamous North Korean-affiliated Lazarus APT group and its BlueNoroff subgroup have once again proven their expertise in exploiting zero-day vulnerabilities. The group, known for targeting financial institutions, governments, and even cryptocurrency platforms, has…
CISA Proposes New Security Measures to Safeguard Sensitive Data from Adversary States
The US Cybersecurity and Infrastructure Security Agency (CISA) has announced a set of proposed security requirements aimed at protecting Americans’ sensitive personal data and government-related information from foreign adversaries. These measures are part of the implementation of Executive Order 14117,…
Five Ways to Improve Your Security Posture, Fast
Cybersecurity has become a critical concern for businesses of all sizes. With cyber threats becoming more sophisticated and frequent, the cost of cybersecurity breaches continues to rise dramatically. In fact, the Netwrix 2024 Hybrid Security Trends Report found that 79% of organizations…
Cyber Attackers Set Their Sights on the Manufacturing Industry
The manufacturing industry has emerged as the most targeted by cyber attacks, accounting for more than 25% of incidents across the top 10 sectors, with 45% of these involving malware. The industry’s appeal to malefactors has grown, largely due to…
Attackers Exploit Roundcube Webmail Vulnerability
Cybersecurity experts from Positive Technologies’ Security Expert Center (PT ESC) have uncovered an exploit targeting Roundcube Webmail, an open-source email client written in PHP. According to the researchers, Roundcube’s “extensive functionality and the convenient access it gives users to email accounts via a browser—without the…
Cyber Attackers Set Their Sights on Manufacturing
The manufacturing industry has emerged as the most targeted by cyber attacks, accounting for more than 25% of incidents across the top 10 sectors, with 45% of these involving malware. The industry’s appeal to malefactors has grown, largely due to…
Google Mandiant: Time-to-Exploit Falls, Zero Day Exploits Rise
A staggering 70% of exploited vulnerabilities in 2023 were leveraged as zero days, meaning threat actors exploited the flaws in attacks before the impacted vendors knew of the bug’s existence or had been able to patch them. In addition, the…
NHS App to Provide Full Medical Records Under Digital Overhaul Plan
The NHS App is set to undergo a major transformation, with plans to make full medical records, test results, and doctor’s letters accessible to patients across England. This initiative is part of a new 10-year strategy aimed at revolutionizing how…
Nearly half (44%) of CISOs Fail to Detect Breaches
A staggering 44% of CISOs were unable to detect a data breach in the last 12 months using existing security tools. Moreover, nearly three-quarters (70%) of CISOs feel their current security tools are ineffective at detecting breaches due to limited…
Fortra Report Reveals Surge in Domain Impersonation, Social Media Attacks, and Dark Web Activity
Fortra’s Q2 2024 report has unveiled a series of concerning trends in the digital threat landscape, analyzing hundreds of thousands of attacks on enterprises, their employees, and brands across domains, social media, counterfeit websites, and the dark web. The findings…
These 7 Practices Are Building Cybersecurity Safeguards in the Construction Industry
Cybersecurity is becoming necessary across multiple industries as they adapt to a technologically driven society. Construction is a perfect example, as most operations a decade ago would consist of human labor. Technological advancements explicitly built for the sector — like…
ConfusedPilot Exposes Vulnerability in AI Systems Used by Major Enterprises
A novel attack, dubbed ConfusedPilot, has been discovered, targeting widely used Retrieval Augmented Generation (RAG)-based AI systems such as Microsoft 365 Copilot. This method allows malicious actors to manipulate AI-generated responses by introducing malicious content into documents referenced by these…
Building Digital Resilience: Insider Insights for a Safer Cyber Landscape
Due to the tremendous feedback we received on our first two articles, which shared invaluable cybersecurity advice from industry experts, we’re excited to continue the series with even more insights. In this third installment, we delve deeper into the theme…
The Battle for Identity Security: Key Insights from the ManageEngine Identity Security Survey 2024
Identity management, particularly privileged identity management, forms the backbone of an effective cybersecurity strategy. The ManageEngine Identity Security Survey 2024 sheds light on the current state of identity management, gathering insights from security decision-makers worldwide. The Importance of Identity Management…
AI Companies Are Not Meeting EU AI Act Standards
Leading artificial intelligence (AI) models are failing to meet key European regulatory standards in areas such as cybersecurity resilience and prevention of discriminatory outputs, according to data obtained by Reuters. The EU AI Act is being implemented in phases over…
Iranian Cyber Actors Compromise Critical Infrastructure Using Brute Force and Credential Access Tactics
Iranian cyber actors are targeting organizations across critical infrastructure sectors, using brute force techniques to obtain user credentials and sell sensitive information on cybercriminal forums. The attacks have affected healthcare, government, information technology, engineering, and energy sectors. This was announced…
Stronger Together: AI and Human Collaboration in the Battle Against Evolving Threats
Sophisticated and complex threats fuel rapid and profound change in the cybersecurity landscape. Malicious actors are exploiting advanced technologies, like artificial intelligence (AI), to launch more targeted, destructive attacks that are harder to detect. As yesterday’s security solutions battle to…
Chinese Researchers Use Quantum Computer to Hack Secure Encryption
In a potentially concerning advancement for global cybersecurity, Chinese researchers have introduced a technique leveraging D-Wave’s quantum annealing systems to breach traditional encryption, which may hasten the timeline for when quantum computers could pose a genuine threat to widely used…
E.U. Court Restricts Meta’s Use of Facebook Data for Targeted Advertising
The Court of Justice for the European Union (CJEU) has ruled that Meta Platforms, the owner of Facebook, must minimize the amount of people’s data it uses for personalized advertising. “An online social network such as Facebook cannot use all…
New Threat Actor Tool EDRSilencer Repurposed for Malicious Use
The Trend Micro Threat Hunting Team has identified an alarming new trend in cyber attacks: malefactors are adopting EDRSilencer, a red team tool designed to interfere with endpoint detection and response (EDR) systems. Originally developed as a tool for security…
Enhance Cyber Resilience to Secure Your Organization
As Cybersecurity Awareness Month unfolds with the continuing theme from 2023, “Secure Our World,” it’s a timely reminder of the importance of taking daily actions to safeguard your organization’s digital ecosystem. In an increasingly interconnected world, where devices, data, and…
TrickMo’s Latest Trick – Stealing PINs and Unlock Patterns
Mobile device and app security firm Zimperium has discovered a new capability in the notorious banking Trojan TrickMo. Some of the samples the company analyzed are able to steal a device’s unlock pattern or PIN. This new feature enables the…
Veeam Vulnerability Actively Exploited by Ransomware Gangs
NHS England’s National Cyber Security Operations Centre (CSOC) has issued a high-severity cyber alert in response to the active exploitation of a critical vulnerability, CVE-2024-40711, in Veeam’s Backup & Replication software. This alert follows Veeam’s security bulletin from September, which…
Check Point’s threat index emphasizes the shift towards AI-driven malware tactics in the current cyber landscape
Several interesting trends are emerging in the cybersecurity landscape, particularly the emergence of artificial intelligence (AI)-driven malware, as well as the ongoing dominance of ransomware threats. Threat actors have started using GenAI as part of their attack infrastructure, which illustrates…
OpenAI says bad actors are using ChatGPT to write malware, sway elections
Cybercriminals are increasingly exploiting OpenAI’s model, ChatGPT, to carry out a range of malicious activities, including malware development, misinformation campaigns, and spear-phishing. A new report revealed that since the beginning of 2024, OpenAI has disrupted over 20 deceptive operations worldwide,…
4 Frightening Things Coming for Security this Season
As we strive to “Secure Our World” this Cybersecurity Awareness Month, a few irrepressible haunts keep rearing their ugly heads. Here are some of the most malicious monsters hiding under our proverbial cybersecurity beds and what we need to know…
What is Digital Assurance and Why It’s Crucial in Today’s Business Landscape
Today’s businesses must navigate evolving technologies, customer expectations, and security threats. Digital assurance is emerging as a pillar of this transformation, ensuring that enterprises can mitigate risks, deliver reliable systems, and create long-term business value. Digital assurance is a key…
The “Mongolian Skimmer” Uses Unicode to Conceal Its Malicious Intent
Researchers at Jscrambler have uncovered a new skimming campaign dubbed the “Mongolian Skimmer.” This malware, initially detected through intelligence shared by Sansec, distinguishes itself through its use of unusual Unicode characters to obfuscate JavaScript code. Although at first glance, this…
31 Million Records Exposed Online by Sports Technology Company TrackMan
A whopping almost 32 million records and around 110 TB of data belonging to tech users from Trackman were left exposed to the internet. The database exposed user names, email addresses, device information, IP addresses, and security tokens. They were…
The Hidden Price of DevSecOps: How Security Tasks Are Sapping Developer Productivity and Jeopardizing Competitive Edge
Developers are spending significantly more time, and companies are spending 28K per developer each year on security-related tasks, such as manual application scan reviews, context switching, and secrets detection, among other things. This was revealed by JFrog, the Liquid Software company…
Palo Alto Networks Warns of Exploitable Firewall Hijack Vulnerabilities
Palo Alto Networks has issued an urgent advisory for its customers following the discovery of multiple critical vulnerabilities in its Expedition tool, which assists with firewall configuration migration. The vulnerabilities are as follows: CVE-2024-9463 has a score of 9.9. It’s…
No Silver Bullet, Just Smarter Security: More Expert Tips for Cyber Defense
We had such an overwhelming response to our first article, which shared industry expert opinions during Cybersecurity Awareness Month, that we’ll be publishing another few articles with more expert insights over the next few weeks. Following on with the theme…
Disinformation Campaign Targets Moldova Ahead of Presidential Elections and EU Membership Referendum
A cyber-enabled disinformation campaign, dubbed Operation MiddleFloor, is targeting Moldova’s government and educational sectors, according to Check Point Research. The campaign began in early August and appears to have been aimed at influencing the country’s presidential elections on 20 October,…
Password Basics: Why Mastering Fundamentals Is Crucial in Today’s Complex Cybersecurity Landscape
It’s often said, but worth repeating: In cybersecurity, we simply cannot afford to neglect the basics. Focus has increasingly shifted to the ‘scarier’ threats posed by Artificial Intelligence (AI) and other disruptive technologies, and many have been overlooking the basics…
Report Highlights Escalating Security Challenges Amid Swift AI Adoption
In the dynamic world of software development, security challenges are advancing at a rapid pace. Black Duck’s 2024 “Global State of DevSecOps” report examines the evolving trends and concerns in application security, drawing insights from a survey of over 1,000…
Lego Hacked by Crypto-Scammers
Early Saturday morning, Lego’s website briefly fell victim to a crypto scam that advertised a fake Lego coin token. The scam appeared as a banner on the homepage, positioned below an advertisement for Lego’s new Fortnite collaboration, which features building…
From Zero Trust to Full Trust: How Remote Browser Isolation Shields Against Emerging Threats
Cyber threats are ubiquitous and constantly evolving and companies are in dire need of robust defense mechanisms to protect their digital assets and ensure business continuity. Remote Browser Isolation (RBI) technology has emerged as a pivotal solution, offering a unique…
American Water Hit by Cyberattack
American Water, the largest publicly traded water and wastewater utility in the United States, has had to shut down certain systems following a cyberattack. The attack impacted the company’s online customer portal, MyWater, and paused billing services. In its 8-K…
Gorilla Botnet Launches Over 300,000 DDoS Attacks
A newly active botnet, dubbed “Gorilla Botnet,” has unleashed a gargantuan wave of cyberattacks this past September, according to the NSFOCUS Global Threat Hunting System. During a surge in activity from September 4 to September 27, Gorilla Botnet issued more…
VIPRE Introduces All-in-one Endpoint EDR+MDR Package for 24/7 Managed Security
VIPRE Security Group, a cybersecurity, privacy, and data protection company, has debuted a combined VIPRE Endpoint EDR+MDR package. This managed protection package provides organisations of all sizes with cost-effective, advanced, and around-the-clock endpoint security. For managed service providers (MSPs), this…
New DDoS Attack Vector Discovered in CUPS, Exposing 58,000+ Vulnerable Devices Online
Akamai researchers have identified a critical vulnerability in the Common Unix Printing System (CUPS) that could allow malicious actors to initiate powerful distributed denial-of-service (DDoS) attacks with minimal resources. Approximately 58,000 exposed devices are potentially at risk, posing a serious…