News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Articles per day, last 14 days
Most articles on Wed 21 Oct (96); 10–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
- Closed-day average
Show as tableHide table
| Day | Articles | On CISA KEV CVEs |
|---|---|---|
| Tue 13 Oct | 85 | 11 |
| Wed 14 Oct | 86 | 25 |
| Thu 15 Oct | 78 | 15 |
| Fri 16 Oct | 61 | 12 |
| Sat 17 Oct | 10 | 1 |
| Sun 18 Oct | 10 | 0 |
| Mon 19 Oct | 60 | 12 |
| Tue 20 Oct | 86 | 16 |
| Wed 21 Oct | 96 | 18 |
| Thu 22 Oct | 84 | 11 |
| Fri 23 Oct | 68 | 16 |
| Sat 24 Oct | 13 | 4 |
| Sun 25 Oct | 13 | 2 |
| Mon 26 Oct | 75 | 20 |
| Today, Tue 27 Oct | 93 so far | 18 |
Developing
Wed 17 Apr 202465 articles
- SoumniBot malware exploits Android bugs to evade detection
A new Android banking malware named 'SoumniBot' is using a less common obfuscation approach by exploiting weaknesses in the Android manifest extraction and parsing procedure. [...]
BleepingComputer - Hackers hijack OpenMetadata apps in Kubernetes cryptomining attacks
In an ongoing Kubernetes cryptomining campaign, attackers target OpenMetadata workloads using critical remote code execution and authentication vulnerabilities. [...]
BleepingComputer - FIN7 targets American automaker’s IT staff in phishing attacks
The financially motivated threat actor FIN7 targeted a large U.S. car maker with spear-phishing emails for employees in the IT department to infect systems with the Anunak backdoor. [...]
BleepingComputer - Dangerous ICS Malware Targets Orgs in Russia and Ukraine
"Kapeka" and "Fuxnext" are the latest examples of malware to emerge from the long-standing conflict between the two countries.
Dark Reading - Should you share your location with your partner?
Every relationship has its disagreements. Who takes out the trash and washes the dishes? Who plans the meals and writes out the grocery list? And when is it okay to start tracking one another’s location? Location sharing is becoming the norm between romantic…
Malwarebytes - Active Kubernetes RCE Attack Relies on Known OpenMetadata Vulns
Once attackers have control over a workload in the cluster, they can leverage access for lateral movement both inside the cluster and to external resources.
Dark Reading - Kapeka: A New Backdoor in Sandworm’s Arsenal of Aggression
Kapeka is a new backdoor that may be a new addition to Russia-link Sandworm’s malware arsenal and possibly a successor to GreyEnergy.
SecurityWeek - Moldovan charged for operating botnet used to push ransomware
The U.S. Justice Department charged Moldovan national Alexander Lefterov, the owner and operator of a large-scale botnet that infected thousands of computers across the United States. [...]
BleepingComputer - Ivanti Releases Fixes for More Than 2 Dozen Vulnerabilities
Users will need to download the latest version of Ivanti's Avalanche to apply fixes for all of the bugs.
Dark Reading - Linux variant of Cerber ransomware targets Atlassian servers
Threat actors are exploiting the CVE-2023-22518 flaw in Atlassian servers to deploy a Linux variant of Cerber (aka C3RB3R) ransomware. At the end of October 2023, Atlassian warned of a critical security flaw, tracked as CVE-2023-22518 (CVSS score...
Security Affairs - Cisco discloses root escalation flaw with public exploit code
Cisco has released patches for a high-severity Integrated Management Controller (IMC) vulnerability with public exploit code that can let local attackers escalate privileges to root. [...]
BleepingComputer - Russian Sandworm hackers pose as hacktivists in water utility breaches
The Sandworm hacking group associated with Russian military intelligence has been hiding attacks and operations behind multiple online personas posing as hacktivist groups. [...]
BleepingComputer - Xiid SealedTunnel: Unfazed by Yet Another Critical Firewall Vulnerability (CVE-2024-3400)
In the wake of the recent disclosure of a critical vulnerability (CVE-2024-3400) affecting a leading firewall solution, Xiid Corporation reminds organizations that Xiid SealedTunnel customers remain secure. This latest vulnerability, currently unpatched and…
gbhackers.com - CVE-2024-21006 in Oracle WebLogic Server – Oracle’s April 2024 Update Brings 441 New Security Patches
CVE-2024-21006 in Oracle WebLogic Server – Oracle’s April 2024 Update Brings 441 New Security Patches Oracle has released its Critical Patch Update advisory for April 2024, which addresses vulnerabilities across multiple products. This update includes 441…
SOCRadar - Miggo Security Gets $7.5 Million Seed Funding to Build ADR Technology
YL Ventures leads an early stage funding round for Miggo Security, a Tel Aviv startup working on application detection and response technology.
SecurityWeek - Various Botnets Pummel Year-Old TP-Link Flaw in IoT Attacks
Moobot, Miori, AGoent, and a Gafgyt variant have joined the infamous Mirai botnet in attacking unpatched versions of vulnerable Wi-Fi routers.
Dark Reading - Armis Acquires Silk Security for $150 Million
Armis has acquired cyber risk prioritization and remediation company Silk Security for $150 million.
SecurityWeek - Dark Web Monitoring: What's the Value?
Cybersecurity firms commonly sell "dark web monitoring" packages, with firms having slighly different features. Learn from Flare about the different dark web monitoring packages and the value they bring to your organization. [...]
BleepingComputer - Preparing for Cyber Warfare: 6 Key Lessons From Ukraine
Having a solid disaster recovery plan is the glue that keeps your essential functions together when all hell breaks loose.
Dark Reading - Committing a Sin, OpenJS Foundation and XZ Utils Incidents: Lessons in Open Source Security
Committing a Sin, OpenJS Foundation and XZ Utils Incidents: Lessons in Open Source Security Recent events have brought to light critical issues related to cybersecurity threats and social engineering tactics. The attempted backdoor incident involving XZ…
SOCRadar - Russian APT Deploys New 'Kapeka' Backdoor in Eastern European Attacks
A previously undocumented "flexible" backdoor called Kapeka has been "sporadically" observed in cyber attacks targeting Eastern Europe, including Estonia and Ukraine, since at least mid-2022. The findings come from Finnish cybersecurity firm WithSecure,…
The Hacker News - Multiple botnets exploiting one-year-old TP-Link flaw to hack routers
At least six distinct botnet malware operations are hunting for TP-Link Archer AX21 (AX1800) routers vulnerable to a command injection security issue reported and addressed last year. [...]
BleepingComputer - Cerber Linux Ransomware Exploits Atlassian Servers to Take Full Control
Security researchers at Cado Security Labs have uncovered a new variant of the Cerber ransomware targeting Linux systems. This strain of the notorious malware has been observed exploiting a recent vulnerability in the Atlassian Confluence application to gain…
gbhackers.com - What should Security Operations teams take away from the IBM X-Force 2024 Threat Intelligence Index?
The IBM X-Force 2024 Threat Intelligence Index has been released. The headlines are in and among them are the fact that a global identity crisis is emerging. X-Force noted a 71% increase year-to-year in attacks using valid credentials. In this blog post,…
securityintelligence.com - Cisco: Multiple VPN, SSH Services Targeted in Mass Brute-Force Attacks
Cisco has observed an increase in brute-force attacks targeting web application authentication, VPNs, and SSH services.
SecurityWeek - Why a Native-First Approach Is Key to Cloud Security
A native-first approach delivers better protections and a more efficient use of resources than best-of-breed solutions, benefiting cloud service providers and end-user customers.
Dark Reading - FGVulDet – New Vulnerability Detector to Analyze Source Code
Detecting source code vulnerabilities aims to protect software systems from attacks by identifying inherent vulnerabilities. Prior studies often oversimplify the problem into binary classification tasks, which poses challenges for deep learning models to…
gbhackers.com - Ivanti Patches 27 Vulnerabilities in Avalanche MDM Product
Ivanti releases patches for 27 vulnerabilities in the Avalanche MDM product, including critical flaws leading to command execution.
SecurityWeek - North Korean Hackers Abuse DMARC To Legitimize Their Emails
DMARC is targeted by hackers as this serves to act as a preventative measure against email spoofing and phishing attempts. They compromise DMARC (Domain-based Message Authentication Reporting and Conformance) so that they can evade email authentication…
gbhackers.com - Microsoft: New Copilot app added by Edge doesn’t collect data
Microsoft says the new Copilot app, added by recent Edge updates to the list of installed Windows apps, doesn't collect or relay data to its servers. [...]
BleepingComputer - Microsoft: Copilot ‘app’ on Windows Server mistakenly added by Edge
Microsoft says the new Copilot app, mistakenly added to the list of installed Windows apps by recent Edge updates, doesn't collect or relay data to its servers. [...]
BleepingComputer - Chrome 124, Firefox 125 Patch High-Severity Vulnerabilities
Chrome and Firefox security updates resolve over 35 vulnerabilities, including a dozen high-severity bugs.
SecurityWeek - Ivanti Avalanche Received an Update for Over Two Dozen Vulnerabilities (CVE-2024-24996, CVE-2024-29204…)
Ivanti Avalanche Received an Update for Over Two Dozen Vulnerabilities (CVE-2024-24996, CVE-2024-29204…) Ivanti has recently issued security updates to address multiple vulnerabilities in Avalanche. These vulnerabilities, ranging from medium to critical…
SOCRadar - Recent OT and Espionage Attacks Linked to Russia’s Sandworm, Now Named APT44
Mandiant summarizes some of the latest operations of Russia’s notorious Sandworm group, which it now tracks as APT44.
SecurityWeek - L00KUPRU Ransomware Attackers discovered in the wild
A new variant of the Xorist ransomware, dubbed L00KUPRU, has been discovered in the wild, posing a threat to unsuspecting users. The L00KUPRU ransomware is known to encrypt user files, appending the .L00KUPRU extension to the affected files. The attackers…
gbhackers.com - GenAI: A New Headache for SaaS Security Teams
The introduction of Open AI’s ChatGPT was a defining moment for the software industry, touching off a GenAI race with its November 2022 release. SaaS vendors are now rushing to upgrade tools with enhanced productivity capabilities that are driven by…
The Hacker News - Critical Atlassian Flaw Exploited to Deploy Linux Variant of Cerber Ransomware
Threat actors are exploiting unpatched Atlassian servers to deploy a Linux variant of Cerber (aka C3RB3R) ransomware. The attacks leverage CVE-2023-22518 (CVSS score: 9.1), a critical security vulnerability impacting the Atlassian Confluence Data Center and…
The Hacker News - Oracle Releases Biggest Security Update in 2024 – 372 Vulnerabilities Are Fixed – Update Now!
Oracle has released its April 2024 Critical Patch Update (CPU), addressing 372 security vulnerabilities across multiple Oracle products. This comprehensive update fixes critical flaws that could allow remote code execution, data manipulation, and…
gbhackers.com - Ivanti fixed two critical flaws in its Avalanche MDM
Ivanti addressed two critical vulnerabilities in its Avalanche mobile device management (MDM) solution, that can lead to remote command execution. Ivanti addressed multiple flaws in its Avalanche mobile device management (MDM) solution, including two…
Security Affairs