News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Articles per day, last 14 days
Most articles on Wed 21 Oct (96); 10–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
- Closed-day average
Show as tableHide table
| Day | Articles | On CISA KEV CVEs |
|---|---|---|
| Wed 14 Oct | 86 | 25 |
| Thu 15 Oct | 78 | 15 |
| Fri 16 Oct | 61 | 12 |
| Sat 17 Oct | 10 | 1 |
| Sun 18 Oct | 10 | 0 |
| Mon 19 Oct | 60 | 12 |
| Tue 20 Oct | 86 | 16 |
| Wed 21 Oct | 96 | 18 |
| Thu 22 Oct | 84 | 11 |
| Fri 23 Oct | 68 | 16 |
| Sat 24 Oct | 13 | 4 |
| Sun 25 Oct | 13 | 2 |
| Mon 26 Oct | 76 | 20 |
| Tue 27 Oct | 95 | 18 |
| Today, Wed 28 Oct | 4 so far | 1 |
Developing
Fri 19 Apr 202446 articles
- The Week in Ransomware - April 19th 2024 - Attacks Ramp Up
While ransomware attacks decreased after the LockBit and BlackCat disruptions, they have once again started to ramp up with other operations filling the void. [...]
BleepingComputer - CrushFTP warns users to patch exploited zero-day “immediately”
CrushFTP warned customers today in a private memo of an actively exploited zero-day vulnerability fixed in new versions released today, urging them to patch their servers immediately. [...]
BleepingComputer - MITRE revealed that nation-state actors breached its systems via Ivanti zero-days
The MITRE Corporation revealed that a nation-state actor compromised its systems in January 2024 by exploiting Ivanti VPN zero-days. In April 2024, MITRE disclosed a security breach in one of its research and prototyping networks. The security team at the…
Security Affairs - CISO Corner: Breaking Staff Burnout, GPT-4 Exploits, Rebalancing NIST
SecOps highlights this week include the executive role in "cyber readiness;" Cisco's Hypershield promise; and Middle East cyber ops heat up.
Dark Reading - FBI Director Wray Issues Dire Warning on China's Cybersecurity Threat
Chinese actors are ready and poised to do "devastating" damage to key US infrastructure services if needed, he said.
Dark Reading - HelloKitty ransomware rebrands, releases CD Projekt and Cisco data
An operator of the HelloKitty ransomware operation announced they changed the name to 'HelloGookie,' releasing passwords for previously leaked CD Projekt source code, Cisco network information, and decryption keys from old attacks.. [...]
BleepingComputer - MITRE says state hackers breached its network via Ivanti zero-days
The MITRE Corporation says a state-backed hacking group breached its systems in January 2024 by chaining two Ivanti VPN zero-days. [...]
BleepingComputer - UNDP, City of Copenhagen Targeted in Data-Extortion Cyberattack
A ransomware gang claimed responsibility for the attack, though it is unknown if a ransom was demanded or paid.
Dark Reading - United Nations agency investigates ransomware attack, data theft
The United Nations Development Programme (UNDP) is investigating a cyberattack after threat actors breached its IT systems to steal human resources data. [...]
BleepingComputer - Multiple LastPass Users Lose Master Passwords to Ultra-Convincing Scam
CryptoChameleon attackers trade quantity for quality, dedicating time and resources to trick even the most diligent user into handing over their high-value credentials.
Dark Reading - Rethinking How You Work With Detection and Response Metrics
Airbnb's Allyn Stott recommends adding the Human Maturity Model (HMM) and the SABRE framework to complement MITRE ATT&CK to improve security metrics analysis.
Dark Reading - BreachRx Raises $6.5M to Revamp Incident Response Reporting Systems
Investors make an early-stage $6.5 million bet on BreachRx, a startup promising to shield cybersecurity executives from personal liability.
SecurityWeek - 22,500 Palo Alto firewalls "possibly vulnerable" to ongoing attacks
Approximately 22,500 exposed Palo Alto GlobalProtect firewall devices are likely vulnerable to the CVE-2024-3400 flaw, a critical command injection vulnerability that has been actively exploited in attacks since at least March 26, 2024. [...]
BleepingComputer - Threat-Intelligence Startup VulnCheck Closes $8M Seed Financing
VulnCheck banks $8 million in early stage capital to build 'exploit intelligence' technologies and services.
SecurityWeek - AI Lowers Barrier for Cyber-Adversary Manipulation in 2024 Election
Securing the presidential election requires vigilance and hardened cybersecurity defenses.
Dark Reading - BlackTech Targets Tech, Research, and Gov Sectors New 'Deuterbear' Tool
Technology, research, and government sectors in the Asia-Pacific region have been targeted by a threat actor called BlackTech as part of a recent cyber attack wave. The intrusions pave the way for an updated version of modular backdoor dubbed Waterbear a...
The Hacker News - Dark Web Profile: Akira Ransomware
Dark Web Profile: Akira Ransomware Since its discovery in early 2023, Akira ransomware has evolved from a seemingly ordinary addition to the ransomware landscape to a significant threat affecting a wide range of businesses and critical infrastructure…
SOCRadar - In Other News: OSS Backdooring Attempts, Botnet Operator Charged, Automotive Firm Attack
Noteworthy stories that might have slipped under the radar: OpenSSF and OpenJS incidents similar to XZ backdoor, Moldovan botnet operator charged, US automotive company targeted by FIN7.
SecurityWeek - test draftt
TestTestTestTestTest TestTestTestTestTest TestTestTestTestTest TestTestTestTestTest TestTestTestTestTest TestTestTestTestTest TestTestTestTestTest TestTestTestTestTest TestTestTestTestTest TestTestTestTestTest TestTestTestTestTest TestTestTestTestTest…
SOCRadar - First Major Attempts to Regulate AI Face Headwinds From All Sides
While over 400 AI-related bills are being debated this year in statehouses nationwide, most target one industry or just a piece of the technology — such as deepfakes used in elections.
SecurityWeek - US Government Releases Guidance on Securing Election Infrastructure
New US guidance details foreign malign influence operations to help election infrastructure stakeholders increase resilience.
SecurityWeek - Akira Ransomware Made Over $42 Million in One Year: Agencies
Akira ransomware has hit over 250 organizations worldwide and received over $42 million in ransom payments.
SecurityWeek - In the Crosshairs: Top 10 Threat Actors Targeting the USA
In the Crosshairs: Top 10 Threat Actors Targeting the USA As the digital landscape continues to evolve, the United States finds itself at the forefront of emerging cybersecurity challenges. With its critical infrastructure, extensive government networks, and…
SOCRadar - Frontier Communications Shuts Down Systems Following Cyberattack
Telecom giant Frontier shuts down systems to contain a cyberattack that led to personal information compromise.
SecurityWeek - How Attackers Can Own a Business Without Touching the Endpoint
Attackers are increasingly making use of “networkless” attack techniques targeting cloud apps and identities. Here’s how attackers can (and are) compromising organizations – without ever needing to touch the endpoint or conventional networked systems...
The Hacker News - Akira Ransomware Gang Extorts $42 Million; Now Targets Linux Servers
Threat actors behind the Akira ransomware group have extorted approximately $42 million in illicit proceeds after breaching the networks of more than 250 victims as of January 1, 2024. "Since March 2023, Akira ransomware has impacted a wide range of…
The Hacker News - Akira Ransomware Attacks Over 250 Organizations and Collects $42 Million
The Akira ransomware variant has severely impacted more than 250 organizations worldwide, amassing approximately USD 42 million in ransom payments. This information comes from a detailed joint Cybersecurity Advisory issued by the FBI and the Cybersecurity…
gbhackers.com - Rise of Malicious AI Tools: A Case Study with HackerGPT
Rise of Malicious AI Tools: A Case Study with HackerGPT Artificial intelligence, particularly generative models, has become increasingly prevalent over the past few years. Its impact on the workforce and the future of the job market is undoubtedly…
SOCRadar - CVE-2024-2961 – glibc Vulnerability Opens Door to PHP Attacks: Patch Immediately
A recently discovered flaw in the GNU C Library’s (glibc) iconv function (CVE-2024-2961) carries severe implications for web applications built on PHP. This vulnerability, which allows for out-of-bounds memory writes, could enable remote attackers...
SecurityOnline - 'MagicDot' Windows Weakness Allows Unprivileged Rootkit Activity
Malformed DOS paths in file-naming nomenclature in Windows could be used to conceal malicious content, files, and processes.
Dark Reading - FBI chief says China is preparing to attack US critical infrastructure
China-linked threat actors are preparing cyber attacks against U.S. critical infrastructure warned FBI Director Christopher Wray. FBI Director Christopher Wray warned this week that China-linked threat actors are preparing an attack against U.S. critical…
Security Affairs - OpenMetadata Vulnerabilities Exploited to Abuse Kubernetes Clusters for Cryptomining
Microsoft warns that several OpenMetadata vulnerabilities are being exploited to deploy cryptomining malware to Kubernetes environments.
SecurityWeek - Exploit Code Released for Severe Ivanti Avalanche Vulnerability (CVE-2024-29204)
Exploit code is now available for a critical vulnerability (CVE-2024-29204) that has been identified in Ivanti Avalanche, a widely deployed mobile device management (MDM) solution used by enterprises. This flaw, rated 9.8 on the...
SecurityOnline - United Nations Development Programme (UNDP) investigates data breach
The United Nations Development Programme (UNDP) has initiated an investigation into an alleged ransomware attack and the subsequent theft of data. The United Nations Development Programme (UNDP) is investigating an alleged ransomware attack that resulted in…
Security Affairs - Hackers Target Middle East Governments with Evasive "CR4T" Backdoor
Government entities in the Middle East have been targeted as part of a previously undocumented campaign to deliver a new backdoor dubbed CR4T. Russian cybersecurity company Kaspersky said it discovered the activity in February 2024, with evidence suggesting…
The Hacker News - Cyberattack Takes Frontier Communications Offline
The local phone and business communications company said that attackers accessed unspecified PII, after infiltrating its internal networks.
Dark Reading - Public Exploit Released for Cisco IMC Flaw – Update Immediately to Halt Takeover Attacks
Cisco customers are facing an increased risk of attack as publicly accessible exploit code has emerged for CVE-2024-20356, a critical vulnerability in Cisco’s Integrated Management Controller (IMC). This vulnerability could allow authenticated attackers…
SecurityOnline - Alert! Windows LPE Zero-day Exploit Advertised on Hacker Forums
A new zero-day Local Privilege Escalation (LPE) exploit has been put up for sale on a notorious hacker forum. This exploit, which has not yet been assigned a Common Vulnerabilities and Exposures (CVE) reference, is said to be capable of granting unauthorized…
gbhackers.com - Evil XDR: Researcher Turns Palo Alto Software Into Perfect Malware
It turns out that a powerful security solution can double as even more powerful malware, capable of granting comprehensive access over a targeted machine.
Dark Reading