News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Articles per day, last 14 days
Most articles on Wed 21 Oct (96); 10–14 on weekend days.
- On CISA KEV CVEs
- Other coverage
- Closed-day average
Show as tableHide table
| Day | Articles | On CISA KEV CVEs |
|---|---|---|
| Sun 18 Oct | 10 | 0 |
| Mon 19 Oct | 60 | 12 |
| Tue 20 Oct | 86 | 16 |
| Wed 21 Oct | 96 | 18 |
| Thu 22 Oct | 84 | 11 |
| Fri 23 Oct | 68 | 16 |
| Sat 24 Oct | 13 | 4 |
| Sun 25 Oct | 13 | 2 |
| Mon 26 Oct | 76 | 21 |
| Tue 27 Oct | 95 | 18 |
| Wed 28 Oct | 87 | 16 |
| Thu 29 Oct | 78 | 17 |
| Fri 30 Oct | 69 | 10 |
| Sat 31 Oct | 14 | 3 |
| Today, Sun 1 Nov | 15 so far | 0 |
Developing
Tue 30 Jul 202474 articles
- Government files its opening brief in its appeal to overturn Conor Fitzpatrick’s sentence
On July 29, the Department of Justice filed its opening brief in its appeal of Conor Fitzpatrick’s (“Pompompurin’s”) sentence. The issue at the appellate level is “whether the district court abused its discretion in sentencing Fitzpatrick to a 17-day…
DataBreaches - Massive SMS stealer campaign infects Android devices in 113 countries
A malicious campaign targeting Android devices worldwide utilizes thousands of Telegram bots to infect devices with SMS-stealing malware and steal one-time 2FA passwords (OTPs) for over 600 services. [...]
BleepingComputer - CISA adds VMware ESXi bug to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds a VMware ESXi bug to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added an authentication bypass VMware ESXi vulnerability,…
Security Affairs - Criminal Hackers Add GenAI Credentials to Underground Markets
According to the study, around 400 stolen GenAI credentials are being sold by threat actors per day.
Dark Reading - Mandrake Android spyware found in five apps in Google Play with over 32,000 downloads since 2022
A new version of the Mandrake Android spyware has been found in five apps on Google Play, which have been downloaded over 32,000 times since 2022. Researchers from Kaspersky discovered a new version of the Mandrake Android spyware in five app on Google Play,…
Security Affairs - Dark Angels ransomware receives record-breaking $75 million ransom
A Fortune 50 company paid a record-breaking $75 million ransom payment to the Dark Angels ransomware gang, according to a report by Zscaler ThreatLabz. [...]
BleepingComputer - Ransomware Gangs Exploit ESXi Bug for Instant, Mass Encryption of VMs
With sufficient privileges in Active Directory, attackers only have to create an "ESX Admins" group in the targeted domain and add a user to it.
Dark Reading - CISA warns of VMware ESXi bug exploited in ransomware attacks
CISA has ordered U.S. Federal Civilian Executive Branch (FCEB) agencies to secure their servers against a VMware ESXi authentication bypass vulnerability exploited in ransomware attacks. [...]
BleepingComputer - Black Basta ransomware switches to more evasive custom malware
The Black Basta ransomware gang has shown resilience and an ability to adapt to a constantly shifting space, using new custom tools and tactics to evade detection and spread throughout a network. [...]
BleepingComputer - Threat actor impersonates Google via fake ad for Authenticator
We have previously reported on the brand impersonation issue with Google ads: users who search for popular keywords are shown malicious ads that purport to be from an official vendor. Not only does this trick innocent victims into downloading malware or…
Malwarebytes - Google Chrome adds app-bound encryption to block infostealer malware
Google Chrome has added app-bound encryption for better cookie protection on Windows systems and improved defenses against information-stealing malware attacks. [...]
BleepingComputer - Columbus investigates whether data was stolen in ransomware attack
The City of Columbus, Ohio, says it's investigating whether personal data was stolen in a ransomware attack on July 18, 2024 that disrupted the City's services. [...]
BleepingComputer - CrowdStrike Chaos Highlights Key Cyber Vulnerabilities with Software Updates — GAO Blog
From their WatchBlog: Earlier this month, a software update from the cybersecurity firm CrowdStrike caused Microsoft Windows operating systems to crash—resulting in potentially the largest IT outage in history. Disruptions were widespread. Around the world,…
DataBreaches - DigiCert mass-revoking TLS certificates due to domain validation bug
DigiCert is warning that it will be mass-revoking SSL/TLS certificates due to a bug in how the company verified if a customer owned or operated a domain and requires impacted customers to reissue certificates within 24 hours. [...]
BleepingComputer - SideWinder phishing campaign targets maritime facilities in multiple countries
The APT group SideWinder launched a new espionage campaign targeting ports and maritime facilities in the Indian Ocean and Mediterranean Sea. SideWinder (also known as Razor Tiger, Rattlesnake, and T-APT-04) has been active since at least 2012, the group…
Security Affairs - EdTech, Impersonation, and Managing Risk
Bill Fitzgerald (@FunnyMonkey) has written a post that I wish all school districts would read, process, and follow up on. The following is just a snippet from his post: We should assume that the KnowBe4 impersonation and the xz incident are not isolated or…
DataBreaches - Google Cloud CISO Phil Venables: ‘I’m short-term pessimistic, long-term optimistic’
SecurityWeek fireside chat: Google Cloud CISO on CISA’s secure-by-design initiatives, government regulations, holding vendors accountable, and transformational security leadership.
SecurityWeek - The Doppelgänger Playbook: Russian Information Operations Unveiled (June-July 2024)
From early June to late July 2024, Russian actors conducted a series of information operations under the code name “Doppelgänger.” These campaigns were particularly active during the unexpected snap elections in France, prompting an...
SecurityOnline - Is your password policy working? Key cybersecurity KPIs to measure
Are your password policies having a positive impact on the cybersecurity posture of your org? Learn more from Specops Software about how to align password policies with wider cybersecurity KPIs. [...]
BleepingComputer - The CrowdStrike Meltdown: A Wake-up Call for Cybersecurity
The incident serves as a stark reminder of the fragility of our digital infrastructure. By adopting a diversified, resilient approach to cybersecurity, we can mitigate the risks and build a more secure digital future.
Dark Reading - Indian APT Targeting Mediterranean Ports and Maritime Facilities
The SideWinder APT has been targeting ports and maritime facilities in the Indian Ocean and Mediterranean Sea in recent attacks.
SecurityWeek - Cyberattackers Accessed HealthEquity Customer Info via Third Party
Data thieves heisted the HSA provider's data repository for 4.5 million people's HR information, including employer and dependents intel.
Dark Reading - IBM: Cost of a breach reaches nearly $5 million, nearly $10 million for healthcare
Jonathan Greig reports on some of the significant findings in IBM’s new survey on the cost of a breach: Businesses that fall victim to a data breach can expect a financial hit of nearly $5 million on average — a 10% increase compared to last year — according…
DataBreaches - Progress Patched New MOVEit File Transfer Flaw that Allows Privilege Escalation
Progress, the company behind MOVEit Transfer, has issued a critical security alert addressing a newly discovered vulnerability in its MOVEit Transfer product. The flaw, CVE-2024-6576, has been classified as a high-severity issue, with a CVSS score of 7.3,…
gbhackers.com - Microsoft 365 and Azure outage takes down multiple services
Microsoft is investigating an ongoing and widespread outage blocking access to some Microsoft 365 and Azure services. [...]
BleepingComputer - AI, Cybersecurity Top Investment Areas for Industrial Organizations: Cisco
Cisco has published its inaugural State of Industrial Networking report, based on a survey of 1,000 individuals.
SecurityWeek - New Mandrake Spyware Found in Google Play Store Apps After Two Years
A new iteration of a sophisticated Android spyware called Mandrake has been discovered in five applications that were available for download from the Google Play Store and remained undetected for two years. The applications attracted a total of more than…
The Hacker News - Software Supply Chain Security Firm Lineaje Raises $20M in Series A Funding
Software supply chain security startup Lineaje has raised $20 million in a Series A funding round that brings the total to $27 million.
SecurityWeek - RADAR and DISPOSSESOR shift to R-a-a-S model
In April, Jim Walter of SentinelOne wrote an article about how some ransomware affiliates were teaming up with others to get paid if they had been cheated by previous partners. Perhaps the best-known recent example of this occurred after ALPHV allegedly…
DataBreaches - VMware ESXi Hypervisor Vulnerability (CVE-2024-37085) Exploited by Ransomware Groups, Microsoft Warns
VMware ESXi Hypervisor Vulnerability (CVE-2024-37085) Exploited by Ransomware Groups, Microsoft Warns Microsoft recently brought attention to the active exploitation of CVE-2024-37085, a critical vulnerability in Broadcom’s VMware ESXi hypervisors. The…
SOCRadar - ubook Suffered Data Breach, 710,000 Users’ Data Exposed
The popular audiobook and podcast platform uBook has been affected by a data breach that exposed the personal information of 710,000 users. According to a tweet by ThreatMon, the breach, which occurred in July 2024, was announced by a member of a dark web…
gbhackers.com - US Senators Turn Up Heat On Automakers Over Sale Of Driver Data
No content available.
packetstormsecurity.com - NIST Releases Open Source Platform For AI Security Testing
No content available.
packetstormsecurity.com - Hackers Exploit VMware Vulnerability That Gives Them Hypervisor Admin
No content available.
packetstormsecurity.com - UK govt links 2021 Electoral Commission breach to Exchange server
The United Kingdom's Information Commissioner's Office (ICO) revealed today that the Electoral Commission was breached in August 2021 because it failed to patch its on-premise Microsoft Exchange Server against ProxyShell vulnerabilities. [...]
BleepingComputer - Proofpoint’s Email Protection Let Attackers Send Millions Of Phishing Emails
Hackers use phishing emails to mislead recipients into providing personal data like usernames, passwords, credit card numbers, or social security numbers. This method exploits human emotions and trust, allowing a threat actor to compromise an account, steal…
gbhackers.com - Turning the tables: two gangs’ opsec fails exposed data; good guys deleted it
Yesterday’s Risky Biz News reported that threat intel firm DarkAtlas says it gained access to one of the Rclone data exfil servers used by the Medusa ransomware group. How many times have researchers uncovered exposed data and warned that threat actors might…
DataBreaches - Hackers Exploiting ESXi Hypervisor Auth Bypass Flaw For Ransomware Attacks
Hackers prefer ransomware attacks primarily because they offer the highest chance of financial gain. By locking victims’ information systems and asking for payment to release them, ransomware attacks lock victims’ information systems and demand payment to…
gbhackers.com