News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Articles per day, last 14 days
Most articles on Wed 21 Oct (96); 13–17 on weekend days.
- On CISA KEV CVEs
- Other coverage
- Closed-day average
Show as tableHide table
| Day | Articles | On CISA KEV CVEs |
|---|---|---|
| Mon 19 Oct | 60 | 12 |
| Tue 20 Oct | 86 | 16 |
| Wed 21 Oct | 96 | 18 |
| Thu 22 Oct | 84 | 11 |
| Fri 23 Oct | 68 | 16 |
| Sat 24 Oct | 13 | 4 |
| Sun 25 Oct | 13 | 2 |
| Mon 26 Oct | 76 | 21 |
| Tue 27 Oct | 95 | 18 |
| Wed 28 Oct | 87 | 16 |
| Thu 29 Oct | 78 | 17 |
| Fri 30 Oct | 69 | 10 |
| Sat 31 Oct | 14 | 3 |
| Sun 1 Nov | 17 | 0 |
| Today, Mon 2 Nov | 31 so far | 5 |
Developing
Wed 14 Aug 202476 articles
- Russian who sold 300,000 stolen credentials gets 40 months in prison
Georgy Kavzharadze, a 27-year-old Russian national, has been sentenced to 40 months in prison for selling login credentials for over 300,000 accounts on Slilpp, the largest online marketplace of stolen logins, until its seizure in June 2021. [...]
BleepingComputer - Zero-click Windows TCP/IP RCE impacts all systems with IPv6 enabled, patch now
Microsoft warned customers this Tuesday to patch a critical TCP/IP remote code execution (RCE) vulnerability with an increased likelihood of exploitation that impacts all Windows systems with IPv6 enabled. [...]
BleepingComputer - GitHub Actions artifacts found leaking auth tokens in popular projects
Multiple high-profile open-source projects, including those from Google, Microsoft, AWS, and Red Hat, were found to leak GitHub authentication tokens through GitHub Actions artifacts in CI/CD workflows. [...]
BleepingComputer - 'EastWind' Cyber-Spy Campaign Combines Various Chinese APT Tools
The likely China-linked campaign is deploying CloudSorcerer and other proprietary binaries belonging to known state-sponsored groups, showing how advanced persistent threat groups often collaborate with each other.
Dark Reading - NIST releases first encryption tools to resist quantum computing
The U.S. National Institute of Standards and Technology (NIST) has released the first three encryption standards designed to resist future cyberattacks based on quantum computing technology. [...]
BleepingComputer - Mimecast Announces Acquisition of Aware, Doubles Down on AI-Powered Human Risk Management Capabilities
No content available.
Dark Reading - Iranian backed group steps up phishing campaigns against Israel, U.S.
Google’s Threat Analysis Group shares insights on APT42, an Iranian government-backed threat actor.
blog.google - Gcore Radar Report Shows 46% Increase in Number of DDoS Attacks in First Half of 2024
No content available.
Dark Reading - Zimperium Teams Up With Okta to Enhance Zero-Trust Identity Threat Protection With AI-Driven Mobile Security Solutions
No content available.
Dark Reading - Microsoft retires Windows updates causing 0x80070643 errors
Microsoft has retired several Windows security updates released during the January 2024 Patch Tuesday that have been causing 0x80070643 errors when installing Windows Recovery Environment (WinRE) updates. [...]
BleepingComputer - Digital Align Inc. Achieves SOC 2 Type 2 Certification for Secure Automation Intelligence
No content available.
Dark Reading - UK Royal Family, Prime Minister Deepfakes Make Rounds on Meta
According to the researchers, roughly 250 fake advertisements appeared on platforms like Facebook and Instagram, and some are reportedly still up and running.
Dark Reading - China-linked APT Earth Baku targets Europe, the Middle East, and Africa
China-linked threat actor Earth Baku expanded its operations in Europe, the Middle East, and Africa starting in late 2022. China-linked APT group Earth Baku (a threat actor associated with APT41) has expanded its operations beyond the Indo-Pacific region to…
Security Affairs - Black Basta-Linked Attackers Target Users with SystemBC Malware
An ongoing social engineering campaign with alleged links to the Black Basta ransomware group has been linked to "multiple intrusion attempts" with the goal of conducting credential theft and deploying a malware dropper called SystemBC. "The initial lure…
The Hacker News - AutoCanada discloses cyberattack impacting internal IT systems
Hackers targeted AutoCanada in a cyberattack last Sunday that impacted the automobile dealership group's internal IT systems, which may lead to disruptions. [...]
BleepingComputer - SolarWinds addressed a critical RCE in all Web Help Desk versions
SolarWinds addressed a critical remote code execution vulnerability in its Web Help Desk solution for customer support. SolarWinds fixed a critical vulnerability, tracked as CVE-2024-28986 (CVSS score 9.8), in SolarWinds’ Web Help Desk solution for custome...
Security Affairs - SolarWinds fixes critical RCE bug affecting all Web Help Desk versions
A critical vulnerability in SolarWinds' Web Help Desk solution for customer support could be exploited to achieve remote code execution, the American business software developer warns in a security advisory today. [...]
BleepingComputer - CVE-2024-39091: Critical Vulnerability in MIPC Camera Framework Puts Millions at Risk
A high-severity vulnerability (CVE-2024-39091, CVSS 8.8) has been discovered in the MIPC camera framework, a widely-used software platform for home security cameras. This vulnerability could allow attackers to gain complete...
SecurityOnline - August 2024 Patch Tuesday Highlights: 89 CVEs, 6 Zero-Day Vulnerabilities Under Exploitation
August 2024 Patch Tuesday Highlights: 89 CVEs, 6 Zero-Day Vulnerabilities Under Exploitation Microsoft has rolled out the August 2024 Patch Tuesday updates, enhancing its products to address a wide array of security threats through various fixes and…
SOCRadar - Unconfirmed Hack of 2.9 Billion Records at National Public Data Sparks Media Frenzy Amid Lawsuits
National Public Data (NPD) is at the center of controversy with allegations of a massive data breach involving 2.9 billion records. Despite media coverage and a class action lawsuit, verifiable proof remains scarce
SecurityWeek - Azure Health Bot Service Vulnerabilities Possibly Exposed Sensitive Data
Azure Health Bot Service vulnerabilities found by Tenable could have been exploited for lateral movement and may have allowed customer data exposure.
SecurityWeek - Microsoft Warns Of OpenVPN Vulnerabilities, Potential For Exploit Chains
No content available.
packetstormsecurity.com - Russia Launching More Sophisticated Phishing Attacks, New Report Finds
No content available.
packetstormsecurity.com - Is Lenovo A Blind Spot In US Anti-China Security Measures?
No content available.
packetstormsecurity.com - Unlocking the Front Door: Phishing Emails Remain a Top Cyber Threat Despite MFA
SecurityWeek spoke with Mike Britton, CISO at Abnormal Security, to understand what the company has learned about current social engineering and phishing attacks.
SecurityWeek - Cybersecurity's Real Challenge Is Communication, Not Just Technology
By nurturing a security-centric work culture that involves everybody, organizations can overcome challenges with greater agility and confidence.
Dark Reading - Cybercriminal Leader 'J.P.Morgan' Busted for Pioneering RaaS Model
Maksim Silnikau and his associates are accused of developing and distributing notorious ransomware strains such as Reveton and Ransom Cartel, amongst other criminal acts.
Dark Reading - We’re making it easier for you to protect your identity
Things have changed in cybersecurity. Gone are the days when our only worry was downloading a virus. Now, 71% of people say having their data leaked and identity stolen is one of their biggest fears about being online. Sadly, they’re right to be concerned:…
Malwarebytes - CIRCIA feedback update: Critical infrastructure providers weigh in on NPRM
In 2022, the Cyber Incident for Reporting Critical Infrastructure Act (CIRCIA) went into effect. According to Secretary of Homeland Security Alejandro N. Mayorkas, “CIRCIA enhances our ability to spot trends, render assistance to victims of cyber incidents…
securityintelligence.com - X accused of unlawfully using personal data of 60 million+ users to train its AI
In what may come as a surprise to nobody at all, there’s been yet another complaint about using social media data to train Artificial Intelligence (AI). This time the complaint is against X (formerly Twitter) and Grok, the conversational AI chatbot developed…
Malwarebytes - Three State Attorneys General Secure $4.5 Million from Enzo Biotech for Failing to Protect Health Data of 2.4 Million Patients
NEW YORK – New York Attorney General Letitia James and the attorneys general of Connecticut and New Jersey today secured $4.5 million from Enzo Biochem, Inc. (Enzo) for failing to adequately safeguard the personal and private health information of its…
DataBreaches - U.S. Army Intelligence Analyst Pleads Guilty to Charges of Conspiracy to Obtain and Disclose National Defense Information, Export Control Violations and Bribery
Today’s reminder of the insider threat is yesterday’s press release from the Department of Justice: Korbein Schultz, a U.S. Army soldier and intelligence analyst, pleaded guilty today to all charges against him in the indictment returned by a federal grand…
DataBreaches