Category: Uncategorized
-
Medusa Ransomware on the Rise: From Data Leaks to Multi-Extortion [email protected] (The Hacker News)
The threat actors associated with the Medusa ransomware have ramped up their activities following the debut of a dedicated data leak site on the dark web in February 2023 to publish sensitive data of victims who are unwilling to agree to their demands. “As part of their multi-extortion strategy, this group will provide victims with multiple options…
-
Urgent: GitLab Releases Patch for Critical Vulnerabilities – Update ASAP [email protected] (The Hacker News)
GitLab has released security updates to address two critical vulnerabilities, including one that could be exploited to take over accounts without requiring any user interaction. Tracked as CVE-2023-7028, the flaw has been awarded the maximum severity of 10.0 on the CVSS scoring system and could facilitate account takeover by sending password reset emails to an unverified…
-
New Class of CI/CD Attacks Could Have Led to PyTorch Supply Chain Compromise Ionut Arghire
Researchers detail a CI/CD attack leading to PyTorch releases compromise via GitHub Actions self-hosted runners. The post New Class of CI/CD Attacks Could Have Led to PyTorch Supply Chain Compromise appeared first on SecurityWeek. Read More
-
Applying the Tyson Principle to Cybersecurity: Why Attack Simulation is Key to Avoiding a KO [email protected] (The Hacker News)
Picture a cybersecurity landscape where defenses are impenetrable, and threats are nothing more than mere disturbances deflected by a strong shield. Sadly, this image of fortitude remains a pipe dream despite its comforting nature. In the security world, preparedness is not just a luxury but a necessity. In this context, Mike Tyson’s famous adage, “Everyone…
-
Russian Hackers Likely Not Involved in Attacks on Denmark’s Critical Infrastructure Ionut Arghire
Researchers find no direct link between Russian APT Sandworm and last year’s attacks on Denmark’s critical infrastructure. The post Russian Hackers Likely Not Involved in Attacks on Denmark’s Critical Infrastructure appeared first on SecurityWeek. Read More
-
Apple Patches Keystroke Injection Vulnerability in Magic Keyboard Ionut Arghire
Apple’s latest Magic Keyboard firmware addresses a recently disclosed Bluetooth keyboard injection vulnerability. The post Apple Patches Keystroke Injection Vulnerability in Magic Keyboard appeared first on SecurityWeek. Read More
-
Malware Used in Ivanti Zero-Day Attacks Shows Hackers Preparing for Patch Rollout Eduard Kovacs
Ivanti zero-day vulnerabilities dubbed ConnectAround could impact thousands of systems and Chinese cyberspies are preparing for patch release. The post Malware Used in Ivanti Zero-Day Attacks Shows Hackers Preparing for Patch Rollout appeared first on SecurityWeek. Read More
-
Cryptominers Targeting Misconfigured Apache Hadoop and Flink with Rootkit in New Attacks [email protected] (The Hacker News)
Cybersecurity researchers have identified a new attack that exploits misconfigurations in Apache Hadoop and Flink to deploy cryptocurrency miners within targeted environments. “This attack is particularly intriguing due to the attacker’s use of packers and rootkits to conceal the malware,” Aqua security researchers Nitzan Yaakov and Assaf Morag said in an analysis published earlierRead More
-
Act Now: CISA Flags Active Exploitation of Microsoft SharePoint Vulnerability [email protected] (The Hacker News)
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical security vulnerability impacting Microsoft SharePoint Server to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The issue, tracked as CVE-2023-29357 (CVSS score: 9.8), is a privilege escalation flaw that could be exploited by an attacker to gainRead More
-
Researchers Flag FBot Hacking Tool Hijacking Cloud, Payment Services Ryan Naraine
The tool, called FBot, is capable of credential harvesting for spamming attacks, and AWS, PayPal and SaaS account hijacking. The post Researchers Flag FBot Hacking Tool Hijacking Cloud, Payment Services appeared first on SecurityWeek. Read More