Latest Cybersecurity News and Articles

---

Ex-NSO Execs Raise $35 Million for Dream Security

Dream Security has raised $35 million in a financing round led by existing investors Aleph and Dovi France's Group 11. It offers a range of products that assess and predict cyber threats, react in real-time, and create customized protective measures.

---

Researchers Discover Dangerous Exposure of Sensitive Kubernetes Secrets

Researchers at Aqua call urgent attention to the public exposure of Kubernetes configuration secrets, warning that hundreds of organizations are vulnerable to this “ticking supply chain attack bomb.” The post Researchers Discover Dangerous Exposure of Sensitive Kubernetes Secrets appeared first on SecurityWeek.

---

NCSC Announces New Standard for Indicators of Compromise

The UK's National Cyber Security Centre (NCSC) has released its first RFC for the Internet Engineering Task Force (IETF), focusing on indicators of compromise (IoCs), which are observable artifacts associated with attackers.

---

Lumma Stealer can Allegedly Restore Expired Google Authentication Cookies

While the effectiveness of this feature is yet to be verified by security researchers or Google, the existence of similar claims by another malware suggests that there may be an exploitable vulnerability in session cookies.

---

Companies are Getting Smarter About Cyber Incidents

According to experts, companies are increasingly prioritizing system backups and restoration capabilities to avoid paying ransoms during cyber incidents. Companies must also report cyber incidents and notify affected individuals.

---

Update: Citrix Provides Additional Measures to Address Citrix Bleed

The CVE-2023-4966 vulnerability has been actively exploited by threat actors since late August, allowing them to hijack authenticated sessions and bypass strong authentication measures.

---

New Flaws in Fingerprint Sensors Let Attackers Bypass Windows Hello Login

A new research has uncovered multiple vulnerabilities that could be exploited to bypass Windows Hello authentication on Dell Inspiron 15, Lenovo ThinkPad T14, and Microsoft Surface Pro X laptops. The flaws were discovered by researchers at hardware and software product security and offensive research firm Blackwing Intelligence, who found the weaknesses in the fingerprint sensors from Goodix,

---

The Shifting Sands of the War Against Cyber Extortion

Ransomware gangs are employing various tactics to force victims to pay, including DDoS attacks and regulatory complaints, while some ransomware operators are introducing new rules to ensure larger ransom amounts and increased payout likelihood.

---

Strong security posture means building effective partnerships

Michael Daniel, President & CEO at Cyber Threat Alliance, discusses sharing threat intelligence with other organizations as well as the challenges faced when establishing effective partnerships in the security industry.

---

Update: Report Details Aftermath of ICBC LockBit Ransomware Attack

A ransomware attack on the Industrial and Commercial Bank of China caused failed trading rates in the U.S. Treasury market to soar to $60 billion, highlighting the potential impact of cyberattacks on financial systems.

---

Us Navy Unveils its First Cyber Strategy

The cyber strategy focuses on enhancing the Navy's cyber enterprise, collaborating with allies, securing critical infrastructure and weapon systems, and improving and supporting the cyber workforce, among other areas.

---

Enterprise Software Provider TmaxSoft Leaks Two Terabytes of Data

Korean IT company TmaxSoft has experienced a major data leak, exposing over 50 million sensitive records. The leak, which has been ongoing for two years, was discovered by Cybernews researchers.

---

185,000 Individuals Impacted by MOVEit Hack at Car Parts Giant AutoZone 

Car parts giant AutoZone says nearly 185,000 individuals were impacted by a data breach caused by the MOVEit hack. The post 185,000 Individuals Impacted by MOVEit Hack at Car Parts Giant AutoZone  appeared first on SecurityWeek.

---

Organizations’ Serious Commitment to Software Risk Management Pays Off

A recent report by Synopsys reveals that there has been a decrease in vulnerabilities found in target applications, indicating that code reviews, automated testing, and continuous integration are helping to reduce programming errors.

---

Atomic Stealer Distributed to Mac Users via Fake Browser Updates

The malware campaign known as ClearFake is now targeting Mac users by distributing fake browser updates that infect their systems with the Atomic Stealer, also known as AMOS.

---

UK Regulator Demands Websites Let Users ‘Reject All’ Cookies

The ICO is cracking down on websites that coerce visitors into accepting advertising cookies, citing concerns about targeted ads based on personal information and potential privacy violations.

---

Windows Hello Fingerprint Authentication Bypassed on Popular Laptops

Researchers have tested the fingerprint sensors used for Windows Hello on three popular laptops and managed to bypass them. The post Windows Hello Fingerprint Authentication Bypassed on Popular Laptops appeared first on SecurityWeek.

---

Sam Altman is Back as OpenAI CEO Just Days After Being Removed, Along With a New Board

San Francisco-based OpenAI has reached an agreement in principle for Sam Altman to return to OpenAI as CEO with a new initial board. The post Sam Altman is Back as OpenAI CEO Just Days After Being Removed, Along With a New Board appeared first on SecurityWeek.

---

Personal data stolen in British Library cyber-attack appears for sale online

Ransomware group Rhysida claims responsibility for hack and has posted images from library’s HR filesThe British Library has confirmed that personal data stolen in a cyber-attack has appeared online, apparently for sale to the highest bidder.The attack was carried out in October by a group known for such criminal activity, said the UK’s national library, which holds about 14m books and millions of other items. Continue reading...

---

Automotive Parts Retailer AutoZone Warns of MOVEit Data Breach

The breach, which occurred on May 28, 2023, compromised the data of 184,995 individuals. The company took three months to determine the extent of the breach and notify affected customers.