Latest Cybersecurity News and Articles
26 October 2023
SecurityWeek’s 2023 ICS Cybersecurity Conference continues in Atlanta, with challenges and solutions the focus of Day 3.
The post Day 3 of SecurityWeek’s 2023 ICS Cybersecurity Conference — Challenges and Solutions appeared first on SecurityWeek.
26 October 2023
The attack, confirmed to be a ransomware attack by Chile's CSIRT, involved the Rorschach ransomware variant and utilized DLL sideloading vulnerabilities in legitimate software executables to load the malicious DLL.
26 October 2023
While cyberattacks on websites receive much attention, there are often unaddressed risks that can lead to businesses facing lawsuits and privacy violations even in the absence of hacking incidents. A new case study highlights one of these more common cases.
Download the full case study here.
It's a scenario that could have affected any type of company, from healthcare to finance, e-commerce to
26 October 2023
The malware overwrites the main index.php file of websites, affecting both WordPress and other CMS platforms. The fake update page looks exactly like the official Google Chrome download page.
26 October 2023
ServiceNow has fixed a flaw that allowed unauthenticated attackers to steal sensitive data. The flaw was highlighted by security researcher Aaron Costello, who found that the default configurations of ServiceNow's widgets exposed personal data.
26 October 2023
The Rhysida ransomware-as-a-service (RaaS) operation has targeted Brazil's popular PIX payment system since December 2022, using a unique self-deletion mechanism and compatibility with older versions of Windows.
26 October 2023
Vacum Stealer is a dangerous malware that can transfer cryptocurrency from users' wallets without requiring any additional confirmation, posing a significant risk to unsuspecting individuals.
26 October 2023
A newly emerged ransomware gang, Hunters International, is resorting to morally questionable tactics by leaking patients' pre-operation pictures in order to hasten ransom negotiations.
26 October 2023
The Iranian threat actor known as Tortoiseshell has been attributed to a new wave of watering hole attacks that are designed to deploy a malware dubbed IMAPLoader.
"IMAPLoader is a .NET malware that has the ability to fingerprint victim systems using native Windows utilities and acts as a downloader for further payloads," the PwC Threat Intelligence said in a Wednesday analysis.
"It uses email
26 October 2023
The vulnerabilities could have allowed attackers to leak credentials and take over user accounts. No Grammarly accounts were compromised, and the company thanked the researchers for reporting the issue.
26 October 2023
Users of Mirth Connect, an open-source data integration platform from NextGen HealthCare, are being urged to update to the latest version following the discovery of an unauthenticated remote code execution vulnerability.
Tracked as CVE-2023-43208, the vulnerability has been addressed in version 4.4.1 released on October 6, 2023.
"This is an easily exploitable, unauthenticated remote code
26 October 2023
A relatively new threat actor known as YoroTrooper is likely made of operators originating from Kazakhstan.
The assessment, which comes from Cisco Talos, is based on their fluency in Kazakh and Russian, use of Tenge to pay for operating infrastructure, and very limited targeting of Kazakhstani entities, barring the government's Anti-Corruption Agency.
"YoroTrooper attempts to obfuscate the
25 October 2023
The current risks within the financial technology (fintech) sector and new compliance regulations were analyzed in a recent report by Fenergo.
25 October 2023
Cisco links the espionage-focused ‘YoroTrooper’ threat actor to Kazakhstan.
The post ‘YoroTrooper’ Espionage Group Linked to Kazakhstan appeared first on SecurityWeek.
25 October 2023
Apple patches dozens of serious security flaws in its macOS and iOS platforms, warning that hackers could launch code execution exploits.
The post Apple Ships Major iOS, macOS Security Updates appeared first on SecurityWeek.
25 October 2023
Firefox and Chrome updates released this week resolve multiple high-severity memory safety vulnerabilities.
The post Firefox, Chrome Updates Patch High-Severity Vulnerabilities appeared first on SecurityWeek.
25 October 2023
This breach raises concerns about the security and privacy of Airbnb's user base, as the stolen data can be used for malicious purposes such as identity theft and phishing.
25 October 2023
Security leaders were surveyed by ISACA on generative AI uses and policies within the workplace, finding 10% of organizations have a formal policy.
25 October 2023
The breach was caused by a vulnerability in Fiserv's MOVEit managed file transfer application. Fiserv has patched the vulnerability, and the bank is monitoring for unusual activity.
25 October 2023
VMware has released security updates to address a critical vulnerability in their vCenter Server software. The flaw, known as CVE-2023-34048, allows for remote code execution and is of critical severity (CVSS score: 9.8).