Latest Cybersecurity News and Articles

---

The transformative impact of cryptocurrency on digital fraud investigations

Cryptocurrency's rise has reshaped the landscape of digital fraud investigations, presenting new challenges and opportunities for enterprise security leaders.

---

NY College Forced to Invest $3.5 Million in Cybersecurity After Breach Affecting 200,000

New York state attorney general has reached an agreement with Marymount Manhattan College (MMC) following a data breach in 2021. The college will invest $3.5 million into cybersecurity to address the deficiencies exposed during the ransomware attack.

---

New BBTok Banking Trojan Versions Target 40 LATAM Banks

Check Point researchers have uncovered a new variant of the BBTok banking trojan, which focuses its attacks on users of more than 40 banks in Latin America, with a primary focus on Brazil and Mexico. The attack strategies differ between Windows 7 and Windows 10 systems. Banking organizations and individuals in the region are advised to stay cautious.

---

National Student Clearinghouse Discloses Data Breach Impacting 890 Schools

The data breach was caused by the Clop ransomware gang, who exploited a zero-day security flaw in the MOVEit Transfer platform and began extorting organizations that were targeted.

---

Watch the Webinar — AI vs. AI: Harnessing AI Defenses Against AI-Powered Risks

Generative AI is a double-edged sword, if there ever was one. There is broad agreement that tools like ChatGPT are unleashing waves of productivity across the business, from IT, to customer experience, to engineering. That's on the one hand.  On the other end of this fencing match: risk. From IP leakage and data privacy risks to the empowering of cybercriminals with AI tools, generative AI

---

Are You Willing to Pay the High Cost of Compromised Credentials?

Weak password policies leave organizations vulnerable to attacks. But are the standard password complexity requirements enough to secure them? 83% of compromised passwords would satisfy the password complexity and length requirements of compliance standards. That’s because bad actors already have access to billions of stolen credentials that can be used to compromise additional accounts by

---

UK Security Agency Publishes New Cryptographic Designs

These designs aim to mitigate risks caused by accidental misuse of cryptography, ensuring cryptographic security is maintained even in the event of significant human error.

---

Stealth Falcon APT Preying Over Middle Eastern Skies With Deadglyph

The backdoor does not have traditional commands implemented; instead, it dynamically receives commands from a command and control server in the form of additional modules.

---

From Watering Hole to Spyware: EvilBamboo Targets Tibetans, Uyghurs, and Taiwanese

Tibetan, Uyghur, and Taiwanese individuals and organizations are the targets of a persistent campaign orchestrated by a threat actor codenamed EvilBamboo to gather sensitive information. "The attacker has created fake Tibetan websites, along with social media profiles, likely used to deploy browser-based exploits against targeted users," Volexity security researchers Callum Roxan, Paul

---

CISA Urges Use of Memory Safe Code in Software Development

The Cybersecurity and Infrastructure Security Agency is urging the software industry to embrace the use of memory safe programming languages as part of a wider effort to eliminate security vulnerabilities in code.

---

Cato Networks Raises $238M on $3B Valuation to Move Upmarket

Cato Networks has secured a $238 million equity investment to enhance its SASE platform by integrating CASB and DLP capabilities, catering to the needs of large enterprises.

---

Gelsemium APT Suspected Behind an Attack on Southeast Asian Government

A recent report by Palo Alto Networks Unit42 researchers reveals that a stealthy APT group known as Gelsemium likely targeted a Southeast Asian government between 2022 and 2023.

---

Update: Nova Scotia Says All Victims of MOVEit Breach Have Been Notified

The security incident highlights the time-consuming process of analyzing stolen data and notifying affected individuals, emphasizing the need for improved cybersecurity measures.

---

Faster Patching Pace Validates CISA’s KEV Catalog Initiative

The Known Exploited Vulnerabilities (KEV) Catalog maintained by the US cybersecurity agency CISA has led to significant improvements in federal agencies’ patching efforts, with more than 1,000 vulnerabilities now included in the list.

---

New Zealand University Operating Despite Cyberattack

Despite a cyberattack on Auckland University of Technology, the university has been able to continue normal operations with minimal disruption. The Monti ransomware gang claimed responsibility for the attack and demanded an undisclosed ransom.

---

Hidden Dangers Loom for Subsea Cables, the Invisible Infrastructure of the Internet

Subsea cables are a critical component of the global internet infrastructure, and protecting them from accidental damage, natural phenomena, physical attacks, and cyberattacks is crucial.

---

Github Passkeys Generally Available for Passwordless Sign-Ins

The adoption of passkeys by GitHub, Microsoft, and Google, among other technology giants, demonstrates a growing trend toward using passkeys for secure authentication across platforms.

---

New Apple Zero-Days Exploited to Target Egyptian ex-MP with Predator Spyware

Apple recently addressed three zero-day vulnerabilities that were used as part of an iPhone exploit chain in an attempt to deliver spyware called Predator to former Egyptian member of parliament Ahmed Eltantawy.

---

LockBit, BlackCat, and Clop Prevail as Top RAAS Groups: Ransomware in First Half of 2023

In the first half of 2023, small businesses were the most targeted victims of LockBit and BlackCat, while large enterprises were the primary targets of Clop ransomware attacks.

---

Update: T-Mobile Denies Rumors of a Breach Affecting Employee Data

The stolen data, believed to be from an authorized retailer called Connectivity Source, includes employee IDs, login information, Social Security numbers, and service account details.