CyberSecure Specialist

09 Apr

April’s Patch Tuesday Brings Record Number of Fixes

Information, Insights

If only Patch Tuesdays came around infrequently — like total solar eclipse rare — instead of just creeping up on us each month like The Man in the Moon. Although to be fair, it would be tough for Microsoft to eclipse the number of vulnerabilities fixed in this month’s patch batch — a record 147 flaws in Windows and related software. Yes, you read that right. Microsoft today released updates to address 147 security holes…

Read More
09 Apr

Microsoft Releases April 2024 Security Updates 

Attacks, Insights, Malware

Microsoft released security updates to address vulnerabilities in multiple products. A cyber threat actor could exploit some of these vulnerabilities to take control of an affected system.   Users and administrators are encouraged to review the following and apply the necessary updates:   Microsoft Security Update Guide for April

Read More
04 Apr

Fake Lawsuit Threat Exposes Privnote Phishing Sites

Information, Insights

A cybercrook who has been setting up websites that mimic the self-destructing message service privnote.com accidentally exposed the breadth of their operations recently when they threatened to sue a software company. The disclosure revealed a profitable network of phishing sites that behave and look like the real Privnote, except that any messages containing cryptocurrency addresses will be automatically altered to include a different payment address controlled by the scammers. The real Privnote, at privnote.com. Launched…

Read More
04 Apr

Ivanti Releases Security Update for Ivanti Connect Secure and Policy Secure Gateways

Attacks, Insights, Malware

Ivanti has released security updates to address vulnerabilities in all supported versions (9.x and 22.x) of Ivanti Connect Secure and Policy Secure gateways. A cyber threat actor could exploit one of these vulnerabilities to take control of an affected system.  Users and administrators are encouraged to review the following Ivanti advisory and apply the necessary updates:  SA:CVE-2024-21894 (Heap Overflow), CVE-2024-22052 (Null Pointer Dereference), CVE-2024-22053 (Heap Overflow) and CVE-2024-22023 (XML entity expansion or XXE) for Ivanti Connect…

Read More
03 Apr

‘The Manipulaters’ Improve Phishing, Still Fail at Opsec

Information, Insights

Roughly nine years ago, KrebsOnSecurity profiled a Pakistan-based cybercrime group called “The Manipulaters,” a sprawling web hosting network of phishing and spam delivery platforms. In January 2024, The Manipulaters pleaded with this author to unpublish previous stories about their work, claiming the group had turned over a new leaf and gone legitimate. But new research suggests that while they have improved the quality of their products and services, these nitwits still fail spectacularly at hiding…

Read More
02 Apr

Cybersecurity starts at home: Help your children stay safe online with open conversations

Information

In today’s digital age, the internet plays a major role in young people’s lives, influencing how they further grow and develop into fully-fledged adults venturing out into the real world: From educational resources to social connections, discovering the latest viral dance trends, or watching how-to videos on how to cook pasta, the online world offers endless possibilities and resources. Gone are the days of being bored when you have a ticket to a world of…

Read More
02 Apr

CISA Publishes New Webpage Dedicated to Providing Resources for High-Risk Communities

Attacks, Insights, Malware

Today, CISA published a new dedicated High-Risk Communities webpage comprised of cybersecurity resources to support civil society communities at heighted risk of digital security threats, including cyber hygiene guidance, a repository of local cyber volunteer programs, and free or discounted tools and services. Despite their vulnerability to advanced cyber threats, many civil society organizations operate on lean budgets and cannot significantly invest in cybersecurity. CISA’s High-Risk Communities webpage provides resources specifically for civil society organizations,…

Read More
01 Apr

Cybercriminals play dirty: A look back at 10 cyber hits on the sporting world

Information

The Olympic Games, the FIFA World Cup, and the Super Bowl are just a few examples of iconic sporting events that showcase the global significance of the professional sports industry. But while professional sports stir passion and emotion among fans, cybercriminals couldn’t care less about the competitive aspects of sports or the feeling of community with fellow fans. Instead, they will relentlessly attempt to exploit the industry’s reach and resources in a bid to line…

Read More
01 Apr

Borrower beware: Common loan scams and how to avoid them

Information

Scams Personal loan scams prey on your financial vulnerability and might even trap you in a vicious circle of debt. Here’s how to avoid being scammed when considering a loan. Phil Muncaster 26 Mar 2024  •  , 6 min. read Times have been tough financially for many of us since the pandemic. Climate shocks, food and energy price rises and persistent inflation elsewhere have squeezed household spending and put huge pressure on working families, with…

Read More
01 Apr

RDP remains a security concern – Week in security with Tony Anscombe

Information

Video Much has been written about the risks that poorly-secured RDP connections entail, but many organizations continue to leave themselves at risk and get hit by data breaches as a result 29 Mar 2024 Remote Desktop Protocol (RDP) turned out to be a lifeline for organizations around the world during the mass shift to remote and hybrid work arrangements. Its popularity didn’t escape the attention of cybercriminals, and RDP remains a popular attack vector among…

Read More