CyberSecure Specialist

13 Mar

Election cybersecurity: Protecting the ballot box and building trust in election integrity

Information

Critical Infrastructure What cyberthreats could wreak havoc on elections this year and how worried should we as voters be about the integrity of our voting systems? Phil Muncaster 12 Mar 2024  •  , 4 min. read This year, billions of people will go to the polls to decide their next political leaders. From India to the US, the outcomes of these and other elections could shape geopolitics for the coming years. With so much at…

Read More
12 Mar

Patch Tuesday, March 2024 Edition

Information, Insights

Apple and Microsoft recently released software updates to fix dozens of security holes in their operating systems. Microsoft today patched at least 60 vulnerabilities in its Windows OS. Meanwhile, Apple’s new macOS Sonoma addresses at least 68 security weaknesses, and its latest updates for iOS fixes two zero-day flaws. Last week, Apple pushed out an urgent software update to its flagship iOS platform, warning that there were at least two zero-day exploits for vulnerabilities being…

Read More
12 Mar

CISA Publishes SCuBA Hybrid Identity Solutions Guidance

Attacks, Insights, Malware

CISA has published Secure Cloud Business Applications (SCuBA) Hybrid Identity Solutions Guidance (HISG) to help users better understand identity management capabilities and securely integrate their traditional on-premises enterprise networks with cloud-based solutions. This initial publication reflects feedback gathered during its 2023 draft public comment period. CISA encourages users to review and implement this solutions guidance as appropriate for their individual organizations. HISG is the latest resource released by CISA’s SCuBA project. In accordance with Executive Order…

Read More
11 Mar

Incognito Darknet Market Mass-Extorts Buyers, Sellers

Information, Insights

Borrowing from the playbook of ransomware purveyors, the darknet narcotics bazaar Incognito Market has begun extorting all of its vendors and buyers, threatening to publish cryptocurrency transaction and chat records of users who refuse to pay a fee ranging from $100 to $20,000. The bold mass extortion attempt comes just days after Incognito Market administrators reportedly pulled an “exit scam” that left users unable to withdraw millions of dollars worth of funds from the platform.…

Read More
10 Mar

APT attacks taking aim at Tibetans – Week in security with Tony Anscombe

Information

Video Evasive Panda has been spotted targeting Tibetans in several countries and territories with payloads that included a previously undocumented backdoor ESET has named Nightdoor 08 Mar 2024 This week, ESET researchers released their analysis of how an Advanced Persistent Threat (APT) group targeted Tibetans via watering hole and supply-chain attacks. The cyberespionage campaign – which ESET attributed with high confidence to the China-aligned Evasive Panda group – leveraged a religious gathering known as the…

Read More
09 Mar

Evasive Panda leverages Monlam Festival to target Tibetans

Information

ESET researchers discovered a cyberespionage campaign that, since at least September 2023, has been victimizing Tibetans through a targeted watering hole (also known as a strategic web compromise), and a supply-chain compromise to deliver trojanized installers of Tibetan language translation software. The attackers aimed to deploy malicious downloaders for Windows and macOS to compromise website visitors with MgBot and a backdoor that, to the best of our knowledge, has not been publicly documented yet; we…

Read More
08 Mar

A Close Up Look at the Consumer Data Broker Radaris

Information, Insights

If you live in the United States, the data broker Radaris likely knows a great deal about you, and they are happy to sell what they know to anyone. But how much do we know about Radaris? Publicly available data indicates that in addition to running a dizzying array of people-search websites, the co-founders of Radaris operate multiple Russian-language dating services and affiliate programs. It also appears many of their businesses have ties to a…

Read More
08 Mar

Apple Released Security Updates for Multiple Products

Attacks, Insights, Malware

Apple released security updates to address vulnerabilities in Safari, macOS, watchOS, tvOS, and visionOS. A cyber threat actor could exploit some of these vulnerabilities to take control of an affected system.  CISA encourages users and administrators to review the following advisories and apply the necessary updates:  Safari 17.4  macOS Sonoma 14.4  macOS Ventura 13.6.5  macOS Monterey 12.7.4  watchOS 10.4  tvOS 17.4  visionOS 1.1 

Read More
08 Mar

Top 10 scams targeting seniors – and how to keep your money safe

Information

Scams The internet can be a wonderful place. But it’s also awash with fraudsters targeting people who are susceptible to fraud. Phil Muncaster 06 Mar 2024  •  , 5 min. read We’re all getting older. That’s good news for digital fraudsters, who see rich pickings to be had in a rapidly ageing society. They’re increasingly targeting senior citizens because they suspect these targets to have more money to steal, but potentially less digital savvy to…

Read More
07 Mar

CISA and NSA Release Cybersecurity Information Sheets on Cloud Security Best Practices

Attacks, Insights, Malware

Today, CISA and the National Security Agency (NSA) released five joint Cybersecurity Information Sheets (CSIs) to provide organizations with recommended best practices and/or mitigations to improve the security of their cloud environment(s). Use Secure Cloud Identity and Access Management Practices Use Secure Cloud Key Management Practices Implement Network Segmentation and Encryption in Cloud Environments Secure Data in the Cloud Mitigate Risks from Managed Service Providers in Cloud Environments CISA and NSA encourage all organizations to…

Read More