CyberSecure Specialist

17 May

Insider threats surge across US CNI as attackers exploit human factors

Data Breaches, Malware, Social Engineering

Over three-quarters (77%) of organizations across US critical national infrastructure (CNI) have seen a rise in insider-driven cyberthreats in the last three years, according to new research from cybersecurity services firm Bridewell. The Cyber Security in CNI: 2023 report surveyed 525 cybersecurity decision makers in the US in the transport and aviation, utilities, finance, government, and communications sectors. It revealed that increased insider threat could be linked to heightened economic pressures and remote working. Threats…

Read More
17 May

Security breaches push digital trust to the fore

Data Breaches, Malware, Social Engineering

As digital transactions with customers, employees, suppliers, and other stakeholders grow, digital trustworthiness is set to become one of the most important enterprise-wide initiatives with the biggest potential impact (both negative and positive), even though it often has the smallest budget allocation. “Organizations are focusing on security and privacy, but if your customers don’t trust you, they will go elsewhere,” says Mark Thomas president of Escoute Consulting, which specializes in compliance. This view is borne…

Read More
17 May

Pig butchering scams: The anatomy of a fast‑growing threat

Information

How fraudsters groom their marks and move in for the kill using tricks from the playbooks of romance and investment scammers Sometimes you have to say things that go without saying: Social media and instant messaging have made staying in touch with friends easier than ever. These days, you’re never too far away from people within your social circle – as well as just about everybody else on the planet. What’s more, you don’t need…

Read More
17 May

ESET Research Podcast: A year of fighting rockets, soldiers, and wipers in Ukraine

Information

ESET experts share their insights on the cyber-elements of the first year of the war in Ukraine and how a growing number of destructive malware variants tried to rip through critical Ukrainian systems With the Russian invasion on February 24th, 2022, the age of wipers seems to have arrived as a growing number of destructive malware variants tried to rip through sensitive Ukrainian systems. While such attacks weren’t unheard of in the years preceding the…

Read More
17 May

You may not care where you download software from, but malware does

Information

Why do people still download files from sketchy places and get compromised as a result? One of the pieces of advice that security practitioners have been giving out for the past couple of decades, if not longer, is that you should only download software from reputable sites. As far as computer security advice goes, this seems like it should be fairly simple to practice. But even when such advice is widely shared, people still download…

Read More
17 May

Belkin Wemo Smart Plug V2 – the buffer overflow that won’t be patched

Information

by Paul Ducklin Researchers at IoT security company Sternum dug into a popular home automation mains plug from well-known device brand Belkin. The model they looked at, the Wemo Mini Smart Plug (F7C063) is apparently getting towards the end of its shelf life, but we found plenty of them for sale online, along with detailed advice and instructions on Belkin’s site on how to set them up. Old (in the short-term modern sense) though they…

Read More
16 May

Russian Hacker “Wazawaka” Indicted for Ransomware

Information, Insights

A Russian man identified by KrebsOnSecurity in January 2022 as a prolific and vocal member of several top ransomware groups was the subject of two indictments unsealed by the Justice Department today. U.S. prosecutors say Mikhail Pavolovich Matveev, a.k.a. “Wazawaka” and “Boriselcin” worked with three different ransomware gangs that extorted hundreds of millions of dollars from companies, schools, hospitals and government agencies. An FBI wanted poster for Matveev. Indictments returned in New Jersey and the…

Read More
16 May

ChatGPT’s Chief Testifies Before Congress, Calls for New Agency to Regulate Artificial Intelligence

Information, News

The head of the artificial intelligence company that makes ChatGPT told Congress on Tuesday that government intervention “will be critical to mitigate the risks of increasingly powerful” AI systems. “As this technology advances, we understand that people are anxious about how it could change the way we live. We are too,” OpenAI CEO Sam Altman testified at a Senate hearing Tuesday. Altman proposed the formation of a U.S. or global agency that would license the…

Read More
16 May

Arnica’s real-time, code-risk scanning tools aim to secure supply chain

Data Breaches, Malware, Social Engineering

Software supply chain security provider Arnica has added new real-time scanning tools to its namesake code-security suite, including static application security testing (SAST), infrastructure as code (IaC) scanning, software component analysis (SCA), and third-party package reputation checks. With the enhancements, the company claims to provide a comprehensive security solution that identifies and prevents the introduction of code risks in real time using a pipeline-less approach. “Arnica implements a pipeline-less security approach, which means that all…

Read More
16 May

Aqua Security releases Real-Time CSPM to tackle multi-cloud security risks

Data Breaches, Malware, Social Engineering

Cloud native security vendor Aqua Security has announced the launch of Real-Time CSPM, a new cloud security posture management solution designed to provide visibility and risk prioritization across multi-cloud security risks. Real-Time CSPM uses “real-time scanning” to pinpoint threats that evade agentless detection and reduce noise so security practitioners can identify, prioritize, and remediate the most important cloud security risks, according to the firm. It is the latest addition to the Aqua Cloud Security Platform.…

Read More