CyberSecure Specialist

26 May

Watch Now: Threat Detection and Incident Response Virtual Summit

Information, News

All sessions from SecurityWeek’s Threat Detection & Incident Response Summit  are now available to watch on demand. This fully immersive online event brought together security practitioners from around the world to share war stories on breaches and the murky world of high-end cyberattacks. Gain insights and learn strategies as we discuss threat hunting tools and frameworks, and explore value of threat intelligence data in the defender’s security stack. Agenda sessions available to watch on demand include…

Read More
25 May

How to check for new exploits in real time? VulnCheck has an answer

Data Breaches, Malware, Social Engineering

Cybersecurity professionals who need to track the latest vulnerability exploits now have a new tool designed to make their job easier, with the launch today of VulnCheck XDB, a database of exploits and proof of concepts hosted on Git repositories. The tool, from cyberthreat intelligence provider VulnCheck, is aimed at helping vulnerability researchers and security teams prioritize vulnerabilities based on the availability and criticality of new exploits that have been made public. “There is a…

Read More
25 May

Inactive accounts pose significant account takeover security risks

Data Breaches, Malware, Social Engineering

Inactive and non-maintained accounts pose significant security risks to users and businesses, with cybercriminals adept at using information stolen from forgotten or otherwise non-upheld accounts to exploit active accounts. That’s according to Okta’s first Customer Identity Trends Report which surveyed more than 20,000 consumers in 14 countries about their online experiences and attitudes towards digital security and identity. It found that increasing identity sprawl can trigger significant account takeover (ATO) security risks due to accounts…

Read More
25 May

CISA Warns of Hurricane/Typhoon-Related Scams

Attacks, Insights, Malware

CISA urges users to remain on alert for malicious cyber activity following a natural disaster such as a hurricane or typhoon, as attackers target potential disaster victims by leveraging social engineering tactics, techniques, and procedures (TTPs). Social engineering TTPs include phishing attacks that use email or malicious websites to solicit personal information by posing as a trustworthy organization, notably as charities providing relief. Exercise caution in handling emails with hurricane/typhoon-related subject lines, attachments, or hyperlinks…

Read More
25 May

Digital security for the self‑employed: Staying safe without an IT team to help

Information

Nobody wants to spend their time dealing with the fallout of a security incident instead of building up their business Approximately one in seven people in Europe and the United States are self-employed, often realizing their dream to be in charge of their own destiny and having more freedom and control over their careers. But with nominally more freedom to shape the trajectory of their future comes extra jeopardy. This often means little or no…

Read More
25 May

Ransomware tales: The MitM attack that really had a Man in the Middle

Information, Uncategorized

by Paul Ducklin It’s taken more than five years for justice to be served in this case, but the cops and the courts got there in the end. The UK law enforcement office SEROCU, short for South East Regional Organised Crime Unit, this week reported the peculiar tale of one Ashley Liles, the literal Man in the Middle whom we referred to in the headline. These days, we usually expand the jargon term MitM to…

Read More
25 May

Drop in Insider Breaches Drives Decline in Intrusions at OT Organizations

Information, News

The 2023 State of Operational Technology and Cybersecurity Report published on Wednesday by Fortinet shows a drop in the number of intrusions at OT organizations. The report is based on a survey of 570 OT professionals, representing the manufacturing, transportation, healthcare, oil and gas, energy, chemical, and water sectors in countries such as the US, Canada, Australia, Brazil, Mexico, the UK, France, Germany, Japan, India, South Africa, and Egypt. A vast majority of the respondents…

Read More
25 May

Microsoft links attacks on American critical infrastructure systems to China

Data Breaches, Malware, Social Engineering

Microsoft and a few American intelligence agencies have detected malware of Chinese origin deployed in critical infrastructure systems in Guam and elsewhere in the United States. The malicious activity, focused on post-compromise credential access and network security discovery, has been linked to Volt Typhoon, a state-sponsored threat actor in China. “Volt Typhoon has been active since mid-2021 and has targeted critical infrastructure organizations in Guam and elsewhere in the United States,” Microsoft said in a…

Read More
25 May

ChatGPT and data: Everything you need to know

Attacks, Data Breaches

Since OpenAI unleashed ChatGPT onto the world, opinion has been split between those who believe it will radically improve the way we live and work and those who are worried about its potential for disruption, particularly on the privacy of individuals and organizations. There have already been incidents where sensitive data has been leaked and employees have landed in hot water after entering confidential company information into the chatbot, with some countries even issuing a…

Read More
25 May

IOTW: Luxottica confirms 2021 data leak of 70 million customers’ information

Attacks, Data Breaches

Italian eyewear brand Luxottica, parent company of Ray-Ban and Oakley, has confirmed that the data of more than 70 million customers was accessed in 2021. The data was exposed after a third-party data storage provider used by Luxottica suffered a cyber attack. It has not currently been made public how the hackers gained access to its network, or which company the third party was. The data breach and theft was revealed after a malicious actor…

Read More