CyberSecure Specialist

31 Jan

Why do hackers target cryptocurrencies?

Attacks, Data Breaches

Cyber Security Hub explores why and how hackers are targeting cryptocurrency investors. With more than 420 million cryptocurrency users, more than 12,000 cryptocurrencies worldwide and an estimated value of US$2.2bn by 2026, the digital currency marketplace is growing rapidly. This rapid growth, however, has made it a target for cyber attackers looking to defraud victims.  Here, Cyber Security Hub explores the threat vectors used and vulnerabilities exploited by hackers specific to cryptocurrency-based cyber crime. Why…

Read More
31 Jan

Threat actors abuse Microsoft’s “verified publisher” status to exploit OAuth privileges

Data Breaches, Malware, Social Engineering

Researchers from cybersecurity firm Proofpoint claim to have discovered a new threat campaign involving malicious third-party OAuth apps that are used to infiltrate organizations’ cloud environments. According to a blog on the company’s website, threat actors satisfied Microsoft’s requirements for third-party OAuth apps by abusing the Microsoft “verified publisher” status, employing brand abuse, app impersonation and other social engineering tactics to lure users into authorizing malicious apps. The potential impacts of the campaign, which Proofpoint…

Read More
31 Jan

New UN cybercrime convention has a long way to go in a tight timeframe

Data Breaches, Malware, Social Engineering

Cybercrime is a growing scourge that transcends borders, spreading across the boundaries of virtually all the world’s nearly 200 nation-states. From ransomware attacks to rampant cryptocurrency theft, criminal exploitation of borderless digital systems threatens global economic security and the political welfare of all countries. Now, the United Nations has a major initiative to develop a new and more inclusive approach to addressing cybercrime. This revised global approach could spark new laws worldwide to battle cybercrime…

Read More
30 Jan

Sandworm Targets Ukraine’s National News Agency

Attacks, Malware

Wiper malware can be a very destructive tool for threat actors when targeting a specific group or business. Although difficult to defend against, there are ways to make organizations less susceptible to these types of attacks. Some of these methods include: • Making sure malware protection and AV is up to date• Regularly creating secure offline backups• Train employees on how to spot phishing attempts and other forms of attacks• Install updates/patch operating systems, software,…

Read More
30 Jan

New Golang-Based Malware Dubbed Titan Stealer

Attacks, Malware

“One of the primary reasons [threat actors] may be using Golang for their information stealer malware is because it allows them to easily create cross-platform malware that can run on multiple operating systems, such as Windows, Linux, and macOS. Additionally, the Go compiled binary files are small in size, making them more difficult to detect by security software,” reads Cyble’s technical analysis. The finding comes a little more than two months after SEKOIA announced Aurora…

Read More
30 Jan

Meta Awards $27,000 Bounty for 2FA Bypass Vulnerability

Information, News

A researcher has disclosed the details of a two-factor authentication (2FA) vulnerability that earned him a $27,000 bug bounty from Facebook parent company Meta.  Gtm Manoz of Nepal discovered in September 2022 that a system designed by Meta for confirming a phone number and email address did not have any rate-limiting protection. A fix was rolled out by Meta in October 2022 and the company highlighted Manoz’s findings in its annual bug bounty program report.…

Read More
30 Jan

How to survive below the cybersecurity poverty line

Data Breaches, Malware, Social Engineering

The security poverty line broadly defines a divide between the organizations that have the means and resources to achieve and maintain mature security postures to protect data, and those that do not. It was first coined by cybersecurity expert Wendy Nather in 2011, and the concept is just as relevant today as it was then (if not more so). It has widely become the benchmark for acceptable cybersecurity, often associated with factors such as company…

Read More
30 Jan

Economic headwinds could deepen the cybersecurity skills shortage

Data Breaches, Malware, Social Engineering

According to the most recent research report from ESG and the Information System Security Association International (ISSA), 57% of organizations claim that they’ve been impacted by the global cybersecurity skills shortage, while 44% of organizations believe the skills shortage has gotten worse over the past few years. The result? Increasing workloads on existing cybersecurity staff, job requisitions open for weeks or months, and high burnout rates and attrition for cybersecurity professionals. (ESG and ISSA will update…

Read More
28 Jan

Are you in control of your personal data? – Week in security with Tony Anscombe

Information

Data Privacy Week is a reminder to protect your data – all year round. Here are three privacy-boosting habits you can start today. Every action we  take on the internet generates data that is shared with online services and other parties. It stands to reason, then, that we need to assert control over how much and what kind of personal information we hand over to online services and generally limit the amount of our data…

Read More
28 Jan

SwiftSlicer: New destructive wiper malware strikes Ukraine

Information

Sandworm continues to conduct attacks against carefully chosen targets in the war-torn country ESET researchers have uncovered a new wiper attack in Ukraine that they attribute to the Sandworm APT group. Dubbed SwiftSlicer, the destructive malware was spotted on the network of a targeted organization on January 25th. It was deployed through Group Policy, which suggests that the attackers had taken control of the victim’s Active Directory environment. Some of the wipers spotted by ESET in…

Read More