Information

01 Nov

Dozens of Kernel Drivers Allow Attackers to Alter Firmware, Escalate Privileges

Information, News

VMware Carbon Black’s Threat Analysis Unit (TAU) has identified dozens of previously unknown vulnerable kernel drivers that could be exploited by attackers to alter firmware or escalate privileges. It’s not uncommon for threat actors, including cybercriminals and state-sponsored groups, to abuse kernel drivers in their operations. Such drivers can allow malicious hackers to manipulate system processes, maintain persistence on a system, and evade security products. VMware’s TAU collected roughly 18,000 Windows driver samples from VirusTotal…

Read More
01 Nov

20 scary cybersecurity facts and figures for a haunting Halloween

Information

Digital Security Cybersecurity Awareness Month draws to a close and Halloween is just around the corner, so here is a bunch of spine-tingling figures about some very real tricks and threats lurking online Phil Muncaster 30 Oct 2023  •  , 4 min. read October is Cybersecurity Awareness Month (CSAM) in the US and Canada and European Cybersecurity Month (ECMS) on the other side of the pond. These campaigns represent a great opportunity to share best…

Read More
01 Nov

Closing the gender gap: 7 ways to attract more women into cybersecurity

Information

We Live Progress Global Diversity Awareness Month is a timely occasion to reflect on the steps required to remove the obstacles to women’s participation in the security industry, as well as to consider the value of inclusion and diversity in the security workforce. 31 Oct 2023  •  , 7 min. read While our digital age is progressing by leaps and bounds and technology-related roles will remain in high demand in the future, the cybersecurity industry…

Read More
31 Oct

Cybersecurity Leaders Spooked by SEC Lawsuit Against SolarWinds CISO

Information, News

In a development sparking chatter and debate through the cybersecurity world, the lawsuit filed by the the U.S. Securities and Exchange Commission (SEC) against the Chief Information Security Officer (CISO) of SolarWinds is leaving CISOs across the industry spooked and reevaluating their roles. The lawsuit alleges that former SolarWinds CISO Timothy Brown failed to disclose critical information regarding the massive cyberattack on the company’s software supply chain that occurred in late 2020. The complex attack,…

Read More
31 Oct

.US Harbors Prolific Malicious Link Shortening Service

Information, Insights

The top-level domain for the United States — .US — is home to thousands of newly-registered domains tied to a malicious link shortening service that facilitates malware and phishing scams, new research suggests. The findings come close on the heels of a report that identified .US domains as among the most prevalent in phishing attacks over the past year. Researchers at Infoblox say they’ve been tracking what appears to be a three-year-old link shortening service…

Read More
30 Oct

SEC Charges SolarWinds and Its CISO With Fraud and Cybersecurity Failures

Information, News

In a surprising development on Monday that is spooking the cybersecurity community, the Securities and Exchange Commission (SEC) has filed charges against SolarWinds and its Chief Information Security Officer (CISO), Timothy G. Brown, alleging that the software company misled investors about its cybersecurity practices and known risks. The charges stem from alleged fraud and internal control failures related to known cybersecurity weaknesses that took place between the company’s October 2018 initial public offering (IPO) and…

Read More
29 Oct

Roundcube Webmail servers under attack – Week in security with Tony Anscombe

Information

Video The zero-day exploit deployed by the Winter Vivern APT group only requires that the target views a specially crafted message in a web browser 27 Oct 2023 This week, ESET research described how the Winter Vivern APT group has been exploiting a zero-day XSS vulnerability in Roundcube Webmail servers to target European governmental entities and a think tank. ESET researchers uncovered the attacks on October 11th while monitoring Winter Vivern’s cyberespionage operations, which typically…

Read More
28 Oct

ESET APT Activity Report Q2–Q3 2023

Information

ESET APT Activity Report Q2–Q3 2023 summarizes the activities of selected advanced persistent threat (APT) groups that were observed, investigated, and analyzed by ESET researchers from April 2023 until the end of September 2023. In the monitored timespan, we observed a notable strategy of APT groups utilizing the exploitation of known vulnerabilities to exfiltrate data from governmental entities or related organizations. Russia-aligned Sednit and Sandworm, North Korea-aligned Konni, and geographically unattributed Winter Vivern and Sturgeon…

Read More
27 Oct

In Other News: Ex-NSA Employee Spying for Russia, EU Threat Landscape, Cyber Education Funding

Information, News

SecurityWeek is publishing a weekly cybersecurity roundup that provides a concise compilation of noteworthy stories that might have slipped under the radar. We provide a valuable summary of stories that may not warrant an entire article, but are nonetheless important for a comprehensive understanding of the cybersecurity landscape. Each week, we will curate and present a collection of noteworthy developments, ranging from the latest vulnerability discoveries and emerging attack techniques to significant policy changes and…

Read More
27 Oct

Advanced ‘StripedFly’ Malware With 1 Million Infections Shows Similarities to NSA-Linked Tools

Information, Malware, News

A highly sophisticated piece of malware posing as a cryptocurrency miner has stayed under the radar for five years, infecting more than one million devices, cybersecurity firm Kaspersky warns. Dubbed StripedFly, the threat contains code sequences previously observed in the malware used by the threat actor known as the Equation Group, which has been linked to the US National Security Agency. Designed as a modular framework, StripedFly can target both Windows and Linux and comes…

Read More