CyberSecurity Updates

30 Nov

Cyber security advisory warns of emerging ransomware variant Rhysida

Malware

A new cybersecurity advisory has warned of the threats posed by emerging ransomware variant Rhysida. The advisory, published jointly by the Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI) and the Multi-State Information Sharing and Analysis Center (MS-ISAC), disseminates the known indicators of compromise (IOCs) and tactics, techniques and procedures (TTPs) of the Rhysida ransomware operators. It also outlines the mitigative steps organizations should take to reduce the likelihood and impact…

Read More
30 Nov

Multiple Vulnerabilities Affecting Web-Based Court Case and Document Management Systems

Attacks, Insights, Malware

CISA has assisted a researcher with coordinating the disclosure of multiple researcher-discovered vulnerabilities affecting web-based case and document management systems used by multiple state, county, and municipal courts. Affected systems include products from Tyler Technologies and Catalis and custom software used by specific counties in Florida. In summary, the vulnerabilities allow an unauthenticated, remote attacker to access sensitive documents by manipulating identifiers and file names in URLs. CISA understands that some of the vulnerabilities may…

Read More
29 Nov

Retail at risk: Top threats facing retailers this holiday season

Information

Business Security While it may be too late to introduce wholesale changes to your security policies, it doesn’t hurt to take a fresh look at where the biggest threats are and which best practices can help neutralize them Phil Muncaster 28 Nov 2023  •  , 6 min. read The holiday shopping season has begun in earnest. While retailers are focused on jockeying for an estimated $1.5 trillion in sales this year (and that’s just for…

Read More
29 Nov

Okta: Breach Affected All Customer Support Users

Data Breaches, Information, Insights

When KrebsOnSecurity broke the news on Oct. 20, 2023 that identity and authentication giant Okta had suffered a breach in its customer support department, Okta said the intrusion allowed hackers to steal sensitive data from fewer than one percent of its 18,000+ customers. But today, Okta revised that impact statement, saying the attackers also stole the name and email address for nearly all of its customer support users. Okta acknowledged last month that for several…

Read More
29 Nov

SecurityWeek to Host Cyber AI & Automation Summit on December 6th

Information, News

Virtual conference will explore cybersecurity use-cases for artificial intelligence (AI) technology and the race to protect LLM algorithms from adversarial use. SecurityWeek will host its 2023 Cyber AI & Automation Summit on December 6, 2023 as a fully immersive virtual conference, showcasing prominent technologists discussing the burgeoning AI-powered security landscape. The Cyber AI & Automation Summit will feature keynotes and editorial presentations from Chief Information Security Officers (CISOs), software developers, policy analysts, government representatives and…

Read More
29 Nov

The biggest cyber security attacks in November

Attacks, Data Breaches

Cyber Security Hub takes a look at the most significant cyber security incidents in November. Contents 2.2 million people impacted by McLaren Health Care data breach Toyota Financial Services systems forced offline by cyber attack Data breach at US nuclear energy firm exposes sensitive employee information BlackCat/APLHV ransomware gang reports victim’s “undisclosed” data breach Canadian Government data exposed by contractor cyber attack LockBit ransomware affiliates actively exploit Citrix Bleed vulnerability General Electric investigates claims of…

Read More
29 Nov

CISA Releases First Secure by Design Alert

Attacks, Insights, Malware

Today, CISA published guidance on How Software Manufacturers Can Shield Web Management Interfaces From Malicious Cyber Activity as a part of a new Secure by Design (SbD) Alert series.    This SbD Alert urges software manufacturers to proactively prevent the exploitation of vulnerabilities in web management interfaces by designing and developing their products using SbD principles:   Take Ownership of Customer Security Outcomes.  Embrace Radical Transparency and Accountability.    For more information on SbD principles,…

Read More
29 Nov

Ransomware attack disrupts multiple US hospital ERs

Attacks, Data Breaches

US healthcare provider Ardent Health Services is facing disruption to clinical and financial operations at six locations following a ransomware attack. Ardent Health Services and its affiliated entities (Ardent) became aware of a cybersecurity incident on the morning of November 23, according to a statement published this week. Ardent’s IT team immediately began working to understand the event, safeguard data and regain functionality, taking its network offline, it said. This suspended all user access to…

Read More
28 Nov

‘Tis the season to be wary: 12 steps to ruin a cybercriminal’s day

Information

Scams, Cybercrime The holiday shopping season may be the time to splurge, but it’s a also favorite time of year for cybercriminals to target shoppers with phony deals, phishing scams and other threats Phil Muncaster 27 Nov 2023  •  , 5 min. read The holiday shopping season is in full swing. It involves a seemingly endless few weeks of shopping mayhem as we rush to take advantage of bargains and buy gifts for our friends…

Read More
28 Nov

ID Theft Service Resold Access to USInfoSearch Data

Data Breaches, Information, Insights

One of the cybercrime underground’s more active sellers of Social Security numbers, background and credit reports has been pulling data from hacked accounts at the U.S. consumer data broker USinfoSearch, KrebsOnSecurity has learned. Since at least February 2023, a service advertised on Telegram called USiSLookups has operated an automated bot that allows anyone to look up the SSN or background report on virtually any American. For prices ranging from $8 to $40 and payable via…

Read More