CyberSecurity Updates

16 Mar

Why red team exercises for AI should be on a CISO’s radar

Data Breaches, Malware, Social Engineering

AI and machine learning (ML) capabilities present a huge opportunity for digital transformation but open yet another threat surface that CISOs and risk professionals will have to keep tabs on. Accordingly, CISOs will need to direct their teams to conduct red team exercises against AI models and AI-enabled applications — just as security teams do with any traditional application, platform, or IT system. AI increasingly powers business decision-making, financial forecasting, predictive maintenance, and an endless list…

Read More
16 Mar

When and how to report a breach to the SEC

Data Breaches, Malware, Social Engineering

New cybersecurity reporting requirements for publicly traded companies are expected to be enacted in the spring of 2023, with proposed rules from the US Securities and Exchange Commission (SEC) looking for more information and transparency from those hit with security incidents. Under the proposal, the SEC would implement three new rules that public companies will need to follow: A requirement that companies report any cybersecurity event within four business days of determining that it was…

Read More
16 Mar

Russian hacktivist group targets India’s health ministry

Data Breaches, Malware, Social Engineering

A Russian hacktivist group has claimed to have breached the health management information system of India, which could contain the health data of millions of Indian citizens. “On 15 March 2023, CloudSek’s contextual AI digital risk platform XVigil discovered a threat actor group claiming to have targeted an Indian government website,” cybersecurity firm CloudSek said in a post. “An analysis of the samples shared concluded that the affected entity is the Health Management Information system…

Read More
15 Mar

Rubrik Confirms Data Theft in GoAnywhere 0-Day Attack

Attacks, Malware

While typically it is recommended to maintain good threat intelligence and an adequate patching schedule, neither of these recommendations would apply in this case as this vulnerability was exploited as a 0-day prior to the patch that was released in February. The best defense against 0-day vulnerabilities is to employ a defense-in-depth strategy. While it won’t stop the 0-day, employing this strategy makes it much more likely to detect the attack at an earlier step…

Read More
15 Mar

Cybercriminals Exploit SVB Collapse to Steal Money and Data

Attacks, Malware

The wisest course of action for former SVB customers is to maintain composure and adhere to the FDIC’s and the U.S. government’s established communication channels. Avoid emails from strange websites and double-check any requests for bank account changes or payments in regards to SVB accounts. Any requests for changes or payments should be verified with a direct communication using a phone call instead of email. Email accounts may be compromised, and all requests should be…

Read More
15 Mar

Microsoft Fixes Outlook Zero-day Used by Russian Attackers Since April 2022

Attacks, Malware

Microsoft urges customers to immediately patch their systems against CVE-2023-23397 or add users to the Protected Users group in Active Directory and block outbound SMB (TCP port 445) as a temporary mitigation to minimize the impact of the attacks. Redmond also released a dedicated PowerShell script to help admins check if any users in their Exchange environment have been targeted using this Outlook vulnerability. It “checks Exchange messaging items (mail, calendar and tasks) to see…

Read More
15 Mar

The slow Tick‑ing time bomb: Tick APT group compromise of a DLP software developer in East Asia

Information

ESET Research uncovered a campaign by APT group Tick against a data-loss prevention company in East Asia and found a previously unreported tool used by the group ESET researchers discovered a campaign that we attribute with high confidence to the APT group Tick. The incident took place in the network of an East Asian company that develops data-loss prevention (DLP) software. The attackers compromised the DLP company’s internal update servers to deliver malware inside the…

Read More
15 Mar

Firefox 111 patches 11 holes, but not 1 zero-day among them…

Information

by Paul Ducklin Heard of cricket (the sport, not the insect)? It’s much like baseball, except that batters can hit the ball wherever they like, including backwards or sideways; bowlers can hit the batter with the ball on purpose (within certain safety limits, of course – it just wouldn’t be cricket otherwise) without kicking off a 20-minute all-in brawl; there’s almost always a break in the middle of the afternoon for tea and cake; and…

Read More
15 Mar

Microsoft fixes two 0-days on Patch Tuesday – update now!

Information

by Paul Ducklin Thanks to the precise four-week length of February this year, last month’s coincidence of Firefox and Microsoft updates has happened once again. Last month, Microsoft dealt with three zero-days, by which we mean security holes that cybercriminals found first, and figured out how to abuse in real-life attacks before any patches were available. (The name zero-day, or just 0-day, is a reminder of the fact that even the most progressive and proactive…

Read More
15 Mar

CISA released four Industrial…

Attacks, Insights, Malware

CISA released four Industrial Control Systems (ICS) advisories on March 14, 2023. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. CISA encourages users and administrators to review the newly released ICS advisories for technical details and mitigations: ICSA-23-073-01 Omron CJ1m PLC ICSA-23-073-02 Autodesk FBX SDK ICSA-23-073-03 GE iFIX ICSA-23-073-04 AVEVA Plant SCADA and AVEVA Telemetry Server

Read More