CyberSecurity Updates

06 Feb

Will your incident response team fight or freeze when a cyberattack hits?

Data Breaches, Malware, Social Engineering

If there’s an intrusion or a ransomware attack on your company, will your security team come out swinging, ready for a real fight? CISOs may feel their staff is always primed with the technical expertise and training they need, but there’s still a chance they might freeze up when the pressure is on, says Bec McKeown, director of human science at cybersecurity training platform Immersive Labs. “You may have a crisis playbook and crisis policies…

Read More
05 Feb

Finland’s Most-Wanted Hacker Nabbed in France

Information, Insights

Julius “Zeekill” Kivimäki, a 25-year-old Finnish man charged with extorting a local online psychotherapy practice and leaking therapy notes for more than 22,000 patients online, was arrested this week in France. A notorious hacker convicted of perpetrating tens of thousands of cybercrimes, Kivimäki had been in hiding since October 2022, when he failed to show up in court and Finland issued an international warrant for his arrest. In late October 2022, Kivimäki was charged (and…

Read More
05 Feb

Fraudulent “CryptoRom” Apps Slip Through Apple and Google App Store Review Process

Information, News

Pig Butchering, also known as Sha Zhu Pan and CryptoRom, is an ugly name for an ugly scam. It is not new. What is new is that apps perpetrating the scam can be downloaded from the official Apple and Android app stores – giving them greater apparent validity to targets. The scam is a version of romance scam, where targets are befriended, lured in, persuaded to download a disguised malicious app, drawn into false cryptocurrency…

Read More
04 Feb

Key takeaways from ESET’s new APT Activity Report – Week in security with Tony Anscombe

Information

As our latest APT Activity Report makes abundantly clear, the threat of cyberespionage and stealthy attacks remains very real The threat of cyberespionage and stealthy cyberattacks remains very real, and the data from ESET’s T3 2022 APT Activity Report released this week backs this up. In this video, Tony shares some of the key takeaways from the report, which reviews the operations of some of the world’s most notorious nation state-affiliated and state-sponsored hacking collectives…

Read More
03 Feb

Critical vulnerability patched in Jira Service Management Server and Data Center

Data Breaches, Malware, Social Engineering

A critical vulnerability was fixed this week in Jira Service Management Server, a popular IT services management platform for enterprises, that could allow attackers to impersonate users and gain access to access tokens. If the system is configured to allow public sign-up, external customers can be affected as well. The bug was introduced in Jira Service Management Server and Data Center 5.3.0, so versions 5.3.0 to 5.3.1 and 5.4.0 to 5.5.0 are affected. Atlassian has…

Read More
03 Feb

Is that survey real or fake? How to spot a survey scam

Information

“Can I tell a legitimate survey apart from a fake one?” is the single most important question you need to answer for yourself before taking any surveys online Online surveys and quizzes are all over the internet. They’re quick and cheap to set up, easy for recipients to fill out, and simple for researchers to interpret. It’s no wonder that they remain a popular tool for marketers to reach and research their target audiences. Many…

Read More
03 Feb

OpenSSH fixes double-free memory bug that’s pokable over the network

Information

by Paul Ducklin The open source operating system distribution OpenBSD is well-known amongst sysadmins, especially those who manage servers, for its focus on security over speed, features and fancy front-ends. Fittingly, perhaps, its logo is a puffer fish – inflated, with its spikes ready to repel any wily hackers who might come along. But the OpenBSD team is probably best known not for its entire distro, but for the remote access toolkit OpenSSH that was…

Read More
03 Feb

Big China Spy Balloon Moving East Over US, Pentagon Says

Information, News

The Pentagon said at midday Friday that a Chinese spy balloon had moved eastward and was over the central United States, and that the U.S. rejected China’s claims that it was not being used for surveillance. Brig. Gen. Pat Ryder, Pentagon press secretary, refused to provide details on exactly where the balloon was or whether there was any new consideration of shooting it down. The military had ruled that option out, officials had said, due…

Read More
03 Feb

Microsoft Visual Studio Tools for Office Weaponized to Push Malware

Attacks, Malware

With macro execution now disabled by default in Office apps, this is just one of the many new phishing techniques that will likely rise to take its place. As with any phishing technique, the best way to prevent it is to make end users aware of this new threat through user education. However, there are some other possible detections to alert to this activity. One possible detection is to monitor for VSTO file creations near…

Read More
03 Feb

Google Ads Push Virtualized Malware Made for Antivirus Evasion

Attacks, Malware

These attacks show that the threat actors are interested in empowering old malware with new tactics, bringing it to new life. Google advertising attacks have become common, and users need to be cautious of the links that they are clicking, not only in email but in the browser as well. Source: https://www.bleepingcomputer.com/news/security/google-ads-push-virtualized-malware-made-for-antivirus-evasion/

Read More