Lazarus exploit Log4Shell vulnerability to deliver novel RAT malware
North Korea-backed group Lazarus has been spotted exploiting the Log4Shell vulnerability (CVE-2021-44228) and novel malware written in DLang (i.e., the memory-safe D programming language). “This campaign consists of continued opportunistic targ.....»»
Commercial spyware vendor exploits used by Kremlin-backed hackers, Google says
Findings undercut pledges of NSO Group and Intgellexa their wares won't be abused. Enlarge (credit: Getty Images) Critics of spyware and exploit sellers have long warned that the advanced hacking sold by commercial surve.....»»
Romance fraud doesn"t only happen online—it can turn into real-world deception
We often think of fraudsters as people on the opposite side of the world. They will manipulate and exploit victims through words on a computer screen, or loving messages through the phone. But romance fraud can also happen in person, with the fraudst.....»»
RISCPoint RADAR provides real-time vulnerability detection across multiple attack surfaces
RISCPoint Advisory Group launched RADAR, an all-in-one cybersecurity platform. Combining continuous threat discovery with expert-led Penetration Testing as a Service (PTaaS), RADAR represents a significant leap forward in proactive security and risk.....»»
Third-party risk management is under the spotlight
In the aftermath of the CrowdStrike IT outage, new research has uncovered a critical vulnerability within financial institutions regarding supply chain resilience. The outage has demonstrated the need for greater digital supply chain resilience, part.....»»
Unpatchable 0-day in surveillance cam is being exploited to install Mirai
Vulnerability is easy to exploit and allows attackers to remotely execute commands. Enlarge (credit: Getty Images) Malicious hackers are exploiting a critical vulnerability in a widely used security camera to spread Mira.....»»
Dragos Platform updates streamline OT threat and vulnerability workflows
Dragos announced the latest release of the Dragos Platform, an OT network visibility and cybersecurity platform. The updates provide industrial and critical infrastructure organizations with even deeper and enriched visibility into all assets in thei.....»»
Expel partners with Wiz to enhance security for cloud environments
Expel announced a new strategic partnership with Wiz, a cloud-native application protection platform (CNAPP). The partnership provides an integration offering MDR for Wiz toxic risk combinations (including vulnerabilities, secrets, malware, and threa.....»»
Critical Fortra FileCatalyst Workflow vulnerability patched (CVE-2024-6633)
Organizations using Fortra’s FileCatalyst Workflow are urged to upgrade their instances, so that attackers can’t access an internal HSQL database by exploiting known static credentials (CVE-2024-6633). “Once logged in to the HSQLDB,.....»»
APT group exploits WPS Office for Windows RCE vulnerability (CVE-2024-7262)
ESET researchers discovered a remote code execution vulnerability in WPS Office for Windows (CVE-2024-7262). APT-C-60, a South Korea-aligned cyberespionage group, was exploiting it to target East Asian countries. When examining the root cause, ESET d.....»»
AI modeling can deliver more benefits, less risk for water partnerships
A Cornell-led research collaboration found that cooperative partnerships seeking to spread the cost burden of water infrastructure projects among regional stakeholders often end up forcing local partners to bear the brunt of underlying supply and fin.....»»
Apple’s Glowtime event creates big expectations – how will it deliver?
The iPhone 16 line-up will be unveiled on Monday, and Apple’s Glowtime event name and graphics seem to be pretty clear pointers to a focus on Apple Intelligence. Anyone who is running the current iOS 18.1 beta will have instantly recognised the eve.....»»
Versa Director zero-day exploited to compromise ISPs, MSPs (CVE-2024-39717)
Advanced, persistent attackers have exploited a zero-day vulnerability (CVE-2024-39717) in Versa Director to compromise US-based managed service providers with a custom-made web shell dubbed VersaMem by the researchers. The malware harvests credentia.....»»
Hackers infect ISPs with malware that steals customers’ credentials
Zero-day that was exploited since June to infect ISPs finally gets fixed. Enlarge (credit: Getty Images) Malicious hackers likely working on behalf of the Chinese government have been exploiting a high-severity zero-day.....»»
New Lexus brand "taste" will come from sweeping rework of body rigidity
Lexus says it has found the missing piece in its quest to match the long-lauded driving dynamics of Germany's big premium players — better body rigidity. To deliver a better signature, Toyota's top-shelf marque is reworking ride and handling across.....»»
Daily 5 report for Aug. 26: Can Ford deliver the goods with new products?
Ford's future product pipeline will emphasize its subbrands including Mustang, Maverick and Bronco......»»
SonicWall patches critical flaw affecting its firewalls (CVE-2024-40766)
SonicWall has patched a critical vulnerability (CVE-2024-40766) in its next-gen firewalls that could allow remote attackers unauthorized access to resources and, in specific conditions, to crash the appliances. About CVE-2024-40766 CVE-2024-40766 is.....»»
Adversaries love bots, short-lived IP addresses, out-of-band domains
Fastly found 91% of cyberattacks – up from 69% in 2023 – targeted multiple customers using mass scanning techniques to uncover and exploit software vulnerabilities, revealing an alarming trend in attacks spreading across a broader target base. In.....»»
Nuclei: Open-source vulnerability scanner
Nuclei is a fast and customizable open-source vulnerability scanner powered by YAML-based templates. With its flexible templating system, Nuclei can be adapted to perform various security checks. It can send requests to multiple targets using customi.....»»
Android malware steals payment card data using previously unseen technique
Attacker then emulates the card and makes withdrawals or payments from victim's account. Enlarge (credit: d3sign) Newly discovered Android malware steals payment card data using an infected device’s NFC reader and rela.....»»
A new malware threat to macOS adds to the data-stealing surge
Mac users face another macOS threat that aims to steal your data and targets x86_64 and Arm architectures......»»