Category Security

The new UK government has vowed to treat cybersecurity as a matter of national security and is “considering all options” to curb cybercrime, according to the Minister for Security, Dan Jarvis. This includes a review of the 1990 Computer Misuse…

Oct 22, 2024Ravie LakshmananVulnerability / Supply Chain Cybersecurity researchers have discovered a number of suspicious packages published to the npm registry that are designed to harvest Ethereum private keys and gain remote access to the machine via the secure shell…

Retailers experienced over half a million (569,884) AI-driven attacks per day according to a recent six-month analysis by cybersecurity firm Imperva. These attacks originate from AI tools like ChatGPT, Claude, and Gemini, alongside specialized bots that are designed to scrape…

Oct 22, 2024Ravie LakshmananMalware / Threat Intelligence Two malware families that suffered setbacks in the aftermath of a coordinated law enforcement operation called Endgame have resurfaced as part of new phishing campaigns. Bumblebee and Latrodectus, which are both malware loaders,…

Nearly 75% of US Senate campaign websites lack Domain-based Message Authentication, Reporting and Conformance (DMARC) protections, leaving them vulnerable to cyber-attacks, a new report by Red Sift has revealed. The study, authored by Sean S. Costigan, PhD, Managing Director of Resilience Strategy…

Russian-speaking users have become the target of a new phishing campaign that leverages an open-source phishing toolkit called Gophish to deliver DarkCrystal RAT (aka DCRat) and a previously undocumented remote access trojan dubbed PowerRAT. “The campaign involves modular infection chains…

Security researchers have uncovered a new flaw in some AI chatbots that could have allowed hackers to steal personal information from users. A group of researchers from the University of California, San Diego (UCSD) and Nanyang Technological University in Singapore…

The Securities and Exchange Commission (SEC) has charged four current and former public technology companies with making materially misleading disclosures regarding cybersecurity risks and intrusions relating to the SolarWinds supply chain attack in 2020. Unisys Corp, Avaya Holdings Corp., Check…

Oct 22, 2024Ravie LakshmananDocker Security / Cloud Security Bad actors have been observed targeting Docker remote API servers to deploy the SRBMiner crypto miner on compromised instances, according to new findings from Trend Micro. “In this attack, the threat actor…

Cloud-based cyber-attacks saw a marked increase in 2024, with threat actors adopting new tactics to exploit cloud resources at an unprecedented scale, according to Sysdig Threat Research Team’s (TRT) latest report.  Beyond LLMjacking, which was observed by the firm to…