Category Security

Oct 17, 2024Ravie LakshmananRansomware / Network Security Cybersecurity researchers have gleaned additional insights into a nascent ransomware-as-a-service (RaaS) called Cicada3301 after successfully gaining access to the group’s affiliate panel on the dark web. Singapore-headquartered Group-IB said it contacted the threat…

RansomHub is now the number one ransomware operation in terms of claimed successful attacks, according to new data from Symantec. The security vendor’s latest threat intelligence report for Q3 2024, Ransomware: Threat Level Remains High in Third Quarter, is based…

As technology adoption has shifted to be employee-led, just in time, and from any location or device, IT and security teams have found themselves contending with an ever-sprawling SaaS attack surface, much of which is often unknown or unmanaged. This…

North Korean threat actors have adopted new tactics to escalate fake IT worker insider attacks, including extorting their former employers, researchers from Secureworks have found. The cybersecurity firm said the development, attributed to the Nickel Tapestry threat group, mark a…

Federal prosecutors in the U.S. have charged two Sudanese brothers with running a distributed denial-of-service (DDoS) botnet for hire that conducted a record 35,000 DDoS attacks in a single year, including those that targeted Microsoft’s services in June 2023. The…

The US Cybersecurity and Infrastructure Security Agency (CISA) has published a request for comment on its draft Product Security Bad Practices guidance. This upcoming guidance, developed as part of CISA’s Secure by Design initiative, will provide an overview of product…

Oct 17, 2024Ravie LakshmananVulnerability / Kubernetes A critical security flaw has been disclosed in the Kubernetes Image Builder that, if successfully exploited, could be abused to gain root access under certain circumstances. The vulnerability, tracked as CVE-2024-9486 (CVSS score: 9.8),…

WordPress’s emperor, Matt Mullenweg, demands a hefty tribute from WP Engine, and a battle erupts, leaving millions of websites hanging in the balance. Meanwhile, the Internet Archive, a digital library preserving our online history, is under siege from hackers. All…

The UK government has announced a new AI safety research program that it hopes will accelerate adoption of the technology by improving resilience to deepfakes, misinformation, cyber-attacks and other AI threats. The first phase of the AI Safety Institute’s Systemic Safety Grants…

Oct 16, 2024Ravie LakshmananVulnerability / Data Protection The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added a critical security flaw impacting SolarWinds Web Help Desk (WHD) software to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active…