Security News > 2023 > November
The email threat landscape is experiencing a profound transformation, adapting to new challenges and exploiting emerging vulnerabilities with speed and sophistication. In this Help Net Security video, Usman Choudhary, CPTO at VIPRE Security Group, discusses how cybercriminals modify their tactics to align with shifting consumer behaviors while taking advantage of technological advancements to carry out their activities and elude capture.
The rate of data encryption following a ransomware attack in healthcare was the highest in the last three years, according to Sophos. Only 24% of healthcare organizations were able to disrupt a ransomware attack before the attackers encrypted their data-down from 34% in 2022; this is the lowest rate of disruption reported by the sector over the past three years.
The security performance of financial applications generally outperforms other industries, with automation, targeted security training, and scanning via Application Programming Interface contributing to a year-over-year reduction in the percentage of applications containing flaws, according to Veracode. While nearly 72% of applications in the financial services sector contain security flaws, this is the lowest of all industries analyzed and an improvement since last year.
Sam Bankman-Fried, the founder and former CEO of crypto exchange FTX and trading firm Alameda Research, has been found guilty of seven criminal charges. FTX was once valued at $32 billion, and Bankman-Fried was fêted as a visionary thanks in part to his willingness to spruik his firm, and crypto, to almost anyone willing to put a microphone in front of his face.
Atlassian warned admins that a public exploit is now available for a critical Confluence security flaw that can be used in data destruction attacks targeting Internet-exposed and unpatched instances. Tracked as CVE-2023-22518, this is an improper authorization vulnerability with a 9.1/10 severity rating affecting all versions of Confluence Data Center and Confluence Server software.
Ace Hardware confirmed that a cyberattack is preventing local stores and customers from placing orders as the company works to restore 196 servers. Ace Hardware is a hardware store retailer-owned cooperative that operates 17 distribution centers and 5,700 shops across the United States, China, Panama, and the UAE. The cooperative employs 12,500 people and has an annual revenue that surpasses $9 billion.
Global leaders from 28 nations have gathered in the U.K. for an influential summit dedicated to AI regulation and safety. Day one of the AI Safety Summit culminated in the signing of the "Landmark" Bletchley Declaration on AI Safety, which commits 28 participating countries - including the U.K., U.S. and China - to jointly manage and mitigate risks from artificial intelligence while ensuring safe and responsible development and deployment.
A new macOS malware dubbed 'KandyKorn' has been spotted in a campaign attributed to the North Korean Lazarus hacking group, targeting blockchain engineers of a cryptocurrency exchange platform. At the final stage of the attack, a loader known as HLoader is used, which impersonates Discord and uses macOS binary code-signing techniques seen in past Lazarus campaigns.
The BlackCat ransomware gang claims it breached the network of healthcare giant Henry Schein and stole dozens of terabytes of data, including payroll data and shareholder information. Henry Schein is a healthcare solutions provider and a Fortune 500 company with operations and affiliates in 32 countries and revenue of over $12 billion in 2022.
Jessie Jamieson, staff research engineer for decision science operations at cyber exposure management firm Tenable, said what has been absent from the strategy detail released so far has been a focus on the one thing that underpins everything: data science. In general, "Everyone is a little behind from a data perspective," Jamieson said, with the obvious recent example being the headlong rush around the world to use data as part of artificial intelligence models, including generative AI. "Some companies are being more careful, but there is so much discussion at the moment about developing these things quickly without asking questions like how these plug into a data process or what the process is around generating training data," she said.