Security News
Email is one of the most popular tools exploited by cybercriminals to launch attacks against organizations. One particular tactic favored by criminals is the Business Email Compromise in which the scammer spoofs a trusted contact to defraud a company out of money.
Malicious hackers are exploiting an old VPN security flaw to compromise SonicWall SRC devices, according to a warning from security vendor CrowdStrike. The vulnerability in question, tracked as CVE-2019-7481, was originally patched by SonicWall back in 2019 but CrowdStrike is warning that the firmware updates did not properly mitigate the issue on legacy SRA devices.
Don't miss today's live webinar to learn how you can better stop Vendor Email Compromise attacks when your partners or suppliers have been compromised or spoofed. What is VEC. The weakness in email security.
ESET has published details of an advanced persistent threat crew that appears to have deployed recent supply chain attack methods against targets including "Electronics manufacturers," although it didn't specify which. "Victims of its campaigns are located in East Asia as well as the Middle East and include governments, religious organizations, electronics manufacturers and universities," said ESET in a research report published today that names the APT crew as Gelsemium.
Belgium's Federal Public Service Interior has suffered a "Complex, sophisticated and targeted cyberattack." When Microsoft released out-of-band security updates for Exchange Server in early March to fix zero-day vulnerabilities exploited by the Hafnium threat actor, the FBS Interior called in the Center for Cybersecurity Belgium to help with the patching of their Exchange servers.
Each one of these supply chain attacks targeted a different piece of implicitly trusted infrastructure-infrastructure that you may or not be paying attention to as a potential target in your organization. Package squatting via software package repositories.
More than one year into the pandemic, banks, insurers, and other financial institutions report costly consequences to falling short of protecting their massive data troves from cloud-based attacks and network disruptions. Biggest cybersecurity issues for financial institutions Data breaches are an increasingly significant cost burden for the industry: Worldwide, financial firms that experienced a data breach reported estimated average losses of roughly $4.2 million per attack, with U.S. organizations hit hardest at $4.7 million in estimated losses.
Microsoft detected a large-scale business email compromise campaign that targeted more than 120 organizations using typo-squatted domains registered a few days before the attacks started. BEC scammers use various tactics to compromise business email accounts, later used to redirect payments to bank accounts under their control or target employees in gift card scams.
HashiCorp, an open-source company whose Terraform product is widely used for automated cloud deployments, has revealed a private code-signing key was exposed thanks to the compromised Codecov script discovered earlier this month. Specifically, it said "a subset of HashiCorp's CI pipelines used the affected Codecov component" and "The GPG private key used for signing hashes used to validate HashiCorp product downloads... was exposed."
Most educational organizations experienced phishing attempts, while 33% were victims of an account compromise attack, and 27% were hit by ransomware in 2020, according to a new report from cybersecurity vendor Netwrix. Fewer than half of non-education sector organizations experienced the same level of attack.