Security

Payloads recently found on compromised Ivanti Connect Secure appliances could be from the same, sophisticated threat actor, according to incident response provider Synacktiv. A new malware analysis from Synacktiv researcher Théo Letailleur showed that the 12 Rust payloads discovered by Volexity as part of its investigation into two Ivanti Connect Secure VPN remote code execution

Teenagers from Western English-speaking countries are increasingly targeted by financial sextortion attacks conducted by Nigeria-based cybercriminals, the Network Contagion Research Institute (NCRI) has found. A majority of these happen on social media platforms like TikTok, Snapchat, Instagram, and Wizz. Financial sextortion, the illegal act of adults manipulating minors, or other adults, into sharing sexually suggestive

More than a quarter (27%) of organizations have banned the use of generative AI among their workforce over privacy and data security risks, at least temporarily, according to the Cisco 2024 Data Privacy Benchmark Study. Most organizations have also instituted controls on these tools. Nearly two-thirds (63%) have established limitations on what data can be

Ukrainian security services have arrested a hacker for allegedly targeting government websites and providing intelligence to Russia to carry out missile strikes on the city of Kharkiv. Security Service of Ukraine (SSU) revealed that its cyber unit has identified the individual, who it accused of following instructions from Russia’s intelligence service, the FSB. Hacker Spied

New evidence shows that Iran’s intelligence and military services are associated with cyber activities targeting Western countries through their network of contracting companies. A string of multi-year leaks and doxxing efforts led by anti-Iranian government hacktivists and dissident networks has uncovered an intricate web of entities associated with the Islamic Revolutionary Guard Corps (IRGC) involved

North Korea-backed threat actors hacked more crypto platforms than ever in 2023 but stole less of the digital currency in total than in 2022. Crypto research firm Chainalysis has found that North Korean adversaries stole slightly over $1.0bn in 2023, compared with around $1.7bn in 2022. The 2022 spike, which set a record of stolen

The emergence of cybercrime-as-a-service (RaaS) has lowered the entry barrier into cybercrime by allowing cybercriminals to specialize in only one aspect of the attack supply chain. This can be coding malware, developing phishing kits, crafting initial access methods, releasing vulnerability exploits, or sharing data dumps listing potential victims. However, at the end of the chain,

The UK government has published a new Code of Practice on cybersecurity governance, targeting directors and other senior business leaders. The draft document aims to establish cybersecurity as a key focus for businesses, on par with financial and legal risks. The code highlights a number of areas business leaders should focus on to enhance their

A lack of understanding combined with budgetary squeezes are significant obstacles for organization’s navigating data privacy and compliance with data protection laws, according to industry body ISACA. In The State of Data Privacy in 2024 report, ISACA found that over half (57%) of cyber professionals are not confident in their organization’s privacy team’s ability to

Cybersecurity researchers at Proofpoint have identified the resurgence of TA866 in email threat campaigns after a hiatus of nine months.  Writing in an advisory published today, the firm said it thwarted a large-scale campaign on January 11 involving several thousand emails primarily targeting North America.  The malicious emails, adopting an invoice-themed guise, were equipped with

South Africa, known to be ‘the world’s most internet-addicted country,’ finds itself plagued by the internet’s dark underbelly: ransomware. It is the most targeted nation in Africa for these cyber-attacks and places eighth globally, according to the South African Council for Scientific and Industrial Research. Despite its digital dependency, the country’s cyber strategy is still

Russian threat group Coldriver has expanded its targeting of Western officials with the use of malware to steal sensitive data, Google’s Threat Analysis Group (TAG) has revealed. Coldriver, AKA Star Blizzard, is linked to Russia’s intelligence service, the FSB. It is known to focus on credential phishing campaigns targeting high-profile NGOs, former intelligence and military

One of the UK’s leading cybersecurity agencies has announced plans to convene a new group of industry experts who will help it track existing and emerging threats to the nation. The National Cyber Security Centre (NCSC) said its new Cyber League would bring together both its own and third-party experts to “work on the biggest

With elections expected to occur in over 50 countries in 2024, the misinformation threat will be top of mind. OpenAI, the developer of the AI chatbot ChatGPT and the image generator DALL-E, has announced new measures to prevent abuse and misinformation ahead of big elections this year. In a January 15 post, the firm announced

Crypto heists increased in volume by 42% in 2023, with 283 incidents, according to an analysis by consumer awareness firm Comparitech. This compares to 199 crypto theft incidents in 2022. However, the total monetary value stolen in 2023 fell by 51% in 2022, from $3.55bn to $1.75bn. Worryingly, $16.93m of crypto has already been stolen

The British Library has begun restoring its online services as it continues to recover from last year’s ransomware attack. Sir Roly Keating, Chief Executive at the institution, confirmed in a blog post that the main British Library catalogue will return online on Monday, January 15. This includes details of its printed books, journals, maps, music

Cybercriminal are exploiting employee desires for job satisfaction and orgnaizations’ promise of benefits with a flurry of phishing scams. Pay raises, promotions, holiday bonuses and other ‘life-impacting’ updates are attractive phishing lures, email security provider Cofense warned in a January 10 blog post. A typical approach is to embed links to commodity software used by

The US Cybersecurity and Infrastructure Security Agency (CISA) has urged critical infrastructure organizations to address vulnerabilities affecting nine industrial control systems (ICS) products. The report, dated January 11, 2024, highlighted a series of high and critical severity vulnerabilities in products widely used in sectors like energy, manufacturing and transportation. Users and administrators in these sectors

A vulnerability has been discovered in a popular Bosch smart thermostat, allowing potential attackers to send commands to the device and replace its firmware, according to Bitdefender. The vulnerability impacts the Wi-Fi microcontroller that acts as a network gateway for the thermostat’s logic microcontroller. The Bosch smart thermostat products BCC101, BCC102 and BCC50, from version