A team of seasoned bug hunter move that highlights the perceived inadequacy of bug bounty programs, s has announced their decision to sell exclusive, exploitable vulnerabilities directly to interested parties.. Renowned for their expertise and credited by industry giants like Apple and Microsoft, th…
The federal government’s HR shop is pitching a legislative proposal to give federal agencies new authorities and flexibilities in how they hire and pay cybersecurity workers to members of Congress, but so far no member has stepped up to sponsor the bill.The package is meant to allow agencies across…
AndroxGh0st is a Python-based threat that targets Laravel applications by exploiting known vulnerabilities in Apache, PHPUnit, and Laravel to achieve remote code execution, deploy web shells, and exfiltrate sensitive configuration data. The tool also probes an…
Ukrainian cyber police have arrested three men suspected of hijacking the accounts of over 100 million internet users.The trio, aged between 20 and 40, were arrested by police in the country’s Kharkiv region under the guidance of the regional prosecutor’s office. Operating as part of a cybercrime gr…
According to the UAE Cybersecurity Council, in 2023, the UAE repelled over 50,000 cyberattacks daily. These findings, highlighted in a report from Frost & Sullivan (F&S), show the exponential growth of the region’s cybersecurity landscape – and serve as a sobering reminder of the rising thre…
An emerging and unsophisticated threat actor is spreading various types of malware with accounting report lures in a phishing campaign that relies on readily available malicious and legitimate software for its success.The active phishing campaign by an actor tracked as Fluffy Wolf demonstrates how e…
A cyberattacker and extortionist of a medical center has pleaded guilty to federal computer fraud and abuse charges in the US. Robert Purbeck, adopting the aliases “Lifelock” and “Studmaster” during his time as a cybercriminal, according to the Department of Justice (DoJ), stole personal data belong…
An Iran-linked hacking group claims to have breached the computer network of a sensitive Israeli nuclear installation in an incident declared by the ‘Anonymous’ hackers as a protest against the war in Gaza. The hackers claim to have stolen and published thousands of documents — including PDFs, email…
A threat actor going by the name verifiedBpp has purportedly put up for sale a significant amount of data allegedly sourced from the Saudi Ministry of Health. The dataset, spanning from 2020 to 2024, comprises 100 GB of information, including sensitive personal details such as full names, addresses,…
💡 Akamai security researcher Tomer Peled discovered a spoofing vulnerability in Microsoft Themes, allowing an attacker to coerce NTLM credentials. 💻 The vulnerability affects all Windows versions and was fixed in January’s Patch Tuesday 2024. 🔒 Exploiting the vulnerability requires the victim to dow…
In the past few years, an increasing number of tech companies, organizations, and even governments have been working on one of the next big things in the tech world: successfully building quantum computers. These actors see a lot of potential in the technology. Quantum computing spreads across a wid…
U.S. National Security Advisor Jake Sullivan and Environmental Protection Agency (EPA) Administrator Michael Regan warned governors today that hackers are “striking” critical infrastructure across the country’s water sector. In a joint letter sent on Tuesday, they asked for the governors’ support to…
Healthcare , HIPAA/HITECH , Industry Specific Facing AHA Lawsuit, HHS Tempers 2022 Warning About Tracking IP Addresses, Other PHI Marianne Kolbasuk McGee (HealthInfoSec) • March 19, 2024 HHS OCR has revised its previous guidance pertaining to the use of online trackers by HIPAA-regulat…
Smokeloader malware used by Russia-linked cybercriminals remains one of the major tools for financial hacks in Ukraine, according to a recent report. Between May and November 2023, researchers identified 23 Smokeloader campaigns aimed at various targets in Ukraine, including financial institutions a…
In the eBook “Active adversaries: Who they are and how they’re targeting your organization,” we outlined recent research from the Sophos X-Ops team on how active adversaries are breaching organizations in two primary ways: exploiting software vulnerabilities and using compromised credentials. Sophos…