Stay Updated with the Latest Tech News
Get ahead of the curve with the latest insights, trends, and analysis in the tech world.
Browse by Category
Popular Topics
#General #Development #Mobile Development #Cloud & DevOps #Cybersecurity & Privacy #AI & Data Science #Hardware & Gadgets #Design & UXNew CRON#TRAP Malware Infects Windows by Hiding in Linux VM to Evade Antivirus
Cybersecurity researchers have flagged a new malware campaign that infects Windows systems with a Linux virtual instance containing a backdoor capable of establishing remote access to the compromised hosts. The "intriguing" campaign, codenamed CRON#TRAP, starts with a malicious Windows shortcut (LNK) file likely distributed in the form of a ZIP archive via a phishing email. "What makes the CRON#
Share on Facebook
Share in Tweet (rip twitter)
Share on LinkedIn
Share on Reddit
Share on Threads
Share on Bluesky
CISA Alerts to Active Exploitation of Critical Palo Alto Networks Vulnerability
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added a now-patched critical security flaw impacting Palo Alto Networks Expedition to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vulnerability, tracked as CVE-2024-5910 (CVSS score: 9.3), concerns a case of missing authentication in the Expedition migration tool that
Business Leaders Shift to Tangible AI Results, Finds New TeamViewer Study
China-Backed MirrorFace Trains Sights on EU Diplomatic Corps
Chinese APT groups increasingly lean on open source platform SoftEther VPN for network access. Now they're lending their know-how to Iranian counterparts.
Canadians Expected to Lose More Than $569M to Scams in 2024
Canada Closes TikTok Offices, Citing National Security
Questions remain over what a corporate ban will achieve, since Canadians will still be able to use the app.
Max-Critical Cisco Bug Enables Command-Injection Attacks
Though Cisco reports of no known malicious exploitation attempts, but thanks to a CVSS 10 out of 10 security vulnerability (CVE-2024-20418) three of its wireless access points are vulnerable to remote, unauthenticated cyberattacks.
Host of House panels getting briefed on major Chinese hacker telecom breaches
The reported scope of the Salt Typhoon hacks has expanded in recent days and weeks, from the incoming president to top U.S. officials. The post Host of House panels getting briefed on major Chinese hacker telecom breaches appeared first on CyberScoop.
TSA issues proposed cyber mandates for pipelines, rail, airlines
The post-Colonial Pipeline proposal requires the agency's charges to follow one cyber mandate to rule them all. The post TSA issues proposed cyber mandates for pipelines, rail, airlines appeared first on CyberScoop.
'SteelFox' Malware Blitz Infects 11K Victims With Bundle of Pain
The malware combines a miner and data stealer, and it packs functions that make detection and mitigation a challenge.
Has the Cybersecurity Workforce Peaked?
While training and credentialing organizations continue to talk about a "gap" in skilled cybersecurity workers, demand — especially for entry-level workers —has plateaued, spurring criticism of the latest rosy stats that seem to support a hot market for qualified cyber pros.
Gootloader Cyberattackers Target Bengal-Cat Aficionados in Oz
It's unclear what the threat actors have against this particular breed of cat, but it's taking down the kitty's enthusiasts with SEO-poisoned links and malware payloads.
Prompt Injection Defenses Against LLM Cyberattacks
Interesting research: “Hacking Back the AI-Hacker: Prompt Injection as a Defense Against LLM-driven Cyberattacks“: Large language models (LLMs) are increasingly being harnessed to automate cyberattacks, making sophisticated exploits more accessible and scalable. In response, we propose a new defense strategy tailored to counter LLM-driven cyberattacks. We introduce Mantis, a defensive framework that exploits LLMs’...
The Power of Process in Creating a Successful Security Posture
Establishing realistic, practitioner-driven processes prevents employee burnout, standardizes experiences, and closes many of the gaps exposed by repeated one-offs.
North Korean Hackers Target Crypto Firms with Hidden Risk Malware on macOS
A threat actor with ties to the Democratic People's Republic of Korea (DPRK) has been observed targeting cryptocurrency-related businesses with a multi-stage malware capable of infecting Apple macOS devices. Cybersecurity company SentinelOne, which dubbed the campaign Hidden Risk, attributed it with high confidence to BlueNoroff, which has been previously linked to malware families such as
Subverting LLM Coders
Really interesting research: “An LLM-Assisted Easy-to-Trigger Backdoor Attack on Code Completion Models: Injecting Disguised Vulnerabilities against Strong Detection“: Abstract: Large Language Models (LLMs) have transformed code com- pletion tasks, providing context-based suggestions to boost developer productivity in software engineering. As users often fine-tune these models for specific applications, poisoning and...
Congress must demand a study of America’s cyber forces
A bipartisan proposal should move forward despite Defense Department objections. The post Congress must demand a study of America’s cyber forces appeared first on CyberScoop.
A Hacker's Guide to Password Cracking
Defending your organization’s security is like fortifying a castle—you need to understand where attackers will strike and how they’ll try to breach your walls. And hackers are always searching for weaknesses, whether it’s a lax password policy or a forgotten backdoor. To build a stronger defense, you must think like a hacker and anticipate their moves. Read on to learn more about hackers'
China’s elite hackers expand target list to European Union
Beijing's hackers are also using an open-source VPN tool for persistence. The post China’s elite hackers expand target list to European Union appeared first on CyberScoop.
ESET APT Activity Report Q2 2024–Q3 2024
An overview of the activities of selected APT groups investigated and analyzed by ESET Research in Q2 2024 and Q3 2024
5 Most Common Malware Techniques in 2024
Tactics, techniques, and procedures (TTPs) form the foundation of modern defense strategies. Unlike indicators of compromise (IOCs), TTPs are more stable, making them a reliable way to identify specific cyber threats. Here are some of the most commonly used techniques, according to ANY.RUN's Q3 2024 report on malware trends, complete with real-world examples. Disabling of Windows Event Logging
SteelFox and Rhadamanthys Malware Use Copyright Scams, Driver Exploits to Target Victims
An ongoing phishing campaign is employing copyright infringement-related themes to trick victims into downloading a newer version of the Rhadamanthys information stealer since July 2024. Cybersecurity firm Check Point is tracking the large-scale campaign under the name CopyRh(ight)adamantys. Targeted regions include the United States, Europe, East Asia, and South America. "The campaign
China-Aligned MirrorFace Hackers Target EU Diplomats with World Expo 2025 Bait
The China-aligned threat actor known as MirrorFace has been observed targeting a diplomatic organization in the European Union, marking the first time the hacking crew has targeted an entity in the region. "During this attack, the threat actor used as a lure the upcoming World Expo, which will be held in 2025 in Osaka, Japan," ESET said in its APT Activity Report for the period April to
Cisco Releases Patch for Critical URWB Vulnerability in Industrial Wireless Systems
Cisco has released security updates to address a maximum severity security flaw impacting Ultra-Reliable Wireless Backhaul (URWB) Access Points that could permit unauthenticated, remote attackers to run commands with elevated privileges. Tracked as CVE-2024-20418 (CVS score: 10.0), the vulnerability has been described as stemming from a lack of input validation to the web-based management
Malicious PyPI Package ‘Fabrice’ Found Stealing AWS Keys from Thousands of Developers
Cybersecurity researchers have discovered a malicious package on the Python Package Index (PyPI) that has racked up thousands of downloads for over three years while stealthily exfiltrating developers' Amazon Web Services (AWS) credentials. The package in question is "fabrice," which typosquats a popular Python library known as "fabric," which is designed to execute shell commands remotely over
Canada Orders TikTok to Shut Down Canadian Operations Over Security Concerns
The Canadian government on Wednesday ordered ByteDance-owned TikTok to dissolve its operations in the country, citing national security risks, but stopped short of instituting a ban on the popular video-sharing platform. "The decision was based on the information and evidence collected over the course of the review and on the advice of Canada's security and intelligence community and other
Symbiotic Security Launches Scanning Tool to Help Fix Flaws in Code
The company comes out of stealth with a tool that integrates directly into the developer's IDE to find flaws, offer remediation advice, and training materials to write secure code.
Fake Copyright Infringement Emails Spread Rhadamanthys
Attackers are triggering victims' deep-seated fear of getting in trouble in order to spread the sophisticated stealer across continents.
Chinese Gamers Targeted in Winos4.0 Framework Scam
Campaigns like Silver Fox and Void Arachne are deploying the framework, using social media and messaging platforms to lure in victims.
Google Cloud to Enforce MFA on Accounts in 2025
Google Cloud will take a phased approach to make multifactor authentication mandatory for all users.
German Law Could Protect Researchers Reporting Vulns
The draft amendment also includes prison time for those who access systems to maliciously spy or intercept data.
Attackers Breach IT-Based Networks Before Jumping to ICS/OT Systems
SANS's "2024 State of ICS.OT Cybersecurity report" highlights the most common types of attack vectors used against ICT/OT networks.
International Police Effort Obliterates Cybercrime Network
Interpol disrupts 22,000 malicious IP addresses, 59 servers, 43 electronic devices, and arrests 41 suspected cybercriminals.
Despite Emerging Regulations, Mobile Device, IoT Security Requires More Industry Attention
Omdia Principal Analyst Hollie Hennessy says that until a promising new set of regulations around the world comes online, connected device security entails a shared responsibility among consumers, enterprises, and manufacturers.