News
-
"GAO Checks Secret Service's Progress on Zero-Trust Architecture"According to the Government Accountability Office (GAO), the US Secret Service's zero-trust cybersecurity implementation plan needs to be updated. The government watchdog did, however, acknowledge the Secret Service's progress in this area. A zero-trust… -
"OIG: HHS Must Modernize Its Approach to Cybersecurity"The Office of Inspector General (OIG) urged the US Department of Health and Human Services (HHS) to improve data governance, secure HHS systems, and modernize its approach to cybersecurity across the department in the 2022 edition of its annual report on…
-
"Enterprise Healthcare Providers Warned of Lorenz Ransomware Threat"The Department of Health and Human Services Cybersecurity Coordination Center (HC3) has issued a warning to larger, enterprise healthcare organizations about the Lorenz ransomware threat group. The human-operated campaign is well-known for going after…
-
"MITRE's MDR Stress-Test Winners Combine Human Intelligence and AI for Stronger Cybersecurity"Cyberattacks have succeeded by exploiting gaps in corporate Information Technology (IT) environments, endpoints, and identities through social engineering and spear-phishing. They often immediately launch persistent threats and then steal credentials to…
-
"Experts Warn Threat Actors May Abuse Red Team Tool Nighthawk"Security researchers at Proofpoint warn that a new red-teaming tool dubbed “Nighthawk” may soon be leveraged by threat actors. Created in late 2021 by MDSec, the tool is best described as an advanced C2 framework, which functions like Cobalt Strike…
-
"Complex M&A Deals Pave Way for Security Gaps"IronNet researchers discovered a likely China-based threat actor that had infiltrated a US software company using legacy infrastructure from a previous company acquisition. Before deploying the Shack2 and China Chopper web shells, the threat actor used…
-
"Over 1,500 Apps Found Leaking API Keys and Potentially Exposing User Data"More than 1,500 apps have been discovered to be leaking the Algolia Application Programming Interface (API) key and application ID, potentially exposing user data. Researchers at CloudSEK discovered 32 applications with hard-coded critical admin secrets…
-
"Leaked Algolia API Keys Exposed Data of Millions of Users"Security researchers at CloudSEK have recently identified thousands of applications leaking Algolia API keys and tens of applications with hardcoded admin secrets, which could allow attackers to steal the data of millions of users. The researchers…
-
"BMC Firmware Vulnerabilities Expose OT, IoT Devices to Remote Attacks"Security researchers at Nozomi Networks have discovered more than a dozen vulnerabilities in baseboard management controller (BMC) firmware. BMC is a specialized processor that allows administrators to remotely control and monitor a device without…
-
"Cyberattacks Cost Enterprises $1,200 per Employee per Year"Every year, organizations pay $1,197 per employee to address successful cyber incidents involving email services, cloud collaboration apps or services, and web browsers. According to a new Osterman Research survey for Perception Point, a 500-employee…
-
"DOJ Shuts Down 'Pig Butchering' Domains Responsible for $10 Million in Victim Losses"The Department of Justice (DOJ) announced the seizure of seven domain names used in "pig butchering" schemes, in which cybercriminals develop relationships with victims before exploiting them. According to the US Attorney's Office for the Eastern…
-
"Cybersecurity Speaker Series: 5G Security Impacts National Security"The National Security Agency's (NSA) Cybersecurity Collaboration Center has released a video as part of its Cybersecurity Speaker Series on how 5G security relates to national security. Through the Speaker Series, NSA shares insights, lessons, and…