News
  • "'Zombinder' Service Allows Cybercriminals to Easily Add Malware to Legitimate Apps"
    A newly discovered dark web service allows cybercriminals to easily add malware to legitimate applications. ThreatFabric researchers detailed "Zombinder," which was discovered while investigating several cases of threat actors employing Ermac, a type of…
  • “HHS Warns Royal Ransomware Threat Targeting Healthcare Providers”
    The Department of Health and Human Services (HHS) Cybersecurity Coordination Center has been made aware of targeted cyberattacks against the healthcare sector since the emergence of the human-operated ransomware threat group known as Royal in September.…
  • "NSA Releases Series on Protecting DOD Microelectronics From Adversary Influence"
    The National Security Agency's (NSA) Joint Federated Assurance Center (JFAC) Hardware Assurance Lab has made four Cybersecurity Technical Reports publicly available to help the Department of Defense (DOD) in protecting Field-Programmable gate array (FPGA…
  • "LF Electromagnetic Radiation Used for Stealthy Data Theft From Air-Gapped Systems"
    Mordechai Guri, a cybersecurity researcher from the Ben-Gurion University of the Negev in Israel who specializes in air gap jumping, has recently released a paper detailing yet another method that can be used to stealthily exfiltrate data from systems…
  • "SOHO Exploits Earn Hackers Over $100,000 on Day 3 of Pwn2Own Toronto 2022"
    Trend Micro’s Zero Day Initiative (ZDI) recently announced total payouts nearing $1 million after the first three days of Pwn2Own Toronto 2022, and there is one day left to go.  On the third day of the event, participants earned $253,500 for hacking…
  • "Over 4,000 Vulnerable Pulse Connect Secure Hosts Exposed to Internet"
    Security researchers at Censys have discovered that more than 4,000 internet-accessible Pulse Connect Secure hosts are impacted by at least one known vulnerability.  Touted as the most widely deployed SSL VPN solution, Pulse Connect Secure provides…
  • "Air-Gapped Networks Vulnerable to DNS Attacks"
    Researchers from the security firm Pentera discovered that common misconfigurations in how Domain Name System (DNS) is implemented in an enterprise environment can put air-gapped networks and the high-value assets they are designed to protect at risk of…
  • "PCI Secure Software Standard 1.2 Released"
    The PCI Security Standards Council (PCI SSC) has released version 1.2 of the PCI Secure Software Standard as well as the supporting program documentation. The PCI Secure Software Standard is one of two PCI Software Security Framework (SSF) standards. The…
  • "Cisco Discloses High-Severity IP Phone Bug With Exploit Code"
    Cisco has disclosed a critical vulnerability that could enable Remote Code Execution (RCE) and Denial-of-Service (DoS) attacks on its latest generation of IP phones. The company warned that its Product Security Incident Response Team (PSIRT) is aware of…
  • "Researchers Uncover New Drokbk Malware that Uses GitHub as a Dead Drop Resolver"
    Nemesis Kitten, a subgroup of an Iranian nation-state group, has been linked to Drokbk. This previously undocumented custom malware uses GitHub as a dead drop resolver to exfiltrate data from infected computers or to receive commands. According to…
  • "Social Engineering Hackers Use Excel to Target Crypto VIPs"
    North Korea's Lazarus Group is suspected of luring high-volume traders in cryptocurrency chat groups on Telegram into installing backdoors by asking for feedback on trading platform fee structures. Microsoft researchers and the digital forensics firm…
  • "Despite a Year of Warnings and Patching, Nearly 3 Out of 4 Organizations Still Vulnerable to Log4Shell"
    According to several security experts, the Log4Shell vulnerability will impact organizations for at least a decade. Those concerns appear to be justified, as a new report from Tenable finds that 72 percent of organizations are still vulnerable, even…