Cyberwarfare / Nation-State Attacks , Forensics , Fraud Management & Cybercrime Issues Include Attackers’ Use of Amazon’s Infrastructure Scott Ferguson (Ferguson_Writes) • February 24, 2021 (Source: Jarek Tuszyński via Wikipedia) The Senate Intelligence Committee’s hearing Tuesday about the supply chain attack that affected SolarWinds and dozens of other companies and federal agencies answered…
The vSphere Client (HTML5) contains an SSRF (Server Side Request Forgery) vulnerability due to improper validation of URLs in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue by sending a POST request to vCenter Server plugin leading to information disclosure.
Cyberpunk 2077’s next big patch has been delayed following developer CD Projekt Red’s disclosure that it fell victim to a ransomware attack earlier this month. The next big patch, 1.2, is now scheduled for a release sometime in the second half of March. “While we dearly wanted to deliver Patch 1.2 for Cyberpunk 2077 in…
MONTREAL, Feb. 23, 2021 (GLOBE NEWSWIRE) — Bombardier (TSX: BBD.B) announced today that it recently suffered a limited cybersecurity breach. An initial investigation revealed that an unauthorized party accessed and extracted data by exploiting a vulnerability affecting a third-party file-transfer application, which was running on purpose-built servers isolated from the main Bombardier IT network. In…
Fraud Management & Cybercrime , Social Engineering Zscaler: Malware Buries Itself Into TeamViewer Theo Nassiokas, Head of Technology, Governance & Risk Controls, Westpac Group • February 24, 2021 Attack flow for Minebridge malware (Source: Zscaler) The operators behind the Minebridge remote-access Trojan have updated the malware, which is targeting security researchers by using…
Nearly eight in 10 businesses globally feel that the pandemic has increased the likelihood of a state-led or -sponsored cyberattack on their organisation, revealed a new survey by the Economist Intelligence Unit (EIU) and the Cybersecurity Tech Accord on Monday. The businesses call for greater international political cooperation to mitigate these state-sponsored threats. The survey…
Feb 23 (Reuters) – Top executives at Texas-based software company SolarWinds, digital giant Microsoft and cybersecurity firms FireEye and CrowdStrike are expected on Tuesday to defend their companies’ responses to a sprawling series of breaches blamed on Russian hackers when they face the U.S. Senate’s Select Committee on Intelligence. The four are expected to argue…
Researchers: ‘Jian’ Hacking Tool Targeted Zero-Day Flaw in Windows Scott Ferguson (Ferguson_Writes) • February 22, 2021 A Chinese hacking group reportedly “cloned” and deployed a zero-day exploit developed by the U.S. National Security Agency’s Equation Group before Microsoft patched the Windows vulnerability that was being exploited in 2017, according to an analysis published…
The New York Department of Financial Services (NYDFS) has issued an alert to instant-quote websites, particularly car insurers, warning of a growing campaign to steal nonpublic information (NPI). The agency says it learned of the threat after receiving reports from auto insurers that cybercriminals were targeting their premium quote sites to steal driver’s license numbers….
The hacking group behind the recent cyber-attack targeting Accellion’s FTA file transfer service appears to be linked to a threat actor known as FIN11, security researchers with FireEye’s Mandiant division reveal. The attacks on FTA, a soon-to-be-retired service, started in mid-December 2020 and resulted in the compromise of data pertaining to multiple Accellion customers. As…
