Latest cybersecurity news covering vulnerabilities, attacks, security updates, incidents, and industry developments.
3804 articles
Huntress says its Auto-Remediation feature can automatically address low-severity threats such as PUPs and malware artifacts after SOC review, with customers opting in to prior approval. The company reports faster incident resolution among users.
Team Cymru announced a free, Splunk-certified Scout app for Splunk Enterprise and Cloud versions 9.0–9.2. It adds threat data and dashboards for enriching indicators, correlating log data, and supporting investigations.
Huntress announced a $150 million Series D at a $1.55 billion valuation. It plans to invest in security research, acquisitions, platform capabilities, global expansion, and education for at-risk businesses.
Group-IB helped Italian law enforcement investigate a Telegram network selling fake Green Passes. The investigation identified 35 channels with about 100,000 users and led to searches and questioning of suspects; authorities warned similar scams could reappear.
Wiz introduced custom runtime rules for detecting process, network, DNS, and actor activity in cloud workloads, plus response policies that can simulate or block high-confidence threats.
HHS’s first HIPAA settlement linked to a ransomware incident required Doctors’ Management Services to pay $100,000 and adopt a corrective action plan. HHS also pledged to seek more resources and higher penalties for HIPAA violations.
Huntress says its endpoint and user data show healthcare facing trojans, RATs, RMM abuse, ransomware and business email compromise, including malicious inbox rules and VPN or proxy use.
A roundup covers the identification and sanctions of LockBit’s administrator, ransomware disruption at Ascension, dating-app and USPS phishing schemes, Chinese-attributed espionage, arrests, a cryptocurrency theft, and vulnerable Tinyproxy servers.
Wiz announced cloud visibility and scanning for hosted AI models, including alerts for suspicious commands and internet connections. The feature targets supply-chain risks from unsafe formats such as pickle.
Group-IB investigators helped identify Paunch, operator of the BlackHole and Cool exploit kits, leading to his 2013 arrest and the prosecution of associates. The takedown halted the kits’ operations, which had been used to deliver malware.
Huntress says ransomware activity shifted after Qakbot’s 2023 takedown, with reported increases in DarkGate, Akira, and LockBit activity from August to September. It also observed more attacks targeting small businesses and MSPs.
Wiz says its certified scanner now uses Red Hat security feeds for Red Hat products, applies Red Hat-specific severity ratings, identifies available Red Hat patches, and omits vulnerabilities Red Hat deems not affected.
The FBI seized BreachForums and linked Telegram channels on May 15, 2024. A new forum appeared on May 23, while users speculated—without confirmation—that it was a law-enforcement honeypot.
Wiz announced real-time CSPM scanning to detect cloud misconfigurations as they occur, provide visibility into newly provisioned resources, and support automated remediation. The company says its service includes more than 2,300 configuration checks.
A cybersecurity digest summarizes reports on malware campaigns, Iranian-linked cyber operations, a ransomware payment, breaches of South Korean defense contractors, help-desk attacks, card theft, phishing, and SIM swapping.
DarkOwl describes ransomware-related insurance data exposures, leaked customer and credential records, and dark-web offers of insurance documents that could support fraud. Some incidents and data origins are claims, not independently confirmed.
DarkOwl reviews major 2023 law-enforcement actions, including arrests and infrastructure seizures targeting ransomware groups, cybercrime services, malware operations, and fraud. It notes some groups quickly resumed activity after disruptions.
Talos reports a rise in brute-force attacks since at least March 18, 2024, targeting VPNs, web application logins and SSH. The activity uses common and organization-specific credentials and appears to originate from anonymizing services.
DarkOwl analysts report tax-related fraud activity across dark-web markets and Telegram, including phishing panels, stolen credentials, and tax documents for sale. They advise avoiding password reuse and watching for phishing and malvertising.
DarkOwl outlines Q1 updates to its darknet-intelligence platform, including secure browsing, MFA, and leak research tools. It also highlights newly collected leak data, including purported datasets involving DC Health Link and AT&T.
Wiz says it acquired Gem Security to add cloud detection and response capabilities to its platform, combining its cloud security posture management with Gem’s real-time analysis of cloud activity for security operations teams.
DarkOwl reviews cyber and hybrid activity tied to the conflict, including hacktivist attack claims, reported damage to undersea cables, and an attempt to misdirect an El Al flight. Some claims and attributions remain uncertain.
Wiz says its agentless SBOM search can locate package versions across cloud resources, helping teams identify vulnerable or outdated libraries and assess exposure, including to xz-utils versions 5.6.0 and 5.6.1.
Team Cymru and Proofpoint report that Latrodectus use increased in campaigns in February and March 2024. Their research links the loader to TA577 and TA578 and assesses that IcedID developers likely created it.
