Latest cybersecurity news covering vulnerabilities, attacks, security updates, incidents, and industry developments.
3810 articles
A September roundup summarizes the claimed ALPHV/BlackCat attack on MGM, malware and credential-theft campaigns, GhostSec’s release of alleged surveillance-tool code, a Snatch ransomware warning, and a Finnish dark-web marketplace takedown.
ThreatFabric says a new Xenomorph campaign uses phishing pages to distribute malicious APKs, targets more than 30 U.S. banks, Portuguese financial institutions and cryptocurrency wallets, and has driven thousands of downloads, particularly in Spain and the U.S.
Wiz says its SageMaker support can flag publicly accessible notebooks, detect pre-signed notebook URLs, identify excessive permissions, and help customers assess data-leakage and data-poisoning risks.
Hunt.io launched a statistics page showing real-time platform activity. The company says its system collects data including open ports, certificates, service detections, HTTP pages, SSH keys, and TLS fingerprints to help identify malicious infrastructure.
Wiz made its Runtime Sensor generally available for containerized workloads, adding detection customization, anomaly signals, container forensics, cloud-native response playbooks, and runtime validation of vulnerabilities in libraries.
Wiz and Fortinet announced an integration that uses Wiz’s cloud exposure insights to help Fortinet detect, prioritize, and automatically block or allow traffic to cloud virtual machines.
A missing repository condition in AWS IAM trust policies could let any GitHub repository assume a role. AWS improved its setup flow and began blocking new misconfigured policies; HashiCorp also announced Terraform-related measures.
Wiz reviews Microsoft’s update on how Storm-0558 may have obtained an MSA signing key, discusses authentication flaws and unanswered questions, and recommends steps organizations can take to reduce similar risks.
A monthly roundup highlights reports on cyber campaigns, ransomware exploiting a Veeam vulnerability, AI-themed Facebook ad credential theft, Android RATs, a cryptocurrency heist warning, a new CISA catalog entry and a US cyber workforce strategy.
Wiz announced Google Cloud security capabilities for BigQuery sensitive-data scanning, detecting data leakage and poisoning in Vertex AI, cloud forensics, and more than 50 Google Workspace threat detection rules.
The FBI and international partners disrupted Qakbot infrastructure. Huntress also describes how it used a Windows Defender sandbox artifact to block new infections on partner endpoints, while cautioning that Qakbot could return.
DarkOwl analysts found darknet discussions of jailbreaking ChatGPT and advertisements for fraud-focused chatbots. They report that some users question the tools’ effectiveness and say they could not verify claims about DarkBERT.
Wiz says it has earned CIS SecureSuite Vendor Certification for Kubernetes Benchmark v1.7.x and Docker Benchmark 1.6.0, with Level 1 and Level 2 coverage, and offers continuous checks and remediation guidance.
A July roundup highlights reporting on information stealers, ransomware and spyware campaigns, attacks targeting European ministries, and data breaches affecting Deutsche Bank customers and HCA patients.
Hunt.io introduced a threat-hunting platform offering active C2 server data, open-directory analysis, bulk enrichment, and a threat intelligence interface to help security teams investigate malicious infrastructure.
DarkOwl reports on CL0P’s MOVEit campaign and says rising DarkSonar signals appeared before many affected organizations’ attacks. The article also outlines victim and data-release figures and risks to organizations through third parties.
DarkOwl’s Q2 update describes DarkSonar and search features, reports 56 new data leaks and 900,000 documents added, and summarizes MOVEit-related victim listings and other breach data found in its collection.
The article examines how the UK’s APP fraud reimbursement scheme could affect banks and customers, including false claims, account and device takeovers, and gaps in fraud detection. It recommends coordinated teams and stronger technology deployment.
A June roundup highlights ransomware-related data concerns and DDoS warnings in Switzerland, arrests following the EncroChat takedown, and reported malware and campaign activity targeting aerospace, diplomatic and other organizations.
DarkOwl linked Killnet and Anonymous Sudan through shared Telegram posts and a joint claim of an attack on the European Investment Bank. Open-source reporting indicated website availability issues; other claims, including one involving IFC, lacked confirmation.
Wiz says its Digital Forensics capabilities let teams copy potentially compromised cloud workload volumes to a forensic account and download investigation packages, including runtime details for customers using its Runtime Sensor.
Talos says apps that interpret .zip filenames as URLs can trigger DNS or web requests, exposing internal filenames to domain owners. The leaked names may aid phishing and social engineering; organizations can monitor requests and consider filtering .zip domains.
Huntress reviews reports of PRC-linked Volt Typhoon intrusions, which used compromised network appliances as C2 relays and legitimate tools after access. The article discusses uncertainty about the threat and recommends perimeter hardening and better visibility.
Wiz says its lightweight eBPF Runtime Sensor collects network, process, and memory signals, correlating them with cloud and Kubernetes context to help detect activity across cloud-native workloads.
