Infosecurity News
Suspected Phobos Ransomware Admin Extradited to US
A Russian national suspected of involvement in Phobos ransomware has appeared in court in the US
Companies Take Over Seven Months to Recover From Cyber Incidents
Fastly claims global organizations are taking 25% longer than expected to recover from security incidents
Swiss Cyber Agency Warns of QR Code Malware in Mail Scam
Switzerland’s National Cyber Security Centre has warned of a new QR code scam in fake MeteoSwiss letters spreading Android malware
‘ClickFix’ Cyber-Attacks for Malware Deployment on the Rise
Proofpoint researchers have observed the growing use of the ClickFix social engineering tactic, which lures people into running malicious content on their computer
Fake Donald Trump Assassination Story Used in Phishing Scam
A phishing email claims to be from the New York Times with a story about an assassination attempt against President-elect Donald Trump
Surge in DocuSign Phishing Attacks Target US State Contractors
Phishing attacks using DocuSign impersonations targeting state agencies have surged 98% since Nov 8
North Korean IT Worker Network Tied to BeaverTail Phishing Campaign
BeaverTail malware has been used to target tech job seekers through fake recruiters, Palo Alto Networks’ Unit 42 has found
FTC Records 50% Drop in Nuisance Calls Since 2021
The US Federal Trade Commission is celebrating a halving of unwanted telemarketing and scam calls since 2021
UK Shoppers Lost £11.5m Last Christmas, NCSC Warns
The UK’s National Cyber Security Centre is urging shoppers to stay safe this Christmas after revealing they lost £11.5m to fraudsters in 2023
Palo Alto Networks Confirms New Zero-Day Being Exploited by Threat Actors
The security provider has elevated its warning about a vulnerability affecting firewall management interfaces after observing active exploitation
Bitfinex Hacker Jailed for Five Years Over Billion Dollar Crypto Heist
Ilya Lichtenstein hacked into the cryptocurrency exchange in 2016 and stole around 120,000 bitcoins
watchTowr Finds New Zero-Day Vulnerability in Fortinet Products
The new vulnerability was named “FortiJump Higher” due to its similarity with the “FortiJump” vulnerability discovered in October
Ransomware Groups Use Cloud Services For Data Exfiltration
SentinelOne described some of ransomware groups’ favorite techniques for targeting cloud services
Sitting Ducks DNS Attacks Put Global Domains at Risk
Over 1 million domains are vulnerable to “Sitting Ducks” attack, which exploits DNS misconfigurations
Microsoft Power Pages Misconfiguration Leads to Data Exposure
Misconfigurations in Microsoft Power Pages granting excessive access permissions expose sensitive data, risking PII to unauthorized users
Massive Telecom Hack Exposes US Officials to Chinese Espionage
The FBI and CISA have confirmed that US officials’ private communications have been compromised
API Security in Peril as 83% of Firms Suffer Incidents
Over 80% of UK organizations suffered an API security incident in the past year, with each costing over £400,000
Bank of England U-turns on Vulnerability Disclosure Rules
The UK’s financial regulators have discarded plans to force critical suppliers to disclose new vulnerabilities
Hive0145 Targets Europe with Advanced Strela Stealer Campaigns
Hive0145 is targeting Spain, Germany, Ukraine with Strela Stealer malware in invoice phishing tactic
