Collaborate Disseminate
Despite what security vendors might say, there is no way to comprehensively solve our supply-chain security challenges, posits JupiterOne CISO Sounil Yu. We can only manage them. Continue reading Supply-Chain Security Is Not a Problem…It’s a Predicament
Attackers increasingly are using malicious JavaScript packages to steal data, engage in cryptojacking and unleash botnets, offering a wide supply-chain attack surface for threat actors. Continue reading Thousands of Malicious npm Packages Threaten Web Apps
The notorious Iranian APT is fortifying its arsenal with new malicious tools and evasion tactics and may even be behind the Memento ransomware.
Continue reading Charming Kitten Sharpens Its Claws with PowerShell Backdoor
The warning follows a Citizen Lab report that found the official, mandatory app has an encryption flaw that “can be trivially sidestepped.” Besides burners, here are more tips on staying cyber-safe at the Games. Continue reading FBI: Use a Burner Phone at the Olympics
ATO attacks are evolving. Jason Kent, hacker-in-residence at Cequence Security, discusses what new-style cyberattacks look like in the wild. Continue reading The Account Takeover Cat-and-Mouse Game
The researcher found that he could gain unauthorized camera access via a shared iCloud document that could also “hack every website you’ve ever visited.”
Continue reading Apple Pays $100.5K Bug Bounty for Mac Webcam Hack
The group once again dangled fake job opportunities at engineers in a spear-phishing campaign that used Windows Update as a living-off-the-land technique and GitHub as a C2.
Continue reading Lazarus APT Uses Windows Update to Spew Malware
The sweetened deal came on the same day that Trustwave SpiderLabs published a new way to bypass Outlook security to deliver malicious links to victims.
Continue reading Zerodium Spikes Payout for Zero-Click Outlook Zero-Days
QNAP had to push out an unexpected (and not entirely welcome) NAS device update, and Delta Electronics’ network has been crippled.
Continue reading Conti, DeadBolt Target Delta, QNAP
MacOS malware Shlayer and Bundlore may have variations, but the behavior of their attacks have not changed – attacking older macOS versions and poorly-protected websites. Continue reading Shlayer and Bundlore MacOS Malware Strains – How Uptycs EDR Detection Can Help