New Vulnerabilities Disclosed in SonicWall and Fortinet Network Security Products

New Vulnerabilities Disclosed in SonicWall and Fortinet Network Security Products,

SonicWall on Wednesday urged customers of Global Management System (GMS) firewall management and Analytics network reporting engine software to apply the latest fixes to secure against a set of 15 security flaws that could be exploited by a threat actor to circumvent authentication and access sensitive information.
Of the 15 shortcomings (tracked from CVE-2023-34123 through CVE-2023-34137), four

,

SonicWall on Wednesday urged customers of Global Management System (GMS) firewall management and Analytics network reporting engine software to apply the latest fixes to secure against a set of 15 security flaws that could be exploited by a threat actor to circumvent authentication and access sensitive information.
Of the 15 shortcomings (tracked from CVE-2023-34123 through CVE-2023-34137), four

, ,
https://thehackernews.com/2023/07/new-vulnerabilities-disclosed-in.html

Ransomware Extortion Skyrockets in 2023, Reaching $449.1 Million and Counting

Ransomware Extortion Skyrockets in 2023, Reaching $449.1 Million and Counting,

Ransomware has emerged as the only cryptocurrency-based crime to grow in 2023, with cybercriminals extorting nearly $175.8 million more than they did a year ago, according to findings from Chainalysis.
« Ransomware attackers are on pace for their second-biggest year ever, having extorted at least $449.1 million through June, » the blockchain analytics firm said in a midyear crypto crime report

,

Ransomware has emerged as the only cryptocurrency-based crime to grow in 2023, with cybercriminals extorting nearly $175.8 million more than they did a year ago, according to findings from Chainalysis.
« Ransomware attackers are on pace for their second-biggest year ever, having extorted at least $449.1 million through June, » the blockchain analytics firm said in a midyear crypto crime report

, ,
https://thehackernews.com/2023/07/ransomware-extortion-skyrockets-in-2023.html

The Risks and Preventions of AI in Business: Safeguarding Against Potential Pitfalls

The Risks and Preventions of AI in Business: Safeguarding Against Potential Pitfalls,

Artificial intelligence (AI) holds immense potential for optimizing internal processes within businesses. However, it also comes with legitimate concerns regarding unauthorized use, including data loss risks and legal consequences. In this article, we will explore the risks associated with AI implementation and discuss measures to minimize damages. Additionally, we will examine regulatory

,

Artificial intelligence (AI) holds immense potential for optimizing internal processes within businesses. However, it also comes with legitimate concerns regarding unauthorized use, including data loss risks and legal consequences. In this article, we will explore the risks associated with AI implementation and discuss measures to minimize damages. Additionally, we will examine regulatory

, ,
https://thehackernews.com/2023/07/the-risks-and-preventions-of-ai-in.html

Microsoft Thwarts Chinese Cyber Attack Targeting Western European Governments

Microsoft Thwarts Chinese Cyber Attack Targeting Western European Governments,

Microsoft on Tuesday revealed that it repelled a cyber attack staged by a Chinese nation-state actor targeting two dozen organizations, some of which include government agencies, in a cyber espionage campaign designed to acquire confidential data.
The attacks, which commenced on May 15, 2023, entailed access to email accounts affecting approximately 25 entities and a small number of related

,

Microsoft on Tuesday revealed that it repelled a cyber attack staged by a Chinese nation-state actor targeting two dozen organizations, some of which include government agencies, in a cyber espionage campaign designed to acquire confidential data.
The attacks, which commenced on May 15, 2023, entailed access to email accounts affecting approximately 25 entities and a small number of related

, ,
https://thehackernews.com/2023/07/microsoft-thwarts-chinese-cyber-attack.html

Chinese Hackers Deploy Microsoft-Signed Rootkit to Target Gaming Sector

Chinese Hackers Deploy Microsoft-Signed Rootkit to Target Gaming Sector,

Cybersecurity researchers have unearthed a novel rootkit signed by Microsoft that’s engineered to communicate with an actor-controlled attack infrastructure.
Trend Micro has attributed the activity cluster to the same actor that was previously identified as behind the FiveSys rootkit, which came to light in October 2021.
« This malicious actor originates from China and their main victims are the

,

Cybersecurity researchers have unearthed a novel rootkit signed by Microsoft that’s engineered to communicate with an actor-controlled attack infrastructure.
Trend Micro has attributed the activity cluster to the same actor that was previously identified as behind the FiveSys rootkit, which came to light in October 2021.
« This malicious actor originates from China and their main victims are the

, ,
https://thehackernews.com/2023/07/chinese-hackers-deploy-microsoft-signed.html

Python-Based PyLoose Fileless Attack Targets Cloud Workloads for Cryptocurrency Mining

Python-Based PyLoose Fileless Attack Targets Cloud Workloads for Cryptocurrency Mining,

A new fileless attack dubbed PyLoose has been observed striking cloud workloads with the goal of delivering a cryptocurrency miner, new findings from Wiz reveal.
« The attack consists of Python code that loads an XMRig Miner directly into memory using memfd, a known Linux fileless technique, » security researchers Avigayil Mechtinger, Oren Ofer, and Itamar Gilad said. « This is the first publicly

,

A new fileless attack dubbed PyLoose has been observed striking cloud workloads with the goal of delivering a cryptocurrency miner, new findings from Wiz reveal.
« The attack consists of Python code that loads an XMRig Miner directly into memory using memfd, a known Linux fileless technique, » security researchers Avigayil Mechtinger, Oren Ofer, and Itamar Gilad said. « This is the first publicly

, ,
https://thehackernews.com/2023/07/python-based-pyloose-fileless-attack.html

Microsoft Releases Patches for 132 Vulnerabilities, Including 6 Under Active Attack

Microsoft Releases Patches for 132 Vulnerabilities, Including 6 Under Active Attack,

Microsoft on Tuesday released updates to address a total of 132 new security flaws spanning its software, including six zero-day flaws that it said have been actively exploited in the wild.
Of the 132 vulnerabilities, nine are rated Critical, 122 are rated Important in severity, and one has been assigned a severity rating of « None. » This is in addition to eight flaws the tech giant patched in

,

Microsoft on Tuesday released updates to address a total of 132 new security flaws spanning its software, including six zero-day flaws that it said have been actively exploited in the wild.
Of the 132 vulnerabilities, nine are rated Critical, 122 are rated Important in severity, and one has been assigned a severity rating of « None. » This is in addition to eight flaws the tech giant patched in

, ,
https://thehackernews.com/2023/07/microsoft-releases-patches-for-130.html

Hackers Exploit Windows Policy Loophole to Forge Kernel-Mode Driver Signatures

Hackers Exploit Windows Policy Loophole to Forge Kernel-Mode Driver Signatures,

A Microsoft Windows policy loophole has been observed being exploited primarily by native Chinese-speaking threat actors to forge signatures on kernel-mode drivers.
« Actors are leveraging multiple open-source tools that alter the signing date of kernel mode drivers to load malicious and unverified drivers signed with expired certificates, » Cisco Talos said in an exhaustive two-part report shared

,

A Microsoft Windows policy loophole has been observed being exploited primarily by native Chinese-speaking threat actors to forge signatures on kernel-mode drivers.
« Actors are leveraging multiple open-source tools that alter the signing date of kernel mode drivers to load malicious and unverified drivers signed with expired certificates, » Cisco Talos said in an exhaustive two-part report shared

, ,
https://thehackernews.com/2023/07/hackers-exploit-windows-policy-loophole.html

How to Apply MITRE ATT&CK to Your Organization

How to Apply MITRE ATT&CK to Your Organization

,

Discover all the ways MITRE ATT&CK can help you defend your organization. Build your security strategy and policies by making the most of this important framework.
What is the MITRE ATT&CK Framework?
MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) is a widely adopted framework and knowledge base that outlines and categorizes the tactics, techniques, and procedures (TTPs)

,

Discover all the ways MITRE ATT&CK can help you defend your organization. Build your security strategy and policies by making the most of this important framework.
What is the MITRE ATT&CK Framework?
MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) is a widely adopted framework and knowledge base that outlines and categorizes the tactics, techniques, and procedures (TTPs)

, ,
https://thehackernews.com/2023/07/how-to-apply-mitre-att-to-your.html

SCARLETEEL Cryptojacking Campaign Exploiting AWS Fargate in Ongoing Campaign

SCARLETEEL Cryptojacking Campaign Exploiting AWS Fargate in Ongoing Campaign,

Cloud environments continue to be at the receiving end of an ongoing advanced attack campaign dubbed SCARLETEEL, with the threat actors now setting their sights on Amazon Web Services (AWS) Fargate.
« Cloud environments are still their primary target, but the tools and techniques used have adapted to bypass new security measures, along with a more resilient and stealthy command and control

,

Cloud environments continue to be at the receiving end of an ongoing advanced attack campaign dubbed SCARLETEEL, with the threat actors now setting their sights on Amazon Web Services (AWS) Fargate.
« Cloud environments are still their primary target, but the tools and techniques used have adapted to bypass new security measures, along with a more resilient and stealthy command and control

, ,
https://thehackernews.com/2023/07/scarleteel-cryptojacking-campaign.html