Preventing Insider Threats in Your Active Directory

Preventing Insider Threats in Your Active Directory,

Active Directory (AD) is a powerful authentication and directory service used by organizations worldwide. With this ubiquity and power comes the potential for abuse. Insider threats offer some of the most potentials for destruction. Many internal users have over-provisioned access and visibility into the internal network.
Insiders’ level of access and trust in a network leads to unique

,

Active Directory (AD) is a powerful authentication and directory service used by organizations worldwide. With this ubiquity and power comes the potential for abuse. Insider threats offer some of the most potentials for destruction. Many internal users have over-provisioned access and visibility into the internal network.
Insiders’ level of access and trust in a network leads to unique

, ,
https://thehackernews.com/2023/03/preventing-insider-threats-in-your.html

WhatsApp, Telegram : comment des copies pirates peuvent voler vos cryptos

WhatsApp, Telegram : comment des copies pirates peuvent voler vos cryptos,

WhatsApp

Des versions pirates de WhatsApp et Telegram circulent sur la toile. Ces déclinaisons factices cachent de dangereux virus destinés à s’emparer de vos cryptomonnaies à votre insu…

,

WhatsApp

Des versions pirates de WhatsApp et Telegram circulent sur la toile. Ces déclinaisons factices cachent de dangereux virus destinés à s’emparer de vos cryptomonnaies à votre insu…

, ,
https://www.01net.com/actualites/whatsapp-telegram-hackers-siphonner-cryptos.html

Rogue NuGet Packages Infect .NET Developers with Crypto-Stealing Malware

Rogue NuGet Packages Infect .NET Developers with Crypto-Stealing Malware,

The NuGet repository is the target of a new « sophisticated and highly-malicious attack » aiming to infect .NET developer systems with cryptocurrency stealer malware.
The 13 rogue packages, which were downloaded more than 160,000 times over the past month, have since been taken down.
« The packages contained a PowerShell script that would execute upon installation and trigger a download of a ‘

,

The NuGet repository is the target of a new « sophisticated and highly-malicious attack » aiming to infect .NET developer systems with cryptocurrency stealer malware.
The 13 rogue packages, which were downloaded more than 160,000 times over the past month, have since been taken down.
« The packages contained a PowerShell script that would execute upon installation and trigger a download of a ‘

, ,
https://thehackernews.com/2023/03/rogue-nuget-packages-infect-net.html

NAPLISTENER: New Malware in REF2924 Group’s Arsenal for Bypassing Detection

NAPLISTENER: New Malware in REF2924 Group’s Arsenal for Bypassing Detection

,

The threat group tracked as REF2924 has been observed deploying previously unseen malware in its attacks aimed at entities in South and Southeast Asia.
The malware, dubbed NAPLISTENER by Elastic Security Labs, is an HTTP listener programmed in C# and is designed to evade « network-based forms of detection. »
REF2924 is the moniker assigned to an activity cluster linked to attacks against an entity

,

The threat group tracked as REF2924 has been observed deploying previously unseen malware in its attacks aimed at entities in South and Southeast Asia.
The malware, dubbed NAPLISTENER by Elastic Security Labs, is an HTTP listener programmed in C# and is designed to evade « network-based forms of detection. »
REF2924 is the moniker assigned to an activity cluster linked to attacks against an entity

, ,
https://thehackernews.com/2023/03/new-naplistener-malware-used-by-ref2924.html

BreachForums Administrator Baphomet Shuts Down Infamous Hacking Forum

BreachForums Administrator Baphomet Shuts Down Infamous Hacking Forum,

In a sudden turn of events, Baphomet, the current administrator of BreachForums, said in an update on March 21, 2023, that the hacking forum has been officially taken down but emphasized that « it’s not the end. »
« You are allowed to hate me, and disagree with my decision but I promise what is to come will be better for us all, » Baphomet noted in a message posted on the BreachForums Telegram

,

In a sudden turn of events, Baphomet, the current administrator of BreachForums, said in an update on March 21, 2023, that the hacking forum has been officially taken down but emphasized that « it’s not the end. »
« You are allowed to hate me, and disagree with my decision but I promise what is to come will be better for us all, » Baphomet noted in a message posted on the BreachForums Telegram

, ,
https://thehackernews.com/2023/03/breachforums-administrator-baphomet.html

New ‘Bad Magic’ Cyber Threat Disrupt Ukraine’s Key Sectors Amid War

New ‘Bad Magic’ Cyber Threat Disrupt Ukraine’s Key Sectors Amid War

,

Amid the ongoing war between Russia and Ukraine, government, agriculture, and transportation organizations located in Donetsk, Lugansk, and Crimea have been attacked as part of an active campaign that drops a previously unseen, modular framework dubbed CommonMagic.
« Although the initial vector of compromise is unclear, the details of the next stage imply the use of spear phishing or similar

,

Amid the ongoing war between Russia and Ukraine, government, agriculture, and transportation organizations located in Donetsk, Lugansk, and Crimea have been attacked as part of an active campaign that drops a previously unseen, modular framework dubbed CommonMagic.
« Although the initial vector of compromise is unclear, the details of the next stage imply the use of spear phishing or similar

, ,
https://thehackernews.com/2023/03/new-bad-magic-cyber-threat-disrupt.html

New ShellBot DDoS Malware Variants Targeting Poorly Managed Linux Servers

New ShellBot DDoS Malware Variants Targeting Poorly Managed Linux Servers,

Poorly managed Linux SSH servers are being targeted as part of a new campaign that deploys different variants of a malware called ShellBot.
« ShellBot, also known as PerlBot, is a DDoS Bot malware developed in Perl and characteristically uses IRC protocol to communicate with the C&C server, » AhnLab Security Emergency response Center (ASEC) said in a report.
ShellBot is installed on servers that

,

Poorly managed Linux SSH servers are being targeted as part of a new campaign that deploys different variants of a malware called ShellBot.
« ShellBot, also known as PerlBot, is a DDoS Bot malware developed in Perl and characteristically uses IRC protocol to communicate with the C&C server, » AhnLab Security Emergency response Center (ASEC) said in a report.
ShellBot is installed on servers that

, ,
https://thehackernews.com/2023/03/new-shellbot-ddos-malware-targeting.html

The Best Defense Against Cyber Threats for Lean Security Teams

The Best Defense Against Cyber Threats for Lean Security Teams,

H0lyGh0st, Magecart, and a slew of state-sponsored hacker groups are diversifying their tactics and shifting their focus to…
You.
That is, if you’re in charge of cybersecurity for a small-to-midsize enterprise (SME).
Why? Bad actors know that SMEs typically have a smaller security budget, less infosec manpower, and possibly weak or missing security controls to protect their data and

,

H0lyGh0st, Magecart, and a slew of state-sponsored hacker groups are diversifying their tactics and shifting their focus to…
You.
That is, if you’re in charge of cybersecurity for a small-to-midsize enterprise (SME).
Why? Bad actors know that SMEs typically have a smaller security budget, less infosec manpower, and possibly weak or missing security controls to protect their data and

, ,
https://thehackernews.com/2023/03/the-best-defense-against-cyber-threats.html

From Ransomware to Cyber Espionage: 55 Zero-Day Vulnerabilities Weaponized in 2022

From Ransomware to Cyber Espionage: 55 Zero-Day Vulnerabilities Weaponized in 2022,

As many as 55 zero-day vulnerabilities were exploited in the wild in 2022, with most of the flaws discovered in software from Microsoft, Google, and Apple.
While this figure represents a decrease from the year before, when a staggering 81 zero-days were weaponized, it still represents a significant uptick in recent years of threat actors leveraging unknown security flaws to their advantage.
The 

,

As many as 55 zero-day vulnerabilities were exploited in the wild in 2022, with most of the flaws discovered in software from Microsoft, Google, and Apple.
While this figure represents a decrease from the year before, when a staggering 81 zero-days were weaponized, it still represents a significant uptick in recent years of threat actors leveraging unknown security flaws to their advantage.
The 

, ,
https://thehackernews.com/2023/03/from-ransomware-to-cyber-espionage-55.html

Hackers Steal Over $1.6 Million in Crypto from General Bytes Bitcoin ATMs Using Zero-Day Flaw

Hackers Steal Over $1.6 Million in Crypto from General Bytes Bitcoin ATMs Using Zero-Day Flaw,

Bitcoin ATM maker General Bytes disclosed that unidentified threat actors stole cryptocurrency from hot wallets by exploiting a zero-day security flaw in its software.
« The attacker was able to upload his own java application remotely via the master service interface used by terminals to upload videos and run it using ‘batm’ user privileges, » the company said in an advisory published over the

,

Bitcoin ATM maker General Bytes disclosed that unidentified threat actors stole cryptocurrency from hot wallets by exploiting a zero-day security flaw in its software.
« The attacker was able to upload his own java application remotely via the master service interface used by terminals to upload videos and run it using ‘batm’ user privileges, » the company said in an advisory published over the

, ,
https://thehackernews.com/2023/03/hackers-steal-over-16-million-in-crypto.html