Why Enterprise Threat Mitigation Requires Automated, Single-Purpose Tools

Why Enterprise Threat Mitigation Requires Automated, Single-Purpose Tools,

As much as threat mitigation is to a degree a specialist task involving cybersecurity experts, the day to day of threat mitigation often still comes down to systems administrators. For these sysadmins it’s not an easy task, however. In enterprise IT, sysadmins teams have a wide remit but limited resources.
For systems administrators finding the time and resources to mitigate against a growing

,

As much as threat mitigation is to a degree a specialist task involving cybersecurity experts, the day to day of threat mitigation often still comes down to systems administrators. For these sysadmins it’s not an easy task, however. In enterprise IT, sysadmins teams have a wide remit but limited resources.
For systems administrators finding the time and resources to mitigate against a growing

, ,
https://thehackernews.com/2022/03/why-enterprise-threat-mitigation.html

Russian Ransomware Gang Retool Custom Hacking Tools of Other APT Groups

Russian Ransomware Gang Retool Custom Hacking Tools of Other APT Groups,

A Russian-speaking ransomware outfit likely targeted an unnamed entity in the gambling and gaming sector in Europe and Central America by repurposing custom tools developed by other APT groups like Iran’s MuddyWater, new research has found.
The unusual attack chain involved the abuse of stolen credentials to gain unauthorized access to the victim network, ultimately leading to the deployment of

,

A Russian-speaking ransomware outfit likely targeted an unnamed entity in the gambling and gaming sector in Europe and Central America by repurposing custom tools developed by other APT groups like Iran’s MuddyWater, new research has found.
The unusual attack chain involved the abuse of stolen credentials to gain unauthorized access to the victim network, ultimately leading to the deployment of

, ,
https://thehackernews.com/2022/03/russian-ransomware-gang-retool-custom.html

New Linux Bug in Netfilter Firewall Module Lets Attackers Gain Root Access

New Linux Bug in Netfilter Firewall Module Lets Attackers Gain Root Access,

A newly disclosed security flaw in the Linux kernel could be leveraged by a local adversary to gain elevated privileges on vulnerable systems to execute arbitrary code, escape containers, or induce a kernel panic.
Tracked as CVE-2022-25636 (CVSS score: 7.8), the vulnerability impacts Linux kernel versions 5.4 through 5.6.10 and is a result of a heap out-of-bounds write in the netfilter

,

A newly disclosed security flaw in the Linux kernel could be leveraged by a local adversary to gain elevated privileges on vulnerable systems to execute arbitrary code, escape containers, or induce a kernel panic.
Tracked as CVE-2022-25636 (CVSS score: 7.8), the vulnerability impacts Linux kernel versions 5.4 through 5.6.10 and is a result of a heap out-of-bounds write in the netfilter

, ,
https://thehackernews.com/2022/03/new-linux-bug-in-netfilter-firewall.html

Researchers Find New Evidence Linking Kwampirs Malware to Shamoon APT Hackers

Researchers Find New Evidence Linking Kwampirs Malware to Shamoon APT Hackers,

New findings released last week showcase the overlapping source code and techniques between the operators of Shamoon and Kwampirs, indicating that they « are the same group or really close collaborators. »
« Research evidence shows identification of co-evolution between both Shamoon and Kwampirs malware families during the known timeline, » Pablo Rincón Crespo of Cylera Labs said.
« If Kwampirs is

,

New findings released last week showcase the overlapping source code and techniques between the operators of Shamoon and Kwampirs, indicating that they « are the same group or really close collaborators. »
« Research evidence shows identification of co-evolution between both Shamoon and Kwampirs malware families during the known timeline, » Pablo Rincón Crespo of Cylera Labs said.
« If Kwampirs is

, ,
https://thehackernews.com/2022/03/researchers-find-new-evidence-linking.html

Multiple Security Flaws Discovered in Popular Software Package Managers

Multiple Security Flaws Discovered in Popular Software Package Managers,

Multiple security vulnerabilities have been disclosed in popular package managers that, if potentially exploited, could be abused to run arbitrary code and access sensitive information, including source code and access tokens, from compromised machines.
It’s, however, worth noting that the flaws require the targeted developers to handle a malicious package in conjunction with one of the affected

,

Multiple security vulnerabilities have been disclosed in popular package managers that, if potentially exploited, could be abused to run arbitrary code and access sensitive information, including source code and access tokens, from compromised machines.
It’s, however, worth noting that the flaws require the targeted developers to handle a malicious package in conjunction with one of the affected

, ,
https://thehackernews.com/2022/03/multiple-security-flaws-discovered-in.html

Les Russes se ruent sur les VPN pour échapper à la censure

Les Russes se ruent sur les VPN pour échapper à la censure,

Le téléchargement d’applis mobiles de VPN a été multiplié par dix depuis que le gouvernement russe a mis une chape de plomb sur la diffusion d’informations.

,

Le téléchargement d’applis mobiles de VPN a été multiplié par dix depuis que le gouvernement russe a mis une chape de plomb sur la diffusion d’informations.

, ,
https://www.01net.com/actualites/les-russes-se-ruent-sur-les-vpn-pour-echapper-a-la-censure-2055498.html

Russian Pushing New State-run TLS Certificate Authority to Deal With Sanctions

Russian Pushing New State-run TLS Certificate Authority to Deal With Sanctions,

The Russian government has established its own TLS certificate authority (CA) to address issues with accessing websites that have arisen in the wake of sanctions imposed by the west following the country’s unprovoked military invasion of Ukraine.
According to a message posted on the Gosuslugi public services portal, the Ministry of Digital Development is expected to provide a domestic

,

The Russian government has established its own TLS certificate authority (CA) to address issues with accessing websites that have arisen in the wake of sanctions imposed by the west following the country’s unprovoked military invasion of Ukraine.
According to a message posted on the Gosuslugi public services portal, the Ministry of Digital Development is expected to provide a domestic

, ,
https://thehackernews.com/2022/03/russian-pushing-its-new-state-run-tls.html

Here’s How to Find if WhatsApp Web Code on Your Browser Has Been Hacked

Here’s How to Find if WhatsApp Web Code on Your Browser Has Been Hacked

,

Meta Platforms’ WhatsApp and Cloudflare have banded together for a new initiative called Code Verify to validate the authenticity of the messaging service’s web app on desktop computers.
Available in the form of a Chrome and Edge browser extension, the open-source add-on is designed to « automatically verif[y] the authenticity of the WhatsApp Web code being served to your browser, » Facebook said 

,

Meta Platforms’ WhatsApp and Cloudflare have banded together for a new initiative called Code Verify to validate the authenticity of the messaging service’s web app on desktop computers.
Available in the form of a Chrome and Edge browser extension, the open-source add-on is designed to « automatically verif[y] the authenticity of the WhatsApp Web code being served to your browser, » Facebook said 

, ,
https://thehackernews.com/2022/03/heres-how-to-find-if-whatsapp-web-code.html

Iranian Hackers Targeting Turkey and Arabian Peninsula in New Malware Campaign

Iranian Hackers Targeting Turkey and Arabian Peninsula in New Malware Campaign,

The Iranian state-sponsored threat actor known as MuddyWater has been attributed to a new swarm of attacks targeting Turkey and the Arabian Peninsula with the goal of deploying remote access trojans (RATs) on compromised systems.
« The MuddyWater supergroup is highly motivated and can use unauthorized access to conduct espionage, intellectual property theft, and deploy ransomware and destructive

,

The Iranian state-sponsored threat actor known as MuddyWater has been attributed to a new swarm of attacks targeting Turkey and the Arabian Peninsula with the goal of deploying remote access trojans (RATs) on compromised systems.
« The MuddyWater supergroup is highly motivated and can use unauthorized access to conduct espionage, intellectual property theft, and deploy ransomware and destructive

, ,
https://thehackernews.com/2022/03/iranian-hackers-targeting-turkey-and.html

New Exploit Bypasses Existing Spectre-v2 Mitigations in Intel, AMD, Arm CPUs

New Exploit Bypasses Existing Spectre-v2 Mitigations in Intel, AMD, Arm CPUs,

Researchers have disclosed a new technique that could be used to circumvent existing hardware mitigations in modern processors from Intel, AMD, and Arm and stage speculative execution attacks such as Spectre to leak sensitive information from host memory.
Attacks like Spectre are designed to break the isolation between different applications by taking advantage of an optimization technique 

,

Researchers have disclosed a new technique that could be used to circumvent existing hardware mitigations in modern processors from Intel, AMD, and Arm and stage speculative execution attacks such as Spectre to leak sensitive information from host memory.
Attacks like Spectre are designed to break the isolation between different applications by taking advantage of an optimization technique 

, ,
https://thehackernews.com/2022/03/new-exploit-bypasses-existing-spectre.html