CloudFlare Thwarts Record DDoS Attack Peaking at 15 Million Requests Per Second

CloudFlare Thwarts Record DDoS Attack Peaking at 15 Million Requests Per Second,

Cloudflare on Wednesday disclosed that it acted to mitigate a 15.3 million request-per-second (RPS) distributed denial-of-service (DDoS) attack. The web infrastructure and website security company called it one of the « largest HTTPS DDoS attacks on record. » 
« HTTPS DDoS attacks are more expensive in terms of required computational resources because of the higher cost of establishing a secure TLS

,

Cloudflare on Wednesday disclosed that it acted to mitigate a 15.3 million request-per-second (RPS) distributed denial-of-service (DDoS) attack. The web infrastructure and website security company called it one of the « largest HTTPS DDoS attacks on record. » 
« HTTPS DDoS attacks are more expensive in terms of required computational resources because of the higher cost of establishing a secure TLS

, ,
https://thehackernews.com/2022/04/cloudflare-thwarts-record-ddos-attack.html

QNAP Advises to Mitigate Remote Hacking Flaws Until Patches are Available

QNAP Advises to Mitigate Remote Hacking Flaws Until Patches are Available,

Network-attached storage (NAS) appliance maker QNAP on Wednesday said it’s working on updating its QTS and QuTS operating systems after Netatalk last month released patches to contain seven security flaws in its software.
Netatalk is an open-source implementation of the Apple Filing Protocol (AFP), allowing Unix-like operating systems to serve as file servers for Apple macOS computers.
<!-

,

Network-attached storage (NAS) appliance maker QNAP on Wednesday said it’s working on updating its QTS and QuTS operating systems after Netatalk last month released patches to contain seven security flaws in its software.
Netatalk is an open-source implementation of the Apple Filing Protocol (AFP), allowing Unix-like operating systems to serve as file servers for Apple macOS computers.
<!-

, ,
https://thehackernews.com/2022/04/qnap-advises-to-mitigate-remote-hacking.html

[eBook] Your First 90 Days as MSSP: 10 Steps to Success

[eBook] Your First 90 Days as MSSP: 10 Steps to Success,

Bad actors continuously evolve their tactics and are becoming more sophisticated. Within the past couple of years, we’ve seen supply chain attacks that quickly create widespread damage throughout entire industries. But the attackers aren’t just focusing their efforts on supply chains.For example, businesses are becoming increasingly more reliant on SaaS apps and the cloud – creating a new avenue

,

Bad actors continuously evolve their tactics and are becoming more sophisticated. Within the past couple of years, we’ve seen supply chain attacks that quickly create widespread damage throughout entire industries. But the attackers aren’t just focusing their efforts on supply chains.For example, businesses are becoming increasingly more reliant on SaaS apps and the cloud – creating a new avenue

, ,
https://thehackernews.com/2022/04/ebook-your-first-90-days-as-mssp-10.html

Chinese Hackers Targeting Russian Military Personnel with Updated PlugX Malware

Chinese Hackers Targeting Russian Military Personnel with Updated PlugX Malware,

A China-linked government-sponsored threat actor has been observed targeting Russian speakers with an updated version of a remote access trojan called PlugX.
Secureworks attributed the attempted intrusions to a threat actor it tracks as Bronze President, and by the wider cybersecurity community under the monikers Mustang Panda, TA416, HoneyMyte, RedDelta, and PKPLUG.
« The war in Ukraine has

,

A China-linked government-sponsored threat actor has been observed targeting Russian speakers with an updated version of a remote access trojan called PlugX.
Secureworks attributed the attempted intrusions to a threat actor it tracks as Bronze President, and by the wider cybersecurity community under the monikers Mustang Panda, TA416, HoneyMyte, RedDelta, and PKPLUG.
« The war in Ukraine has

, ,
https://thehackernews.com/2022/04/chinese-hackers-targeting-russian.html

Google’s New Safety Section Shows What Data Android Apps Collect About Users

Google’s New Safety Section Shows What Data Android Apps Collect About Users

,

Google on Tuesday officially began rolling out a new « Data safety » section for Android apps on the Play Store to highlight the type of data being collected and shared with third-parties.
« Users want to know for what purpose their data is being collected and whether the developer is sharing user data with third parties, » Suzanne Frey, Vice President of product for Android security and privacy, 

,

Google on Tuesday officially began rolling out a new « Data safety » section for Android apps on the Play Store to highlight the type of data being collected and shared with third-parties.
« Users want to know for what purpose their data is being collected and whether the developer is sharing user data with third parties, » Suzanne Frey, Vice President of product for Android security and privacy, 

, ,
https://thehackernews.com/2022/04/googles-new-safety-section-shows-what.html

U.S. Offers $10 Million Bounty for Information on 6 Russian Military Hackers

U.S. Offers $10 Million Bounty for Information on 6 Russian Military Hackers,

The U.S. government on Tuesday announced up to $10 million in rewards for information on six hackers associated with the Russian military intelligence service.
« These individuals participated in malicious cyber activities on behalf of the Russian government against U.S. critical infrastructure in violation of the Computer Fraud and Abuse Act, » the State Department’s Rewards for Justice Program 

,

The U.S. government on Tuesday announced up to $10 million in rewards for information on six hackers associated with the Russian military intelligence service.
« These individuals participated in malicious cyber activities on behalf of the Russian government against U.S. critical infrastructure in violation of the Computer Fraud and Abuse Act, » the State Department’s Rewards for Justice Program 

, ,
https://thehackernews.com/2022/04/us-offers-10-million-bounty-for.html

Plusieurs hôpitaux français victimes de piratage, des données sensibles de patients en vente sur le dark web

Plusieurs hôpitaux français victimes de piratage, des données sensibles de patients en vente sur le dark web,

Le groupement hospitalier de territoire de la région Grand Est a été piraté, et une archive de 28 Go de données mise en vente sur le dark web. On y trouve, pêle-mêle, des passeports, des analyses médicales, des données bancaires, des dossiers patients…

,

Le groupement hospitalier de territoire de la région Grand Est a été piraté, et une archive de 28 Go de données mise en vente sur le dark web. On y trouve, pêle-mêle, des passeports, des analyses médicales, des données bancaires, des dossiers patients…

, ,
https://www.01net.com/actualites/plusieurs-hopitaux-francais-victimes-de-piratage-des-donnees-sensibles-de-patients-en-vente-sur-le-dark-web-2056026.html

NPM Bug Allowed Attackers to Distribute Malware as Legitimate Packages

NPM Bug Allowed Attackers to Distribute Malware as Legitimate Packages,

A « logical flaw » has been disclosed in NPM, the default package manager for the Node.js JavaScript runtime environment, that enables malicious actors to pass off rogue libraries as legitimate and trick unsuspecting developers into installing them.
The supply chain threat has been dubbed « Package Planting » by researchers from cloud security firm Aqua. Following responsible disclosure on February

,

A « logical flaw » has been disclosed in NPM, the default package manager for the Node.js JavaScript runtime environment, that enables malicious actors to pass off rogue libraries as legitimate and trick unsuspecting developers into installing them.
The supply chain threat has been dubbed « Package Planting » by researchers from cloud security firm Aqua. Following responsible disclosure on February

, ,
https://thehackernews.com/2022/04/npm-bug-allowed-attackers-to-distribute.html

Microsoft Discovers New Privilege Escalation Flaws in Linux Operating System

Microsoft Discovers New Privilege Escalation Flaws in Linux Operating System,

Microsoft on Tuesday disclosed a set of two privilege escalation vulnerabilities in the Linux operating system that could potentially allow threat actors to carry out an array of nefarious activities.
Collectively called « Nimbuspwn, » the flaws « can be chained together to gain root privileges on Linux systems, allowing attackers to deploy payloads, like a root backdoor, and perform other

,

Microsoft on Tuesday disclosed a set of two privilege escalation vulnerabilities in the Linux operating system that could potentially allow threat actors to carry out an array of nefarious activities.
Collectively called « Nimbuspwn, » the flaws « can be chained together to gain root privileges on Linux systems, allowing attackers to deploy payloads, like a root backdoor, and perform other

, ,
https://thehackernews.com/2022/04/microsoft-discovers-new-privilege.html

Emotet Testing New Delivery Ideas After Microsoft Disables VBA Macros by Default

Emotet Testing New Delivery Ideas After Microsoft Disables VBA Macros by Default,

The threat actor behind the prolific Emotet botnet is testing new attack methods on a small scale before co-opting them into their larger volume malspam campaigns, potentially in response to Microsoft’s move to disable Visual Basic for Applications (VBA) macros by default across its products.
Calling the new activity a « departure » from the group’s typical behavior, ProofPoint alternatively 

,

The threat actor behind the prolific Emotet botnet is testing new attack methods on a small scale before co-opting them into their larger volume malspam campaigns, potentially in response to Microsoft’s move to disable Visual Basic for Applications (VBA) macros by default across its products.
Calling the new activity a « departure » from the group’s typical behavior, ProofPoint alternatively 

, ,
https://thehackernews.com/2022/04/emotet-testing-new-delivery-ideas-after.html