Ruling says email services not subject to data retention rules.
Ransomware attacks continue to grow in number and severity, data shows, but organizations are stepping up to prepare for the threat.
Software supply chain security experts to drive aggressive go-to-market strategy
The infamous Carbanak operator is moving is looking to juice its ransomware game by recruiting IT staff to its fake Bastion Secure 'pen-testing' company.
Microsoft's analysis of a recent phishing attack shows how cybercriminals are mixing and matching to efficiently develop their attack frameworks.
Only for one-to-one voice and video, mind Microsoft has finally kicked off the rollout of end-to-end-encryption (E2EE) in its Teams collaboration platform with a public preview of E2EE for one-to-one calls.…
A multi-country effort has given ransomware gang REvil a taste of its own medicine by pwning its backups and pushing its leak site and Tor payment site offline.
Following the PrintNightmare case, printer security has become a hot issue for security teams. Here are seven ways to keep printers secure on enterprise networks.
Conventional data security tools do not address insider risk — a growing problem in today's remote-hybrid world. We need a better way to manage insider risk.
Researcher spots RSA tell-tale lurking in plain sight on VirusTotal Around 1,500 Cobalt Strike beacons uploaded to VirusTotal were reusing the same RSA keys from a cracked version of the software, according to a security researcher who pored through the m ...
The high-severity bug, tracked as CVE-2021-1529, is an OS command-injection flaw.
When life inside the security operations center feels treacherous, here are some suggestions for getting out alive.
The platform’s Content Delivery Network and core features are being used to send malicious files—including RATs--across its network of 150 million users, putting corporate workplaces at risk.
The second vanishing of the cybergang... for now As we noted a few days back, notorious ransomware gang REvil "disappeared" again this week. Recent reports have now shed light on why that may be.…
Unique fingerprints lurk in radio signals more often than not, it seems Over the past few years, mobile devices have become increasingly chatty over the Bluetooth Low Energy (BLE) protocol and this turns out to be a somewhat significant privacy risk.…
Vid-slingers had been asking how this happened for years, even while their channels were spruiking dodgy crypto After years of complaints from YouTubers, Google has pinpointed the root cause of a series of account hijackings: software sponsorship deals th ...
Coordinated takedown by US gov, allies.
The launch of Android 12 brings several new default security features, along with new security efforts for Android Enterprise.
Researchers warn that Discord's bot framework can be easily weaponized.
Online cybersecurity professional development platform bolsters the Check Point Education Initiative.
Security leaders are adopting a multilayered approach to address new security threats and risks.
Guardicore's micro-segmentation products will be added to Akamai's portfolio of Zero Trust solutions.
Transaction marks Plurilock’s second acquisition in 2021.
Web application security provider plans to leverage new investment to continue product expansion and support global growth.
Response and recovery have significant impact on 58% of targeted businesses.
New Offering Can Help Businesses Quickly Recover from Ransomware Attacks, Speed Data Recovery, and Advance Business Continuity
New Offering Can Help Businesses Quickly Recover from Ransomware Attacks, Speed Data Recovery, and Advance Business Continuity
XDR is a newish industry term addressing a very old problem: security products that don't work together to detect threats.
Meanwhile, Zerodium's quest to buy VPN exploits is problematic, researchers said.
A new email campaign from the threat group uses the attack-simulation framework in a likely leadup to ransomware deployment.
A new set of security tools is built to assess risk, provide monitoring and notification if an attack occurs, and train IT pros and users.
If AvosLocker stole Gigabyte's master keys, threat actors could force hardware to download fake drivers or BIOS updates in a supply-chain attack a la SolarWinds.
The top 10 categories of digital threats on macOS are all adware programs, with only a sliver of the share of victims affected by actual malware, according to an IT management firm.
Update to v6.02 – or don't, but on your head be it A remote code execution vulnerability existed in an old and free trial version of WinRAR, according to infosec firm Positive Technologies.…
Understanding human psychology, how it works, and how to introduce its concepts into cybersecurity awareness training can make a huge difference to your organization.
Hardly a week goes by without another major company falling victim to a ransomware attack. Nate Warfield, CTO at Prevailion, discusses the immense challenges in changing that status quo.
Chicago-based Ferrara acknowledged an Oct. 9 attack that encrypted some systems and disrupted production.
Considering the slack security of such kit, it's a perfect storm Increasing numbers of "non-business" Internet of Things devices are showing up inside corporate networks, Palo Alto Networks has warned, saying that smart lightbulbs and internet-connected p ...
Darktrace: why you need defence that operates at machine speed Sponsored There used to be two certainties in life - death and taxes - but thanks to online crooks around the world, there's a third: ransomware. This attack mechanism continues to gain trac ...
Surveillance tech faces trade limits as America syncs policy with treaty obligations More than six years after proposing export restrictions on "intrusion software," the US Commerce Department's Bureau of Industry and Security (BIS) has formulated a rule ...
Intel researchers describe how Trusted Execution Environments can enhance HTTPS and boost web security.
$10,000 to be awarded annually for four years each by Optiv’s Black Employee Network.
FiveSys is the second publicly known rootkit since June that attackers have managed to sneak past Microsoft's driver certification process.
Led by representatives from the three companies, the work group will create guidance that defines, implements, and upholds security standards for the entire supply chain.
Offering to provide transparency into the capabilities of managed security service providers and and managed detection and response competencies.
Award recipients NPower and CyberWarrior recognized for development of cyber workforce training programs.
Email endpoint security-as-a-service company founder and two others indicted in an elaborate financial fraud scheme.
"We cannot do this alone."
The attackers behind the campaign, which distributes cookie theft malware, are attributed to actors recruited in a Russian-speaking forum.
Trusted access can help reduce friction so that your team can get work done.
Google has caught and brushed off a bunch of cookie-stealing YouTube channel hijackers who were running cryptocurrency scams on, or auctioning off, ripped-off channels.
If you want to know the solution, join this Regcast Sponsored We know for sure that ransomware attackers and sundry dark forces want to break into critical infrastructure. Ransomware attacks on industrial environments have increased by 500 per cent sinc ...
Experts warn that virtual private networks are increasingly vulnerable to leaks and attack.
Password managers, single sign-on, and multifactor authentication each offers its own methodology and unique set of benefits — and drawbacks — to users.
It's time to steer the conversation away from whether payment bans should be implemented to how and when they should take effect.
Obfuscation techniques are extremely prevalent, data shows, but they can't be used as a single indicator of compromise because legitimate websites use them.
A combination of business email compromise and deepfake audio led a branch manager to transfer millions to scammers, in a case that serves as a warning to organizations.
Disguised as an IT firm, the APT is hitting targets in Afghanistan & India, exploiting a 20-year-old+ Microsoft Office bug that's as potent as it is ancient.
A death by a thousand cuts The Chromium team has finally done it – File Transfer Protocol (FTP) support is not just deprecated, but stripped from the codebase in the latest stable build of the Chrome browser, version 95.…
It's like rai-iiiiiin on your wedding day NHS Digital has scored a classic Mail All own-goal by dispatching not one, not two, not three, but four emails concerning an infosec breakfast briefing, each time copying the entirety of the invite list in on the ...
Website patched following phishing scam, no financial data exposed The Centre for Computing History (CCH) in Cambridge, England, has apologised for an "embarrassing" breach in its online customer datafile, though thankfully no payment card information was ...
Fortinet seeks to make EDR easy for non-specialists Sponsored For the longest time it seemed that modern endpoint detection and response (EDR) was getting on top of the worst malware, only for that certainty to evaporate in a single day in June 2017 tha ...
CrowdStrike says 'LightBasin' gang avoids Windows, and knows that telco networks run on badly-secured *nix A mysterious criminal gang is targeting telcos' Linux and Solaris boxes, because it perceives they aren't being watched by infosec teams that have f ...
Gang says it grabbed internal info, could do the same to Acer elsewhere Taiwanese PC maker Acer has not only admitted servers it operates in India and and Taiwan were compromised but that only those systems in India contained customer data.…
As ASIO raises 'concerns' about malware injection.
Intel duo propose fresh use of, yes, SGX but also Arm's TrustZone and similar TEEs Two Intel staffers believe web services can be made more secure by not only carrying out computations in remote trusted execution environments, or TEEs, but by also verifyi ...
Attackers use a different set of techniques to target the cloud, meaning defenders must think differently when pen testing cloud environments.
LightBasin has displayed in-depth knowledge of telecom architectures and protocols in its attacks, security vendor warns.
Cato more than doubles its valuation in one year with largest funding round to date. Total financing reaches $532 million.
The out-of-bounds read vulnerability enables an attacker to escape a Squirrel VM in games with millions of monthly players – such as Counter-Strike: Global Offensive and Portal 2 – and in cloud services such as Twilio Electric Imp.
Data in Dark Reading's 2021 Strategic Security Survey report suggest organizations are taking the security challenge seriously.
The funding will support product development for Query.AI's browser-based security investigations tool.
The group is likely nation-state-backed and is mounting an ongoing spy campaign using custom malware and stealthy tactics.
What was that about hackable tractors? The US CISA cybersecurity agency has warned that the Darkside ransomware gang, aka BlackMatter, has been targeting American food and agriculture businesses – and urges security pros to be on the lookout for indicat ...
Simulation and modeling solutions augment Keysight's 5G and cybersecurity portfolio.
Research by ThycoticCentrify shows a majority of organizations experienced a ransomware attack, while 93% are allocating special budget to fight growing threats.
Closes out $225 million Series F with additional $66 million raised from Atlassian Ventures, CrowdStrike Falcon Fund, NTT Docomo Ventures, and others.
Ferrara Candy Co. said a ransomware attack earlier this month won't affect Halloween supplies of its sweets, which include Brachs, Keebler, Sweet Tarts, and other popular brands.
Feeling creative? Submit your caption and our panel of experts will reward the winner with a $25 Amazon gift card.
The tool is designed to automatically discover personal data in organizations' Microsoft 365 environments.
Join this masterclass and learn how to plan a far more efficient response Sponsored When you read about security teams “scrambling” to respond to a ransomware attack, what do you think is the real problem?…
The APT, which targets Middle-Eastern energy firms & telecoms, has been relatively quiet since its exposure but not entirely silent. It's kept up attacks through 2021 and is working on retooling its arsenal yet again.
And they're packing a new dirty RAT as well A prolific email phishing threat actor – TA505 – is back from the dead, according to enterprise security software slinger Proofpoint.…
Institute of International Education and Inflection Point Systems recognized for their advanced security awareness and training programs.
Cybersecurity industry veteran brings substantial public and private sector experience to help guide [redacted] growth and expansion.
Achieves 8x growth in last three quarters, and raises $70M in less than 18 months.
Introducing Veritas NetBackup Recovery Vault, a Veritas-managed cloud storage service.
Treat customers fairly when it comes to auto-renewal. Or else The UK's Competition and Markets Authority (CMA) has unveiled compliance principles to curb locally some of the sharper auto-renewal practices of antivirus software firms.…
Cybersecurity budget cuts are everywhere. Chad Anderson, senior security researcher at DomainTools, discusses alternatives to fancy tooling, and good human skills alignment.
Why understanding human behavior is essential to building resilient security systems.
An advisory by the CISA, FBI and NSA reveals hallmark tactics of and shares defense tips against the cybercriminal group that’s picked up where its predecessor DarkSide left off.
Analysis of the top-50 multi-party attacks over the past decade finds that nation-state-linked hackers focused on disruption and using stolen credentials cause the most damage.
TA505 – cybercrime trailblazers with ever-evolving TTPs – have returned to mass-volume email attacks, flashing retooled malware and exotic scripting languages.
Home quarantine week was the price for an overseas trip, ongoing observation is the price of COVID-19 Feature My family and I recently returned to Singapore after an overseas trip that, for the first time in over a year, did not require the ordeal of tw ...
Sent user data to China without once thinking Beijing might decide to snoop, lied about server location Line, the Japan-based messaging and payments app with millions of users around Southeast Asia, has conceded that its data protection regimes had multip ...
Recent McKinsey & Company analysis examines which technologies will have the most momentum in the next ten years. These are the trends security teams need to be aware of in order to protect the organization effectively.
New Online Authentication Barometer from the FIDO Alliance reveals consumer habits, trends and adoption of authentication technologies.
The Lyceum group has previously been linked to attacks on targets in the Middle East.
Chris Hass, director of information security and research at Automox, discusses how to assign security responsibility, punishment for poor cyber-hygiene and IDing 'security champions' to help small businesses.
As retailers roll out more "buy online, pickup in-store" options, loss prevention professionals are increasingly shifting their attention from in-store theft to e-commerce fraud.
Companies are worried that the highly privileged password app could let attackers deep inside an enterprise’s footprint, says Redscan’s George Glass.
A major cyberattack resulted in data being stolen, too, but Sinclair's not sure which information is now in the hands of the crooks.
Ransomware has become a "national security issue," NSA director said.
The certification aims to help new entrants to the security field with professional development and career paths early on.
The US television station operator has revealed certain servers and workstations, as well as office and operational networks, were disrupted in the attack.
The tween-friendly video app is being used to serve up malvertising, disguised as free Steam game accounts or Among Us game hacks.
Infosec pro: 'OneDrive abuse has been going on for years' Microsoft has been branded as "the world's best malware hoster for about a decade," thanks to abuse of the Office 365 and Live platform, as well as its slow response to reports by security research ...
The accounts were used to catfish security researchers into downloading malware in a long-running cyber-espionage campaign attributed to North Korea.
Instead of using a substantial proportion of resources to determine attribution, organizations should focus on defenses that will help them remediate an attack.
Ongoing crackdown saw apps 1.83 million apps tested, 4,200 told to clean up their act, pop-up ads popped China's Minister of Industry and Information Technology, Xiao Yaqing, has given a rare interview in which he signalled the nation's crackdown on the i ...
Here’s how zero trust and immutability can save you Sponsored When you’re putting your enterprise security and data management strategy in place, should you worry more about ransomware or natural disasters?…
Names and bars crypto exchange SUEX, warns paying ransoms could spell trouble Ransomware extracted at least $590 million for the miscreants who create and distribute it in the first half of 2021 alone – more than the $416 million tracked in all of 2020, ...
Heading back to the private sector.
But not login credentials or credit card details.
Payments climb to $795 million in first six months.
Plus rifle-toting robot dogs, but makers insist they're really dumb In brief Whether or not non-fungible tokens are a flash in the pan or forever, malware operators have been keen to weaponise the technology.…
The slate of Arsenal presentations at Black Hat Europe is set to feature lots of low-cost and free goodies for offensive security pros.
Michigan man arrested for borrowing costly textbooks and selling them A 36-year-old man from Portage, Michigan, was arrested on Thursday for allegedly renting thousands of textbooks from Amazon and selling them rather than returning them.…
China's premier hackers will target web browsers, operating systems, mobile devices, and even a car at Tianfu Cup.
Multifactor authentications soar as enterprises move away from passwords to secure hybrid workers.
The group – which also created BazarLoader and the Conti ransomware – has juiced its distribution tactics to threaten enterprises more than ever.
Missouri Gov. Mike Parson launched a criminal investigation of a reporter who flagged a state website that exposed 100K+ Social-Security numbers for teachers and other state employees.
Inside their motivations, how they go about it -- and what businesses can do about it, according to Counterintelligence Institute founder Peter Warmka.
Discovered during a recent incident response engagement, the malware avoids Russian computers and uses a single symmetric key for encrypting every compromised system.
The firm expands capital base, team, and platform addressing a rapidly growing cybersecurity investment opportunity.