Security Affairs

MAY 24, 2021

Researchers identified a vulnerability affecting the Passkey authentication in BR/EDR Secure Simple Pairing in Bluetooth Core Specifications 2.1 BR/EDR Secure Connections Pairing in Bluetooth Core Specifications 4.1 and LE Secure Connections Pairing in Bluetooth Core Specifications 4.2 through 5.2, through 5.2.

Wireless 117

Wireless Authentication Mobile Encryption 117

Security Affairs

SEPTEMBER 19, 2023

Researchers from Trend Micro, while monitoring the activity of the China-linked threat actor Earth Lusca , discovered an encrypted file hosted on a server under the control of the group. It consists of two components, the loader and the encrypted main payload. The backdoor uses AES-ECB encryption for C2 communications.

Malware 103

Malware Encryption Telecommunications Authentication 103

Security Affairs

JULY 26, 2021

A few days ago, security researcher Gilles Lionel (aka Topotam ) has discovered a vulnerability in the Windows operating system that allows an attacker to force remote Windows machines to authenticate and share their password hashes with him. Guidance at [link] — Security Response (@msftsecresponse) July 24, 2021.

Authentication 119

Authentication Passwords Encryption Hacking 119

The Last Watchdog

MAY 19, 2022

Nearly all CMS platforms, whether traditional or headless, offer some level of built-in security to authenticate users who are allowed to view, add, remove, or change content. Best security practices. According to the IBM Data Breach Report 2021 , data breaches in the United States reached $4.24 What can you do about it?

Data breaches 262

Data breaches Encryption Mobile Technology 262

Security Affairs

DECEMBER 15, 2021

Once a user has successfully authenticated on the OWA authentication web page, the Owawa module captures its credential. The module was most likely compiled between late 2020 and April 2021. The module verifies the successful authentication by checking that the OWA application is sending an authentication token back to the user.

Encryption 103

Encryption Authentication Passwords Internet 103

Security Affairs

APRIL 21, 2021

The three vulnerabilities addressed by the security vendor are: CVE-2021-20021 : Email Security Pre-Authentication Administrative Account Creation: A vulnerability in the SonicWall Email Security version 10.0.9.x ” reads the advisory published by FireEye. ” continues the analysis published by FireEye.

Authentication 114

Authentication Accountability Encryption Hacking 114

Security Affairs

JULY 13, 2021

ModiPwn flaw (CVE-2021-22779) in some of Schneider Electric’s Modicon PLCs can allow attackers to bypass authentication mechanisms and take over the device. The vulnerability can allow attackers to bypass authentication mechanisms which can lead to native remote-code-execution on vulnerable PLCs.”

Authentication 111

Authentication IoT Engineering Encryption 111

Thales Cloud Protection & Licensing

MARCH 23, 2022

Shifting Risk and Business Environment Demand creates a Shift in Security Strategies. The continued high ranking of cloud as a target demonstrates a lack of maturity in cloud data security with limited use of encryption, perceived or experienced multi-cloud complexity and the rapid growth of enterprise data. 2021 Report.

Risk 126

Risk Encryption Ransomware Technology 126

Security Affairs

AUGUST 9, 2021

The Australian Cyber Security Centre (ACSC) warns of a surge of LockBit 2.0 ransomware attacks against Australian organizations starting July 2021. The Australian Cyber Security Centre (ACSC) warns of an escalation in LockBit 2.0 ransomware attacks against Australian organizations in multiple industry sectors starting July 2021.

Ransomware 112

Ransomware Retail Manufacturing Encryption 112

Security Affairs

OCTOBER 9, 2021

American media conglomerate Cox Media Group (CMG) was hit by a ransomware attack that took down live TV and radio broadcast streams in June 2021. The American media conglomerate Cox Media Group (CMG) announced it was hit by a ransomware attack that caused the interruption of the live TV and radio broadcast streams in June 2021.

Media 100

Media Ransomware Identity Theft Insurance 100

Security Affairs

APRIL 19, 2021

Has a Discord token stealer too… @demonslay335 pic.twitter.com/OayXQPcSEl — MalwareHunterTeam (@malwrhunterteam) April 17, 2021. Upon executing the ransomware, it will encrypt the victim’s file and will give 3 hours to them to provide a valid Discord nitro. ” states BleepingComputer.

Ransomware 127

Ransomware Encryption Malware Hacking 127

Security Affairs

AUGUST 29, 2021

Taiwan vendor Synology announced that recently disclosed vulnerabilities (CVE-2021-3711 and CVE-2021-3712) in the OpenSSL impact some of its products. The CVE-2021-3711 is a high-severity buffer overflow flaw that could allow an attacker to change an application’s behavior or cause the app to crash. Important Ongoing DSM 6.2

VPN 121

VPN Encryption Authentication Hacking 121

Security Affairs

JULY 26, 2023

A remote and authenticated attacker can escalate privileges from admin to super-admin on the Winbox or HTTP interface.” The CVE-2023-30799 flaw can be exploited by a remote and an authenticated attacker to escalate privileges from admin to ‘super-admin’ which allows it to get a root shell on the router.

Hacking 95

Hacking Passwords Authentication Encryption 95

Security Affairs

AUGUST 20, 2021

Emsisoft has released a free decryptor for SynAck Ransomware that can allow victims of the gang to decrypt their encrypted files. <gwmw The master decryption keys work for victims that were infected between July 2017 and early 2021. <gwmw style=”display:none;”>. The gang has now rebranded as the new El_Cometa group.

Ransomware 109

Ransomware Encryption Authentication Internet 109

Security Affairs

AUGUST 27, 2021

The five previously unreported vulnerabilities in the medical system are: CVE-2021-33886 – Use of Externally-Controlled Format String (CVSS 7.7) CVE-2021-33885 – Insufficient Verification of Data Authenticity (CVSS 9.7) CVE-2021-33882 – Missing Authentication for Critical Function (CVSS 8.2)

Hacking 104

Hacking Authentication Internet Internet 104

Security Affairs

MARCH 19, 2022

The AvosLocker ransomware-as-a-service emerged in the threat landscape in September 2021, since January the group expanded its targets by implementing the support for encrypting Linux systems, specifically VMware ESXi servers. Use multifactor authentication where possible. Focus on cyber security awareness and training.

Ransomware 99

Ransomware DDOS Passwords Backups 99

Security Affairs

FEBRUARY 5, 2022

The LockBit ransomware gang has been active since September 2019, in June 2021 the group announced the LockBit 2.0 enumerates system information to include hostname, host configuration, domain information, local drive configuration, remote shares, and mounted external storage devices. Like other ransomware gangs, Lockbit 2.0

Ransomware 89

Ransomware Backups Encryption Accountability 89

Security Affairs

FEBRUARY 28, 2024

The Mirai -based Moobot botnet was first documented by Palo Alto Unit 42 researchers in February 2021, in November 2021, it started exploiting a critical command injection flaw ( CVE-2021-36260 ) in the webserver of several Hikvision products. Since September 2022, Moobot botnet was spotted targeting vulnerable D-Link routers.

Energy and Utilities 98

Energy and Utilities Government Firewall Malware 98

Security Affairs

FEBRUARY 14, 2022

Secret Service (USSS) to provide information on BlackByte ransomware. As of November 2021, BlackByte ransomware had compromised multiple US and foreign businesses, including entities in at least three US critical infrastructure sectors (government facilities, financial, and food & agriculture).” ” reads the advisory.

Ransomware 90

Ransomware Accountability Firmware Antivirus 90

Security Affairs

FEBRUARY 10, 2023

Threat actors use various exploits of common vulnerabilities, including CVE 2021-44228 , CVE-2021-20038 , and CVE-2022-24990. threat actors use virtual private networks (VPNs) and virtual private servers (VPSs) or third-country IP addresses to hide the origin of the attacks. Gain Access [ TA0001 ].

Ransomware 81

Ransomware Healthcare Cryptocurrency Government 81

Security Affairs

OCTOBER 24, 2021

The researchers found a vulnerability in the encryption process implemented in the BlackMatter ransomware that allowed them to recover encrypted files for free. More details can be found here: [link] — Fabian Wosar (@fwosar) October 24, 2021. BlackMatter then remotely encrypts the hosts and shared drives as they are found.

Ransomware 98

Ransomware Encryption Backups Healthcare 98

Security Affairs

MARCH 23, 2023

The authors claim that Nexus has been entirely written from scratch, but the researchers found similarities between Nexus and the SOVA banking trojan , which appeared on the threat landscape in August 2021. Like other malware, Nexus doesn’t infect systems located in Russia and CIS countries.

Banking 79

Banking Cryptocurrency Malware Advertising 79

Security Affairs

SEPTEMBER 1, 2021

. “Although FBI and CISA do not currently have any specific threat reporting indicating a cyberattack will occur over the upcoming Labor Day holiday, malicious cyber actors have launched serious ransomware attacks during other holidays and weekends in 2021.” Securing and monitoring Remote Desktop Protocol endpoints.

Ransomware 106

Ransomware Risk Encryption Passwords 106

Security Affairs

SEPTEMBER 3, 2021

“Cyber criminal threat actors exploit network vulnerabilities to exfiltrate data and encrypt systems in a sector that is increasingly reliant on smart technologies, industrial control systems, and internet-based automation systems. Use multifactor authentication with strong pass phrases where possible.

Ransomware 98

Ransomware Passwords Backups Firmware 98

SecureList

FEBRUARY 1, 2022

Kaspersky’s own research found that as of 2021 91% of global medical providers had implemented telehealth capabilities. Now, more than two years since the start of the pandemic, some of the homebrew telehealth projects have since grown and become more stable and secure. In 2021, the situation did not improve.

Phishing 115

Phishing Healthcare IoT Authentication 115

Security Affairs

OCTOBER 5, 2021

The unsecured database was discovered on September 14, 2021, it included internal logs and subscriber information. Subscriber data exposed includes full names, email addresses, device info, URL requests, IP addresses, authentication tokens, and unique reader identifiers. — Bob Diachenko (@MayhemDayOne) September 16, 2021.

Media 98

Media Passwords Engineering Encryption 98

Security Affairs

APRIL 23, 2021

(QNAP), a leading computing, networking and storage solution innovator, today issued a statement in response to recent user reports and media coverage that two types of ransomware (Qlocker and eCh0raix) are targeting QNAP NAS and encrypting users’ data for ransom. qlocker @QNAP_nas — Jack Cable (@jackhcable) April 22, 2021.

Ransomware 120

Ransomware Backups Media Malware 120

Security Affairs

JANUARY 16, 2023

In April 2017, Wikileaks published some documents about the project, describing it as a sort of malware command and control infrastructure used by the US agency to control its malicious code and exfiltrate information from the target systems. The backdoor has to two task, beacon and trigger.

Malware 93

Malware Encryption Authentication Hacking 93

Security Affairs

JUNE 29, 2022

Researchers detailed a new information-stealing malware, dubbed YTStealer, that targets YouTube content creators. Intezer cybersecurity researchers have detailed a new information-stealing malware, dubbed YTStealer, that was developed to steal authentication cookies from YouTube content creators.

Malware 97

Malware Authentication Software Accountability 97

Security Affairs

SEPTEMBER 12, 2021

A new banking trojan dubbed maxtrilha (due to its encryption key) has been discovered in the last few days and targeting customers of European and South American banks. The victims’ data is encrypted and sent to the C2 server geolocated in Russia. Figure 4: Maxtrilha samples disseminated in August and September 2021.

Banking 125

Banking Malware Internet Internet 125

Security Affairs

JUNE 3, 2021

.” The vulnerabilities impact all embedded and IoT devices that use the Realtek RTL8710C module, they could be exploited only by attackers on the same Wi-Fi network or know the network’s pre-shared key (PSK) used to authenticate wireless clients on local area networks. ” continues the report.

Wireless 89

Wireless IoT Encryption Firmware 89

Malwarebytes

MARCH 17, 2021

PYSA, aka Mespinoza, is a malware capable of exfiltrating data and encrypting users’ critical files and data stored on their systems. link] pic.twitter.com/NOPAcEFxM8 — FBI Buffalo (@FBIBuffalo) March 16, 2021. To prevent attacks: Install security updates for operating systems, software, and firmware as soon as they are released.

Education 106

Education Ransomware Phishing Passwords 106

Security Affairs

SEPTEMBER 22, 2021

link] #Cybersecurity #Ransomware pic.twitter.com/UQ7bZCtu0e — US-CERT (@USCERT_gov) September 22, 2021. The advisory urges organizations to take supplementary measures to increase their level of security. The advisory published by the US agencies provides the following mitigations: Use multi-factor authentication.

Ransomware 98

Ransomware Cybercrime Authentication Healthcare 98

CyberSecurity Insiders

MARCH 21, 2023

Initial changes to the Safeguards Rule Initially, the Federal Trade Commission approved changes to the Safeguards Rule in October 2021. These changes included updated criteria for financial institutions, providing more specific requirements about which safeguards they must include in their information security programs.

Cryptocurrency 69

Cryptocurrency Identity Theft Authentication Banking 69

Security Affairs

MARCH 4, 2024

In October 2021, CrowdStrike uncovered a campaign after the investigation of a series of security incidents in multiple countries. If the implant is active, a specially crafted empty TCP packet is returned, accompanied by information regarding the host’s responsiveness.

Telecommunications 130

Telecommunications Firewall Mobile Malware 130

Security Affairs

APRIL 19, 2023

The joint advisory provides detailed info on tactics, techniques, and procedures (TTPs) associated with APT28’s attacks conducted in 2021 that exploited the flaw in Cisco routers. The Russia-linked APT28 conducted the attacks in 2021 and targeted a small number of entities in Europe, U.S. ” reads the joint advisory. through 12.4

Malware 86

Malware Firmware Government Education 86

Malwarebytes

MAY 28, 2021

According to Coveware, a company that offers incident response services to organizations impacted by ransomware attacks, Conti is the second most common ransomware family that victim organizations have reported in the first quarter of 2021. Earlier versions appended the.CONTI extension to encrypted files.

Healthcare 103

Healthcare Ransomware Encryption Passwords 103