Security Affairs

JUNE 22, 2021

DirtyMoe is a Windows botnet that is rapidly growing, it passed from 10,000 infected systems in 2020 to more than 100,000 in the first half of 2021. “Recently, a new infection vector that cracks Windows machines through SMB password brute force is on the rise” reads the analysis published by AVAST. Pierluigi Paganini.

DNS 136

DNS Cryptocurrency Internet Internet 136

Security Affairs

JULY 12, 2022

Microsoft observed a large-scale phishing campaign that used adversary-in-the-middle (AiTM) phishing sites to steal passwords, hijack a user’s sign-in session, and bypass the authentication process even when the victim has enabled the MFA. The post Large-scale AiTM phishing campaign targeted +10,000 orgs since 2021? Pierluigi Paganini.

Phishing 134

Phishing Authentication Social Engineering Passwords 134

Daniel Miessler

MARCH 24, 2021

Basically, how secure is someone’s current behavior with respect to passwords and authentication, and how can they improve? The idea here is for someone in the security community—or really any security-savvy user—to use this visual to help someone with poor password hygiene. How to use this model.

Authentication 363

Authentication Passwords Internet Internet 363

Security Affairs

NOVEMBER 5, 2021

have been hijacked, threat actors replaced them with versions laced with password-stealing malware. The security team of the npm JavaScript package warns that two popular npm libraries, coa and rc. have been hijacked, threat actors replaced them versions laced with password-stealing malware. The last stable coa version 2.0.2

Passwords 108

Passwords Malware Accountability Hacking 108

Security Affairs

FEBRUARY 10, 2022

The FBI reported that US citizens have lost more than $68 million to SIM swapping attacks in 2021, the number of complaints since 2018 and associated losses have increased almost fivefold. In 2021, IC3 received 1,611 SIM swapping complaints with adjusted losses of more than $68 million.”

Mobile 98

Mobile Cryptocurrency Authentication Accountability 98

Cisco Security

AUGUST 12, 2021

Cisco Secure returned as a supporting partner of the Black Hat USA 2021 Network Operations Center (NOC) for the 5 th year ; joining conference producer Informa Tech and its other security partners. SECURITY CATEGORY (PHISHING). Date & Time: Aug 5, 2021 at 6:32 AM. app.nihaocloud[.]com. Event Details (1 of 2).

DNS 137

DNS Firewall Phishing Mobile 137

Security Affairs

APRIL 25, 2021

The software company Click Studios was the victim of a supply chain attack, hackers compromised its Passwordstate password management application. Informacja od Tajemniczego Pedro) pic.twitter.com/PGHhmEKpje — Niebezpiecznik (@niebezpiecznik) April 23, 2021. Affected customers password records may have been harvested.”

Password Management 99

Password Management Passwords Software Malware 99

Security Affairs

OCTOBER 26, 2021

“Unknown cyber criminals using Ranzy Locker ransomware had compromised more than 30 US businesses as of July 2021. The victims include the construction subsector of the critical manufacturing sector, the academia subsector of the government facilities sector, the information technology sector, and the transportation sector.”

Ransomware 134

Ransomware Firmware Antivirus Accountability 134

Security Affairs

DECEMBER 13, 2022

Twitter confirmed that the recent leak of members’ profile information resulted from the 2021 data breach disclosed in August 2022. Twitter confirmed that the recent data leak of millions of profiles resulted from the 2021 data breach that the company disclosed in August 2022. ” the source told 9to5Mac.

Data breaches 100

Data breaches Accountability Media Hacking 100

Security Boulevard

MARCH 31, 2021

roundup of UK focused Cyber and Information Security News, Blog Posts, Reports and general Threat Intelligence from the previous calendar month, March 2021. FatFace CEO Liz Evans released a statement which said “ On 17th January 2021 FatFace identified some suspicious activity within its IT systems.

Energy and Utilities 120

Energy and Utilities Ransomware Banking Hacking 120

Security Affairs

MAY 20, 2023

Luxottica has finally confirmed the 2021 data breach that exposed the personal information of 70 million customers. pic.twitter.com/62uQWT4YQB — Andrea Draghetti (@AndreaDraghetti) May 12, 2023 The most recent entry in the database is March 16th, 2021, a circumstance that suggests it is a new data breach suffered by Luxottica.

Data breaches 96

Data breaches Retail Hacking Ransomware 96

Security Affairs

NOVEMBER 22, 2021

Threat actors compromised the company network since at least September 6, 2021, but the security breach was only discovered by the company on November 17. “On November 17, 2021, we discovered unauthorized third-party access to our Managed WordPress hosting environment.” We reset both passwords.

Data breaches 128

Data breaches Passwords Accountability Phishing 128

CyberSecurity Insiders

OCTOBER 1, 2021

SALT LAKE CITY–( BUSINESS WIRE )– Venafi , the inventor and leading provider of machine identity management, today announced that the company’s Trust Protection Platform won the “Identity Management Platform of the Year” award in the 2021 CyberSecurity Breakthrough Awards. For more information, visit: www.venafi.com.

Cybersecurity 52

Cybersecurity Digital transformation IoT Marketing 52

Security Affairs

MAY 13, 2024

In December 2021, experts at Check Point Research observed the resurgence of the Phorpiex botnet. .” Password Management : Use strong, unique passwords and implement multi-factor authentication (MFA) whenever possible, prioritizing authentication apps or hardware tokens over SMS text-based codes.

Phishing 117

Phishing Ransomware Security Awareness Authentication 117

Herjavec Group

DECEMBER 15, 2021

Needless to say, in 2021 cybersecurity was front and center for individuals, enterprises, and governments alike. This forced security leaders and enterprise executives to assess their information security operations and overall cybersecurity posture to ensure their organizations were ready to face the challenges ahead.

Cybersecurity 52

Cybersecurity Digital transformation Ransomware Cyber Risk 52

Security Affairs

SEPTEMBER 20, 2023

An attacker can trigger the flaws to escalate privileges in the product and obtain sensitive user data, including password hashes and API tokens. An attacker can trigger the flaw to read and modify page data, including plain-text passwords from login forms. ” reads the post published by Outpost24.

Software 130

Software Passwords Hacking Cybersecurity 130

Security Affairs

JULY 17, 2021

The flaws were discovered by Cisco Talos researchers, the first one tracked as CVE-2021-21818 is hard-coded password vulnerability in the Zebra IP Routing Manager functionality of D-LINK DIR-3040 1.13B03, while the second one is a hard-coded password vulnerability exists in the Zebra IP Routing Manager functionality of D-LINK DIR-3040 1.13B03.

Firmware 118

Firmware Wireless Passwords Internet 118

Security Affairs

DECEMBER 28, 2021

Password manager app LastPass confirmed that threat actors have launched a credential stuffing attack against its users. “Someone just used your master password to try to log in to your account from a device or location we didn’t recognize,” reads the warnings. — Valcrist (@Valcristerra) December 28, 2021.

Password Management 114

Password Management Passwords Accountability Authentication 114

Security Affairs

DECEMBER 31, 2021

A few days ago the data breach hunter Bob Diachenko discovered an unsecured server exposing over 6 million RedLine logs containing data harvested between August and September 2021. Internationally sourced data, exfiltrated in Sept and Aug 2021. pic.twitter.com/kv9MNL8hAE — Bob Diachenko (@MayhemDayOne) December 25, 2021.

Accountability 140

Accountability Malware Data breaches Passwords 140

CyberSecurity Insiders

MARCH 25, 2021

This is why it is essential to your device performance to make sure any endpoints include flexible, secure, default-settings and, in particular, optional mechanisms like password complexity, password expiration, and account lock-out, which forces users to modify the default credentials when setting up the device.

IoT 100

IoT Authentication Passwords Data collection 100

CyberSecurity Insiders

MAY 22, 2021

NEW YORK–( BUSINESS WIRE )– Veridium , a leading developer of frictionless, passwordless authentication solutions, is proud to announce that it’s won the 2021 Global InfoSec Award in the category of Next-Gen in Passwordless Authentication. “We For more information, please visit www.veridiumid.com.

InfoSec 52

InfoSec B2C B2B Authentication 52

Security Affairs

JULY 10, 2021

An unauthorized person also potentially accessed subscribers’ personal information, including call history, names, addresses, emails, and passwords. In January, another US carrier disclosed a data breach, UScellular revealed that attackers had access to personal information of its customers. Pierluigi Paganini.

Mobile 137

Mobile Data breaches Telecommunications Passwords 137

ForAllSecure

MAY 25, 2021

Black Hat Briefings USA ( Jul 31, 2021 through Thu, Aug 5, 2021). BsidesLV (July 31 and August 1, 2021). BSidesLV will be entirely virtual in 2021. For example, FuzzCON 2021 will be hybrid, in person and virtual, the Thursday night between Black Hat and DEF CON. Well, don’t sweat it. Human Needs.

VPN 52

VPN Passwords Internet Internet 52

ForAllSecure

MAY 25, 2021

Black Hat Briefings USA ( Jul 31, 2021 through Thu, Aug 5, 2021). BsidesLV (July 31 and August 1, 2021). BSidesLV will be entirely virtual in 2021. For example, FuzzCON 2021 will be hybrid, in person and virtual, the Thursday night between Black Hat and DEF CON. Well, don’t sweat it. Human Needs.

VPN 52

VPN Passwords Internet Internet 52

Security Affairs

MARCH 13, 2024

Compromised information varies from person to person, but they could include date of birth, Social Security number, government ID, passport number, driver’s license number, and other information collected by the Department of Public Safety in its operations.

Ransomware 116

Ransomware Data breaches Passwords Government 116

Security Affairs

JANUARY 25, 2022

Threat actors are actively exploiting a critical flaw (CVE-2021-20038) in SonicWall’s Secure Mobile Access (SMA) gateways addressed in December. Threat actors are actively exploiting a critical flaw, tracked as CVE-2021-20038 , in SonicWall’s Secure Mobile Access (SMA) gateways addressed by the vendor in December.

Mobile 95

Mobile Passwords Firmware Firewall 95

Security Affairs

DECEMBER 31, 2021

Below is the list of flaws discovered by the researchers: CVE-2021-20173 : Post Authentication Command Injection via SOAP Interface. CVE-2021-20174 : Default HTTP Communication (Web Interface). CVE-2021-20175 : Default HTTP Communication (SOAP Interface). CVE-2021-23147 : Insufficient UART Protection Mechanisms.

Firmware 131

Firmware Encryption Authentication Passwords 131

Security Affairs

MARCH 15, 2024

Source Hackread.com Diaconu was arrested in May 2021 while attempting to leave the United Kingdom 2021 and was extradited to the United States on October 13, 2023. The man operated a series of websites used to sell access to compromised computers worldwide, including servers belonging to companies and individuals in the United States.

Cybercrime 110

Cybercrime Cryptocurrency Advertising Passwords 110

Security Affairs

MAY 17, 2024

CVE-2021-40655 An informtion disclosure issue exists in D-LINK-DIR-605 B2 Firmware Version : 2.01MT.

Firmware 104

Firmware Authentication Passwords Hacking 104

Security Affairs

DECEMBER 11, 2021

The access to user’s private vault is protected by a personal password, and all the files are automatically encrypted. The software also uses a password hash with insufficient computational effort, as a consequence, an attacker can brute force user passwords leading to unauthorized access to user data.

Passwords 113

Passwords Software Encryption Hacking 113

Security Affairs

DECEMBER 30, 2021

Researcher Sylvain Pelissier has discovered that the DataVault encryption software made by ENC Security and used by multiple vendors is affected by a couple of key derivation function issues. An attacker can exploit the flaws to obtain user passwords. ” The vulnerabilities have been tracked as CVE-2021-36750 and CVE-2021-36751.

Encryption 121

Encryption Software Passwords Engineering 121

Security Affairs

SEPTEMBER 3, 2021

.” The PIN provides a series of examples of ransomware attacks impacting food and agriculture sector businesses, such as an attack that took place in January 2021 against an identified US farm that resulted in losses of approximately $9 million due to the disruption of the farming operations. Implement network segmentation.

Ransomware 105

Ransomware Passwords Backups Firmware 105

Security Affairs

JULY 9, 2022

Four of the fixed issues have been rated as a “high” severity, they are CVE-2022-26117, CVE-2021-43072, CVE-2022-30302, and CVE-2021-41031.

Authentication 137

Authentication Passwords Hacking Accountability 137

Security Affairs

DECEMBER 1, 2022

While no plaintext passwords or financial data was stolen, the hack did expose answers to security questions. This attack could’ve easily been avoided if Yahoo had invested more in the security infrastructure. In February 2021, several U.S. Weak passwords are the easiest way hackers can hack into a system.

Data breaches 100

Data breaches Passwords Social Engineering Encryption 100

Security Affairs

MAY 25, 2021

The flaws addressed by the security firm were reported by experts from Cisco Talos. “ TALOS-2021-1230 (CVE-2021-32457) and TALOS-2021-1231 (CVE-2021-32458) are elevation of privilege vulnerabilities that could allow an attacker to obtain elevate permissions on the targeted device.

Network Security 126

Network Security Authentication Firmware Passwords 126

Security Affairs

JULY 22, 2021

Oracle released its Critical Patch Update for July 2021 , it fixes hundreds of flaws, including Critical Remotely Exploitable vulnerabilities in Weblogic Server. Oracle this week released its quarterly Critical Patch Update for July 2021 that contains 342 new security patches for multiple product families. and 11.2.5.0.

Authentication 128

Authentication Passwords Hacking Technology 128

Security Affairs

OCTOBER 11, 2021

DEV-0343: Iran-linked threat actors are targeting US and Israeli defense technology companies leveraging password spraying attacks. Threat actors are launching extensive password spraying attacks aimed at the target organizations, the malicious campaign was first spotted in July 2021.

Technology 95

Technology Passwords Accountability Authentication 95