26. June 2021

SolarWinds backdoor gang pwns Microsoft support agent to turn sights on customers

Mercedes-Benz data breach impacted roughly 1000 individuals

SolarWinds backdoor gang now pwns Microsoft support agent to turn sights on customers

Yuki Chan – Automated Penetration Testing and Auditing Tool

Microsoft: Russia-linked SolarWinds hackers breached three new entities

Securing Patient Private Information in The Age of Shared Information

New Report Shows Over Two Million Secrets Detected on Public GitHub in 2020 and a 20% growing trend Year-Over-Year.

Best Practices and Techniques for Pseudonymization

How Zero Trust architecture improves the organization’s network security

7 Challenges in modern Cybersecurity and how to fix them

7 keys to evaluating zero trust security frameworks

Attackers Pummelled the Gaming Industry During the Pandemic

A New GoLang Trojan ChaChi Used in Attacks Against US Schools

VMware Patches Authentication Bypass in Carbon Black App Control

New ransomware group Hive leaks Altus group sample files

New malware in pirated games disables Windows Updates, Defender

NoSQL Injections in Rocket.Chat 3.12.1: How A Small Leak Grounds A Rocket

Hackers Are Erasing Western Digital Hard Drives Remotely

Top Stories: iPhone 14 With In-Screen Touch ID, iOS 15 Beta 2, Apple Warns Leakers, and More

US supermarket giant Wegmans exposed sensitive data

Mercedes-Benz USA: Nearly 1,000 Customers’ Data Accessible Online

Say $6 Trillion Again … I DARE you: Examining the roots of a total BS Marketing Number

How the Capital One Breach Could Have Been Avoided With Application-Layer Data Encryption

CVE-2019-9670: Zimbra Collaboration Suite XXE vulnerability, (Sat, Jun 26th)

‘Build’ or ‘Buy’ your own antivirus product

SOC First Defense Phase – Understanding The Cyber Attack Chain – A Defense Approach with/without SOC

Epsilon Red – our research reveals more than 3.5 thousand servers are still vulnerable

Prepare your defense against cybercriminals with ransomware best practice resources | #RansomwareWeek

How can the cloud take instant card issuance to the next level?

The Bitglass Blog

How data poisoning is used to trick fraud detection algorithms on ecommerce sites

Palo Alto Networks teams with AT&T to deliver managed SASE

Russian Foreign Ministry accused the United States of trying to win back the summit agreements on cybersecurity

SolarWinds backdoor gang pwned Microsoft support agent to turn sights on customers

Intermedia AI Guardian protects businesses and their employees from targeted cyberattacks

EclecticIQ Platform delivers threat intelligence, hunting, and response capabilities

Avaya OneCloud for Service Cloud empowers service agents with flexible migration options

Week in security with Tony Anscombe

FOSTA-SESTA trafficking law used once since 2018: GAO report

Decoding California’s New Digital Vaccine Records and Potential Dangers

HID Global TouchChip TC series of capacitive fingerprint sensors achieves Level 1 PAD status

How Zscaler combined active threat defense and zero trust

Entrust achieves Visa Ready certification for Instant Financial Card Issuance solutions

Jailed for seven years: Cyber-crook who broke into Big Biz to steal bank card info for FIN7 super-gang

What We Know About The Ransomware Economy

Podcast: Can we fix IoT security?

New Nobelium activity

AWS launches BugBust contest: Help fix a $100m problem for a $12 tshirt

IT Security News Daily Summary 2021-06-25

The Myth of Part-time Hunting, Part 1: The Race Against Ever-diminishing Breakout Times

PS3 Players Ban: Latest Victims of Surging Attacks on Gaming Industry

Mercedes-Benz Customer Data Flies Out the Window

New CPU Baseline for Windows 11 Will Ensure Better Security, Microsoft Says

Thoughts on Assessing Threat Actor Intent & Sophistication

What the Pentagon’s New UFO Report Reveals About Humankind

Joint operations demand a digital battlefield. Here are key steps for delivering

Linux: How to find details about user logins

end-to-end encryption (E2EE)

Cyber Cold War? The US and Russia talk tough, but only diplomacy will ease the threat

Ransomware-as-a-service business model takes a hit in the aftermath of the Colonial Pipeline attack

MyBook Users Urged to Unplug Devices from Internet

Infographic: Bad Bot Sophistication Levels

How enterprises can close 5 major SASE gaps

Marketo Marketplace – Cybercriminals are targeting major law firms

iOS 15 Hotspot Connections Feature Stronger WPA3 Security

Investigating and Mitigating Malicious Drivers

Cyber Security Risk Modeling: What Is It And How Does It Benefit Your Organization?

Young Americans Twice as Likely to Cyber-stalk

500 Organizations Affected Via Security Flaw in AWS Route53

Expert On Report: 79% Of Developers Don’t Update Third-party Libraries In Their Code

NIST defines ‘critical software’ under the cyber EO

Small businesses ask Congress to focus CMMC on primes and DOD

FIN7 ‘Pen Tester’ Headed to Jail Amid $1B in Payment-Card Losses

Amazon Acquires Secure Messaging Platform Wickr

Your password is too predictable

Hackers exploit 3-years old flaw to wipe Western Digital devices

Progress on Transatlantic Data Transfers? The Picture After the US-EU Summit

Time To End India’s War on Sedition

Vaccine Documentation Needs To Be Kept Secure

Bit Discovery Banks $4 Million for Attack Surface Management Tech

Data Privacy Is in 23andMe CSO’s DNA

MacRumors Giveaway: Win an Apple Watch Series 6 and Leather Band From BluShark

Tool lets users supplement Mitre ATT&CK knowledge base with their own threat intel

A quick-start guide to OpenZFS native encryption

John McAfee found dead by apparent suicide in Spanish prison cell

Apple exec: “Sideloading in this case is actually eliminating choice”

ChaChi: a new GoLang Trojan used in attacks against US schools

Encouraging women to embrace their cybersecurity superpowers

Dell SecureAssist contained RCE flaw allowing miscreants to remotely reflash your BIOS with code of their creation

AWS acquires encrypted messaging app Wickr

Will your PC run Windows 11? Even Microsoft can’t say for sure

World’s Largest E-tailers to be Investigated Over Fake Reviews

FIN7 Pen Tester to Serve Seven Years

Europol supports the French Gendarmerie in taking down Ivorian network behind scam in excess of €13 million

Video: Belkin’s Soundform Connect Adds AirPlay 2 to Your Existing Speakers

Business Continuity – The Light in a Time of Darkness

Know Your Guest: Why secure identity verification needs to be a top priority for hotels

Risk-based security now more important than ever for Energy and Utilities!

Threat Intelligence and Energy and Utilities

Google Delays Third-Party Cookie Removal Until 2023

Cisco ASA Bug Now Actively Exploited as PoC Drops

How Cyber Sleuths Cracked an ATM Shimmer Gang

CISO of the month by Cisco Secure – Esmond Kane

FIN7 Hacking Group Member Lands Seven Year Prison Term

How Hackers Are Using Gamers To Become Crypto-Rich

Disconnect Your WD My Book Live NAS Off The Internet Now

Google Tracking Cookies Ban Delayed Until 2023

Apple Watch ECG App Receives Approval in China, Already Working in watchOS 8 Beta 2

CipherTrace CEO on tracking crime in crypto

Dell new vulnerability puts over 30 million users at risk

Mozilla partners with Princeton researchers for privacy-focused data sharing platform on Firefox

My Book Live Users Wake Up to Wiped Devices, Active RCE Attacks

Hybrid workforce model needs long-term security roadmap

School’s Out for Summer, but Don’t Close the Book on Cybersecurity Training

This Month on Apple Arcade: ‘Legends of Kingdom Rush,’ ‘Game Dev Story+,’ ‘Frenzic: Overtime,’ ‘INKS.+,’ and ‘Leo’s Fortune+’

Windows 11 enables security by design from the chip to the cloud

How Smart Organizations Mitigate Cyber Risks in a World of Unknown Unknowns

Dell Support Assistant Bug Let Hackers Perform RCE at the BIOS/UEFI level on Dell Systems

Pull your Western Digital My Book Live NAS off the internet now if you value your files

AWS Acquires Encrypted Communications Service Wickr

Atlassian moves to lock down accounts from takeover bugs

High-Level FIN7 Member Sentenced to 7 Years in Prison

US Takedown of Iranian Media Sites Extends a Thorny Precedent

Citrix Releases Security Updates for Hypervisor

Apple TV+ Shares Trailer for Musical Comedy Series ‘Schmigadoon!’ Ahead of July 16 Premiere

PS3 users reportedly banned from their accounts as a result of possible data breach

REvil strikes Healthcare giant Grupo Fleury

Threat Actors Reinforce Spam Campaigns: New IcedID Banking Trojan Version Discovered

WD My Book Live NAS Devices Reformatted Remotely All Over the World

Binance Helps Take Down Multiple Clop Ransomware Gang Members

What is Polymorphism? Documenting a Malware’s Middle-Life Crisis

Study: Facebook’s Top Three Apps Tie For Least Respect For Privacy

REvil Hits French Connection, Grupo Fleury

Microsoft signed a malicious Netfilter rootkit

Beats Studio Buds Launch Today With Apple Store Pickup Now Available

#RansomAware: Coalition forms to fight back on ransomware

Making our computers more secure

Researcher Discovers Susceptibility Affecting Numerous Linux Marketplaces

Old Vulnerability Exploited to Hack, Wipe WD Storage Devices

An Unusual File Attachment Is Being Used in Phishing Attacks

NIST Has Come Out With Its Own Ransomware Guidance | #RansomwareWeek

6 official Python repositories plagued with cryptomining malware

Ever wondered what makes hackers tick? Find out from Kevin Mitnick at this virtual event

7 Unconventional Pieces of Password Wisdom

Google Extends Support for Tracking Party Cookies Until 2023

AI-Piloted Fighter Jets

Deals: Get $49 Off Apple’s New M1 iMacs, Starting at $1,249.99 for 7-Core 256GB

Virgin Galactic Receives US Approval For Space Travel

Hackers Crack Pirated Games with Cryptojacking Malware

1-15 June 2021 Cyber Attacks Timeline

Crackonosh malware abuses Windows Safe mode to quietly mine for cryptocurrency

Three Texan men jailed after using Grindr to find targets for theft, kidnap, assault

Disconnect your WD My Book Live from the web to avoid data deletion, says Western Digital

Google Rolling Out Security Update for Google Drive

Flaws in FortiWeb WAF expose Fortinet devices to remote hack

Apple To Bank On Revised Retail Store Strategy

British tourists charged £1000s for pier visits in billing blunder

Roll-your-own tobacco smuggling network dismantled in Portugal and Spain with Europol’s support

Cisco’s CISO of the Month – Esmond Kane

Dell BIOSConnect Flaws Show Over-the-Air Risks

New Bugs Found in Dell SupportAssist

Sophisticated hackers are targeting these Zyxel firewalls and VPNs

‘Pen tester’ FIN7 hacking group member lands seven-year prison term

Member of FIN7 Cybercrime Gang Sentenced to Prison in U.S.

Atlassian Domain Flaws Could Have Led to Data Leakage and Account Control with Just One-click Exploit

Taking Data Privacy Further: Prioritizing Privacy & Continuous Improvement

30 Million Dell Devices Vulnerable to Remote BIOS Attacks

Unknown User Accounts Can be Used to Hack Zyxel Firewalls and VPNs

Vulnerabilities Expose Fortinet Firewalls to Remote Attacks

Cl0p Ransomware Group Announces New Victim After Police Arrest

DreamHost hosting firm exposed almost a billion sensitive records

The Evolution of Application Security (AppSec)

Ursnif Banking Trojan is Back in Italy

Watch Out! Zyxel Firewalls and VPNs Under Active Cyberattack

Brokerage Companies Alerted by FINRA of Ongoing Phishing Campaign

Amazon, Google Face CMA Investigation Over Fake Reviews

Cloud security is still a work in progress

Dutch Group Launches Data Harvesting Claim Against TikTok

AWS BugBust Aims to Fix One Million Vulnerabilities Globally

Crackonosh virus mined $2 million of Monero from 222,000 hacked computers

Clop gang members recently arrested laundered over $500M in payments

Google Fi VPN Starts Rolling Out to iPhone Users

Hackers are infecting gamers’ PCs with malware to make millions from crypto

Windows 11 Slated To Arrive Before Year End

‘What are the odds someone will find and exploit this?’ Nice one — you just released an insecure app

Newly Discovered Dell Bugs Impact 30 Million PCs

Latest iOS and iPadOS 15 Betas Allow Apps to Request Access to More RAM

New US CISO appointments, June 2021

US Takes Aim At Big Tech, Approves Breakup Antitrust Bill

It was 20 years ago today…

FCW Insider: June 25, 2021

Cloud Database Exposes 800M+ WordPress Users’ Records

Emotet Email Aftermath

Western Digital Asks ‘My Book Live’ Device Owners to Unplug After Reports of Remotely Wiped Drives

US Takes Aim At Big Tech, Approves Five Antitrust Bills

Researchers Detail Exploit Chain for Hijacking Atlassian Accounts

Why You Shouldn’t Reuse Usernames | Avast

Privacy Group Denounces Eproctoring | Avast

Who would cross the Bridge of Death? Answer me these questions three! Oh and you’ll need two-factor authentication

FIN7 Supervisor Gets 7-Year Jail Term for Stealing Millions of Credit Cards

Ask Chloé: Public Speaking Advice

The Cyber Blue Line – the new law enforcement frontier

Open Source Package Management: Balancing Power and Security

Desktop Instagram Posting Currently Being Tested, Confirms Facebook

Want your endpoint security product in the ‘Microsoft Consumer Antivirus Providers for Windows’ ?

Weekly Update 249

How Can SMBs Fight Cyberattacks?

Teespring – 8,234,193 breached accounts

DirtyMoe Botnet has Infected over 100,000 Windows Systems

Polish Authorities Says Recent Hacker Attacks Connected with Special Services of The Russian Federation

Clop Gang Partners Laundered $500 Million in Ransomware Payments

REvil Ransomware gang targets FCUK

Make the best of ISC Ransomware course free till July end this year

After Van Buren, are Data Scraping Cases Barred?

New infosec products of the week: June 25, 2021

Third-party identity risk management, compliance, or both?

How SMBs are dealing with emerging threats

yotepresto.com – 1,444,629 breached accounts

SN1PER – A Detailed Explanation of Most Advanced Automated Information Gathering & Penetration Testing Tool

Data sharing is critical for JADC2, but reciprocity is hard to enforce

DOD watchdog says DDS director didn’t mistreat employees

Pentagon ‘actively’ considering JEDI options, Hicks says

States rely on National Guard cyber units

How NGA is handling hybrid telework

Most businesses to accelerate data security investments in 2021

U.S. Government Equates Threat of Ransomware with Terrorism | #RansomwareWeek

Help Shape the ISSMP Exam

What is Digital Identity, and why is it important?

Stories from the SOC – Office 365 account compromise and credential abuse

Are fraudsters using automation to execute mass cyber-attacks?

Australia’s cops need reminding that chasing criminals isn’t society’s only need

The impact of current and emerging threats on the day-to-day lives of SecOps teams

ISC Stormcast For Friday, June 25th, 2021 https://isc.sans.edu/podcastdetail.html?id=7558, (Fri, Jun 25th)

71% of organizations experienced BEC attacks over the past year

NS1 Connect: A unified application traffic automation and intelligence platform

Cyberattack traffic targeting video game industry surged during the pandemic

Minister prioritises Critical Infrastructure Bill as two others pass through Parliament

Eutelsat ADVANCE: A network solution for end-to-end managed connectivity services

Gaming industry under siege from cyberattacks during pandemic

Spam Downpour Drips New IcedID Banking Trojan Variant

Is this traffic bAD?, (Fri, Jun 25th)

Eftpos sends connectID digital identity solution live

Unisys chooses Unbound CORE to unify key management and security policies

Zero trust startup Illumio raises $225M to protect multicloud and edge

Generated on 2021-06-26 23:55:28.369968