Attacks, Threats, and Vulnerabilities
Iran nuclear attack: Mystery surrounds nuclear sabotage at Natanz (BBC News) Iran blames Israel, but was this a cyber-attack or physical act of sabotage?
Natanz ‘sabotage’ highlights Iran’s vulnerability to cyber-attacks (the Guardian) Analysis: Apparent attack by Israel is a reminder of the weaknesses of industrial control systems
Iran weighs options after ‘Israeli cyber-attack sets back nuclear programme’ (bne IntelIiNews) Iran has vowed to avenge a suspected Israeli cyber-attack on its main nuclear facility that US intelligence sources have reportedly said may set back ...
Israel awaits Iran’s response: Terrifying days ahead for Zionist entity! (PressTV) The Zionist entity confirmed its role behind its cyber-attack on the Natanz nuclear reactor. This means there are terrifying Days ahead for the Zionist entity.
Israel appears to confirm it carried out cyberattack on Iran nuclear facility (the Guardian) Shutdown happened hours after Natanz reactor’s new centrifuges were started
Israel Reportedly Behind Cyberattack That Caused Blackout at Iran Nuclear Facility (Slate Magazine) The apparent attack came shortly after Iran said it would launch new reactors at the Natanz plant that would speed up uranium enrichment.
Iran-Israel war of words ensue over Natanz nuclear facility power outage (WION) The war of words between Iran and Israel over Iran's Natanz nuclear facility outage has heated up. The nuclear site that has been very active in the past few years is a Uranium enrichment site.
The site was started by Iran in 2018 after former US President Donald Trump took US out of the nuclear deal with Iran The facility saw a blackout on Sunday.
US reacts to cyberattack on Iran's nuclear site (Yahoo) The White House weighed in on the cyberattack on Iran's uranium enrichment facility, saying "the U.S. "was not involved in any manner." (April 12)
‘They knew I was running late to meetings’: Former DHS chief on reports that SolarWinds hackers targeted his emails (The Record by Recorded Future) " Just the fact that they got my email and knew I was running late to meetings isn’t that big of a deal at the end of the day."
Spy Chiefs to Warn of Threats From SolarWinds to North Korea (Bloomberg) Return to public testimony after Trump called his team ‘naive’. Four top intelligence chiefs to testify on Wednesday, Thursday.
NAME:WRECK DNS vulnerabilities affect over 100 million devices (BleepingComputer) Security researchers today disclosed nine vulnerabilities affecting implementations of the Domain Name System protocol in popular TCP/IP network communication stacks running on at least 100 million devices.
NAME:WRECK: Breaking and fixing DNS implementations (Forescout | JSOF) In the third study of Project Memoria – NAME:WRECK – Forescout Research Labs and JSOF Research Labs joined forces to understand underlying problems related to Domain Name System (DNS) implementations, to disclose a set of 9 vulnerabilities affecting 4 popular TCP/ IP stacks and to propose solutions for the community.
Pulse Secure VPN users can't login due to expired certificate (BleepingComputer) Users worldwide cannot connect to Pulse Secure VPN devices after a code signing certificate used to digitally sign and verify software components has expired.
Security researcher drops Chrome and Edge exploit on Twitter (The Record by Recorded Future) An Indian security researcher has published details today about a zero-day vulnerability impacting Google Chrome, Microsoft Edge, and other Chromium-based browsers like Opera and Brave.
Blox Tales: W2 Tax Scam Using Typeform (Armorblox) In this blog, we’ll focus on a W2 tax email scam that used Typeform within its attack flow. The email attack aimed to harvest victims’ email account credentials.
Lucky Penny: Missing ATM Card Attack Bypasses Scanners (Avanan) Avanan researchers uncovered a variant on the classic Nigerian Prince scheme that bypassed Proofpoint.
Initial Access Brokers listings increasing in 2021 (Digital Shadows) Since we first published our report Initial Access Brokers: An Excess of Access, Digital Shadows has continued to closely monitor this criminal category and analyze in detail its development over the following months. Our first report uncovered 500 listings throughout 2020 yet already in 2021 we have found some 200 new listings published by Initial Access Brokers (IABs) in cybercriminal forums and other dark web sources in just the first quarter of this year.
Dutch supermarkets run out of cheese after ransomware attack (BleepingComputer) A ransomware attack against conditioned warehousing and transportation provider Bakker Logistiek has caused a cheese shortage in Dutch supermarkets.
Clubhouse in the spotlight after user records posted online (WeLiveSecurity) A database containing scraped personal data of 1.3 million Clubhouse users is up for grabs on a hacking forum.
7 new social engineering tactics threat actors are using now (CSO Online) Old tactics in new packages lead the list of current social engineering attacks. Experts provide real-world examples.
Positive Technologies discovers critical vulnerability in the VMware endpoint protection platform (Positive Technologies) The vulnerability allows attackers to bypass authentication mechanisms and access Carbon Black Cloud Workload with maximum privileges
Report: Indian Supply-chain Giant Bizongo Suffered Devastating Data Breach (Website Planet) Company name and location: Bizongo, based in India. Size (in GB and amount of records): 643GB, with 2,532,610 files exposed.
Pokies shut down by hacker ransomware attack (ABC) Tasmania's lone casino operator confirms it is being held to ransom in a cyber attack that has impacted its pokies machines and hotel bookings system for more than a week.
Systemwide Data Breach Poses Threat to Students’ Personal Information (The Triton) The University of California released a statement on March 31 stating they were impacted by a cyber attack that affected at least 300 organizations including several universities. Prior to UCSD’s announcement, many students had already received suspicious emails, mentioning their personal information had been hacked.
Vulnerability Summary for the Week of April 5, 2021 (CISA) The CISA Vulnerability Bulletin provides a summary of new vulnerabilities that have been recorded by the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD) in the past week. NVD is sponsored by CISA. In some cases, the vulnerabilities in the bulletin may not yet have assigned CVSS scores. Please visit NVD for updated vulnerability entries, which include CVSS scores once they are available.
Acknowledging Data Breach Upstox Upgrades Security Systems (BW Disrupt) internet security researcher Rajshekhar Rajaharia was first to reveal that data of 56 million KYC and 2.5 million users has been compromised. , , Upstox, hacking, data breach, cyber security, user data, startups
Brown University Recovering from Cyber Attack (Government Technology) Brown University was still recovering last week from a recent cybersecurity attack that affected Microsoft Windows-based programs, although it did not disclose whether sensitive data was exposed.
Hackers try to extort University of Colorado in cyberattack (The Colorado Sun) Hackers are trying to extort the University of Colorado after a cyberattack that potentially compromised personal information from more than 310,000 files, including student data, medical information and several Social Security numbers, university officials said Friday. The attackers have posted small amounts of data on the internet and are threatening to post more […]
Security Patches, Mitigations, and Software Updates
Why Brave Disables FLoC (Brave Browser) Brave opposes FLoC, a recent Google proposal that would have your browser share your browsing behavior and interests by default with every site and advertiser with which you interact.
Trends
Cyberattacks are the number-one threat to the global financial system, Fed chair says (CNN) Cyberattacks are now the foremost risk to the global financial system, even more so than the lending and liquidity risks that led to the 2008 financial crisis, according to Federal Reserve Chairman Jerome Powell.
Data protection has never been a hotter topic, and that's good news for every organisation (Computing) Data protection is evolving into data management
Highlights from the Unit 42 Cloud Threat Report, 1H 2021 (Unit42) The Unit 42 Cloud Threat Report, 1H 2021, found a spike in security incidents for COVID-19 critical industries, a decline in cryptojacking and more.
M-Trends Cyber Security Trends (FireEye) The annual report was compiled by mandiant consultants at FireEye based on hundreds of incident response investigations in many industry sectors. It offers recommendations on how organizations can improve the way they prevent, detect, analyze and respond to cyber attacks.
McAfee Labs Report Reveals Latest COVID-19 Threats and Malware Surges (McAfee Blogs) The McAfee Advanced Threat Research team today published the McAfee Labs Threats Report: April 2021. In this edition, we present new findings in our
Threat Intelligence Summary (Fidelis Cybersecurity) The Fidelis Threat Research Team (TRT) monitors and collects information on external threats which may pose a risk to Fidelis customers.
Invicti Security Reports on Lost Year in Web Application Security (PR Newswire) Invicti Security™, a global leader in web application security, today released the spring volume of its Invicti AppSec Indicator Report, which...
Synopsys Study Shows Uptick in Vulnerable, Outdated, and Abandoned Open Source Components in Commercial Software (Synopsys) Analysis of more than 1,500 commercial codebases finds that open source security, license compliance, and maintenance issues are pervasive in every industry sector
CloudKnox Report Uncovers Dubious Permissions Gap Across Enterprise Hybrid and Multi-Cloud Environments (BusinessWire) State of Cloud Entitlements Report reveals significant security risk with more than 90% of organizations using less than 5% of permissions granted.
Marketplace
Crosspoint Capital Partners LP Raises $1.3 Billion for Debut Private Equity Fund focused on Cybersecurity, Privacy and Infrastructure Software (PR Newswire) Today Crosspoint Capital Partners LP ("Crosspoint") announced the closing of Crosspoint Capital Fund I ("Fund I"), an investment fund focused...
Talon Cyber Security Raises $26M for Distributed Workforce Protection (MSSP Alert) Talon Cyber Security raises $26m in seed funding from Lightspeed Venture Partners for distributed workforce cybersecurity technology.
Veriff Secures $69 Million Funding To Grow Identity Verification Business (Forbes) Veriff, an Estonia-based technology company focused on identity verification, announced today that it has secured $69 million in a series B funding round led by investment firms IVP and Accel.
Cybersecurity training startup Hack The Box raises $10.6M Series A led by Paladin Capital (TechCrunch) Cybersecurity training startup Hack The Box, which emerged originally from Greece, has raised a Series A investment round of $10.6 million, led by Paladin Capital Group and joined by Osage University Partners, Brighteye Ventures and existing investors Marathon Venture Capital. It will use the fundi…
Darktrace Plans First Major London IPO Since Deliveroo Flop (Bloomberg) IPO may value cybersecurity firm at $3 billion to $4 billion.
Cybersecurity firm Darktrace plans £3bn IPO on London Stock Exchange (the Guardian) British firm’s CEO Poppy Gustafsson says London was ‘natural choice’ despite Deliveroo’s disastrous debut
Gallagher Re brings Bermuda cyber hub to life (Insurance Business) Operation is one of the first of its kind within the market
Cyber Events Could Pose Material Risk to Water, Sewer Utility Credit (Fitch Ratings) Water and sewer credit ratings incorporate an assessment of an entity's resiliency to manage unexpected events, including cyberattacks, which could pose financial and operating risks that ultimately affect utility credit quality, Fitch Ratings says.
Efren Zamaro Selected As SynED's Cyber Hero for Drive, Passion, and Curiosity at an Early Age (PR Newswire) Today, SynED, a national non-profit organization that identifies emerging best practices for effective articulation between employers, job...
Armis Names Tim Mackie Vice President of Worldwide Channels (PR Newswire) Armis®, the leading agentless device security platform, today announced the appointment of Tim Mackie as the new Worldwide Vice President of...
Former Defense Intelligence Agency CISO Joins Corelight as Federal CTO (PR Newswire) Corelight, provider of the industry's first open network detection and response (NDR) platform, today announced that Jean Schaffer, a 33-year...
Products, Services, and Solutions
Absolute Software Enables Customers to Identify and Address Potential Endpoint Security Risks With Additional Platform Enhancements (BusinessWire) Absolute Software™ (NASDAQ:ABST) (TSX:ABST), a leader in Endpoint Resilience™ solutions, today announced additional platform enhancements, further ena
Randori Unveils Target Temptation Engine - Exposes Where Hackers Will Attack Organizations First (PR Newswire) Randori, the company unlocking the attacker's perspective, today unveiled a series of updates to its award-winning Attack Surface Management...
Evolv Brings Data Analytics Capabilities to Touchless Security Screening (Evolv Technology) An Industry-first, Bolstering Security Operations Efficiency, Evolv Insights™ Provides Evolv Express® Customers with Greater Visibility into the Performance of Their Screening Systems
New Infosec IQ Cybersecurity Culture Survey Quantifies Security Beliefs, Sentiments (Infosec Institute) Tool introduces actionable, scalable method to assess organizational security culture
UNECE WP 29 - update monitoring for your software suppy chain by asvin (asvin) Update monitoring and management for the entire software supply chain according to UNECE WP 29 by asvin. Read more now !
Cloudera Collaborates with NVIDIA to Accelerate Data Analytics and AI in the Cloud (Cloudera) Cloudera Collaborates with NVIDIA to Accelerate Data Analytics and AI in the Cloud
Acronis launches new partner portal to empower service providers, resellers and distributors (Acronis) For information about Acronis and Acronis' products or to schedule an interview, please send an email or get through to Acronis' representative, using media contacts.
Threat Stack Announces Support for Arm-based AWS Graviton2 (BusinessWire) Threat Stack today announced its ability to support AWS Graviton2-based instances through the Threat Stack Cloud Security Platform.
Beyond Identity Integration With Auth0 Enables Completely Passwordless Authentication (Beyond Identity) Beyond Identity Now Available on Auth0 Marketplace to Eliminate User Friction and Credential-Based Attacks
airSlate Announces signNow Partnership with Defa3 Cyber Security (Yahoo) airSlate, a leader in no-code workflow automation solutions, announced today that its award-winning eSignature solution, signNow, is available to customers of Defa3 Cyber Security, a pioneer partner and preferred provider of information technology and security solutions and services in the Middle East. The partnership will serve to expand awareness for airSlate in the region, as well as further enhance the value of Defa3 Cyber Security's technology portfolio to its customers.
Skybox Security Delivers Industry's Most Advanced Exposure Analysis (PR Newswire) Security today announced major enhancements to its Security Posture Management Platform. Skybox is the only platform that offers IT and...
Axiad Airlock Accelerates Passwordless Authentication (axiad) Axiad, a leading provider of cloud-based passwordless authentication and secure interactions for users and machines, today announced the general availability of Airlock, a key feature of the Axiad Cloud SMARTidentity platform.
Tuxera's File System Software Chosen by Orca Security for Their Enterprise Multi-Cloud Security Platform (PR Newswire) Tuxera, a world-leader in quality-assured storage management and networking software, announced that Orca Security, the cloud security...
Cobalt Iron Signs Agreement With Global Systems Integrator Rahi Systems to Distribute Compass for SaaS Backup
(Wall Street Communications) Partnership Will Extend Global Reach of Compass, Bringing Modern and Advanced Data Protection to Enterprise Customers Around the World
IRONSCALES Announces Expanded MSSP Partnership Program (PRWeb) IRONSCALES, the pioneer of self-learning email security, announced today that it has expanded its managed security service provider (MSSP) stra
Telos’ Xacta Expands Availability to Microsoft Azure across all U.S. Government Cloud Instances (Telos Corporation) Telos Corporation’s cyber risk management solution to bring faster cloud compliance to Azure customers.
Fitch Ratings Partners with SecurityScorecard to Assess Cyber Risk (Fitch Ratings) Fitch Ratings is pleased to announce a partnership with SecurityScorecard, the global leader in cybersecurity scores, with the goal of providing investors with additional insights into how to assess this growing risk.
Technologies, Techniques, and Standards
How to Handle a Data Breach and Form an Incident Response Plan (EC Council) Data breaches are far deeper than what appears on the surface.
Cybersecurity guide for the hospitality industry (Help Net Security) A practical cybersecurity guide from NIST can help hotel owners protect the hotel property management system (PMS) from hackers.
Research and Development
Science of Security and Privacy 2021 Annual Report (CPS-VO) The National Security Agency Research Directorate sponsors the Science of Security and Privacy Initiative for the promotion of a foundational cybersecurity science that is needed to mature the cybersecurity discipline and to underpin advances in cyberspace.
Legislation, Policy, and Regulation
US, Iran recommit to indirect talks after sabotage attack on nuclear site (ABC News) An attack on one of Iran's most sensitive nuclear facilities has threatened to unravel President Joe Biden's diplomatic efforts to revive the Iran nuclear deal.
Government urged to include 'right to disconnect' in UK Employment Bill (Computing) Support for the policy crosses party lines across Labour and Conservative voters
Revealed: the Facebook loophole that lets world leaders deceive and harass their citizens (the Guardian) A Guardian investigation exposes the breadth of state-backed manipulation of the platform
President Biden Announces His Intent to Nominate Key Members for the U.S. Department of Homeland Security (The White House) Today, President Joe Biden announced his intent to nominate key leadership for the U.S. Department of Homeland Security; John Tien for Deputy
Amid a Wave of Hacks, Biden Moves to Fill Key Cyber Posts (Wall Street Journal) The president intends to nominate NSA veterans to key positions, as the White House looks to round out its personnel in the wake of two recent hacks linked to foreign governments.
Biden names former NSA officials to key cybersecurity positions (POLITICO) The president’s selection of Chris Inglis and Jen Easterly adds to a roster of intelligence community veterans named as top cyber officials.
Biden’s cybersecurity dream team takes shape (TechCrunch) Former NSA official Jen Easterly is tapped as the next CISA director.
White House Chip Summit Builds Momentum for Federal Investments in U.S. Chip Manufacturing and Research (Semiconductor Industry Association) The Semiconductor Industry Association (SIA) today released the following statement from President and CEO John Neuffer regarding
Utah Creates Data Breach Safe Harbor (The National Law Review) Utah recently amended its breach notice law to provide certain defenses to companies who suffer a data breach.  It is now the second state, after Ohio, to include such provisions.
Florida lawmakers consider cybersecurity overhaul (StateScoop) State lawmakers are in the process of approving legislation that would add new security roles at the year-old Florida Digital Service agency.
Israelis May Ban High Tech Cars From Bases: ‘Perfect Espionage Vector’ (Breaking Defense) "Imagine you work at a chemical research part of a base. Its location is secret. But you have a smart car. Through other espionage activities, I found out you work there. I hack your phone or your car’s online account," Keatron Evans said. "I track your location as you go to work every day. Now I know the specific GPS location of your work facility. It goes downhill quickly from there."
Litigation, Investigation, and Law Enforcement
Antitrust and Privacy Are on a Collision Course (Wired) Facebook is being sued for weakening data protections. Google is being sued for strengthening them. Can that paradox be resolved?
First NYDFS Cybersecurity Enforcement Action Arising From a Standard Examination Results in $1.5 Million Penalty (The National Law Review) On March 1, 2017, the New York State Department of Financial Services (“NYDFS”) Cybersecurity Requirements for Financial Services Companies (the “Cybersecurity Regulation”) bec
How The FBI Unmasked A WhatsApp And Whisper User In A Pedophile Sting (Forbes) The FBI says it needs access to encrypted messages, but it can use lawful data requests and old fashioned policing to unmask supposedly-anonymous criminals using the likes of WhatsApp and Whisper.
Shopify, Ledger named in new class-action lawsuit following 2020 data breach (BetaKit) Shopify and cryptocurrency hard wallet company Ledger have been hit with a class-action lawsuit in relation to a 2020 data breach.
Apple and Google block NHS Covid app update over privacy breaches (the Guardian) App was to have been updated before English lockdown easing, but firms objected to data-sharing changes
Apple and Google block official UK COVID-19 app update (Naked Security) UK coronavirus app update apparently included “feature creep” that’s explicitly prohibited by Apple’s and Google’s programming rules.
