Last year alone, SpyCloud researchers and data scientists recaptured and analyzed more than 43.7 billion distinct identity records. Use our free tool to see your organization’s darknet footprint, including breach exposures and malware-exfiltrated data that puts your business at risk of account takeover and ransomware. Simply enter your business email to reveal PII, credentials, breach exposures, stolen session cookies, and more. Check your exposure now to see what criminals know about your business.
We're always looking for ways to improve the N2K CyberWire network to give you an intelligence-driven news experience. Please take a few minutes to tell us about your network experience and share your feedback by completing our 2024 Audience Survey, and you will have a chance to win a $100 Amazon gift card. Take the survey.
An international law enforcement operation coordinated by Europol has seized thirteen websites operated by terrorist groups, GBHackers reports. Europol said in a press release, "This joint effort, known as Operation HOPPER II, targeted key assets in the online dissemination of terrorist propaganda, including those of the so-called Islamic State, al-Qaeda and its affiliates, and Hay’at Tahrir al-Sham. The operation specifically targeted terrorist-operated websites used to disseminate terrorist propaganda, thereby limiting the ability of terrorist organisations to recruit, radicalise, and mobilise recruiters online."
An attack can execute in the cloud in as little as 10 minutes. Security teams must accelerate cloud investigation to combat these fast-moving threats. But how? On June 25, hear from cloud security experts - firsthand - as they discuss the industry’s ONLY cloud security benchmark (/555) and why it’s critical to achieve this milestone for cloud detection and response. Further, learn methods to streamline investigations and reduce manual effort for your SecOps team! Secure your spot!
Sygnia has published a report outlining a sophisticated attack against a major organization by the Chinese threat actor Velvet Ant. The threat actor maintained persistence within the organization's network for three years while conducting cyberespionage. Sygnia explains, "The threat actor achieved remarkable persistence by establishing and maintaining multiple footholds within the victim company’s environment. One of the mechanisms utilized for persistence was a legacy F5 BIG-IP appliance, which was exposed to the internet and which the threat actor leveraged as an internal Command and Control." The researchers note that the compromised F5 appliance was "running an outdated, vulnerable, operating system."
VMware by Broadcom has released patches for two critical vulnerabilities (CVE-2024-37079 and CVE-2024-37080) affecting vCenter Server, SecurityWeek reports. The company states, "A malicious actor with network access to vCenter Server may trigger these vulnerabilities by sending a specially crafted network packet potentially leading to remote code execution." The flaws have been assigned CVSSv3 scores of 9.8.
The company also patched several local privilege escalation vulnerabilities (CVE-2024-37081) with a CVSSv3 score of 7.8.
Sign up for Scout Insight's free trial today! Get immediate insights into threats, search any IP with no training required, and enjoy intuitive graphical results. Whether you need to identify compromised hosts or enrich Splunk queries, Scout Insight has you covered. Don’t wait – accelerate your threat response now. Visit team-cymru.com/cyberwire to start your free trial!
NHS Dumfries and Galloway, part of NHS Scotland, says approximately 150,000 people should assume their data has been leaked following a data extortion attack the organization sustained in February, the Register reports. The NHS board is sending breach notifications to everyone in the Dumfries and Galloway region, stating, "This is an extremely serious situation, and everyone is asked to be on their guard for any attempts to access their computer systems, or any approaches by anyone claiming to hold their data or someone else’s data." The breached data includes "xrays, test results and correspondence between health and social care teams, correspondence between our teams and patients, and complaints letters."
NHS Dumfries and Galloway refused to meet the criminals' extortion demands, and the crooks published the stolen data online on May 6th.
Launching a new product or service? Looking for alternative ways to recruit cyber talent? Want your company or leadership team members to be seen as an industry thought leader? Be heard by over 350,000 subscribers on the N2K CyberWire network. Whether through sponsored advertising, executive events, or exclusive interviews, we offer off-the-shelf and bespoke packages to help you reach your goals. Let’s work together.
Today's issue includes events affecting China, the United Kingdom, and the United States.
Tomorrow is the US Federal holiday of Juneteenth, and we won't be publishing. We'll be back as usual on Thursday. In the meantime, enjoy the holiday.
Fake Google Chrome errors trick you into running malicious PowerShell scripts (BleepingComputer) A new malware distribution campaign uses fake Google Chrome, Word, and OneDrive errors to trick users into running malicious PowerShell "fixes" that install malware.
Arm Memory Tag Extensions broken by speculative execution (The Register) 'TikTag' security folks find anti-exploit mechanism rather fragile
From Clipboard to Compromise: A PowerShell Self-Pwn | Proofpoint US (Proofpoint) Key findings Proofpoint researchers identified an increasingly popular technique leveraging unique social engineering to run PowerShell and install malware. Researchers observed TA571 and the Clea...
In-Depth Analysis: Velvet Ant's Prolonged Cyber Attack on a Large Organization (Sygnia) Sygnia exposes Velvet Ant, a China nexus threat actor, who infiltrated a network for years. Learn how they hid & Sygnia's fight to eradicate them.
Signicat's MobileID adds facial authentication to prevent account takeover and AI-related fraud (Mynewsdesk) London, 18th of June 2024 – Signicat, the European leader in digital identity and identity fraud prevention solutions, announces the launch of a new feature...
New AI deepfake porn bill would require Big Tech to police and remove images (CNBC) The new bill will seek to hold social media companies accountable for policing and removing AI generated deepfake porn images on their sites.
Empire Market owners charged for enabling $430M in dark web transactions (BleepingComputer) Two men have been charged in a Chicago federal court for operating "Empire Market," a dark web marketplace that facilitated over $430 million in illegal transactions between February 2018 and August 2020.
For a complete running list of events, please visit the Event Tracker.
SANS Rocky Mountain Summer 2024 (Denver (and virtual), Colorado, USA, Jun 17 - 22, 2024) At SANS Rocky Mountain Summer 2024, choose from 48 interactive courses with hands-on labs. Practice your skills and compete against your peers during NetWars Tournaments, and network with your instructor and industry colleagues in real-time. Each course includes electronic and printed books, and several courses align with GIAC certifications!
ISA OT Cybersecurity Summit (London, England, UK, Jun 18 - 19, 2024) Strategic OT Cybersafety | Intelligent Innovation for a Secure World The future of intelligence evolution and IoT cybersecurity relies on a strategic approach that integrates supply chain sustainability and security. By leveraging intelligent technologies and prioritizing standards and conformance, we can create a more resilient and secure future for all.
Initial Compromise Insights: VPN and Phishing Attacks Exposed (Virtual, Jun 20, 2024) Join us for an exclusive deep dive into initial compromise risks, focusing on threats posed by VPN vulnerabilities and sophisticated phishing attacks, and share insights from recent research and reports by Zscaler ThreatLabz group. Register now.
Insider Threat Program Development, Management & Optimization Live Web Based Training Course (Virtual, Jun 24 - 25, 2024) This highly sought after and very comprehensive training course, will ensure that the Insider Threat Program (ITP) Manager and other key stakeholders that support the ITP (Insider Threat Analyst, FSO, CSO, CISO, Human Resources, CIO - IT, Network Security, Counterintelligence Investigators, Behavioral Science Professionals, Legal Etc.), have the Core / Advanced Knowledge, Blueprint, Resources needed for developing, managing or optimizing an ITP. Students will be provided with an ITP Management Toolkit that provides an abundance of educational resources, templates and checklists for ITP development, management and optimization. All materials will be provided to the student in electronic format (Via Download) before the training. Our student satisfaction levels are in the exceptional range. Over 1000+ individuals have attended this training course and received ITP Manager Certificates. The Insider Threat Defense Group is so confident about our training courses that they come with a money back training guarantee.
SANSFIRE Washington, DC 2024 (Washington (or virtual), DC, USA, Jul 15 - 20, 2024) At SANSFIRE Washington, DC 2024, choose from 48 interactive courses with hands-on labs. Practice your skills and compete against your peers during NetWars Tournaments, and network with your instructor and industry colleagues in real-time. Each course includes electronic and printed books, and several courses align with GIAC certifications!
