A remote or hybrid workforce expands your company's surface area of attack beyond corporate firewall boundaries. Employees’ personal computers introduce shadow IT, and home networks with default settings are easy targets, compounded by public Wi-Fi vulnerabilities. You need to develop a strategy to stay secure while remote employees work across untrusted networks. To learn how you can secure your company's workforce, get a free copy of the latest ThreatLocker® whitepaper on how to secure remote workforces.
Is your 2025 marketing strategy already outdated? Find out by joining leading voices in cybersecurity marketing as they unpack what 2025 holds for our industry. We'll discuss the trends shaping the marketing landscape, which channels are in and which are out, and where they find the most significant opportunities for success. Register now for our webinar on November 19th, 2024 at 12:00 PM.
CISA yesterday issued a joint statement with the Office of the Director of National Intelligence (ODNI) and the FBI noting that the intelligence community "has been observing foreign adversaries, particularly Russia, conducting additional influence operations intended to undermine public confidence in the integrity of U.S. elections and stoke divisions among Americans." The agencies expect this activity to continue after the election.
Retired Gen. Paul Nakasone, former NSA director and commander of US Cyber Command, told the Record that the intelligence community has made significant progress in sharing information about influence operations, stating, "What's different this year is the fact that we're hearing so much about so many adversaries at different times. I see this as success. This is exactly what we want to be doing. [In 2016] we knew all this information and didn't share it. [Now] when we see it, we say something about it."
US Cybersecurity and Infrastructure Security Agency (CISA) director Jen Easterly told reporters yesterday that the agency has only observed "small-scale incidents" during the early voting period, including DDoS attacks, criminal destruction of ballot drop boxes, and threats against election officials, the Record reports. Easterly stated that "our election infrastructure has never been more secure," adding, "[a]t this point, we see no evidence of activity that has the potential to materially impact the outcome of the presidential election."
Join Kieran Walsh (Senior SOC Engineer, Samsara) and Hela Lucas (Security Operations Engineer, Samsara) for a behind-the-scenes look at how they optimize security operations with AI.
They'll share how AI helped them:
The City of Columbus, Ohio, has disclosed that data belonging to approximately 500,000 people was stolen by a "foreign cyber threat actor" during a thwarted ransomware attack in July 2024, TechCrunch reports. The city said in a notification to affected individuals that the breached data includes "first and last name, date of birth, address, bank account information, driver’s license(s), Social Security number, and other identifying information concerning you and/or your interactions with the City." The city adds that the information has apparently been posted on the dark web.
TechCrunch notes that the Rhysida ransomware gang has uploaded 3.1 terabytes of data it claims to have stolen from Columbus.
In our free eBook, Attack Vectors Decoded: Securing Organizations Against Identity-Based Threats, we delve into the attacker’s playbook and arm you with the knowledge and tools to bolster your secure access. Learn how to build powerful, secure identity access that protects your business, your data, and your workers—no matter where they are. Download the eBook now and take the first step in modernizing and galvanizing your secure access against identity-based threats.
The US Justice Department has indicted a Virginia company and two of its executives for allegedly violating export restrictions by transferring millions of dollars worth of sensitive American technology to Russia. The company, Eleview International, is an e-commerce service that allowed Russian customers to purchase items from US retailers. The Justice Department stated, "After the Department of Commerce imposed stricter export controls in response to Russia’s further invasion of Ukraine in February 2022, the defendants began shipping items to purported end users in Turkey, Finland, and Kazakhstan, knowing that the items were ultimately destined for end users in Russia. To facilitate these illegal exports, the defendants made numerous false statements to the Department of Commerce and other freight forwarders about the end users and ultimate consignees of the items in these shipments."
Today's issue includes events affecting Canada, Russia, and the United States.
CRON#TRAP: Emulated Linux Environments as the Latest Tactic in Malware Staging (Securonix) In a rather novel attack chain, attackers deploy a custom-made emulated QEMU Linux box to persist on endpoints, delivered through phishing emails.
Supply Chain Attack Using Ethereum Smart Contracts to Distribute Multi-Platform Malware (Checkmarx) Supply chain attack using Ethereum smart contracts for C2 distribution of cross-platform malware. Typosquatting npm package targets developers.
Ngioweb Remains Active 7 Years Later (LevelBlue) Seven years after its first appearance, the proxy server botnet Ngioweb continues its impactful presence on the internet with barely any relevant changes in its original code
Machine Learning Bug Bonanza - Exploiting ML Services (JFrog) JFrog’s security research team continuously monitors open-source software registries, proactively identifying and addressing potential malware and vulnerability threats to foster a secure and reliable ecosystem for open-source software development and deployment. In our previous research on MLOps we noted the immaturity of the Machine Learning (ML) field often results in a higher amount of discovered …
A Deeper Look at FortiJump (FortiManager CVE-2024-47575) (Bishop Fox) The recent discovery of FortiJump (CVE-2024-47575) highlights a critical vulnerability exploited in the wild, prompting an urgent need to understand its…
Investigating a SharePoint Compromise: IR Tales from the Field (Rapid7) Our investigation uncovered an attacker who accessed a server without authorization and moved laterally across the network, compromising the entire domain.
Feds identify two more Russian election disinfo attempts, say Iranian campaigns remain a threat (The Record) The FBI, CISA and the White House's intelligence office said Russia was behind an article and a video intended to falsely cast doubt on integrity of elections — the latest example of their attempts to keep up with disinformation on the eve of Election Day.
Custom "Pygmy Goat" malware used in Sophos Firewall hack on govt network (BleepingComputer) UK's National Cyber Security Centre (NCSC) has published an analysis of a Linux malware named "Pigmy Goat" created to backdoor Sophos XG firewall devices as part of recently disclosed attacks by Chinese threat actors.
New Report from BlueVoyant Shows Progress in Third-Party Cyber Risk Management, But Breaches Persist (PR Newswire) /PRNewswire/ -- BlueVoyant, an industry-leading cyber defense company, today released its fifth annual global survey into supply chain cyber risk management....
Shift5 Welcomes Dennis Lu to Lead Value Engineering and Commercial Growth (Shift5) Palantir alumni Dennis Lu joins Shift5 as its Vice President of Value Engineering and Commercial. Shift5 also welcomed Samantha Segall as its Vice President, Head of Government Affairs.
Public Report: WhatsApp Contacts Security Assessment (NCC Group) In May 2024, Meta engaged NCC Group’s Cryptography Services practice to perform a cryptography security assessment of selected aspects of the WhatsApp Identity Proof Linked Storage (IPLS) protocol implementation.
Suspected Snowflake Hacker Arrested in Canada (404 Media) For more than a week Judische, the hacker linked to the AT&T, Ticketmaster and other breaches, has not been responding to messages. That's because he's been arrested.
For a complete running list of events, please visit the Event Tracker.
The Future of National Cyber Defense (Arlington, Virginia, USA, Nov 6, 2024) This unique event brings together key leaders from U.S. Department of Defense (DoD) invested in creating and delivering strategies for our nation’s cyber defense. Hon. Leslie Beavers, Acting CIO, DoD will begin an interactive evening in a fireside chat with Mary O'Brien, Principal and Owner Mary O'Brien Strategies, LTG USAF (Ret). This will be followed by our esteemed panel who will stimulate audience discussion about what is required to build on successes and position challenges to the private and public sectors to ensure advancement of the national security mission.
SecureWorld Seattle (Bellevue, Washington, USA, Nov 6 - 7, 2024) Join your regional cybersecurity community for high-quality, affordable training and collaboration. Earn 12-18 CPE credits through 30+ educational sessions learning from local and nationally recognized industry leaders. Attend featured keynotes, panel discussions, breakout sessions, and solution vendor displays—all while networking with peers in InfoSec.
The Cyber Guild Virtual Employer Roundtable (Virtual, Nov 12, 2024) The Cyber Guild Employer Roundtable is an innovative sequence of virtual events for business, technical and people leaders across all sectors and industries building a sustainable cyber ecosystem, and who are invested in driving inclusive workforce practices. A peer discussion on how an intentional approach to deploying innovative tools ensures the desired outcome of increased innovation, inclusion and alignment with NIST AI standards.
Beyond Earth Symposium (Washington, DC, USA, Nov 12 - 13, 2024) The acceleration of space innovations that will enable space migration is outpacing public policy and international law regimes. Beyond Earth Institute’s mission is to create a policy and legal framework to support the robust development of an in-space economy and the expansion of human civilization beyond Earth. At the Beyond Earth Symposium 2024, we will wrestle with the critical current issues of the day and delve into the bleeding edge issues that must be moved to the center of international debate. What we do in a post-ISS era is an urgent, immediate concern. Policies that can foster the creation of a lunar-based economy are equally important. Let’s be bold together! Join stakeholders from across the industry, government, and international sector for this third annual Beyond Earth Symposium. Momentum is building to transform policy and legal landscape to enable a space migration future. Dare to be part of this work.
SecureWorld Midwest Virtual Conference (Virtual, Nov 13, 2024) Join with cybersecurity professionals for training and information sharing through an interactive online experience. Earn 6 CPE credits learning from nationally recognized industry leaders. The agenda offers 12+ educational presentations, including panel discussions, breakout sessions, and keynotes. Connect with your peers in the Networking Lounge, enter to win prizes, and see demos and resources from top solution vendors in the Exhibitor Hall.
