Thousands of companies are unaware of the software lurking in the background on their devices. ThreatLocker® is offering free I.T. security health reports to organizations looking to harden their environment and mitigate the risks of shadow I.T., foreign software, nation-state attacks, and unpatched vulnerabilities. Get your free report today and visualize what is occurring within your organization on a single pane of glass.
Mark your calendar for our next CSO Perspectives Live on Thursday, December 19th at 2:00 PM EST. Join N2K’s Rick Howard, and Hash Table members Kim Jones and Steve Winterfeld for a look at the most impactful stories, threats, and events of the last 90 days. Register now.
Researchers at Symantec say a "large US organization with a significant presence in China" sustained a four-month-long intrusion between April and August 2024. The goal of the operation was likely espionage. Symantec notes, "The available evidence suggests that the organization was breached by a China-based actor. Aside from the fact that DLL sideloading is a widely favored tactic among Chinese groups, the same organization was targeted in 2023 by an attacker with tentative links to the China-based Daggerfly group."
The researchers add, "The attackers moved laterally across the organization’s network, compromising multiple computers. Some of the machines targeted were Exchange Servers, suggesting the attackers were gathering intelligence by harvesting emails. Exfiltration tools were also deployed, suggesting that targeted data was taken from the organizations."
Security teams are facing a constant uphill battle. Between alert fatigue, repetitive manual tasks, endless false positives, inflexible technology, and the looming risk of burnout, it all adds up, making it tough for teams to stay ahead of threats.
That’s where effective workflow orchestration and automation comes in.
Discover how automation can empower analysts and engineers to automate their most repetitive, time-consuming tasks - regardless of complexity - in this guide from Tines. Get the guide today!
A Nebraska man has pleaded guilty to a multi-million dollar cryptojacking operation that "defrauded two well-known providers of cloud-computing services out of more than $3.5 million," BleepingComputer reports. The defendant, Charles O. Parks III (also known as "CP3O"), used the cloud services to generate nearly $1 million worth of cryptocurrency.
According to a US Justice Department press release, "Parks tricked the providers into approving heightened privileges and benefits, including elevated levels of cloud computing services and deferred billing accommodations, and deflected inquiries from the providers regarding questionable data usage and mounting unpaid subscription balances."
In our eBook, Building an Identity Security Program, we provide a step-by-step guide to creating a resilient identity security framework. You'll learn how to integrate identity security into your overall security strategy, protect against threats like MFA attacks, and secure access across your entire organization. Don’t leave your organization vulnerable to identity-based attacks. Arm yourself with the knowledge and tools to defend your business. Download the eBook.
The Record reports that Russian users are reporting outages at Gazprombank, Russia's third-largest bank, following an alleged DDoS attack by Ukraine's military intelligence agency (HUR). An anonymous HUR source told Ukrinform earlier this week, "Hundreds of thousands of Russians will be unable to transfer money and carry out online payments due to Gazprombank applications not working." The attack also reportedly disrupted payment terminals for public transportation.
Dropzone AI has been recognized as a Gartner Cool Vendor, validating its role in transforming SOCs. With an AI SOC Analyst that autonomously investigates alerts 24/7, Dropzone AI helps security teams stay ahead by reducing alert fatigue and providing decision-ready insights. Discover how we're leading SOC innovation.
SailPoint has released a security advisory for a maximum severity improper access control vulnerability (CVE-2024-10905) that was patched earlier this week. SailPoint CISO Rex Booth said in a statement, “As part of our continued commitment to transparency and security, on Monday December 2, SailPoint issued a security advisory for its Identity IQ product which was assigned CVE-2024-10905. A fix has already been released, and we’ve provided customers with guidance on how to apply it. Publishing CVEs is a voluntary practice across the industry that demonstrates dedication to security and transparency. At SailPoint, we invest in secure development practices and strive to catch vulnerabilities prior to software release, but, as with all software, new vulnerabilities can emerge as attacker tactics and detection capabilities evolve. For this reason, we continually test our products in all stages of the development lifecycle to minimize risk to our customers."
Today's issue includes events affecting China, Russia, Ukraine, and the United States.
BlueAlpha Russian hackers caught abusing CloudFlare services (SC Media) A notorious Kremlin-backed hacking group is using a legitimate network service to coordinate targeted attacks.
New Windows 7 To 11 Warning As Zero-Day With No Official Fix Confirmed (Forbes) A credential-stealing security threat with no official fix has been confirmed—here’s what all users of Windows from version 7 to 11 need to know and do.
Microsoft spots another China spy crew stealing US data (The Register) Redmond threat intel maven talks explains this persistent pain to The Reg
US arrests Scattered Spider suspect linked to telecom hacks (BleepingComputer) U.S. authorities have arrested a 19-year-old teenager linked to the notorious Scattered Spider cybercrime gang who is now charged with breaching a U.S. financial institution and two unnamed telecommunications firms.
Nebraska Man pleads guilty to $3.5 million cryptojacking scheme (BleepingComputer) A Nebraska man pleaded guilty on Thursday to operating a large-scale cryptojacking operation after being arrested and charged in April.
For a complete running list of events, please visit the Event Tracker.
AWS re:Invent (Las Vegas, Nevada, USA, Dec 2 - 6, 2024) AWS re:Invent offers learning sessions on many topics in a variety of formats and at various levels so you can expand your knowledge and grow your skills at a pace that is right for you. Select a topic from the list to learn more about these opportunities at re:Invent.
SecureWorld Pacific Virtual Conference (Virtual, Dec 11, 2024) Join with cybersecurity professionals for training and information sharing through an interactive online experience. Earn 6 CPE credits learning from nationally recognized industry leaders. The agenda offers 12+ educational presentations, including panel discussions, breakout sessions, and keynotes. Connect with your peers in the Networking Lounge, enter to win prizes, and see demos and resources from top solution vendors in the Exhibitor Hall.
GovSummit (Washington, DC, USA, Dec 11, 2024) In a world of escalating digital threats and disruptions, Splunk stands at the core of government agencies, equipping them with the solutions they need to stay resilient and ensure mission success, even in the face of the unexpected. Today, the power is in digital resilience.
