Cyberpills.news
Creepy evolution: Rustbucket malware updatesSecurity experts discover a new variant of Rustbucket malware for macOS, which stands out for its sophisticated persistence and ability to evade security measuresIn a recent revelation, researchers have unveiled an enhanced version of an Apple macOS malware named Rustbucket. This upgraded variant exhibits superior capabilities that strengthen its persistence on infected systems and allow it to evade detection by security tools. The Rustbucket malware family,...
Inclusivity: the secret weapon in cybersecurity successDiversifying thinking patterns in cybersecurity: A strategic move beyond quotas, driving innovation and business protectionIn the face of a growing talent gap, diversity, equity, and inclusion (DEI) in cybersecurity have become focal points in 2023. However, according to industry insiders, the emphasis on diversity extends beyond simply meeting staffing quotas or creating an equitable work environment. Those advocating for...
Fujitsu reprimanded by japanese government for insufficient cybersecurity measuresJapanese tech giant faces severe criticism for handling data breaches affecting 1,700 businesses and government agenciesFujitsu, the Japanese IT giant, has recently come under fire from Japanese authorities because of its weak cybersecurity measures that have led to data breaches affecting at least 1,700 companies and government agencies. Authorities on Friday asked Fujitsu to implement corrective measures to address...
Mysterious cyber attack disables DozorAnonymous hackers vandalize russian websites, incite Wagner mercenaries and promise more cyberattacksLate wednesday night, an anonymous group of cyberattackers claimed they had struck Dozor, a satellite telecommunications provider with a diverse clientele including oil fields, power lines, russian military units, and the Federal Security Service (FSB). According to a message posted on Telegram, the...
Critical bug found in Ultimate Member: 200,000 WordPress sites at riskA security flaw in the popular WordPress plugin puts the integrity of sites at risk, allowing hackers to create administrative accountsA dangerous vulnerability in the Ultimate Member plugin is putting over 200,000 WordPress websites at risk. This plugin, designed to facilitate user registration and login procedures, allows site owners to create user profiles, define roles, customize form fields and much more. However, a recent security...
Nokod Security: $8M to revolutionize low-code/no-code app securityWith the aim of consolidating its presence in the US market, the start-up aims to integrate security into low-code/no-code applications, revolutionizing the cybersecurity sectorNokod Security said it has raised $8 million in a seed funding round, intended to establish its presence in the US market. The funds will also be used to expand research and development teams, as well as support new research on security vulnerabilities in the low-code/no-code sector.Supporters and founders...
Itway launches towards success with the cybersecurity agreement with MastercardThrough a strategic partnership with RiskRecon, Itway is set to dominate the cybersecurity market in Italy, Greece and TurkeyItway, a major company active in the IT, cyber security, artificial intelligence and big data industries, recently noticed a notable increase in its financial performance. This leap came following the announcement of a partnership deal with RiskRecon, a Mastercard subsidiary that specializes in cybersecurity....
Former network security chief arrested: diplomatic dilemma for KazakhstanNikita Kislitsyn, formerly the head of security for one of Russia's largest cybersecurity firms, has been arrested on decades-long hacking charges. Tensions between Russia, Kazakhstan and the Unite...Nikita Kislitsyn, the former head of network security for a major Russian cybersecurity firm, was arrested last week in Kazakhstan following hacking allegations dating back 10 years by the US Department of Justice. Experts believe Kislitsin's trial could soon create a diplomatic impasse for Kazakhstan's...
Cybersecurity priorities 2025: Biden's approach to investment and defenseUS administration sets cybersecurity budget priorities: focus on infrastructure defense, fighting ransomware, and software securityThe Biden administration recently outlined cybersecurity budget priorities for the 2025 fiscal year. The document, sent Tuesday to executive departments and agencies, intends to link cybersecurity investments to the five pillars of the national cybersecurity strategy, published today. beginning of March.Spending...
Critical flaw exposes accounts in WordPress pluginsUnauthorized access to WordPress accounts is possible through a vulnerability in the miniOrange plugin for social media login and registrationA critical security flaw has been revealed in the miniOrange social login and registration plugin for WordPress, which could allow an attacker to log in as any user, as long as the email address details are known. Known as CVE-2023-2982 and with a CVSS score of 9.8, the authentication bypass flaw affects...
Facial recognition in Italy: the blockade extended until 2025Italian Senate confirms extended ban, offering longer cooling-off period to assess implications of AI on privacy and national securityThe Italian Senate recently gave its assent, following the approval of the Chamber, to the extension of the ban on facial recognition in the country until 2025. "From today the moratorium on the use of facial recognition technologies will last until 2025“, says Senator PD Filippo Sensi, previously i...
Astrix Security raises $25M to secure app-to-app connectionsThe expansion of AI-powered initiatives creates a growing threat to the security of connections between applications. Astrix, a fast-growing company, has secured funding to address this emerging ch...Astrix Security, a leading cybersecurity firm, has raised $25 million in Series A funding, led by CRV and with participation from existing investors, Bessemer Venture Partners and F2 Venture Capital. This recent investment has increased Astrix's total funding to nearly $40 million.A response to growing...
Cyber attack cripples Suncor Energy, one of Canada's largest energy companiesCyber security is put to the test: over 1500 service stations involved, the importance of critical infrastructure is in the spotlightSuncor Energy, Canada's leading integrated energy company, disclosed earlier this week that it had suffered a cybersecurity incident. This caused technical problems at its subsidiary, Petro-Canada, affecting the operation of more than 1,500 gas stations across the country. As a result, these stations...
The rise of Midnight Blizzard's cyber attacks: Microsoft alertsA dramatic increase in intrusions conducted by the Russian hacker group is reported; the techniques used become increasingly sophisticated and disguisedMicrosoft has revealed a dramatic increase in credential-stealing attacks perpetrated by the state-affiliated Russian hacker group known as the Midnight Blizzard. These attacks use residential proxy services to mask the source IP address, targeting governments, IT service providers, NGOs, defense sectors...
Software security: between persistent pitfalls and innovative strategiesA global overview of software security: challenges in the digital age, code analysis techniques, and the future role of artificial intelligenceSoftware security is a persistent problem that requires a rigorous scientific approach to prevent errors that could skew results. Elisa Bertino, a respected authority on information security at Purdue University, lays out the landscape of that challenge. His study, "The persistent problem of software...
Global attack on mobile banking: Anatsa trojan infects Google PlaySophisticated malware aims to steal sensitive data from more than 600 banking applications via malicious droppers on Google PlayAndroid users in at least five countries have been targeted by the Anatsa banking trojan through malicious vaults uploaded to Google Play. This alarming news was reported by ThreatFabric, a company that specializes in detecting computer threats. The identified repositories, which have achieved over 30,000...
Cyber scam alert: WhatsApp Pink threatens Android usersMumbai Police Issue Emergency Alert Against Dangerous WhatsApp Pink Scam: Here's How To Protect YourselfMumbai Police has issued a red alert notice for Android users who have downloaded WhatsApp Pink, warning of the potential repercussions of this scam.Scam emergency: Mumbai issues red alert for WhatsApp PinkIn a new wave of fraudulent activity, the Mumbai Police recently issued a red alert for Android...
DHS releases new cybersecurity regulations: impact on policyholdersNew rules implemented by the US Department of Homeland Security introduce new requirements for protecting information and reporting cybersecurity incidentsThe United States Department of Homeland Security (DHS) recently issued new cybersecurity regulations with the goal of protecting controlled unclassified information (CUI). These long overdue regulations amend and add to the Homeland Security Acquisition Regulations (HSAR) and will be integrated into...
European Media Freedom Act: protection or danger for journalists?Despite aiming to safeguard press freedom, EMFA raises privacy concerns for journalists due to spyware exceptionOn 16 September 2022, the European Commission proposed a law, called the European Media Freedom Act (EMFA). This legislative act introduces a series of measures to guarantee freedom of the press. However, despite the changes and the Council's approval, the text includes an exception for the use of spyware...
The Zero Trust approach in Ireland: an urgent appeal by Rob AllenCybersecurity expert stresses the need to take preemptive steps to protect government agencies and potentially save billionsRob Allen, an Irish cybersecurity expert and vice president of cybersecurity firm ThreatLocker, has urged the Irish government to follow the US lead. Allen proposes forcing all government entities to adopt the Zero Trust approach, considered the gold standard in terms of cybersecurity. His appeal, made...
Protection of Pirelli technology: the golden power of the italian government in actionThe government intervenes to safeguard user data privacy and national security in response to the interest of China National Tire and Rubber Corporation, Ltd. for Pirelli & CSpAIn the context of growing digitization and interconnection, the improper use of advanced technologies can pose a considerable risk not only for user privacy, but also for national security through the possible transfer of strategic information. This is the main reason for the decision taken by the Italian...
IT market in 2023: tensions, renewal and new trendsGlobal insight into the technology workforce, recruitment challenges and the importance of emerging skillsIn the shadow of growing concerns about artificial intelligence, the global economic turbulence and the ongoing repercussions of Covid, the IT sector is also not without tensions. The Linux Foundation's "2023 State of Tech Talent Report" proves to be a valuable tool for both companies and professionals...
Global industrial security market: growth forecast to 2028Critical infrastructure protection and robust IIoT device security fuel the demand for advanced solutions in the industrial security marketThe global industrial security market is projected to reach a size of US$25.6 billion by 2028, with a compound annual growth rate (CAGR) of 7.44% over the period 2023-2028. These statistics emerge from the latest report from the IMARC Group, titled “Industrial Cybersecurity Market: Global Industry T...
Network sandboxes: advanced shield against cyber threatsThe growing use of sandboxes to address APTs and predictions about the future development of this key technology in cybersecurityA primary protection tool in the cybersecurity landscape is represented by the network-based sandbox. This technology, which has shown remarkable maturity, is effective for detecting, disrupting and investigating incidents related to Advanced Persistent Threats (APT). The sandbox allows a constant and...
Profitable companies targeted by cybercriminals: risks and impacts of cybercrimeAnalysis by the American Enterprise Institute reveals how large companies with significant financial resources are preferred targets for cyber attacks, with serious economic repercussions on the entire...Research by the American Enterprise Institute (AEI) think tank has shown that cybercriminals tend to attack highly profitable companies with abundant cash reserves and which invest generously in advertising. Analysis of cyber attacks from January 1999 to January 2022 suggests that cyber threat actors...
The European Union adopts a new regulation to strengthen cybersecurityThe political agreement establishes the creation of a security framework to protect EU data, networks and decision-making processes, with the strengthening of the mandate of CERT-EUThe Commission expresses its satisfaction with the political agreement obtained between the European Parliament and the EU Council on the Regulation, proposed by the Commission itself, which establishes measures for a high common level of cybersecurity in the institutions, bodies, offices and agencies...
Cybercrime and malware: explosive growth in two decadesFrom the rise of modern ransomware to the revolutionary impact of quantum computing: the evolution of cybercrime and the fight for cybersecurityThe growth of cybercrime, and in particular the production of malware, is a worrying phenomenon. According to data from Barracuda Networks, the number of known malware has soared to over a billion today, up from just 25 million in 2009. Over the past year, 94 million new malware appeared. This exponential...
Cybersecurity in India: a new chapter with CloudflareWith a mindset shift and the introduction of new regulations, India is taking significant steps to strengthen its position in the global cybersecurity landscapeTo understand how the cybersecurity landscape in India is evolving, we interviewed Fernando Serto, chief technologist and evangelist for the APJC at Cloudflare. While India is underperforming in terms of cybersecurity preparedness, being ranked 17th out of 20 on the MIT Cyber Defense Index and often...
Volt Typhoon: the emerging chinese cyber-espionage threatDetailed analysis reveals advanced hacking techniques used by Volt Typhoon, a new chinese cyber-espionage group, also known as Vanguard PandaA new Chinese state actor in the cyber warfare landscape, known as Volt Typhoon, has been recently discovered and has been active since 2020. This group of hackers has shown unprecedented operational techniques to maintain remote access to its targets. The findings come from CrowdStrike, which keeps...
British hacker convicted of 2020 Twitter attack: 5 years in prisonJoseph James O'Connor, aka PlugwalkJoe, convicted of massive Twitter hack, cryptocurrency fraud and cyberstalking, faces heavy legal repercussionsA British citizen involved in the massive Twitter hack that took place in July 2020 has been sentenced to five years in prison in the United States. Joseph James O'Connor, also known as PlugwalkJoe, 24, received his sentence on Friday in the Southern District of New York, just over a month after pleading...
Cyber security: six new vulnerabilities in the US Agency catalogApple, VMware and Zyxel involved: CISA's list of known and exploited vulnerabilities is updated with six new flaws highlighted by cyber espionage activitiesThe US Information Security and Infrastructure Security Agency (CISA) recently updated its catalog of Known and Exploited Vulnerabilities (KEV), including six new flaws. The decision was made based on evidence of active exploitation of the vulnerabilities.Three Apple vulnerabilities, two in VMware and...
Financial scam: courier companies in the crosshairsNew online threat: Zerodha CEO reveals alarming fraud exploiting FedEx and Blue Dart namesFinancial fraud, increasingly sophisticated in the age of the pervasive internet, has become a regular phenomenon. The latest in chronological order involves courier companies, with a scam that is rapidly spreading.Under the name of FedEx: a worrying example from the CEO of ZerodhaNithin Kamath, co-founder...
The CyberChallenge.it gathers young IT talents in TurinA competition for young cybersecurity talents: training, challenge and opportunity to join the cyberdefender national teamFrom 28 June to 1 July, Turin will become the nerve center of Italian IT security, hosting the 258 finalists of the CyberChallenge.it. This program, now in its seventh edition, represents a point of reference for the training of young talents in the field. Over the past year, the program has involved...
Firmware backdoor discovered in Gigabyte motherboards: what to do to protect dataThe security risk to your personal data is high: here's what to do to prevent unauthorized accessA firmware backdoor has been discovered in several motherboards manufactured by Gigabyte, one of the world's largest manufacturers. The firmware backdoor would be present on 271 motherboard models, including the most used ones for high-end gaming PCs from the Aorus and Gaming brands. PCs that use these...
The new US cyber security strategy: a sea change for critical infrastructureFrom strengthening the role of private business to the growth of cyber insurance, a detailed analysis of the revolutionary approach to cyber security in the United StatesIn the context of a growing national security priority related to the protection of critical infrastructure, on March 2, 2023, the Biden administration unveiled the National Cyber Security Strategy. This document represents a broad and forward-looking vision for both public and private cyber defenses....
Tanium enhances threat identification and extends the reach of terminalsSignificant improvements to the Software Bill of Materials (SBOM) to effectively manage software vulnerabilities and processor architecture evolutionTanium announced a significant strengthening of its Software Bill of Materials (SBOM), expanding it to include information on Common Vulnerability and Exposures (CVE). This shift is a direct response to the ever-increasing attacks on the software supply chain, facilitated by organizations' growing dependence...
VMware mitigates security threats with critical updates for vCenter ServerThe virtualization company addresses five memory corruption vulnerabilities that could allow remote code executionVMware, the global leader in virtualization, recently released software updates to fix several memory corruption vulnerabilities in its vCenter Server that could allow remote code execution. These updates aim to address five security flaws in the software's implementation of the DCERPC protocol. Four...
ETCISO Decrypt 2023: revolutionizing the future of cybersecurityFrom enhancing cybersecurity to optimizing emerging technologies, ETCISO Decrypt 2023 establishes itself as the hub for collaboration, innovation and risk management in today's digital landscapeETCISO Decrypt 2023, a premier event dedicated to cybersecurity, was held at ITC Maratha in Mumbai, highlighting the latest technologies and best practices in the industry. In addition to generating in-depth discussions, the event highlighted the evolution of information security managers (CISOs) into...
Security in the cloud: a complex balance of responsibilitiesHow to manage the technical, strategic and human challenges of implementing a shared security model for applications in the cloudMany organizations find that applications in the cloud are naturally more secure than those based locally. This perception is based on the idea that the cloud service provider (CSP) takes responsibility for security. However, while it is possible to get a secure application in the cloud, one should not...
Strengthening cyber security: a priority for the United States of AmericaPresident Garbarino highlights the need for expansion and renewal of the cyber workforce to counter emerging threatsToday, Subcommittee Chair on Cyber Security and Infrastructure Protection Andrew Garbarino delivered an introductory speech during a hearing on the need to expand the national cybersecurity workforce. He thanked all attendees for their presence and reiterated his main commitment as President: to address...
MULTI#STORM: new phishing attack targets India and the United StatesSophisticated cyber attack using JavaScript files exploits RATs like Warzone and Quasar to compromise digital systems, creating pitfalls for unwitting usersA recent phishing campaign, identified as MULTI#STORM, has launched a targeted attack on India and the United States. Using JavaScript files, the attack aims to introduce remote access Trojans into compromised systems. Securonix researchers, including Den Iuzvyk, Tim Peck, and Oleg Kolesnikov, noted...
Digital Health Schools 10th anniversary: the future of digital health leadershipCelebrating a decade of progress and training for the next generation of digital health leaders in the NHSThe tenth anniversary of the summer edition of the Digital Health Schools will be an occasion to celebrate the achievements of the last ten years in the field of clinical informatics and digital health, without forgetting to project a look to the future. The conference program and educational sessions...
The security frontier: defending against data exfiltration with machine learningHow network detection and response (NDR) technology, powered by machine learning algorithms, revolutionizes data exfiltration detectionThe world is experiencing an exponential escalation in cases of ransomware and data theft, often used to extort funds from companies. In parallel, the industry faces a number of critical vulnerabilities in database software and corporate websites. This situation poses a serious data exposure and exfiltration...
Cisco VPN vulnerability test model revealedSecurity researcher publishes proof-of-concept model (PoC) leveraging a recently fixed flaw in Cisco's VPN software, highlighting potential security threat to corporate networksA security researcher recently revealed a proof of concept (PoC) model targeting a recently fixed security vulnerability in the Cisco AnyConnect Secure Mobility Client and Secure Client for Windows VPN applications. This software allows remote working employees to connect to the organization's network...
The EU steps up the security of 5G networks: plans and reactionsCollection of strategic measures to mitigate risks related to 5G networks, with emphasis on the measures taken against Chinese operators Huawei and ZTE and the geopolitical responseThe NIS Cooperation Group, the body responsible for the security of networks and information systems of the European Union, has released, with the support of Member States and ENISA, the second report regarding the implementation of the Toolbox on the security of 5G networks on 15 June 2023. The information...
Accurx and Leicester NHS Trust: an alliance to fight waiting listsTechnology and healthcare come together in an innovative partnership to solve the problem of long waiting lists in hospitalsHealthcare organization University Hospitals of Leicester NHS Trust (UHL) has entered into an Innovation Partnership agreement with Accurx, a software company dedicated to integrating healthcare communications around individual patients. Like all NHS bodies, UHL aims to reduce its elective waiting list...
Russian hackers attack ukrainian infrastructure: Roundcube software is the targetRussian APT group exploits open-source webmail vulnerabilities to infiltrate ukrainian government and military entitiesA well-known Advanced Persistent Attack (APT) group, linked to the Russian government, has been discovered exploiting security vulnerabilities in the open-source email software Roundcube to spy on organizations in Ukraine. These include government institutions and military entities involved in aviation...
ChatGPT credential theft: more than 100,000 cases in 2022-2023Information thieves expose numerous OpenAI ChatGPT credentials on dark web markets, with India and Asia-Pacific particularly affectedIn the period between June 2022 and May 2023, over 101,100 compromised OpenAI ChatGPT credentials were found on illicit dark web marketplaces. India has been particularly affected by this issue, alone accounting for 12,632 stolen credentials. These credentials were traced to information theft records...
The strengthening of the Personal Data Protection Authority has been postponedThe Italian government postpones the introduction of a law to strengthen the staff of the Guarantor for the protection of personal data, delaying the fight against illicit telemarketing and the dangers...The wait for a more robust Personal Data Protection Authority capable of better defending us against the abuses of telemarketing and the dangers of social media will be prolonged. The government has in fact decided to exclude the law which provided for the strengthening of this body. This measure was...
Cyber attack in East Asia: malware infiltration for over a yearThe details of the RDStealer malware and its corporate security implicationsA particular IT corporation based in East Asia fell prey to a sophisticated cyber attack meticulously designed and executed over a period exceeding one year. This cyber espionage operation involved deploying a unique piece of malware, RDStealer, coded using the Golang language. The cyber criminals had...