News


  • UK cyber security agency creates tool to test what would happen if you were hit by cyber attack while working from home

    July 13, 2020

    The UK’s official cyber security agency have created a tool to practise being cyber attacked. It has been launched as people continue to work from home in an attempt to stop the spread of coronavirus, often doing so over personal internet connections and computers. The tool allows people to test their defences by roleplaying the experience of ...

  • Cyber experts urge Australia to develop local capability to defend against hackers

    July 12, 2020

    Cyber experts have urged the federal government to become less reliant on overseas businesses, technologies and expertise for its defences against hackers as it puts the finishing touches on the nation’s new cyber security strategy. Foreign providers are responsible for most of the cyber security products and services in Australia, with no local companies among the ...

  • Zoom Zero-Day Allows RCE, Patch on the Way

    July 10, 2020

    A newly discovered bug in the Zoom Client for Windows could allow remote code-execution, according to researchers at 0patch, which disclosed the existence of the flaw on Thursday after pioneering a proof-of-concept exploit for it. The issue was confirmed for Threatpost by a Zoom spokesperson. The 0patch team said that the vulnerability is present in any ...

  • Microsoft Warns on OAuth Attacks Against Cloud App Users

    July 9, 2020

    Against the backdrop of widespread remote working and the increased use of collaboration apps, attackers are ramping up application-based attacks that exploit OAuth 2.0, Microsoft is warning. OAuth is an open standard for access delegation, commonly used as a way for people to sign into services without entering a password — using signed-in status on another, ...

  • Evilnum hackers use the same malware supplier as FIN6, Cobalt

    July 9, 2020

    Hackers in the Evilnum group have developed a toolset that combines custom malware, legitimate utilities, and tools bought from a malware-as-a-service (MaaS) provider that caters to big fintech threat actors. The group has been active since at least 2018 and focuses on companies from the financial technology sector that offer trading and investment platforms. Its targets are ...

  • Conti ransomware uses 32 simultaneous CPU threads for blazing-fast encryption

    July 9, 2020

    A lesser-known ransomware strain known as Conti is using up to 32 simultaneous CPU threads to encrypt files on infected computers for blazing-fast encryption speeds, security researchers from Carbon Black said in a report on Wednesday. Conti is just the latest in a long string of ransomware strains that have been spotted this year. Just like ...

  • More pre-installed malware has been found in budget US smartphones

    July 9, 2020

    Pre-installed malware has been discovered on another budget handset connected to Assurance Wireless by Virgin Mobile. Back in January, cybersecurity researchers from Malwarebytes discovered unremovable malware bundled with the Android operating systems on the Unimax (UMX) U686CL, a low-end handset sold by Assurance Wireless as part of the Lifeline Assistance program, a 1985 US initiative which subsidizes telephone services for ...

  • Security funding soars despite Covid-19 slump, but problems lie ahead

    July 8, 2020

    The overall cyber security funding ecosystem in the UK is healthier than ever despite Covid-19, but the figures mask stark and concerning disparities in where the money is going Almost £500m has been invested in British cyber security startups in 2020 in spite of the economic slump caused by the Covid-19 coronavirus pandemic, with the investment well on track ...

  • New Mirai Variant Expands Arsenal, Exploits CVE-2020-10173

    July 8, 2020

    Researchers at Trend Micro discovered a new Mirai variant (detected as  IoT.Linux.MIRAI.VWISI) that exploits nine vulnerabilities, most notable of which is CVE-2020-10173 in Comtrend VR-3033 routers which we have not observed exploited by past Mirai variants. This discovery is a new addition to the Mirai variants that appeared in the past few months, that include SORA, UNSTABLE, and Mukashi. The case, ...

  • 15 Billion Credentials Currently Up for Grabs on Hacker Forums

    July 8, 2020

    Fifteen billion usernames and passwords for a range of internet services are currently for sale on underground forums – shedding light on the sheer scope of compromised credentials that are fueling account takeovers on the internet. A report released Wednesday — “From Exposure to Takeover” by the Digital Shadows Photon Research Team — found that 100,000 separate data ...

  • Configuring a Windows Domain to Dynamically Analyze an Obfuscated Lateral Movement Tool

    July 7, 2020

    Researchers at FireEye recently encountered a large obfuscated malware sample that offered several interesting analysis challenges. It used virtualization that prevented us from producing a fully-deobfuscated memory dump for static analysis. Statically analyzing a large virtualized sample can take anywhere from several days to several weeks. Bypassing this time-consuming step presented an opportunity for collaboration ...

  • Patch Now: F5 Vulnerability with CVSS 10 Severity Score

    July 7, 2020

    F5 Networks, a provider of networking devices and services, urges users to patch their BIG-IP networking systems as soon as possible, after the provider disclosed two vulnerabilities. First of these is CVE-2020-5902, a critical remote code execution (RCE) vulnerability found in BIG-IP device’s Traffic Management User Interface (TMUI). CVE-2020-5902 received a 10 out of 10 score on the Common ...

  • ‘Keeper’ hacking group behind hacks at 570 online stores

    July 7, 2020

    A hacking group known as “Keeper” is responsible for security breaches at more than 570 online e-commerce portals over the last three years. The Keeper gang broke into online store backends, altered their source code, and inserted malicious scripts that logged payment card details entered by shoppers in checkout forms. These types of attacks are what the ...

  • German authorities seize ‘BlueLeaks’ server that hosted data on US cops

    July 7, 2020

    German authorities have seized today a web server that hosted BlueLeaks, a website that provided access to internal documents stolen from US police departments. The server belonged to DDoSecrets (Distributed Denial of Secrets), an activist group that published the files last month, in mid-June. The server seizure was announced today by investigative journalist Emma Best, one of ...

  • Purple Fox EK Adds Microsoft Exploits to Arsenal

    July 6, 2020

    The Purple Fox exploit kit (EK) has added two new exploits targeting critical- and high-severity Microsoft vulnerabilities to its bag of tricks – and researchers say they expect more attacks to be added in the future. The Purple Fox EK was previously analyzed in September, when researchers said that it appears to have been built to replace the Rig ...

  • E.U. Authorities Crack Encryption of Massive Criminal and Murder Network

    July 3, 2020

    European law-enforcement officials have shut down an encrypted Android-based communications platform used exclusively by criminals to plot murders, traffic illegal drugs, commit money laundering and plan other organized crimes. An international law-enforcement team from the France and the Netherlands cracked the encryption of EncroChat, a secure mobile messaging service that was “one of the largest providers of encrypted communications,” ...

  • This is how EKANS ransomware is targeting industrial control systems

    July 2, 2020

    New samples of the EKANS ransomware have revealed how today’s cyberattackers are using a variety of methods to compromise key industrial companies. In a research report published on Wednesday, FortiGuard Labs researchers Ben Hunter and Fred Gutierrez said that malware designed to attack industrial control systems (ICS) continues to be lucrative for threat actors. While ransomware only accounted for ...

  • Windows 10 background image tool can be abused to download malware

    July 2, 2020

    A binary in Windows 10 responsible for setting an image for the desktop and lock screen can help attackers download malware on a compromised system without raising the alarm. Known as living-off-the-land binaries (LoLBins), these files come with the operating system and have a legitimate purpose. Attackers of all colors are abusing them in post-exploitation phases ...

  • TrickBot malware now checks screen resolution to evade analysis

    July 1, 2020

    The infamous TrickBot trojan has started to check the screen resolutions of victims to detect whether the malware is running in a virtual machine. When researchers analyze malware, they typically do it in a virtual machine that is configured with various analysis tools. Due to this, malware commonly uses anti-VM techniques to detect whether the malware is ...

  • US Govt shares tips on defending against cyberattacks via Tor

    July 1, 2020

    The Cybersecurity and Infrastructure Security Agency (CISA) today issued guidance on how to protect against cyberattacks launched from the activity originating from or routed through the Tor anonymity network. Tor is a software enabling internet anonymity by automatically encrypt and reroute a user’s web requests through a network of Tor nodes (relay layers). Tor’s infrastructure is also used ...