NEWS:
Cybersecurity in the Cloud: The Challenging Hurdles It Has To Overcome
Cloud Security Challenges. Organizations embracing cloud environments must understand that cloud applications and services have become popular targets for cybercriminals. A few notable and inherent risks with cloud deployments include: API Vulnerabilities. Unfortunately, API exploits are on the rise, costing organizations dearly. Whether it’s stolen data or denial-of-service (DoS) attacks, an API security breach can put data in the hands of criminals and cost a company its hard-won reputation in the blink of an eye.
https://www.tripwire.com/state-of-security/cybersecurity-cloud-challenging-hurdles-it-has-overcome
How To Secure Web Applications Against AI-assisted Cyber Attacks
Artificial intelligence (AI) has brought forth a new era of innovation, with its transformative impact being felt across various industries at an unprecedented pace. However, the rise of AI has also led to an evolving landscape of emerging cyber threats, as cybercriminals harness the power of AI to develop more sophisticated and hyper-targeted attacks. As organizations continue to integrate AI-driven technologies into their operations, it’s crucial for them to properly anticipate and adapt to the ever-evolving threat landscape and bolster their security posture to withstand these new security challenges.
How Microsoft can help you go passwordless this World Password Day
It’s that time of year again. World Password Day is May 4, 2023.1 There’s a reason it’s still going strong 10 years after being created by cybersecurity professionals. A recent study that analyzed more than 15 billion passwords found that the top 10 most popular passwords still include easy-to-crack combinations like “123456” and “qwerty.” With that level of security, many organizations are essentially leaving the front door open. Sharing your password for a streaming service may seem harmless (their accountants might disagree), but this behaviour sometimes bleeds into the workplace, where weak or shared employee passwords often become one of the largest security threat vectors that companies face.
5 API security best practices you must implement
As outside economic pressures continue to shape how organizations think and allocate resources, data security continues to be a high priority. Due to their dependence on data to innovate and reduce expenses, many businesses are significantly more exposed to the threat of cybersecurity incidents than they may realize. APIs are also being targeted as the data reachable through them could prove highly lucrative for hackers.
Critical Infrastructure Organizations Urged to Identify Risky Communications Equipment
The US Cybersecurity and Infrastructure Security Agency (CISA) on Monday issued an alert to urge critical infrastructure organizations to scope their environments for communications equipment deemed to pose high risk. Per the Secure and Trusted Communications Networks Act of 2019 (PDF), federal agencies are prohibited from purchasing communications equipment and services that pose national security risks, and the Federal Communications Commission (FCC) maintains a list of such products, the Covered List.
Using multiple solutions adds complexity to your zero trust strategy
Companies’ operating models today are significantly more complex than they were just a couple of years ago, according to BeyondTrust. Remote employees accessing key systems and data, more applications, and information stored and flowing through the cloud, are all helping drive this complexity. Supply chain security under threat: Companies are also increasingly reliant on their supply chain, which means partners, suppliers, and shippers are now typically directly connected to a company’s systems.
INCIDENTS:
City of Dallas hit by Royal ransomware attack impacting IT services
The City of Dallas, Texas, has suffered a Royal ransomware attack, causing it to shut down some of its IT systems to prevent the attack’s spread. Dallas is the ninth largest city in the United States, with a population of approximately 2.6 million people, according to US census data. Local media reported that the City’s police communications and IT systems were shut down Monday morning due to a suspected ransomware attack. This has led to 911 dispatchers having to write down received reports for officers rather than submit them via the computer-assisted dispatch system. The Dallas County Police Department’s website was also offline for part of the day due to the security incident but has since been restored.
Vietnamese Threat Actor Infects 500,000 Devices Using ‘Malverposting’ Tactics
A Vietnamese threat actor has been attributed as behind a “malverposting” campaign on social media platforms to infect over 500,000 devices worldwide over the past three months to deliver variants of information stealers such as S1deload Stealer and SYS01stealer. Malverposting refers to the use of promoted social media posts on services like Facebook and Twitter to mass propagate malicious software and other security threats. The idea is to reach a broader audience by paying for ads to “amplify” their posts.
https://thehackernews.com/2023/05/vietnamese-threat-actor-infects-500000.html
MALWARE:
Russian hackers use WinRAR to wipe Ukraine state agency’s data
The Russian ‘Sandworm’ hacking group has been linked to an attack on Ukrainian state networks where WinRar was used to destroy data on government devices. In a new advisory, the Ukrainian Government Computer Emergency Response Team (CERT-UA) says the Russian hackers used compromised VPN accounts that weren’t protected with multi-factor authentication to access critical systems in Ukrainian state networks. Once they gained access to the network, they employed scripts that wiped files on Windows and Linux machines using the WinRar archiving program.
New Atomic macOS Malware Steals Keychain Passwords and Crypto Wallets
Threat actors are advertising a new information stealer for the Apple macOS operating system called Atomic macOS Stealer (or AMOS) on Telegram for $1,000 per month, joining the likes of MacStealer. “The Atomic macOS Stealer can steal various types of information from the victim’s machine, including Keychain passwords, complete system information, files from the desktop and documents folder, and even the macOS password,” Cyble researchers said in a technical report.
https://thehackernews.com/2023/04/new-atomic-macos-stealer-can-steal-your.html
Facebook warns of a new information-stealing malware dubbed NodeStealer
NodeStealer is a new information-stealing malware distributed on Meta that allows stealing browser cookies to hijack accounts on multiple platforms, including Facebook, Gmail, and Outlook. The malware was first spotted in late January 2023 while targeting the browsers of Windows systems. It can target multiple web browsers, including Google Chrome, Microsoft Edge, Brave, and Opera. The researchers explained that NodeStealer is a custom Javascript malware that bundles the Node.js environment. The author uses Node.js to allow malware execution on multiple OS, including Windows, Linux, and macOS.
VULNERABILITIES:
Researchers Discover 3 Vulnerabilities in Microsoft Azure API Management Service
Three new security flaws have been disclosed in Microsoft Azure API Management service that could be abused by malicious actors to gain access to sensitive information or backend services. This includes two server-side request forgery (SSRF) flaws and one instance of unrestricted file upload functionality in the API Management developer portal, according to Israeli cloud security firm Ermetic.
https://thehackernews.com/2023/05/researchers-discover-3-vulnerabilities.html
Alert: Active Exploitation of TP-Link, Apache, and Oracle Vulnerabilities Detected
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added three flaws to the Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation. The security vulnerabilities are as follows –
CVE-2023-1389 (CVSS score: 8.8) – TP-Link Archer AX-21 Command Injection Vulnerability
CVE-2021-45046 (CVSS score: 9.0) – Apache Log4j2 Deserialization of Untrusted Data Vulnerability
CVE-2023-21839 (CVSS score: 7.5) – Oracle WebLogic Server Unspecified Vulnerability
CVE-2023-1389 concerns a case of command injection affecting TP-Link Archer AX-21 routers that could be exploited to achieve remote code execution. According to Trend Micro’s Zero Day Initiative, the flaw has been put to use by threat actors associated with the Mirai botnet since April 11, 2023.
Netgear Vulnerabilities Lead to Credentials Leak, Privilege Escalation
Vulnerabilities in Netgear’s NMS300 ProSAFE network management system allow attackers to retrieve cleartext credentials and escalate privileges, cybersecurity firm Flashpoint reports. The tool provides users with a web-based interface for network device management. It uses TCP port 8080 for communication and supports administrator accounts and lower-privileged operator and observer account roles.
