Blog

Cybersecurity News

• Cybersecurity researchers have discovered a stealthy backdoor named Effluencethat’s deployed following the successful exploitation of a recently disclosed security flaw in Atlassian Confluence Data Center and Server.
• WhatsApp is rolling out a new privacy feature that helps Android and iOS users hide their location during calls by relaying the connection through WhatsApp servers.
• Attackers are exploiting a recently patched and critical severity Atlassian Confluence authentication bypass flaw to encrypt victims’ files using Cerber ransomware.
• Threat actors infected more than 10,000 devices worldwide with the ‘PrivateLoader’ and ‘Amadey’ loaders to recruit them into the proxy botnet ‘Socks5Systemz.’
• Apple’s “Find My” location network can be abused by malicious actors to stealthily transmit sensitive information captured by keyloggers installed in keyboards.
• A WhatsApp mod has been discovered that contains previously unknown malware – a spyware Trojan for Android. It’s called CanesSpy.
• A scientist claims to have developed an inexpensive system for using quantum computing to crack RSA, which is the world’s most commonly used public key algorithm.
• MITRE has announced the release of version 14 of ATT&CK, the widely used knowledge base of adversary tactics and techniques.

More

Cybersecurity news

• The APT36 hacking group has been observed using at least three Android apps that mimic YouTube to infect devices with their signature remote access trojan (RAT), ‘CapraRAT.’ Once the malware is installed on a victim’s device, it can harvest data, record audio and video, or access sensitive communication information, essentially operating like a spyware tool.
• Apple has released emergency patches for outdated versions of the iPhone and Mac. The update eliminates the CVE-2023-41064 vulnerability and eliminates the possibility of remote hacking of devices for the purpose of subsequent monitoring of users using spyware.
• A new vulnerability disclosed in GitHub could have exposed thousands of repositories at risk of repojacking attacks, new findings show. The flaw could allow an attacker to exploit a race condition within GitHub’s repository creation and username renaming operations.
• A new cyber attack campaign is leveraging the PowerShell script associated with a legitimate red teaming tool to plunder NTLMv2 hashes from compromised Windows systems primarily located in Australia, Poland, and Belgium.
• A critical vulnerability impacting the Cisco BroadWorks Application Delivery Platform and Cisco BroadWorks Xtended Services Platform could allow remote attackers to forge credentials and bypass authentication.

More

Defensys has introduced an updated technology of Defensys Endpoint for data collecting, detection and response on endpoints. Among the key changes is the enhanced number of integrations with other Defensys products. The vendor has also improved events collecting and added new response techniques.

The Defensys Endpoint technology expands functionalities of other technologies and offers additional advantages for users. Thanks to the Defensys Endpoint each user is able to conduct detailed asset inventory, detect threats and respond directly on endpoints. Users now can also automatically conduct technical audit of all popular operation systems according to cyber security standards.

Due to these innovations the Defensys Endpoint can be used as a sensor for IoC detection on servers and users workstations in the company’s infrastructure. Now users can receive events independently from configurations of other security systems and also from the node’s location – inside or outside the organization. The feature was supplemented as a result of integration with the Defensys TIP.

Besides, the developer created a new integration with the Defensys SGRC Platform, which allows users to conduct technical audit of the node according to legislation and chosen security level. This way you can check correctness and optimality both of operating system and application software settings and make sure the node complies with the requirements.

More

Risk handling

The main purpose of a risk assessment is to form a strategy to avoid or mitigate the damage of potential cyber incidents.

But while audits are about the present (there is a certain requirement – it is not being met now, the picture is clear), in the context of future threats, it can be extremely difficult for CS staff to explain to management the purpose of allocating the budget. A risk assessment helps to translate the needs of the CS department into the language of the business and communicate the importance of the information received.

At the same time, SGRC solutions strengthen communication with the business, allowing the removal of higher-level risks from technical ones, as well as automatically generating understandable graphs and visual dashboards to simplify this communication without additional time expenditure on the part of employees.

Accumulating technical data about the state of CS is an important but not the last task. To make a breakthrough in the quality and effectiveness of the IS system, this data needs to be contextualized and properly analyzed.

But in an ideal worldview, of course, one would like to use the SGRC system after its implementation not “in a vacuum” but to aggregate in it information useful in terms of processes automated by the SGRC system.

More

Cybersecurity news

• Proof-of-concept exploit code has been released for a critical SSH authentication bypass vulnerability in VMware’s Aria Operations for Networks analysis tool (formerly known as vRealize Network Insight).
• Researchers took advantage of a weakness in the encryption scheme of Key Group ransomware and developed a decryption tool that lets some victims to recover their files for free.
• A vulnerability in Skype mobile apps can be exploited by attackers to discover a user’s IP address – a piece of information that may endanger individuals whose physical security depends on their general location remaining secret.
• U.S. authorities said an international law enforcement operation had taken down the notorious “Qakbot” malware platform used extensively by cybercriminals in a variety of financial crimes.
• In yet another sign that developers continue to be targets of software supply chain attacks, a number of malicious packages have been discovered on the Rust programming language’s crate registry.
• A threat actor believed to be tied to the FIN8 hacking group exploits the CVE-2023-3519 remote code execution flaw to compromise unpatched Citrix NetScaler systems in domain-wide attacks.

More