"NCSC detaile 'pygmy goat' backdoor planted on hacked Sophos firewall devices."

Views expressed in this cybesecurity, cyber crime update are those of the reporters and correspondents.  Accessed on 01 November 2024, 1651 UTC.

Content and Source:  Email subscription from https://feedly.com.   https://feedly.com/i/subscription/feed%2Fhttp%3A%2F%2Ffeeds.feedburner.com%2FSecurityweek

Please check link or scroll down to read your selections.  Thanks for joining us today.

Russ Roberts (https://www.hawaiicybersecurityjournal.net).

SecurityWeek

81K followers34 articles per week#security#tech

43

Today

NCSC Details ‘Pygmy Goat’ Backdoor Planted on Hacked Sophos Firewall Devices

by Ryan Naraine / 2h

A stealthy network backdoor found on hacked Sophos XG firewall devices is programmed to work on a broader range of Linux-based devices. The post appeared first on SecurityWeek .

GreyNoise Credits AI for Spotting Exploit Attempts on IoT Livestream Cams

by Ryan Naraine / 3h

GreyNoise Intelligence says an internal AI tool captured attempts to exploit critical vulnerabilities in commercial livestream IoT cameras. The post appeared first on SecurityWeek .

In Other News: FBI’s Ransomware Disruptions, Recall Delayed Again, CrowdStrike Responds to Bloomberg Article

by SecurityWeek News / 4h

Noteworthy stories that might have slipped under the radar: FBI conducted over 30 ransomware disruption operations this year, Windows Recall delayed until December, CrowdStrike responds to a Bloomberg article. The post appeared first on SecurityWeek .

US, Israel Describe Iranian Hackers’ Targeting of Olympics, Surveillance Cameras

by Eduard Kovacs / 5h

The US and Israel have published an advisory describing the latest activities of Iranian cyber firm Emennet Pasargad, now called Aria Sepehr Ayandehsazan. The post appeared first on SecurityWeek .

Yesterday

Lottie-Player Supply Chain Attack Targets Cryptocurrency Wallets

Lottie Player supply chain attack

•

by Eduard Kovacs / 7h

LottieFiles has confirmed that Lottie-Player has been compromised in a supply chain attack whose goal is cryptocurrency theft. The post appeared first on SecurityWeek .

Bug Bounty Platform Bugcrowd Secures $50 Million in Growth Capital

by Eduard Kovacs / 8h

Bugcrowd has secured $50 million in growth capital facility from Silicon Valley Bank for expansion and innovation. The post appeared first on SecurityWeek .

Sophos Used Custom Implants to Surveil Chinese Hackers Targeting Firewall Zero-Days

Sophos battles Chinese hackers' intrusions

•

by Ryan Naraine / 1d

British EDR vendor Sophos details a years-long “cat-and-mouse” tussle with sophisticated Chinese government-backed hackers. The post appeared first on SecurityWeek .

Yahoo Discloses NetIQ iManager Flaws Allowing Remote Code Execution

by Eduard Kovacs / 1d

Yahoo researchers found nearly a dozen vulnerabilities in OpenText’s NetIQ iManager and some could have been chained for unauthenticated RCE. The post appeared first on SecurityWeek .

Honeypot Surprise: Researchers Catch Attackers Exposing 15,000 Stolen Credentials in S3 Bucket

by Kevin Townsend / 1d

Sysdig researchers trace a bizarre S3 bucket misconfiguration to EmeraldWhale, exposing 1.5 terabytes of stolen credentials and script. The post appeared first on SecurityWeek .

Mystic Valley Elder Services Data Breach Impacts 87,000 People

Mystic Valley Elder Services data breach

•

by Eduard Kovacs / 1d

Mystic Valley Elder Services detected a security breach in April and now says files containing personal information may have been stolen. The post appeared first on SecurityWeek .

Designing a Future-focused Cybersecurity Investment Strategy

by Marc Solomon / 1d

CISOs must attempt to define a strategic approach to technology investment that will protect the business over the long term. The post appeared first on SecurityWeek .

API Security Matters: The Risks of Turning a Blind Eye

by Joshua Goldfarb / 1d

Willfully ignoring important security issues to make our lives easier is, unfortunately, something that does happen in the security field. The post appeared first on SecurityWeek .

Prosecutors Seek a 17-Year Prison Term for Pentagon Secrets Leaker Jack Teixeira

Teixeira seeks 11-year sentence

•

by Associated Press / 1d

Prosecutors want a Massachusetts Air National Guard member who leaked highly classified military documents to serve 17 years in prison. The post appeared first on SecurityWeek .

CyberPanel Vulnerabilities Exploited in Ransomware Attacks Shortly After Disclosure

PSAUX ransomware attacks CyberPanel instances

•

by Eduard Kovacs / 1d

CyberPanel vulnerabilities have been exploited to compromise thousands of instances as part of ransomware attacks. The post appeared first on SecurityWeek .

Oct 30, 2024

Data Loss Prevention Startup MIND Emerges From Stealth With $11M in Funding

MIND raises 11M for data security

•

by Eduard Kovacs / 2d

MIND has emerged from stealth mode with a data loss prevention (DLP) solution and $11 million in seed funding. The post appeared first on SecurityWeek .

Microsoft Warns of Russian Spear-Phishing Attacks Targeting Over 100 Organizations

Russian hackers target US officials

•

by Eduard Kovacs / 2d

Microsoft says a new spear-phishing campaign by Russia’s Midnight Blizzard uses RDP files, a new vector for this threat group. The post appeared first on SecurityWeek .

FakeCall Android Trojan Evolves with New Evasion Tactics and Expanded Espionage Capabilities

by Kevin Townsend / 2d

The FakeCall Android banking trojan now employs advanced evasion tactics and expanded surveillance capabilities, posing heightened risks for banks and enterprises. The post appeared first on SecurityWeek .

Colorado Accidentally Put Voting System Passwords Online, but Officials Say Election Is Secure

Colorado posts voting passwords online

•

by Associated Press / 2d

Voting system passwords were mistakenly put on the Colorado Secretary of State’s website for several months before being spotted and taken down. The post appeared first on SecurityWeek .

WhiteRabbitNeo: High-Powered Potential of Uncensored AI Pentesting for Attackers and Defenders

by Kevin Townsend / 2d

Version 2.5 of WhiteRabbitNeo is designed to think like a seasoned red team expert, capable of identifying and exploiting vulnerabilities with remarkable speed and precision. The post appeared first on SecurityWeek .

Back to the Future, Securing Generative AI

by Matt Honea / 2d

While there are similar security challenges that parallel traditional security, we must understand that AI requires new ways to approach security. The post appeared first on SecurityWeek .

Recent Version of LightSpy iOS Malware Packs Destructive Capabilities

LightSpy spyware targets iOS devices

•

by Eduard Kovacs / 2d

A newer version of the LightSpy malware for iOS includes over a dozen new plugins, many with destructive capabilities. The post appeared first on SecurityWeek .

Oct 29, 2024

Google Patches Critical Chrome Vulnerability Reported by Apple

CVE-2024-10487 & 1 other

•

by Eduard Kovacs / 2d

Google has patched CVE-2024-10487, a critical Chrome vulnerability, and Mozilla has patched high-severity flaws in Firefox. The post appeared first on SecurityWeek .

Synology, QNAP, TrueNAS Address Vulnerabilities Exploited at Pwn2Own Ireland

Pwn2Own Ireland hackers earn $500K

•

by Eduard Kovacs / 2d

Synology, QNAP and TrueNAS have started patching and mitigating the vulnerabilities exploited recently at Pwn2Own Ireland 2024. The post appeared first on SecurityWeek .

Italian Politicians Express Alarm at Latest Data Breach Allegedly Affecting 800,000 Citizens

Italy data breach affects 800000 citizens

•

by Associated Press / 2d

Prosecutors say the data of at least 800,000 Italians was compromised in breaches dating from 2022 by a private investigative agency. The post appeared first on SecurityWeek .

Proofpoint to Acquire Data Security Posture Management Firm Normalyze

by Eduard Kovacs / 3d

Enterprise cybersecurity giant Proofpoint is acquiring data security posture management (DSPM) company Normalyze. The post appeared first on SecurityWeek .

RedLine and Meta Infostealers Disrupted by Law Enforcement

Dutch police disrupt Redline Meta infostealers

•

by Ionut Arghire / 3d

Authorities announce server shutdowns, domain seizures, and arrests in RedLine and Meta infostealers takedown operation. The post appeared first on SecurityWeek .

Fitness App Strava Gives Away Location of Biden, Trump and other Leaders, French Newspaper Says

Macron's bodyguards leak location on Strava

•

by Associated Press / 3d

Le Monde found that some U.S. Secret Service agents use the Strava fitness app, including in recent weeks after two assassination attempts on Trump. The post appeared first on SecurityWeek .

Zenity Raises $38 Million to Secure Agentic AI

by Ionut Arghire / 3d

Agentic AI security startup Zenity has raised $38 million in a Series B funding round led by Third Point Ventures and DTCP. The post appeared first on SecurityWeek .

How to Improve the Security of AI-Assisted Software Development

by Matias Madou / 3d

CISOs need an AI visibility and KPI plan that supports a “just right” balance to enable optimal security and productivity outcomes. The post appeared first on SecurityWeek .

Canada Says Chinese Reconnaissance Scans Targeting Government Organizations

by Ionut Arghire / 3d

Canada says multiple government and critical infrastructure organizations have been targeted in Chinese reconnaissance scans. The post appeared first on SecurityWeek .