#XynikCybersecurity

7 Tips for Navigating Cybersecurity Risks in M&As

by

July 15, 2024 at 01:33PM Mergers and acquisitions (M&As) present cybersecurity challenges due to data breaches, limited due diligence, integration complexities, compliance variations, insider threats, legacy system vulnerabilities, and resource allocation issues. Mitigation strategies involve phased integration, thorough due diligence, detailed integration plans, compliance reviews, insider threat monitoring, legacy system modernization, and dedicated cybersecurity resource … Read more

MITRE: US Government Needs to Focus on Critical Infrastructure

by

June 17, 2024 at 08:45AM MITRE’s memo “Don’t Trust but Verify” outlines key priorities for the next US presidential administration in cyberspace. It emphasizes protecting critical infrastructure, implementing zero trust and SBOMs, preparing for quantum computing, and clarifying cybersecurity leadership roles. MITRE calls for specific actions and timelines to address these critical cyber defense areas. … Read more

Ransomware crew may have exploited Windows make-me-admin bug as a zero-day

by

June 12, 2024 at 06:16PM Symantec’s threat hunters suspect Black Basta ransomware gang exploited a Windows privilege escalation bug, CVE-2024-26169, before Microsoft’s patch. Symantec’s analysis suggests the ransomware could have been compiled pre-patch, allowing “at least one group” to exploit the vulnerability as a zero-day. The ransomware gang, tracked as Storm-1811, used social engineering attacks … Read more

North Korea hacks two South Korean chip firms to steal engineering data

by

March 4, 2024 at 09:47AM The National Intelligence Service (NIS) of South Korea has warned of increased cyber espionage attacks by North Korean hackers targeting domestic semiconductor manufacturers. The attacks exploit known vulnerabilities in internet-exposed servers to steal sensitive data. South Korean chipmakers, including Samsung Electronics and SK Hynix, are crucial in the global semiconductor … Read more

New Terrapin Flaw Could Let Attackers Downgrade SSH Protocol Security

by

January 1, 2024 at 04:48AM Security researchers from Ruhr University Bochum discovered a vulnerability in the Secure Shell (SSH) protocol, labeled Terrapin (CVE-2023-48795), allowing attackers to downgrade connection security by manipulating the connection’s sequence numbers during the handshake. This can lead to the interception of sensitive data and control over critical systems. Various SSH client … Read more

CISA Flags Gaps in Healthcare Org’s Security Posture, Issues Security Guidance

by

December 18, 2023 at 10:09AM CISA conducted a cybersecurity assessment for a healthcare and public health organization, finding no significant exploitable conditions but identifying weak passwords and other security issues. CISA is sharing the results with the sector to improve cybersecurity posture. The report includes mitigation recommendations and urges organizations to review and apply them. … Read more

CISA Releases Cybersecurity Guidance for Healthcare, Public Health Organizations

by

November 20, 2023 at 10:09AM The US cybersecurity agency CISA has published a guidance document to help healthcare and public health organizations understand cyber threats and risks in their sector. The document incorporates vulnerability trends and provides recommendations on asset management, identity management, device security, patching, and vulnerability remediation. The agency emphasizes the need for … Read more

CVE-2023-46604 (Apache ActiveMQ) Exploited to Infect Systems With Cryptominers and Rootkits

by

November 20, 2023 at 04:16AM The Apache ActiveMQ vulnerability CVE-2023-46604 is being actively exploited by threat actors to download and infect Linux systems with the Kinsing malware and cryptocurrency miner. The vulnerability allows remote code execution, which Kinsing utilizes to install malware. Users are advised to upgrade their ActiveMQ versions to address the issue. The … Read more

Single Sign On and the Cybercrime Ecosystem

by

October 18, 2023 at 11:16AM Cybercrime, specifically data extortion ransomware attacks, is increasing dramatically. Stealer logs, which are logs containing stolen credentials and session cookies, are being distributed through Telegram channels and pose a significant threat. Single sign-on (SSO) applications used by enterprises are being compromised, exposing sensitive information and making social engineering tactics easier. … Read more