X-Industry

Executive Summary from Fortinet - Not long ago, the operational technology (OT) networks used in environments such as factories and critical infrastructure were air-gapped, meaning they were not connected to the internet.  But today, the once-siloed worlds of OT and information technology (IT) are seeing greater interconnectivity due to digital transformation and support for scarce or remote workers.  This connectivity can enhance production via data sharing and new cloud-based tools that allow

Global cyber insurance premiums are declining despite an increase in ransomware attacks, according to a recent report by insurance broker Howden  www.howdengroup.com.  This trend reflects improved business security practices, evolving insurance industry dynamics, and changing attitudes toward cyber risk management.

The Howden report indicates that the cyber insurance market experienced double-digit price reductions in 2023/24, starkly contrasting the skyrocketing premiums seen in 2021 and 2022 d

A Microsoft outage starting during the evening of 18 July which crippled airlines, financial services, health-care and many energy companies across the world, resulting for many in a "blue screen of death" on their work computers.  In response, Microsoft on Saturday released a recovery tool to help repair Windows machines affected by the bug, a day after CrowdStrike provided instructions for how to fix a crashed PC.

CrowdStrike, a cybersecurity firm whose software protects small businesses and l

Behind a massive IT failure that grounded flights, upended markets and disrupted corporations around the world is one cybersecurity company: CrowdStrike Holdings Inc.  Known as a dominant supplier of software that protects businesses from ransomware attacks, CrowdStrike was thrust into the spotlight on 19 July as it struggled to fix a faulty patch that led to cascading, system-wide failures, paralyzing the operations of clients ranging from banks to global retail giants to health-care systems.

W

Recorded Future’s Insikt Group identified a suspected cyber-espionage campaign by TAG-100, targeting global government and private sector organizations.  TAG-100 exploited internet-facing devices and used open-source tools like the Go backdoor Pantegana. The campaign compromised two Asia-Pacific intergovernmental organizations and targeted multiple diplomatic and trade entities.

• TAG-100 Uses Open-Source Tools in Suspected Global Espionage Campaign, Compromising Two Asia-Pacific Intergovernmenta

At least a dozen organizations with domain names at domain registrar Squarespace saw their websites hijacked last week.  Squarespace bought all assets of Google Domains a year ago, but many customers still haven’t set up their new accounts.  Experts say malicious hackers learned they could commandeer any migrated Squarespace accounts that hadn’t yet been registered, merely by supplying an email address tied to an existing domain.  Until this past weekend, Squarespace’s website had an option to l

Between April and June 2024, the NullBulge group emerged, targeting users in AI-centric applications and gaming communities.  The NullBulge persona has showcased creative methods of distributing malware targeting said tools and platforms.  Though the group projects an image of activism claiming to be “protecting artists around the world” and claims to be motivated by a pro-art, anti-AI cause rather than profit, other activities tied to this threat actor may indicate otherwise.

NullBulge’s servic

Cyber threat researchers recently uncovered a Chinese cyber espionage campaign targeting a newly discovered command injection vulnerability in Cisco’s Cisco NX-OS software.  They found the vulnerability and its exploitation as part of an ongoing forensic investigation of a Velvet Ant threat group.   The vulnerability tracked as CVE-2024-20399 concerns a case of command injection that allows an authenticated, local attacker to execute arbitrary commands as root on the underlying operating system

The sophisticated malware known as ViperSoftX has been observed being distributed as eBooks over torrents.  BitTorrent, also referred to as simply torrent, is a communication protocol for peer-to-peer file sharing (P2P), which enables users to distribute data and electronic files over the Internet in a decentralized manner.  The protocol is developed and maintained by Rainberry, Inc., and was first released in 2001.

A notable aspect of the current variant of ViperSoftX is that it uses the Common

Destructive cyber-attacks such as ransomware and wiper attacks are forcing a culture change within organizations as teams need to come together to build resilience.  In many organizations, the CIO and CISO and their teams pursue their own, sometimes conflicting, goals and maintain their own cultures and methods.  But to build resilience to attacks, security and IT operations must work much better together.

Historically CISOs primarily had to deal with incidents of data theft, or more accurately

In 2019, the Space Force became the nation’s first new military branch in nearly 80 years.   Now, the US Congress is already thinking about starting another one, a cyber force.  For years, there's been talk of creating a military branch that concentrates on the cyber domain, driven by the increasing threat posed by geopolitical rivals like China and by organizational and staffing problems with the existing US military cyber operations.  Now, members of the House of Representatives and Senate hav

Select versions of the OpenSSH secure networking suite are susceptible to a new vulnerability that can trigger remote code execution (RCE).  The vulnerability tracked as CVE-2024-6409 (CVSS score: 7.0) is distinct from CVE-2024-6387 (aka RegreSSHion) and relates to a case of code execution in the privsep child process due to a race condition in signal handling.  It only impacts versions 8.7p1 and 8.8p1 shipped with Red Hat Enterprise Linux 9.  This vulnerability, if exploited, could lead to full

A Russian was charged with conspiring to hack and destroy computer systems and data in Ukraine and allied countries, including the United States, the US Justice Department (DoJ) announced in June 2024, offering a $10 million reward for information.   Amin Timovich Stigal, a 22-year-old Russian national, has been indicted in Maryland, US, for his alleged role in staging destructive cyber-attacks against Ukraine and its allies in the days leading to Russia's full-blown military invasion of Ukraine

Political strife and natural disasters have stripped millions of people of internet access over the last two weeks, with experts raising particular concern over actions taken by Turkey's government.  This article explores the intentional and unintentiaional sequestering of social media communication.  Last week, the Turkish government shut down access to social media sites in the Kayseri region of the country due to local anti-Syrian immigrant riots. While hundreds of governments have proven the

Do you recognize "Lyle" who told all of us about the phase of his career in the mid-1990s during which he installed enterprise management software at Air Force bases, then stuck around to drill staff in its use.  When Lyle arrived for one such, he was told that the base was participating in wargames during the week, and that judges of this event might be present at various moments.  As a civilian, he was assured none of this would impact his work.  As he settled in, Lyle noticed a member of the

A recent US Supreme Court (SCOTUS) ruling has shifted regulatory enforcement from the federal agencies to the judicial system.  On 28 June 2024, the Supreme Court struck down a legal principle known as the Chevron Doctrine (or Deference).  This doctrine dates to a 1984 Supreme Court ruling (Chevron v Natural Resources Defense Council) that allows federal agencies to use their own expertise to interpret ambiguities in the law.  It became the foundation for the federal system of regulation through

As cybersecurity providers advance and evolve their service capabilities, they may fall into one of two camps relative to managed detection and response (MDR) or extended detection and response (XDR) technologies or blur the lines by offering both.  What are the similarities and differences between MDR and XDR?  And who are the key players in either space?  If you’re an MSSP, MSP or cybersecurity vendor, it’s important to know.

MDR and XDR are both cybersecurity services designed to enhance thre

The National Health Laboratory Service (NHLS) in South Africa has confirmed that its laboratories are operational following a recent cyber-attack, although the automated distribution of test results to clinicians remains disrupted.  In a statement released on Wednesday, the NHLS explained that its systems and infrastructure were compromised by the cyber-attack, affecting the automatic generation and delivery of laboratory reports to clinicians via WebView.  Despite these challenges, urgent test

Transparent Tribe (aka APT 36, Operation C-Major) has been active since at least 2016 with attacks against Indian government and military personnel.  The group relies heavily on social engineering attacks to deliver a variety of Windows and Android spyware, including spear-phishing and watering hole attacks.

In September 2023, SentinelLabs outlined the CapraTube campaign, which used weaponized Android applications (APK) designed to mimic YouTube, often in a suspected dating context due to the na

International Joint Operation Takes Down Over 600 IP Addresses Abusing Cobalt Strike Tool - Hundreds of IP addresses abusing Cobalt Strike have been shut down in a joint effort involving law enforcement across several nations. Codenamed “Morpheus”, the joint operation resulted in flagging 690 IP addresses and domains used to infiltrate victim networks.  So far, 593 of them have been taken offline.

The servers flagged in Operation Morpheus used old, unlicensed versions of Cobalt Strike, a popular