Security analysts with Microsoft have been tracking recent Russian cyber attacks and have seen a pattern of their use to support real world missile strikes and seizures of facilities, with destructive attacks sometimes used as a part of the overall strategy.
42% of these developers said that they push vulnerable code at least once per month. Security teams, in turn, express frustration at developers not following their advice.
Security experts consider Log4j to be one of the most serious threats to come down the pipe in recent years. It’s viewed in this way because of two factors: the sheer number of systems that are vulnerable, and the ease with which an attacker can compromise a network.
Reports from Mandiant and Google found that 2021 was a record year for zero-day vulnerabilities, more than doubling the number seen in 2020. Google, Microsoft and Apple account for 75% of the vulnerabilities.
Phishing scams are targeting Apple device users known to use the MetaMask crypto wallet app, attempting to reset their credentials and gain access to the seed phrase stored in iCloud backup.
GitHub’s security team traced a breach of npm back to a stolen OAuth token, and the ensuing investigation turned up more stolen tokens and markers of access to private repositories.
The FBI named the Lazarus hacking group as the primary suspect after the Treasury Department found links to a wallet used to host the stolen funds from the crypto theft.
After the August 2021 T-Mobile hack, which saw at least 50 million records exposed to the attackers, the stolen customer data appeared for sale on an underground site. A secret attempt to buy it back failed.
The malware kit has not yet been used to compromise a target, according to a public warning issued by US intelligence agencies, but has extensive capabilities for attacking a wide range of industrial control systems that are currently in use.
Organizations should have already been on top of patching Spring4Shell, but the emergence of the Mirai botnet malware campaign should be the final wake-up call.