Information Security Magazine

Five men have been indicted in connection with crimes committed by the Scattered Spider group

Five LPE flaws in Ubuntu’s needrestart utility enable attackers to gain root access in versions prior to 3.8

60% of QR code emails are spam according findings from Cisco Talos, who also identified attackers using QR code art to bypass security filters

CrowdStrike unveiled a new Chinese-aligned hacking group allegedly spying on telecom providers

Apple has urged customers to download the security updates, which address vulnerabilities relating to the JavaScriptCore and WebKit frameworks

OWASP has updated its Top 10 list of risks for LLMs and GenAI, upgrading several areas and introducing new categories

Aqua Security has observed threat actors using compromised Jupyter servers in a bid to illegally stream sporting events

Entrust claims deepfakes are driving a surge in digital identity fraud

Ransomware groups are targeting weekends and holidays to exploit understaffed security teams in order to get the best chance of a pay day

Easterly and her Deputy Director Nitin Natarajan are expected to leave office before President-elect Trump names a new leadership

T-Mobile was hit by Salt Typhoon, a Chinese cyber-espionage group targeting US and global telecom firms

Helldown ransomware has expanded its reach to target Linux and VMware systems, exploiting Zyxel firewall vulnerabilities and exfiltrating data

Palo Alto advised users to patch urgently as the vulnerability is critical and actively exploited in the wild

Ransomware groups are recruiting pen testers from the dark web to expand their operations, as revealed by Cato Network's Q3 2024 SASE Threat Report

A Russian national suspected of involvement in Phobos ransomware has appeared in court in the US

Fastly claims global organizations are taking 25% longer than expected to recover from security incidents

Switzerland’s National Cyber Security Centre has warned of a new QR code scam in fake MeteoSwiss letters spreading Android malware

Proofpoint researchers have observed the growing use of the ClickFix social engineering tactic, which lures people into running malicious content on their computer

A phishing email claims to be from the New York Times with a story about an assassination attempt against President-elect Donald Trump

Phishing attacks using DocuSign impersonations targeting state agencies have surged 98% since Nov 8