Help Net Security

In today’s dynamic threat landscape, security leaders are under constant pressure to make informed choices about which solutions and strategies they employ to protect their organizations. The “MITRE Engenuity ATT&CK Evaluations: Enterprise” stand out as an essential resource for cybersecurity decision makers to navigate this challenge. Unlike other independent assessments, MITRE ATT&CK Evaluations simulate real-world threats to assess how competing cybersecurity vendors detect and respond to real-world threats. As soon as the highly anticipated 2024 MITRE … More →

The post Why cybersecurity leaders trust the MITRE ATT&CK Evaluations appeared first on Help Net Security.

In this Help Net Security video, Nic Benders, Chief Technical Strategist at New Relic, discusses the key findings of a recent 2024 Observability Forecast report. The annual survey of 1,700 technology professionals across 16 countries reveals that: IT outages can cost up to $1.9 million per hour. The median annual downtime across all business impact levels was 3 days (77 hours). Network failure is the leading cause of outages (34%), outranking someone making a change … More →

The post How the role of observability is changing within organizations appeared first on Help Net Security.

Attackers leveraging virtual private network (VPN) vulnerabilities and weak passwords for initial access contributed to nearly 30% of ransomware attacks, according to Corvus Insurance. According to the Q3 report, many of these incidents were traced to outdated software or VPN accounts with inadequate protection. For example, common usernames such as “admin” or “user” and a lack of multi-factor authentication (MFA) made accounts vulnerable to automated brute-force attacks, where attackers exploit publicly accessible systems by testing … More →

The post VPN vulnerabilities, weak credentials fuel ransomware attacks appeared first on Help Net Security.

The crypto sector stands out as the only surveyed industry where deepfake fraud surpasses traditional document fraud in prevalence, according to Regula. Crypto companies suffer significant losses from fraud The study finds that 57% of crypto companies report audio deepfake incidents, compared to just 45% facing fake or modified document fraud. Research further reveals that 53% of crypto firms have encountered video deepfake fraud, cementing deepfakes as a top concern. In contrast, other industries continue … More →

The post Crypto companies are losing ground to deepfake attacks appeared first on Help Net Security.

Despite the efforts of law enforcement agencies to stop and bring to justice those responsible for ransomware attacks, the situation is not improving. While authorities do not recommend making a ransomware payment, some companies are forced to make that choice in order to continue their operations. In this article, we present some important statistics about the ransom demands that companies are facing. 83% of organizations experienced at least one ransomware attack in the last year … More →

The post Ransomware payments are now a critical business decision appeared first on Help Net Security.

Threat actors are using an ingenious new way for covertly delivering malware to a wide variety of operating systems and platforms: they have created a malware loader that uses Godot Engine, an open-source game engine. The loader – dubbed GodLoader – is distributed through the Stargazers Ghost Network, an extensive network of GitHub accounts and repositories that provides malware distribution “as-a-Service”. According to Check Point researchers, over 17,000 machines have been infected with the malicious … More →

The post Cybercriminals used a gaming engine to create undetectable malware loader appeared first on Help Net Security.

ESET Research has discovered the first UEFI bootkit designed for Linux systems, named Bootkitty by its creators. Researchers believe this bootkit is likely an initial proof of concept, and based on ESET telemetry, it has not been deployed in the wild. Bootkitty execution overview (Source: ESET) However, it is the first evidence that UEFI bootkits are no longer confined to Windows systems alone. The bootkit’s main goal is to disable the kernel’s signature verification feature … More →

The post ESET researchers analyze first UEFI bootkit for Linux systems appeared first on Help Net Security.

QScanner is a Linux command-line utility tailored for scanning container images and performing Software Composition Analysis (SCA). It is compatible with diverse container orchestration systems, container runtimes, and operating systems. QScanner features Instant console results: Scan for vulnerabilities and receive real-time results directly on the console. Integration: Seamlessly integrate QScanner with your CI/CD pipelines and leverage the benefits of security policy-based evaluations. Runtime support: QScanner is compatible with multiple container runtimes enabling flexibility in deployment … More →

The post QScanner: Linux command-line utility for scanning container images, conducting SCA appeared first on Help Net Security.

In this Help Net Security interview, Liad Shnell, CTO at Rakuten Viber, discusses what organizations should look for in secure messaging apps, including encryption, privacy standards, and ease of integration. Shnell also covers the need for a multi-layered approach to securing corporate messaging systems while balancing convenience with strong security. What should organizations look for when selecting a secure messaging app? When evaluating a secure messaging app, organizations should prioritize platforms that deliver advanced security, … More →

The post Choosing the right secure messaging app for your organization appeared first on Help Net Security.

In this Help Net Security video, Carl Froggett, CIO of Deep Instinct, discusses the complexities of modern cloud architectures and why current defenses are falling short. He talks about the rise of zero-day data security and the need for organizations to stop attacks before they breach cloud environments and exfiltrate sensitive data.

The post Zero-day data security appeared first on Help Net Security.

32% of warehouse respondents report that social engineering is one of the most-used entry points in warehouse cyberattacks – tied with software vulnerabilities (32%) and followed by devices (19%), according to Ivanti. Cyberattacks on warehouses threaten supply chain stability As the backbone of the supply chain, a cyberattack on a warehouse can result in major consequences such as significant operational downtime, damage to a company’s reputation and financial losses. Given the vast amount of data … More →

The post Supply chain managers underestimate cybersecurity risks in warehouses appeared first on Help Net Security.

This month’s roundup features exceptional open-source cybersecurity tools that are gaining attention for strengthening security across various environments. ScubaGear ScubaGear is an open-source tool the Cybersecurity and Infrastructure Security Agency (CISA) created to automatically evaluate Microsoft 365 (M365) configurations for potential security gaps. ScubaGear analyzes an organization’s M365 tenant configuration, offering actionable insights and recommendations to help administrators address security gaps and strengthen defenses within their Microsoft 365 environment. Am I Isolated: Open-source container security … More →

The post Hottest cybersecurity open-source tools of the month: November 2024 appeared first on Help Net Security.

Researchers have discovered vulnerabilities in the update process of Palo Alto Networks (CVE-2024-5921) and SonicWall (CVE-2024-29014) corporate VPN clients that could be exploited to remotely execute code on users’ devices. CVE-2024-5921 CVE-2024-5921 affects various versions of Palo Alto’s GlobalProtect App on Windows, macOS and Linux, and stems from insufficient certification validation. It enables attackers to connect the GlobalProtect app to arbitrary servers, the company confirmed, and noted that this may result in attackers installing malicious … More →

The post Researchers reveal exploitable flaws in corporate VPN clients appeared first on Help Net Security.

Authorities across 19 African countries have arrested 1,006 suspects and dismantled 134,089 malicious infrastructures and networks thanks to a joint operation by INTERPOL and AFRIPOL against cybercrime. Results of the operation (Source: INTERPOL) Operation Serengeti Operation Serengeti (2 September – 31 October) targeted criminals behind ransomware, business email compromise (BEC), digital extortion, and online scams – all identified as prominent threats in the 2024 Africa Cyber Threat Assessment Report. Over 35,000 victims were identified during … More →

The post Authorities disrupt major cybercrime operation, 1000+ suspects arrested appeared first on Help Net Security.

Supply chain management SaaS vendor Blue Yonder announced on November 21 that it experienced a ransomware attack that impacted its managed services hosted environment. “Since learning of the incident, the Blue Yonder team has been working diligently together with external cybersecurity firms to make progress in their recovery process. We have implemented several defensive and forensic protocols,” the company said. “With respect to the Blue Yonder Azure public cloud environment, we are actively monitoring and … More →

The post Starbucks, grocery stores impacted by Blue Yonder ransomware attack appeared first on Help Net Security.

Commvault announced Clumio Backtrack, a new capability that will enable enterprises to use automation to rapidly revert objects – or pieces of data – stored in Amazon Simple Storage Service (Amazon S3) to a specific version at a specific point and time. This makes it quick and easy for cloud operations, IT, and security teams to recover data from errors, accidents, or cyberattacks, almost as if they were able to turn back the clock to … More →

The post Commvault Clumio Backtrack helps recover data from errors, accidents, or cyberattacks appeared first on Help Net Security.

Building fake, fraudulent online stores has never been easier: fraudsters are registering domain names for a pittance, using the SHOPYY e-commerce platform to build the websites, and leveraging large language models (LLMs) to rewrite existing product listings to perfect their search engine performance. “We first observed LLM-generated retail product descriptions in July 2024, and similar behaviors continue into the holiday shopping season,” Netcraft Software Engineering Team Lead Will Barnes has shared. From August to October … More →

The post Black Friday shoppers targeted with thousands of fraudulent online stores appeared first on Help Net Security.

Russia-aligned APT group RomCom was behind attacks that leveraged CVE-2024-9680, a remote code execution flaw in Firefox, and CVE-2024-49039, an elevation of privilege vulnerability in Windows Task Scheduler, as zero-days earlier this year. “Chaining together two zero-day vulnerabilities armed RomCom with an exploit that requires no user interaction,” ESET researchers said. The campaign leveraging the zero-click exploit CVE-2024-9680 allowed the attackers to execute code in the restricted context of the browser and CVE-2024-49039 allowed it … More →

The post RomCom hackers chained Firefox and Windows zero-days to deliver backdoor appeared first on Help Net Security.

Bitwarden further strengthened inline autofill capabilities within its browser extension. Users can easily generate and autofill strong, unique passwords for new accounts directly from the inline autofill menu. This update eliminates the need for manual password creation, making account management more efficient and intuitive. Integrating secure account creation directly into the autofill menu enables users to complete the process with just one click, enhancing functionality and convenience. Streamlining account creation and security The latest update … More →

The post Bitwarden enhances inline autofill features to simplify account creation appeared first on Help Net Security.

CampusGuard announced CampusGuard Central, its dynamic customer compliance portal. CampusGuard Central empowers organizations to manage PCI DSS compliance across their enterprise with a single, user-friendly tool. Central’s latest release includes the following enhancements: Updated user interface: Hide or expand the left navigation bar Collapsible group headers on the dashboard Expand the view to full screen Resize and/or filter data tables Full support for PCI DSS v4.0 Customers can define an unlimited number of Custom Fields … More →

The post CampusGuard Central empowers organizations to manage PCI DSS compliance appeared first on Help Net Security.