Help Net Security

Thousands of Linux systems are likely infected with the highly elusive and persistent “perfctl” (or “perfcc“) cryptomining malware and many others still could be at risk of getting compromised, Aqua Security researchers revealed last week. “In all the attacks observed, the malware was used to run a cryptominer, and in some cases, we also detected the execution of proxy-jacking software,” they shared. “Perfctl” malware Though the actual cryptomining is performed by XMRIG Monero cryptomining software, … More →

The post Linux systems targeted with stealthy “Perfctl” cryptomining malware appeared first on Help Net Security.

For several years, external attack surface management (EASM) has been an important focus for many security organizations and the vendors that serve them. EASM, attempting to discover the full extent of an organization’s external attack surface and remediate issues, had broad purview, targeting software vulnerabilities, misconfigurations and neglected shadow IT assets from the outside-in. The focus on greater attack surface visibility and external asset awareness resonated with CISOs, CIOs and practitioners alike. Recently, a new … More →

The post The case for enterprise exposure management appeared first on Help Net Security.

In this Help Net Security interview, Amiram Shachar, CEO at Upwind, discusses the complexities of cloud security in hybrid and multi-cloud environments. He outlines the need for deep visibility into configurations and real-time insights to achieve a balance between agility and security. Shachar also shares strategies for addressing misconfigurations and ensuring compliance, recommending a proactive approach to risk management in cloud deployments. With hybrid and multi-cloud setups becoming the norm, cloud environments are getting more … More →

The post Transforming cloud security with real-time visibility appeared first on Help Net Security.

Rspamd is an open-source spam filtering and email processing framework designed to evaluate messages based on a wide range of rules, including regular expressions, statistical analysis, and integrations with custom services like URL blacklists. The system analyzes each message and assigns a verdict, which the MTA can use to take further actions, such as rejecting the message or adding a spam indicator header. Additionally, Rspamd provides valuable information like potential DKIM signatures and suggested message … More →

The post Rspamd: Open-source spam filtering system appeared first on Help Net Security.

Security operations center (SOC) practitioners believe they are losing the battle detecting and prioritizing real threats – due to too many siloed tools and a lack of accurate attack signal, according to Vectra AI. They cite a growing distrust in vendors, believing their tools can be more of a hindrance than help in spotting real attacks. This is at odds with growing confidence in their teams’ abilities and a sense of optimism around the promise … More →

The post SOC teams are frustrated with their security tools appeared first on Help Net Security.

You can’t fulfill your end of the shared responsibility model if you don’t emphasize secure configurations. Depending on the cloud services you’re using, you’re responsible for configuring different things. Once you figure out those responsibilities, you then need to perform the hardening. Our guidance helps simplify the process. It explains how you can use the CIS Foundations Benchmarks to get started with identity and access management (IAM), logging and monitoring, and networking on the cloud … More →

The post Meet the shared responsibility model with new CIS resources appeared first on Help Net Security.

Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: October 2024 Patch Tuesday forecast: Recall can be recalled October arrived, and Microsoft started the month by announcing the release of Windows 11 24H2. The preview versions of this release have been in the news due to many innovations and one controversial feature. Critical Zimbra RCE vulnerability under mass exploitation (CVE-2024-45519) Attackers are actively exploiting CVE-2024-45519, a critical Zimbra vulnerability … More →

The post Week in review: Critical Zimbra RCE vulnerability exploited, Patch Tuesday forecast appeared first on Help Net Security.

Microsoft and the US Justice Department have seized over 100 domains used by Star Blizzard, a Russian nation-state threat actor. “Between January 2023 and August 2024, Microsoft observed Star Blizzard target over 30 civil society organizations – journalists, think tanks, and non-governmental organizations (NGOs) core to ensuring democracy can thrive – by deploying spear-phishing campaigns to exfiltrate sensitive information and interfere in their activities,” Steven Masada, Assistant General Counsel at Microsoft’s Digital Crimes Unit, explained. … More →

The post 100+ domains seized to stymie Russian Star Blizzard hackers appeared first on Help Net Security.

October arrived, and Microsoft started the month by announcing the release of Windows 11 24H2. The preview versions of this release have been in the news due to many innovations and one controversial feature. Windows 11 24H2 and Microsoft Recall This OS was released in May for Microsoft’s new Copilot+ PCs, powered by a neural processing unit (NPU); several features are unique to that platform. Now available for systems that meet the hardware requirements, it … More →

The post October 2024 Patch Tuesday forecast: Recall can be recalled appeared first on Help Net Security.

In this Help Net Security interview, Sanaz Yashar, CEO at Zafran, discusses the role of threat exposure management (TEM) in modern cybersecurity strategies. As traditional vulnerability management evolves, TEM addresses the overwhelming risks arising from expanded attack surfaces and fragmented security tools. The proactive TEM approach prioritizes risks and integrates seamlessly with existing security tools, enabling organizations to mitigate threats before they can be exploited effectively. Why has Threat Exposure Management (TEM) become critical in … More →

The post Best practices for implementing threat exposure management, reducing cyber risk exposure appeared first on Help Net Security.

MaLDAPtive is an open-source framework for LDAP SearchFilter parsing, obfuscation, deobfuscation, and detection. At its core, the project features a custom-built C# LDAP parser designed for tokenization and syntax tree parsing. It also incorporates specialized properties to ensure precise obfuscation, deobfuscation, and detection of LDAP SearchFilters. Complementing this is a PowerShell wrapper, crafted for flexibility and randomization, with pipeline capabilities that allow seamless integration of all desired functions within a single command. MaLDAPtive is available … More →

The post MaLDAPtive: Open-source framework for LDAP SearchFilter parsing, obfuscation, and more! appeared first on Help Net Security.

Off-the-shelf offensive security tools and poorly configured cloud environments create openings in the attack surface, according to Elastic. Adversaries are utilizing off-the-shelf tools Offensive security tools (OSTs), including Cobalt Strike and Metasploit, made up ~54% of observed malware alerts. The most prevalent malware family observed this year was Cobalt Strike, accounting for 27.02% of infections. Cobalt Strike is a very mature commercial post-exploitation framework with an experienced research and development team. It is so effective … More →

The post Cybercriminals capitalize on poorly configured cloud environments appeared first on Help Net Security.

Here’s a look at the most interesting products from the past week, featuring releases from Balbix, Halcyon, Metomic, Red Sift, SAFE Security, Veeam Software, and Legit Security. SAFE X equips CISOs with integrated data from all their existing cybersecurity products SAFE X delivers CISOs real-time business impact insights into their cybersecurity posture, enabling better decision-making and risk prioritization. Powered by AI, it delivers instant answers on an organization’s cyber risk posture and offers personalized risk … More →

The post New infosec products of the week: October 4, 2024 appeared first on Help Net Security.

CVE-2024-29824, an unauthenticated SQL Injection vulnerability in Ivanti Endpoint Manager (EPM) appliances, is being exploited by attackers, the Cybersecurity and Infrastructure Security Agency has confirmed by adding the bug to its Known Exploited Vulnerabilities catalog. Ivanti did the same by updating the relevant security advisory to say that they are aware of a limited number of customers who have been exploited. Further details about the attacks are unavailable at this time. About CVE-2024-29824 CVE-2024-29824, reported … More →

The post Critical Ivanti Endpoint Manager flaw exploited (CVE-2024-29824) appeared first on Help Net Security.

Malwarebytes released new features for Browser Guard, its free browser extension for Chrome, Edge, Firefox, and Safari that blocks content identified as potentially unwanted and unsafe. Users will now receive a pop-up alert if a website was involved in a recent breach, offering the ability to click and scan their digital footprint to evaluate if private information was exposed. New Auto-Cookie Block empowers users to manage their privacy with ease by preventing the collection of … More →

The post Malwarebytes Browser Guard updates block unwanted and unsafe content appeared first on Help Net Security.

Darktrace announced the expansion of Darktrace / CLOUD to support Microsoft Azure environments. The AI-driven Cloud Detection and Response (CDR) system leverages Microsoft’s virtual network flow logs for agentless deployment, slashing deployment times by 95%. The need for AI-driven cloud security has never been more critical. 51% of US organizations use cloud computing today, and global spending on public cloud services is expected to reach $805 billion in 2024. Moreover, Darktrace’s State of AI Cybersecurity report … More →

The post Darktrace brings real-time cloud detection and response to Microsoft Azure customers appeared first on Help Net Security.

While the Common UNIX Printing System (CUPS) vulnerabilities recently disclosed by researcher Simone “evilsocket” Margaritelli are not easily exploited for remote command execution on vulnerable systems, they could offer more opportunity to attackers who engage in DDoS attacks, Akamai threat researchers have discovered. Potential for RCE CUPS is an open-source printing system based on the Internet Printing Protocol (IPP). While present on many Linux, BSD and other systems, CUPS is not enabled by default on … More →

The post CUPS vulnerabilities could be abused for DDoS attacks appeared first on Help Net Security.

Legit Security launched its new “Legit Posture Score,” delivering a dynamic, comprehensive, and fully transparent ASPM rating system. Now security teams can proactively measure and manage their AppSec posture instantly with a holistic score that eliminates security scanning siloes and continuously assesses all associated risks, policies, and controls across today’s sprawling software development lifecycle (SDLC). Security leaders today struggle simply to see, let alone act or improve on, their application security postures. They’re left with … More →

The post Legit Posture Score empowers security teams to measure and manage their AppSec posture appeared first on Help Net Security.

Undeterred by the indictment issued against one of its alleged members, North Korean APT group Stonefly (aka APT45) continues to target companies in the US, Symantec threat analysts warned. About Stonefly Also known as Andariel and OnyxFleet, Stonefly has been linked to the linked to the Reconnaissance General Bureau (RGB), a North Korean military intelligence agency. Assessed structure of DPRK cyber operations in 2024 (Source: Mandiant) “APT45 relies on a mix of publicly available tools … More →

The post Private US companies targeted by Stonefly APT appeared first on Help Net Security.

AuthenticID released Velocity Checks, a new tool that integrates with its comprehensive identity verification and fraud prevention platform. The solution leverages biometric and document analysis to detect multiple identities for fraudulent activities in real-time. Fraudsters can use different names with the same image so that identical visual data (like headshots or biometric information) is paired with multiple identity documents or account registrations with differing names. Velocity Checks uses sophisticated image comparison algorithms to analyze ID … More →

The post AuthenticID Velocity Checks detects fraudulent activities appeared first on Help Net Security.