Kaseya Patches Zero-Days Used in REvil Attacks
The security update addresses three VSA vulnerabilities used by the ransomware gang to launch a worldwide supply-chain attack on MSPs and their customers.
Read More
Author: Lisa Vaas
Coursera Flunks API Security Test in Researchers’ Exam
The problem APIs included numero uno on the OWASP API Security Top 10: a Broken Object Level Authorization (BOLA) issue that could have exposed personal data.
Read MoreSuspected ‘Dr HeX’ Hacker Busted for 9 Years of Phishing
The unnamed suspect allegedly helped to develop carding and phishing kits with the aim of stealing customers’ bank-card data.
Read MoreFake Kaseya VSA Security Update Drops Cobalt Strike
Threat actors are planting Cobalt Strike backdoors by malspamming a bogus Microsoft update along with a SecurityUpdates.exe.
Read MorePro-Trump ‘Gettr’ Social Platform Hacked On Day One
The newborn platform was inundated by Sonic the Hedgehog-themed porn and had prominent users’ profiles defaced. Next, hackers posted its user database online.
Read MoreWestern Digital Users Face Another RCE
Say hello to one more zero-day and yet more potential remote data death for those who can’t/won’t upgrade their My Cloud storage devices.
Read MoreWidespread Brute-Force Attacks Tied to Russia’s APT28
The ongoing attacks are targeting cloud services such as Office 365 to steal passwords and password-spray a vast range of targets, including in U.S. and European governments and military.
Read MoreDropbox Used to Mask Malware Movement in Cyberespionage Campaign
The ongoing spear-phishing campaign targeting the Afghan government uses Dropbox as an API that leaves no traces of communications with weirdo websites.
Read MoreZero-Day Used to Wipe My Book Live Devices
Threat actors may have been duking it out for control of the compromised devices, first using a 2018 RCE, then password-protecting a new vulnerability.
Read MoreMicrosoft Translation Bugs Open Edge Browser to Trivial UXSS Attacks
The bug in Edge’s auto-translate could have let remote attackers pull off RCE on any foreign-language website just by sending a message with an XSS payload.
Read More