Latest

Cloud Security

Possible Chinese Hackers Use OpenMetadata to Cryptomine

Prajeet Nair  •  April 17, 2024

Hackers who appear to be Chinese are exploiting vulnerabilities in the OpenMetadata platform running as workloads on Kubernetes clusters to download cryptomining software, warned Microsoft. "I want to buy a car," the hackers tell victims in a note and solicit monero donations.

Fraud Management & Cybercrime

Free Ransomware: LockBit Knockoffs and Imposters Proliferate

Mathew J. Schwartz  •  April 17, 2024

What do a German healthcare network, a Russian security company and an American bridal clothing retailer have in common? All seem to have been compromised in recent months by attackers who wielded LockBit crypto-locking malware - but who weren't tied to the actual LockBit operation.

Endpoint Security

Exploited TP-Link Vulnerability Spawns Botnet Threats

Prajeet Nair  •  April 17, 2024

Half a dozen different botnets are prowling the internet for TP-Link-brand Wi-Fi routers unpatched since last summer with the goal of commandeering them into joining distributed denial-of-service attacks. Chinese router manufacture TP-Link in June patched a command injection vulnerability.

Cybercrime

Steganography Campaign Targets Global Enterprises

Prajeet Nair  •  April 16, 2024

Financially motivated hackers are using the oldie-but-goodie technique of hiding malicious code in digital images to target businesses in Latin America, say security researchers. One image containing a PowerShell script results in Agent Tesla being loaded on the victim computer.

Fraud Management & Cybercrime

After XZ Utils, More Open-Source Maintainers Under Attack

Mathew J. Schwartz  •  April 16, 2024

Major open-source software projects are warning that more pieces of code than XZ Utils may have been backdoored by attackers, based on ongoing supply-chain attack attempts that have targeted "popular JavaScript projects," apparently seeking to trick them into sharing code maintainer rights.

Business Continuity Management / Disaster Recovery

Commvault Buys Appranix to Make Ransomware Recovery Quicker

Michael Novinson  •  April 16, 2024

Commvault purchased a cyber resilience vendor led by a longtime Hewlett-Packard manager to help enterprises get up and running faster after an outage or cyberattack. With Appranix, Commvault can reduce the time needed to rebuild after a ransomware attack from days or weeks to just hours or minutes.

3rd Party Risk Management

Sisense Breach Highlights Rise in Major Supply Chain Attacks

Chris Riotta  •  April 15, 2024

Cybersecurity experts are sounding the alarm over a rise in supply chain attacks targeting the interconnected systems of global corporate giants after the top U.S. cyber agency urged Sisense customers to reset their credentials following an apparent hack.

Cybersecurity Spending

FBI Calls for Increased Funding to Counter Cyberthreats

Chris Riotta  •  April 11, 2024

FBI Director Christopher Wray told a congressional panel Thursday the United States faces a wide range of "escalated" digital threats, including sophisticated cyberattacks and emerging risks to networks and critical infrastructure. The FBI took over 1,000 actions against cyber adversaries in 2023.

Cybercrime

Breach Roundup: Sisense Supply Chain Attack

Anviksha More  •  April 11, 2024

This week, Sisense supply chain attack, a likely Romanian botnet, Patch Tuesday, an Apple spyware warning and AT&T notifies customers of breach. Alcohol counselor Monument shared data with Meta, a breach of Home Depot employee data, a breach at Targus and a threat actor targeted Moroccan activists.

Breach Notification

Half of UK Firms, Charities Failed to Report Cyber Incidents

Akshaya Asokan  •  April 10, 2024

Cybercriminals launched 7.78 million attacks against U.K. businesses and nearly 1 million against charity organizations, according to the latest U.K. government survey report. But fewer than half of those firms reported the incidents to authorities, something researchers say is a concerning trend.

Artificial Intelligence & Machine Learning

Should We Just Accept the Lies We Get From AI Chatbots?

Rashmi Ramesh  •  April 10, 2024

Employers can now fire an employee who complains about sexual harassment, take a cut of their workers' tips and serve customers cheese nibbled on by rats: at least according to advice doled out by New York City's AI chatbot meant to help small business owners navigate the city's bureaucratic maze.

Recruitment & Reskilling Strategy

Employees Are 'Quiet Quitting' - What Can Employers Do?

Brandy Harris , Steve King  •  April 9, 2024

"Quiet quitting" is when employees strictly adhere to their job descriptions and meticulously avoid any tasks that fall outside their defined responsibilities. Here's how employers and employees can prevent it and create a workplace culture that promotes engagement, satisfaction and shared success.