Think You’re Secure? 49% of Enterprises Underestimate SaaS Risks

It may come as a surprise to learn that 34% of security practitioners are in the dark about how many SaaS applications are deployed in their organizations. And it’s no wonder—the recent AppOmni 2024 State of SaaS Security Report reveals that only 15% of organizations centralize SaaS security within their cybersecurity teams. These statistics not […]

Ransomware Gangs Use LockBit’s Fame to Intimidate Victims in Latest Attacks

Threat actors have been observed abusing Amazon S3 (Simple Storage Service) Transfer Acceleration feature as part of ransomware attacks designed to exfiltrate victim data and upload them to S3 buckets under their control. « Attempts were made to disguise the Golang ransomware as the notorious LockBit ransomware, » Trend Micro researchers Jaromir Horejsi and Nitesh Surana said. […]

Researchers Reveal ‘Deceptive Delight’ Method to Jailbreak AI Models

Cybersecurity researchers have shed light on a new adversarial technique that could be used to jailbreak large language models (LLMs) during the course of an interactive conversation by sneaking in an undesirable instruction between benign ones. The approach has been codenamed Deceptive Delight by Palo Alto Networks Unit 42, which described it as both simple […]

Gophish Framework Used in Phishing Campaigns to Deploy Remote Access Trojans

Russian-speaking users have become the target of a new phishing campaign that leverages an open-source phishing toolkit called Gophish to deliver DarkCrystal RAT (aka DCRat) and a previously undocumented remote access trojan dubbed PowerRAT. « The campaign involves modular infection chains that are either Maldoc or HTML-based infections and require the victim’s intervention to trigger the

Security Flaw in Styra’s OPA Exposes NTLM Hashes to Remote Attackers

Details have emerged about a now-patched security flaw in Styra’s Open Policy Agent (OPA) that, if successfully exploited, could have led to leakage of New Technology LAN Manager (NTLM) hashes. « The vulnerability could have allowed an attacker to leak the NTLM credentials of the OPA server’s local user account to a remote server, potentially allowing […]

Cybercriminals Exploiting Docker API Servers for SRBMiner Crypto Mining Attacks

Bad actors have been observed targeting Docker remote API servers to deploy the SRBMiner crypto miner on compromised instances, according to new findings from Trend Micro. « In this attack, the threat actor used the gRPC protocol over h2c to evade security solutions and execute their crypto mining operations on the Docker host, » researchers Abdelrahman Esmail […]

Vendu à Sophos, Secureworks élargit l’empire cyber de Thoma Bravo

Dell a fini par revendre sa filiale Secureworks, en perte de vitesse. Elle passe dans le giron de son concurrent Sophos, que contrôle le fonds Thoma Bravo.

Le Campus Cyber, cet autre vecteur de ressources communautaires

Le groupe de travail « Crise cyber et entraînement » constitué il y a deux ans au Campus Cyber a orchestré une publication globale des livrables qu’il a produits jusqu’alors.

A Comprehensive Guide to Finding Service Accounts in Active Directory

Service accounts are vital in any enterprise, running automated processes like managing applications or scripts. However, without proper monitoring, they can pose a significant security risk due to their elevated privileges. This guide will walk you through how to locate and secure these accounts within Active Directory (AD), and explore how Silverfort’s solutions can help […]

Malicious npm Packages Target Developers’ Ethereum Wallets with SSH Backdoor

Cybersecurity researchers have discovered a number of suspicious packages published to the npm registry that are designed to harvest Ethereum private keys and gain remote access to the machine via the secure shell (SSH) protocol. The packages attempt to « gain SSH access to the victim’s machine by writing the attacker’s SSH public key in the […]