To Customer Support To Customer Support

Events
Leaderboard
Customer Support

📊 2023 OpenText Cybersecurity Threat Report

2 months ago

Home
Community overview
Welcome

Welcome

News, Announcements, Tech Discussions

41019 Topics

Newest first

Recently active Most replies Most views

Jasper_The_RasperModerator

posted in Security Industry News

US Treasury sanctions four North Korean entities engaged in malicious cyber activities

May 24, 2023 By MARIA DEUTSCHER The U.S. Department of Treasury has sanctioned four North Korean organizations, as well as one individual, for engaging in malicious cyber activities.Officials announced the move on Tuesday. Additionally, the Treasury Department detailed that South Korea has also sanctioned the organizations and individual in question.The first organization to which the new sections apply is the Pyongyang University of Automation. It’s described as one of North Korea’s main hacker training institutions. It trains hackers who in many cases go on to work for cyber units of the RGB, North Korea’s primary intelligence bureau. >> Full Article <<

7 days ago

Jasper_The_RasperModerator

posted in Security Industry News

Google's .zip, .mov Domains Give Social Engineers a Shiny New Tool

Security professionals warn that Google's new top-level domains, .zip and .mov, pose social engineering risks while providing little reason for their existence. May 24, 2023 By Robert Lemos Two new top-level domain names — .zip and .mov — have caused concern among security researchers, who say they allow for the construction of malicious URLs that even tech-savvy users are likely to miss.Google announced the domains in early May, kicking off a slow buildup of criticism from the security community as people became aware of the issues. In a widely circulated post on Medium, security researcher Bobby Rauch pointed to two seemingly identical URLs that appear to go to the same place — downloading a zip file from a GitHub repository — but by using unicode slashes, an "@" sign, and the .zip domain, a potentially malicious URL could instead redirect users to an attacker's website. >> Full Article <<

7 days ago

Jasper_The_RasperModerator

posted in Security Industry News

Barracuda Discloses Breach Of Some Email Security Customers Due To Zero-Day Vulnerability

May 24, 2023 By Kyle Alspach The cybersecurity vendor says that an unspecified number of customers of its Email Security Gateway appliance have been impacted. Barracuda said that some Email Security Gateway customers were impacted by a breach last week that exploited a zero-day vulnerability in the appliance.The cybersecurity vendor didn’t specify how many customers were affected in its disclosure, and said in an email to CRN that it’s not sharing further details.In a post Tuesday, Barracuda said that the vulnerability was discovered on May 19, and the company deployed a patch “to all ESG appliances worldwide” the following day. A second patch was deployed on May 21 to all Email Security Gateway appliances.The investigation so far has found that the vulnerability “resulted in unauthorized access to a subset of email gateway appliances.” Affected customers have been notified, Barracuda said. >> Full Article <<

7 days ago

Jasper_The_RasperModerator

posted in Security Industry News

Ransomware tales: The MitM attack that really had a Man in the Middle

May 24, 2023 By Paul Ducklin It’s taken more than five years for justice to be served in this case, but the cops and the courts got there in the end.The UK law enforcement office SEROCU, short for South East Regional Organised Crime Unit, this week reported the peculiar tale of one Ashley Liles, the literal Man in the Middle whom we referred to in the headline.These days, we usually expand the jargon term MitM to mean Manipulator in the Middle, not merely to avoid the gendered term “man”, but also because many, if not most, MitM attacks these days are performed by machines.Some techies have even adopted the name Machine in the Middle, but we prefer “manipulator” because we think it usefully decribes how this sort of attack works, and because (as this story shows) sometimes it really is man, and not a machine, in the middle. >> Full Article <<

7 days ago

Jasper_The_RasperModerator

posted in Security Industry News

Legit app in Google Play turns malicious and sends mic recordings every 15 minutes

The malicious iRecorder app has come to light, but its purpose remains shrouded.DAN GOODIN - 5/24/2023 An app that had more than 50,000 downloads from Google Play surreptitiously recorded nearby audio every 15 minutes and sent it to the app developer, a researcher from security firm ESET said.The app, titled iRecorder Screen Recorder, started life on Google Play in September 2021 as a benign app that allowed users to record the screens of their Android devices, ESET researcher Lukas Stefanko said in a post published on Tuesday. Eleven months later, the legitimate app was updated to add entirely new functionality. It included the ability to remotely turn on the device mic and record sound, connect to an attacker-controlled server, and upload the audio and other sensitive files that were stored on the device. >> Full Article <<

7 days ago

Jasper_The_RasperModerator

posted in Security Industry News

Operation "Total Exchange": New PowerExchange Backdoor Discovered in the UAE

By Asaf Rubinfeld, John Simmons, Luca Pugliese and Rotem Sde-Or | May 24, 2023 Affected Platforms: WindowsImpacted Users: Government agenciesImpact: Stealing domain credentials and code executionSeverity Level: High Last year, the FortiEDR research lab identified several simultaneous attacks targeting a government entity in the United Arab Emirates. Some were classified as known threats, such as JS_POWMET and AdKoob, while one remained unidentified.This isolated case was a custom, targeted PowerShell-based backdoor we named PowerExchange. This backdoor’s C2 protocol is email-based, with the C2 server being the victim’s Microsoft Exchange server. Forensics investigation of the network revealed the backdoor on additional endpoints and multiple other implants on various servers. One implant discovered on Microsoft Exchange servers was a novel web shell, dubbed ExchangeLeech, due to its unique ability to harvest credentials.We see indicators of an Iranian threat actor operating these tools

7 days ago

deepak.chowNew Member

asked in Community 101

Can Webroot protect the USB , CD/DVD drives when the endpoint is offline ?

Can Webroot protect the endpoint if any new malware has been in to the system through USB, CD/DVD drives or any new suspicious file or program been added to the system while the system is offline and cannot be connected to the Internet for a long time.

6 days ago

Jasper_The_RasperModerator

posted in Security Industry News

A deeper insight into the CloudWizard APT’s activity revealed a long-running activity

May 23, 2023 By Pierluigi Paganini Experts warn of a threat actor, tracked as CloudWizard APT, that is targeting organizations involved in the region of the Russo-Ukrainian conflict.On March 2023, researchers from Kaspersky spotted a previously unknown APT group, tracked as Bad Magic (aka Red Stinger), that targeted organizations in the region of the Russo-Ukrainian conflict. The attackers were observed using PowerMagic and CommonMagic implants.Looking for other implants with similarities with PowerMagic and CommonMagic, the researchers identified a different cluster of even more sophisticated malicious activities associated with the same threat actor. >> Full Article <<

7 days ago

Jasper_The_RasperModerator

posted in Security Industry News

Twitter's History of Security Lapses and How They Affected Users

Twitter's suffered many data breaches in the past, affecting millions of users. Only by knowing of these breaches can you protect yourself in future. May 23, 2023 By KATIE REES Like most social media sites, Twitter is no stranger to security breaches. Over the years, Twitter has fallen victim to numerous malicious attacks, some worse than others. So, when was Twitter's first security breach, and what does the timeline look like up to today? >> Full Article <<

7 days ago

Edmund44Fresh Face

asked in Community 101

Webroot oddity on startup

I’ve recently come back to Webroot after a few months away. Since installing Webroot, when starting up or restarting, I get a prompt from Windows asking if I want Webroot to make changes. I always click yes, and startup continues. It’s the same prompt one gets when installing or updating a new app. It never did this before. I don’t know if it’s a new protocol from Webroot or yet another oddity from Microsoft. I would like it to stop, but have no clue what to do. Any suggestion is appreciated.Ed LeRoy

6 days ago

Jasper_The_RasperModerator

posted in Security Industry News

Threat Actor Abuses SuperMailer for Large-scale Phishing Campaign

A credential phishing campaign using the legitimate SuperMailer newsletter distribution app has doubled in size each month since January 2023. May 23, 2023 By Kevin Townsend A credential phishing campaign using the legitimate SuperMailer newsletter distribution app has doubled in size each month since January 2023.“In January this campaign was limited to only a handful of emails, but in May we have seen thousands reaching inboxes,” Brad Haas, cyber threat intelligence analyst at Cofense, told SecurityWeek. The campaign was discovered courtesy of a unique string included by SuperMailer in an embedded URL within the phishing email. This string is only visible to the email recipient by hovering the cursor over the link – but it shouldn’t have been there. It is the result of a coding error made by the threat actor, but its presence links multiple different phishes to the same campaign. >> Full Article <<

8 days ago

Jasper_The_RasperModerator

posted in Security Industry News

Here’s how long it takes new BrutePrint attack to unlock 10 different smartphones

BrutePrint requires just $15 of equipment and a little amount of time with a phone.DAN GOODIN - 5/22/2023 Researchers have devised a low-cost smartphone attack that cracks the authentication fingerprint used to unlock the screen and perform other sensitive actions on a range of Android devices in as little as 45 minutes.Dubbed BrutePrint by its creators, the attack requires an adversary to have physical control of a device when it is lost, stolen, temporarily surrendered, or unattended, for instance, while the owner is asleep. The objective: to gain the ability to perform a brute-force attack that tries huge numbers of fingerprint guesses until one is found that will unlock the device. The attack exploits vulnerabilities and weaknesses in the device SFA (smartphone fingerprint authentication). The workflow of a smartphone fingerprint authentication system. >> Full Article <<

7 days ago

Jasper_The_RasperModerator

posted in Security Industry News

YouTube Pirated Software Videos Deliver Triple Threat: Vidar Stealer, Laplas Clipper, XMRig Miner

By Artem Semenchenko, Joie Salvio, and Roy Tay | May 23, 2023 Affected Platforms: WindowsImpacted Users: Any organizationImpact: Remote attackers steal credentials, sensitive information, and cryptocurrency and perform cryptojacking on systemsSeverity Level: Critical FortiGuard Labs came across an ongoing threat campaign targeting YouTube viewers searching for pirated software earlier this month. Videos advertising downloads of “cracked” (aka pirated) software are uploaded by verified YouTube channels with a large number of subscribers. Victims are led to execute malicious binaries that install multiple malware into their systems focused on harvesting credentials, cryptojacking, and stealing cryptocurrency funds from wallets.While investigating this campaign, other researchers published a report about it. And although there are overlaps with our findings, this report provides additional observations, such as the deployment of a third malware family being distributed to the victims.This

8 days ago

Jasper_The_RasperModerator

posted in Security Industry News

The previously undocumented GoldenJackal APT targets Middle East, South Asia entities

May 23, 2023 By Pierluigi Paganini A previously undocumented APT group tracked as GoldenJackal has been targeting government and diplomatic entities in the Middle East and South Asia since 2019.Kaspersky researchers shared details about the activity of a previously undocumented APT group, tracked as GoldenJackal, which has been active since 2019. The primary motivation of the group appears to be the espionage.The group focuses on government and diplomatic entities in the Middle East and South Asia. Kaspersky started monitoring the operations of the group in mid-2020, the researchers explained that it showed a constant level of activity that demonstrates the capability of the group to fly under the radar.The APT group employed a specific toolset of .NET malware, composed of JackalControl, JackalWorm, JackalSteal, JackalPerInfo and JackalScreenWatcher. The malware allows the group to: >> Full Article <<

8 days ago

Jasper_The_RasperModerator

posted in Security Industry News

EU hits Meta with $1.3 billion fine for transferring European user data to the US

May 22, 2023 By Pierluigi Paganini The European Union condemned Meta with a record $1.3 billion fine for transferring European user data to the US.The European Union fined Meta $1.3 billion for transferring user data to the US. This is the biggest fine since the adoption of the General Data Protection Regulation (GDPR) by the European Union (EU) on May 25, 2018.In the past, the social media giant Meta threatened to block its services for users in Europe without a legal basis for data transfers. Now the company was disappointed by the decision of Ireland’s Data Protection Commission and said that it sets a dangerous precedent for a large number of companies transferring data between the EU and U.S.. >> Full Article <<

9 days ago

Jasper_The_RasperModerator

posted in Security Industry News

Cloned CapCut websites push information stealing malware

May 20, 2023 By Bill Toulas A new malware distribution campaign is underway impersonating the CapCut video editing tool to push various malware strains to unsuspecting victims.CapCut is ByteDance's official video editor and maker for TikTok, supporting music mixing, color filters, animation, slow-mo effects, picture-in-picture, stabilization, and more.It has over 500 million downloads on Google Play alone, and its website receives over 30 million hits monthly.The application's popularity, combined with nationwide bans in Taiwan, India, and other places, has pushed users to seek alternative ways of downloading the program.However, threat actors exploit this by creating websites that distribute malware disguised as CapCut installers. >> Full Article <<

11 days ago

1
2
3
4
5
6
...
1641

Page 3 / 1641

Badges

Petrovichas earned the badge Beta To The Max
TylerMhas earned the badge Have 50 answers marked as "solved"!
tasystemshas earned the badge Posted 100 comments!
Tarnakhas earned the badge Beta To The Max
andrea.raniolohas earned the badge News: Posted 10 comments!

Show all badges

Join the Conversation

Tweets by Webroot

Terms & Conditions

Sign up

Already have an account? Login

Username *

E-mail address *

Password *

I accept the terms & conditions

loginBox.register.email_repeat

Login to the community

No account yet? Create an account

Username or Email

Password

Remember me

Forgot password?

Enter your username or e-mail address. We'll send you an e-mail with instructions to reset your password.

Username or e-mail

Back to overview

Scanning file for viruses.

Sorry, we're still checking this file's contents to make sure it's safe to download. Please try again in a few minutes.

This file cannot be downloaded

Sorry, our virus scanner detected that this file isn't safe to download.

Customer Support
Webroot.com
Blog
Status Page
Community Guidelines
Legal
Privacy
Cookie Preferences

We have recently updated our Privacy Policies. We encourage you to read the full terms here.