To Customer Support To Customer Support

Welcome

News, Announcements, Tech Discussions

40662 Topics

Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News

Reduce, Reuse, Recycle: Bad Actors Practicing the Three Rs

By Derek Manky | March 15, 2023 Malware has a way of grabbing all the attention in the media and keeping companies on their toes. The world watched as wipers were deployed to Ukrainian organizations after the Russian invasion of Ukraine, which marked the beginning of a time of instability that included ransomware and InfoStealers, as well. Adding to the negative cybersecurity load of 2022, the contemporary version of ransomware celebrated its 10-year anniversary.And if that weren’t enough, our FortiGuard Labs researchers have seen that a cybercriminal, like any sensible businessperson, are big proponents of getting the most out of their resources. You might say they’re practicing the reduce, reuse, recycle principles, but instead of being focused on environmental concerns, they’re retrofitting code to enable more successful criminal outcomes. >> Full Article <<

0
Jasper_The_Rasper
Moderator
10 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News

LockBit Threatens to Leak Stolen SpaceX Schematics

The ransomware group sent a message directly to Elon Musk: Pay or the confidential SpaceX information goes up for grabs on the Dark Web. March 14, 2023 By Dark Reading Staff The LockBit ransomware group is reportedly threating to release stolen SpaceX schematics unless Elon Musk pays to keep them under wraps.Musk has until March 20 to make an extortion payment, according to a recent LockBit post shared on Twitter by cybersecurity analyst Dominic Alvieri. The confidential drawings were reportedly lifted not from SpaceX itself, but from a third-party vendor: Maximum Industries, which produces parts for SpaceX projects. >> Full Article <<

1
TylerM
Administrator
11 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News

SAP releases security updates fixing five critical vulnerabilities

March 14, 2023 By Bill Toulas Software vendor SAP has released security updates for 19 vulnerabilities, five rated as critical, meaning that administrators should apply them as soon as possible to mitigate the associated risks.The flaws fixed this month impact many products, but the critical severity bugs affect SAP Business Objects Business Intelligence Platform (CMC) and SAP NetWeaver.More specifically, the five flaws fixed this time are the following:CVE-2023-25616: Critical severity (CVSS v3: 9.9) code injection vulnerability in SAP Business Intelligence Platform, allowing an attacker to access resources only available to privileged users. The flaw impacts versions 420 and 430. CVE-2023-23857: Critical severity (CVSS v3: 9.8) information disclosure, data manipulation, and DoS flaw impacting SAP NetWeaver AS for Java, version 7.50. The bug allows an unauthenticated attacker to perform unauthorized operations by attaching to an open interface and accessing services via the directory

0
Jasper_The_Rasper
Moderator
11 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News

DEV-1101 AiTM phishing kit is fueling large-scale phishing campaigns

March 14, 2023  By Pierluigi Paganini Microsoft warns of large-scale phishing attacks orchestrated with an open-source adversary-in-the-middle (AiTM) phishing kit available in the cybercrime ecosystemAdversary-in-the-middle (AiTM) phishing kits are becoming an essential technology in the cybercrime ecosystem that is used by multiple threat actors to launch phishing attacks. AiTM phishing allows threat actors to circumvent multifactor authentication (MFA) through reverse-proxy functionality.In AiTM phishing, threat actors set up a proxy server between a target user and the website the user wishes to visit, which is the phishing site under the control of the attackers. The proxy server allows attackers to access the traffic and capture the target’s password and the session cookie.  >> Full Article <<

0
Jasper_The_Rasper
Moderator
11 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News

Fortinet: New FortiOS bug used as zero-day to attack govt networks

March 13, 2023 By Sergiu Gatlan Unknown attackers used zero-day exploits to abuse a new FortiOS bug patched this month in attacks targeting government and large organizations that have led to OS and file corruption and data loss.Fortinet released security updates on March 7, 2023, to address this high-severity security vulnerability (CVE-2022-41328) that allowed threat actors to execute unauthorized code or commands."A improper limitation of a pathname to a restricted directory vulnerability ('path traversal') [CWE-22] in FortiOS may allow a privileged attacker to read and write arbitrary files via crafted CLI commands," the company says in the advisory. >> Full Article <<

0
Jasper_The_Rasper
Moderator
11 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News

Zoll Medical notifies 1M patients of data breach tied to LifeVest device

March 14, 2023 By Jessica Davis Zoll notified over 1 million current and former patients who use Zoll’s LifeVest device that their data was compromised. (Adobe Stock Images) Just over 1 million patients who used or were considered for use of a Zoll product were recently notified that their data was potentially exposed after a hack of the medical device and technology solutions vendor’s internal network in early February.In a statement to SC Media, Zoll confirmed the hack was tied to current and former patients who use Zoll’s LifeVest device, a wearable cardioverter defibrillator and stressed that the “cybersecurity incident does not affect the safety or operation of the LifeVest device or any other Zoll medical device or related software.” >> Full Article <<

0
Jasper_The_Rasper
Moderator
11 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News

Clop ransomware is victimizing GoAnywhere MFT customers

March 14, 2023 By Pieter Arntz According to information gathered by BleepingComputer, the Clop ransomware group has claimed responsibility for the ransomware attacks that are tied to a vulnerability in the Fortra GoAnywhere MFT secure file-sharing solution.As we reported on February 8, Fortra released an emergency patch (7.1.2) for an actively exploited zero-day vulnerability found in the GoAnywhere MFT administrator console.GoAnywhere MFT, which stands for managed file transfer, allows businesses to manage and exchange files in a secure and compliant way. According to its website, it caters to more than 3,000 organizations, predominantly ones with over 10,000 employees and 1B USD in revenue. >> Full Article << 

0
Jasper_The_Rasper
Moderator
11 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News

Adobe fixed ColdFusion flaw listed as under active exploit

March 14, 2023  By Pierluigi Paganini Adobe is warning that a critical zero-day flaw in ColdFusion web app development platform was exploited in very limited attacks.Software giant Adobe released security updates for ColdFusion versions 2021 and 2018 to resolve a critical flaw, tracked as CVE-2023-26360 (CVSS base score 8.6), that was exploited in very limited attacks.“Adobe is aware that CVE-2023-26360 has been exploited in the wild in very limited attacks targeting Adobe ColdFusion.” reads the advisory published by the company.The vulnerability is an Improper Access Control that can allow a remote attacker to execute arbitrary code. The vulnerability could also lead to arbitrary file system read and memory leak. >> Full Article <<

0
Jasper_The_Rasper
Moderator
11 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News

Still using authenticators for MFA? Software for sale can hack you anyway

Some forms of multi-factor authentication only go so far in preventing account takeovers.DAN GOODIN - 3/14/2023 Microsoft on Tuesday profiled software for sale in online forums that makes it easy for criminals to deploy phishing campaigns that successfully compromise accounts, even when they’re protected by the most common form of multi-factor authentication.The phishing kit is the engine that’s powering more than 1 million malicious emails each day, researchers with the Microsoft Threat Intelligence team said. The software, which sells for $300 for a standard version and $1,000 for VIP users, offers a variety of advanced features for streamlining the deployment of phishing campaigns and increasing their chances of bypassing anti-phishing defenses. >> Full Article <<

0
Jasper_The_Rasper
Moderator
11 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News

Microsoft SmartScreen Zero-Day Exploited to Deliver Magniber Ransomware

See Also  -  March 2023 Security Updates (Patch Tuesday) A cybercrime group has been exploiting a Microsoft SmartScreen zero-day vulnerability tracked as CVE-2023-24880 to deliver the Magniber ransomware. March 14, 2023 By Eduard Kovacs  A cybercrime group has been exploiting a zero-day vulnerability in the Microsoft SmartScreen security feature to deliver the Magniber ransomware, Google warned on Tuesday.Google’s Threat Analysis Group (TAG) said the vulnerability, tracked as CVE-2023-24880, has been exploited since at least January. The internet giant’s researchers reported their findings to Microsoft on February 15 and a fix has been released with Microsoft’s latest Patch Tuesday updates. The SmartScreen feature is designed to protect users against phishing and malware, including by flagging potentially malicious files downloaded from the web.  >> Full Article <<

0
Jasper_The_Rasper
Moderator
11 days ago
TylerM
Administrator
TylerMSr. Security Analyst & Community Manager
published in News & Announcements

Hey did you notice anything different with the home page recently?Giveaway!

OpenText has some new branding with the new acquisition of Microfocus! All of the security products for OpenText are now going to be branded as OpenText Cybersecurity   Here are all the OpenText brands in this Cybersecurity divisionNotice that Webroot still keeps the green 🤗 What this means is that we have a whole bunch of OLD BRANDED SWAG that we need to give away to make room for the newly minted SWAG that we’ll be ordering.  Dang that cowbell just wont quitWe have a lovely bundle of gifts to giveaway. Included in this SWAG BAG is:Socks Light up Chat Bubble Cowbell Pens BBQ Tool Apple-Scented Notebook Lowball YETI mug The first 30 people reply to this thread with “OpenText is Cybersecurity” I will DM you and get this shipped to you! (US, UK, CA only)   I’m all about that apple-scented notebook  

66158
TylerM
Administrator
11 days ago
C
Administrator
ConnorMThreat Research Analyst
published in Security Industry News

Cyber News Rundown: Two more U.S. universities fall victim to ransomwareNews

Tennessee State University and Southeastern Louisiana University are just the latest higher education institutions to suffer a successful ransomware attack. In other cybersecurity news, the Hospital Clinic de Barcelona was forced to temporarily shut down operations after discovering unauthorized activity on their internal systems.Million-dollar ransom demanded from Minneapolis school districtTwo weeks after suffering a ransomware attack that caused significant interruptions to the Minneapolis Public Schools (MPS) computer systems, the district has received a ransom demand for $1 million to delete or return all stolen data. Alongside the ransom demand was a video that showed proof of the Medusa ransomware group’s access to the school district's systems, which is an improved tactic of simply posting screenshots of a victim’s computer. While the investigation into this security incident is still ongoing, officials for MPS have confirmed that they will be restoring any encrypted data from

16011
russell.harris
Popular Voice
12 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News

CISA warns of actively exploited Plex bug after LastPass breach

March 11, 2023 By Sergiu Gatlan  CISA has added an almost three-year-old high-severity remote code execution (RCE) vulnerability in the Plex Media Server to its catalog of security flaws exploited in attacks.Tracked as CVE-2020-5741, this security flaw allows threat actors with admin privileges to execute arbitrary Python code remotely in low-complexity attacks that don't require user interaction.Attackers with "admin access to a Plex Media Server could abuse the Camera Upload feature to make the server execute malicious code," according to an advisory published by the Plex Security Team in May 2020 when it patched the bug with the release of Plex Media Server 1.19.3. >> Full Article <<

0
Jasper_The_Rasper
Moderator
14 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News

Pirated copies of Final Cut Pro infect Macs with cryptojacking malware

March 10, 2023 By Graham Cluley  Sure, there’s much more malware for Windows (by a large order of magnitude) than there is on macOS, but that doesn’t mean that Macs are somehow magically immune from threats.It’s simply the case that if you’re running a Mac, there are a lot less arrows being flung in your direction.But if you do foolhardy things on your Mac, you can certainly come a cropper.Take, for instance, if you decide that you don’t fancy paying the $300 or so that Apple charges for the Mac edition of Final Cut Pro. >> Full Article <<

1
russell.harris
Popular Voice
15 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News

Mental health provider Cerebral alerts 3.1M people of data breach

March 10, 2023 By Bill Toulas  Healthcare platform Cerebral is sending data breach notices to 3.18 million people who have interacted with its websites, applications, and telehealth services.Cerebral is a remote telehealth company that provides online therapy and medication management for various mental health conditions, including anxiety, depression, ADHD, Bipolar Disorder, and substance abuse.In a 'Notice of HIPAA Privacy Breach' published on Cerebral's site this week, the company disclosed that they had been using invisible pixel trackers from Google, Meta (Facebook), TikTok, and other third parties on its online services since October 12, 2019. >> Full Article <<

0
Jasper_The_Rasper
Moderator
15 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News

New Version of Prometei Botnet Infects Over 10,000 Systems Worldwide

March 10, 2023 By Ravie Lakshmanan An updated version of a botnet malware called Prometei has infected more than 10,000 systems worldwide since November 2022.The infections are both geographically indiscriminate and opportunistic, with a majority of the victims reported in Brazil, Indonesia, and Turkey.Prometei, first observed in 2016, is a modular botnet that features a large repertoire of components and several proliferation methods, some of which also include the exploitation of ProxyLogon Microsoft Exchange Server flaws. >> Full Article <<

0
Jasper_The_Rasper
Moderator
15 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News

Acronis downplays intrusion after 12GB trove leaks online

Cyber-thief said goal was to 'humiliate' data-protection biz March 10, 2023 By Laura Dobberstein The CISO of Acronis has downplayed what appeared to be an intrusion into its systems, insisting only one customer was affected, using stolen credentials, and that all other data remains safe.A Thursday thread [PDF] on the notorious Breached Forums leak-mart brought news of the theft. In that post an attacker named kernelware - who also cracked Acer - claimed they had broken into Acronis, and stolen then leaked certificate files, command logs, system configurations, system information logs, archives of their filesystem, python scrips for an Acronis database, and backup configuration, plus oodles of screenshots of backup operations. >> Full Article <<

0
Jasper_The_Rasper
Moderator
15 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News

CISA warns of critical VMware RCE flaw exploited in attacks

March 10, 2023 By Sergiu Gatlan CISA has added a critical severity vulnerability in VMware's Cloud Foundation to its catalog of security flaws exploited in the wild.The flaw (tracked as CVE-2021-39144) was found in the XStream open-source library used by vulnerable VMware products and has been assigned an almost maximum severity score of 9.8/10 by VMware.Unauthenticated threat actors can exploit the bug in low-complexity attacks that will not need user interaction to execute arbitrary code remotely with root privileges on unpatched appliances."Due to an unauthenticated endpoint that leverages XStream for input serialization in VMware Cloud Foundation (NSX-V), a malicious actor can get remote code execution in the context of 'root' on the appliance," VMware explains. >> Full Article <<

0
Jasper_The_Rasper
Moderator
15 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News

US Lawmakers Face Cyberattacks, Potential Physical Harm After DC Health Link Breach

The threat actor who posted the data for sale has claimed credit for multiple other breaches, including one at grocery platform Weee! that exposed data on more than 1.1 million customers. March 9, 2023 By Jai Vijayan Hundreds of US lawmakers and their families are at risk of identity theft, financial scams, and potentially even physical threats after a known info-theft threat actor called IntelBroker made House of Representatives members' personally identifiable information (PII) available for sale on the "Breached" criminal forum.The information, confirmed as being obtained via a breach at health insurance marketplace DC Health Link, includes names, Social Security numbers, birth dates, addresses, and other sensitive identifying information. The data on the House members was part of a larger data set of PII belonging to more than 170,000 individuals enrolled with DC Health Link that the threat actor put up for sale this week. >> Full Article <<

0
Jasper_The_Rasper
Moderator
15 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News

AT&T alerts 9M wireless customers of security breach

March 10, 2023 By Monica Alleven AT&T is informing about 9 million wireless customers that their Customer Propriety Network Information (CPNI) was accessed by an unauthorized person through a vendor’s system.The data was several years old, mostly relating to device upgrade eligibility, AT&T said in a statement.Importantly, the information did not contain credit card information, Social Security numbers, account passwords or other sensitive personal information, AT&T said. >> Full Article <<

0
Jasper_The_Rasper
Moderator
15 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News

Akamai foils massive DDoS attack in Asia that reached 900Gbps

March 10, 2023 By Monica J. White Akamai has just mitigated a distributed denial of service (DDoS) attack of epic proportions. While it was short-lived, it was very intense, and it most likely could have easily taken the target server offline.It was the largest-ever DDoS attack launched against a target in the Asia-Pacific region. Despite the scale of the attack, Akamai was able to block it entirely.A DDoS attack consists of hundreds, if not thousands of computers that are used to send fake requests to the target server. When such a large volume of requests hits the server out of nowhere, the websites or applications affected are usually taken offline as a result. Even if they remain online, they’re likely to be very slow to respond. The scale of the problem depends on the size of the attack. Just recently, a massive volumetric attack took place, involving over 30,000 computers. >> Full Article <<

0
Jasper_The_Rasper
Moderator
15 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News

Latest version of Xenomorph Android malware targets 400 banks

March 10, 2023  By Pierluigi Paganini A new version of the Xenomorph Android malware includes a new automated transfer system framework and targets 400 banks.The author of the Xenomorph Android malware, the Hadoken Security Group, continues to improve their malicious code.In February 2022, researchers from ThreatFabric first spotted the Xenomorph malware, which was distributed via the official Google Play Store reaching over 50,000 installations.The banking Trojan was used to target 56 European banks and steal sensitive information from the devices of their customers. The analysis of the code revealed the presence of not implemented features and the large amount of logging present, a circumstance that suggests that this threat is under active development. >> Full Article <<

0
Jasper_The_Rasper
Moderator
15 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News

New GoBruteforcer malware targets phpMyAdmin, MySQL, FTP, Postgres

March 10, 2023 By Sergiu Gatlan A newly discovered Golang-based botnet malware scans for and infects web servers running phpMyAdmin, MySQL, FTP, and Postgres services.According to researchers with Palo Alto Networks' Unit 42, who first spotted it in the wild and dubbed it GoBruteforcer, the malware is compatible with x86, x64, and ARM architectures.GoBruteforcer will brute force accounts with weak or default passwords to hack into vulnerable *nix devices. >> Full Article <<

0
Jasper_The_Rasper
Moderator
15 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News

Refreshed from its holiday, Emotet has gone phishing

Notorious botnet starts spamming again after a three-month pause March 9, 2023 By Jeff Burt Emotet is back. After another months-long lull since a spate of attacks in November 2022, the notorious malware operation that has already survived a law enforcement takedown and various periods of inactivity began sending out malicious emails on Tuesday morning.Researchers with cybersecurity firms Codefense and Cryptolaemus, which track Emotet activity, both reported a sudden startup in the spamming from the botnet. And Palo Alto Networks' Unit 42 threat intelligence group tweeted about the new activity, with the researchers saying they had "also seen new #Emotet #malspam and the associated malware (inflated Word docs and inflated Emotet Dll files)." >> Full Article <<

2
TylerM
Administrator
15 days ago
M
New Member
MatthewZNew Member
asked in Community 101

Removing computers from the list of deactivated endpoints

Hello there, Is there a way to remove computers from Deactivated Endpoints list? I have found a thread about similiar subject from 9 years ago. It says that i need contact support . Was there any changes regarding this method in passing monthsl?

2
russell.harris
Popular Voice
16 days ago

Badges

  • Most Wanted
    jhartnerd123has earned the badge Most Wanted
  • Broadcast Boss
    ConnorMhas earned the badge Broadcast Boss
  • Hot Topic Hero
    ConnorMhas earned the badge Hot Topic Hero
  • News: Posted 50 topics!
    ConnorMhas earned the badge News: Posted 50 topics!
  • News: Posted 100 comments!
    TylerMhas earned the badge News: Posted 100 comments!
Show all badges

Join the Conversation

Terms & Conditions

© 2004 - Webroot Inc.

We have recently updated our Privacy Policies. We encourage you to read the full terms here.