Blog
How to spot a North Korean agent before they get comfy inside payroll
Mandiant publishes cheat sheet for weeding out fraudulent IT staff Against a backdrop of rising exposure to North Korean agents seeking (mainly) US IT roles, organizations now have a cheat sheet to help spot potential operatives.…
A data leak and a data breach
How to protect personal data Partner Content For people who haven't personally experienced them, terms like data leak or data breach may seem unfamiliar and foreign - much like visiting a new destination abroad.…
Some US Kaspersky customers find their security software replaced by ‘UltraAV’
Back story to replacement for banned security app isn't enormously reassuring Some US-based users of Kaspersky antivirus products have found their software replaced by product from by a low-profile entity named "UltraAV" – a change they didn't ask for, and which has delivered them untested and largely unknown…
Telegram will now hand over IP addresses, phone numbers of suspects to cops
Maybe a spell in a French cell changed Durov's mind In a volte-face, Telegram CEO Pavel Durov announced that the made-in-Russia messaging platform will become a lot less cozy for criminals.…
So how’s Microsoft’s Secure Future Initiative going?
34,000 engineers pledged to the cause, but no word on exec pay Microsoft took a victory lap today, touting the 34,000 full-time engineers it has dedicated to its Secure Future Initiative (SFI) since it launched almost a year ago and making public its first progress report on efforts…
UPS supplier’s password policy flip-flops from unlimited, to 32, then 64 characters
That 'third party' person sure is responsible for a lot of IT blunders, eh? A major IT hardware manufacturer is correcting a recent security update after customers complained of a password character limit being introduced when there previously wasn't one.…
Move over, Cobalt Strike. Splinter’s the new post-exploit menace in town
No malware crew linked to this latest red-teaming tool yet Attackers are using Splinter, a new post-exploitation tool, to wreak havoc in victims' IT environments after initial infiltration, utilizing capabilities such as executing Windows commands, stealing files, collecting cloud service account info, and downloading additional malware onto victims'…
US indicts two over socially engineered $230M+ crypto heist
Just one victim milked of nearly a quarter of a billion bucks Two individuals are in cuffs and facing serious charges in connection to a major theft of cryptocurrency worth more than $230 million from a single victim.…
Ivanti patches exploited admin command execution flaw
Fears over chained attacks affecting EOL product The US Cybersecurity and Infrastructure Security Agency (CISA) just added the latest Ivanti weakness to its Known Exploited Vulnerability (KEV) catalog, a situation sure to annoy some – given that it's yet another path traversal flaw.…
Cybercrooks strut away with haute couture Harvey Nichols data
Nothing high-end about the sparsely detailed, poorly publicized breach High-end British department store Harvey Nichols is writing to customers to confirm some of their data was exposed in a recent cyberattack.…