Because of the vulnerability – which was addressed in November 2021 – an attacker only needed stolen credentials to access an organization’s Box account and steal sensitive data, provided that the account has SMS-based MFA enabled (which has long been proven insecure). Box, which claims that close to 100,000 companies use its platform, allows users…

Members of the hacker group, also known as Sodinokibi, have been charged with crimes in Russia, and its infrastructure has “been liquidated,” the public relations arm of Moscow’s FSB security agency told Russia’s Interfax news agency. The special operation, conducted by Russian authorities, was reportedly at the request of the United States. “The FSB of…

“[The] community is defined by those who show up and do the work. Companies that build open source into their products rarely participate in their continued maintenance,” the ASF said in a position paper published ahead of a high-level White House meeting on open-source software security. “Only a tiny percentage of downstream companies (reusing the…

The warning comes almost exactly one month after the first disclosure of a Log4j remote code execution vulnerability that threatens major damage on the internet and heightens the urgency for enterprise defenders to find and fix the issue. According to an advisory from NHS Digital, attackers are exploiting the critical vulnerability in the Apache Tomcat…

The latest financing was led by WestCap, with additional investment from Dave DeWalt’s NightDragon. It comes exactly one year after the company (previously known White Ops) was acquired by the Goldman Sachs merchant banking division. HUMAN Security sells technology capable of differentiating between bots and human transactions on the internet, protecting enterprises from fraudulent e-commerce…

Citizen Lab teamed up with the threat-intel team at Facebook parent company Meta to expose Cytrox alongside a handful of PSOAs (private sector offensive actors) in the murky surveillance-for-hire industry. In a detailed technical report published late Thursday, Citizen Lab said Cytrox is responsible for a piece of iPhone eavesdropping malware that was planted on…

The attacks targeted 35,000 devices in 195 countries between January and November 2021, including devices housed by high-profile organizations. Roughly seven percent of the targets were ICS, with the engineering and building automation sectors being most impacted. Attacks were also aimed at military industrial enterprises and research laboratories. In many cases, the attackers targeted engineering…