-
CrowdStrike is alerting about an unfamiliar threat actor attempting to capitalize on the Falcon Sensor update fiasco to distribute dubious installers targeting German customers as part of a highly targeted campaign. The cybersecurity company said it identified what it described as an unattributed spear-phishing attempt on July 24, 2024, distributing an inauthentic CrowdStrike Crash Reporter
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Progress Software is urging users to update their Telerik Report Server instances following the discovery of a critical security flaw that could result in remote code execution. The vulnerability, tracked as CVE-2024-6327 (CVSS score: 9.9), impacts Report Server version 2024 Q2 (10.1.24.514) and earlier. “In Progress Telerik Report Server versions prior to 2024 Q2 (10.1.24.709), a remote code
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Companies that used to sell pictures and pixels are selling analysis—and looking for ways to move faster.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
After years of declines, the jet’s cost is being pushed by upgrades, inflation, and a proposal to buy fewer of them.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Despite the service’s proposal to cut funding, “we have not received” word that 6th-gen plans have changed.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
A hacktivist entity known as USDoD has asserted that it has leaked CrowdStrike’s “entire threat actor list” and claims to possess the company’s “entire IOC [indicators of compromise] list,” which purportedly contains over 250 million data points.
Details of the Alleged Leak
On July 24, 2024, the USDoD group announced an English-language cybercrime forum, stating that they had obtained and leaked CrowdStrike’s comprehensive threat actor database.
The group provided a link to download the alleged list and shared sample data fields to substantiate their claims.
The leaked information reportedly includes:
- Adversary aliases
- Adversary status
- The last active dates for each adversary
- Region/Country of Adversary Origin
- Number of targeted industries and countries
- Actor type and motivation
Claim of the breach The sample data contained “LastActive” dates up to June 2024, while the Falcon portal’s last active dates for some actors extend to July 2024, suggesting the potential timeframe of the data acquisition.
Join our free webinar to learn about combating slow DDoS attacks, a major threat today.Cyber Press researchers stated that they were able to view some of the documents leaked.
Background on USDoD
USDoD has a history of exaggerating claims, likely to enhance its reputation within hacktivist and eCrime communities.
For example, they previously claimed to have conducted a hack-and-leak operation targeting a professional networking platform, which was later debunked by industry sources as mere web scraping.
Since 2020, USDoD has engaged in both hacktivism and financially motivated breaches, primarily using social engineering tactics.
In recent years, they have focused on high-profile targeted intrusion campaigns and have sought to expand their activities into administering eCrime forums.
USDoD also claimed to possess “two big databases from an oil company and a pharmacy industry (not from the USA).” However, the connection between these claims and the alleged CrowdStrike data acquisition remains unclear.
The potential leak of CrowdStrike’s threat actor database could have significant implications for cybersecurity:
- Compromise of ongoing investigations
- Exposure of tracking methods for malicious actors
- Potential advantage for cybercriminals in evading detection
This story unfolds following a CrowdStrike update that caused Windows machines to experience the Blue Screen of Death (BSOD) error.
CrowdStrike’s Response
CrowdStrike, a leading cybersecurity firm known for its threat intelligence and incident response services, has responded to the claims. The company stated:
“The threat intel data noted in this report is available to tens of thousands of customers, partners, and prospects – and hundreds of thousands of users. Adversaries exploit current events for attention and gain. We remain committed to sharing data with the community.”
While USDoD has been involved in legitimate breaches, its credibility in this specific case is questionable.
Their history of exaggeration, the inconsistencies in the leaked data, and CrowdStrike’s response all cast doubt on the authenticity and severity of the claimed leak.
Protect Your Business Emails From Spoofing, Phishing & BEC with AI-Powered Security | Free DemoThe post Threat Actors Claiming Leak of IOC list with 250M Data, CrowdStrike Responded appeared first on GBHackers on Security | #1 Globally Trusted Cyber Security News Platform.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
A North Korea-linked threat actor known for its cyber espionage operations has gradually expanded into financially-motivated attacks that involve the deployment of ransomware, setting it apart from other nation-state hacking groups linked to the country. Google-owned Mandiant is tracking the activity cluster under a new moniker APT45, which overlaps with names such as Andariel, Nickel Hyatt,
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Google Chrome has introduced a revamped download experience with comprehensive warnings about potentially malicious files.
This update is part of Chrome’s ongoing effort to keep users secure while interacting with downloaded content.
Last year, Google Chrome unveiled a redesigned downloads interface on desktops, designed to make it easier for users to manage their recent downloads. This new interface offers a more flexible and spacious UI and provides a platform for enhanced security features.
The redesign allows Chrome to deliver more detailed and nuanced warning messages, helping users make informed decisions about their downloads.
Adding Context and Consistency to Download Warnings
According to the Google blog reports, With the additional space in the new downloads UI, Chrome has replaced its previous warning messages with more detailed ones.
These messages now offer better context about the nature of the threat, enabling users to understand the risks more clearly.
Our legacy, space-constrained warning vs. our redesigned one. The warnings are part of a two-tier system based on AI-powered malware verdicts from Google Safe Browsing:
- Suspicious Files: These carry a lower confidence verdict and an unknown risk of user harm.
- Dangerous Files: These have a high confidence verdict and a high risk of user harm.
Join our free webinar to learn about combating slow DDoS attacks, a major threat today.The two types of warnings are differentiated by iconography, color, and text, making it easier for users to quickly assess the threat level and decide on the appropriate action.
Differentiation between suspicious and dangerous warnings
Protecting More Downloads with Automatic Deep Scans
For users who have opted into the Enhanced Protection mode of Safe Browsing in Chrome, there is an additional layer of security.
These users are prompted to send the contents of suspicious files to Safe Browsing for deep scanning before opening the file.
This process has proven highly effective, catching new malware and dangerous files that Safe Browsing has not previously encountered. Files sent for deep scanning are over 50 times more likely to be flagged as malware than the average download.
An automatic deep scan resulting in a warning To streamline this process and reduce user friction, Chrome performs automatic deep scans for Enhanced Protection users rather than prompting each time.
Staying Ahead of Attackers Who Hide in Encrypted Archives
A current trend among attackers is distributing malware in encrypted archives, such as .zip, .7z, or .rar files, which are protected by passwords. This method hides the file contents from Safe Browsing and other antivirus detection scans.
Enter a file password to send an encrypted file for a malware scan To counter this, Chrome has introduced two protection mechanisms based on the user’s Safe Browsing mode:
- Enhanced Protection Mode: Users are prompted to enter the file’s password and send it along with the file to Safe Browsing for a deep scan. The uploaded files and passwords are deleted shortly after scanning.
- Standard Protection Mode: Users are still prompted to enter the file’s password, but in this case, both the file and the password remain on the local device. Safe Browsing checks only the metadata of the archive contents.
Collaborating for Better Security
The Chrome Security team collaborates closely with Google Safe Browsing, Google’s Threat Analysis Group, and security researchers worldwide.
This collaboration helps Chrome stay ahead of attackers by continuously adapting its product strategy based on the latest insights into attack techniques.
Google Chrome’s new download warnings and enhanced security measures represent a significant step in protecting users from malicious files.
By providing more detailed warnings and leveraging AI-powered malware detection, Chrome is helping users make safer choices and stay protected online.
As attackers continue to evolve their methods, Chrome remains committed to enhancing its security features and keeping users safe. By incorporating these advanced security measures, Google Chrome sets a new standard for user safety in the digital age.
Stay tuned for more updates as Chrome continues to innovate and improve its security protocols.
Protect Your Business Emails From Spoofing, Phishing & BEC with AI-Powered Security | Free DemoThe post Google Chrome Warns of Malicious Files While Downloading appeared first on GBHackers on Security | #1 Globally Trusted Cyber Security News Platform.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
While the specifics for security testing vary for applications, web applications, and APIs, a holistic and proactive applications security strategy is essential for all three types. There are six core types of testing that every security professional should know about to secure their applications, regardless of what phase they are in in development or deployment. In this article, we will
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
CYBERSECURITY / DEFENSE / INTELLIGENCE
