Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

CrowdStrike

The Anatomy of an ALPHA SPIDER Ransomware Attack

Feb 29, 2024 By Jean-Philippe Teissier In CrowdStrike
Over the last two years, CrowdStrike Services has run several incident response (IR) engagements — in both pre- and post-ransomware situations — in which different ALPHA SPIDER affiliates demonstrated novel offensive techniques coupled with more commonly observed techniques. The events described in this blog have been attributed to ALPHA SPIDER affiliates by CrowdStrike Counter Adversary Operations.
Read Post
ionix

How to prevent credential stuffing in 3 steps (e.g. naz.API)

Feb 28, 2024 By Moran Alony In IONIX
Credential stuffing is a cyberattack method where attackers use lists of compromised user credentials to breach into a system. These credentials, often obtained from previous data breaches and available on various dark web forums, include combinations of usernames, email addresses, and passwords.
Read Post
keeper

How Is Ransomware Delivered?

Feb 28, 2024 By Aranza Trevino In Keeper
Some of the most common ways ransomware is delivered are through phishing emails, drive-by downloads, exploit kits and RDP exploits. According to Malwarebytes’ 2024 State of Malware report, in 2023 the number of known ransomware attacks increased by 68% from the previous year. The report also found that the largest ransom demanded in 2023 was $80 million.
Read Post

Account Takeover Attack Live Simulation

Feb 28, 2024 By Indusface In Indusface
Account takeover attacks have increased by 354% y-o-y in 2023. What’s worse? It takes 11 months to solve an ATO breach. By that time, attackers would have laterally traversed your entire digital infrastructure, including databases. So, how do you protect your organisations against sophisticated ATO attacks that even bypass 2FA? In this live attack simulation, Karthik Krishnamoorthy (CTO) and Vivekanand Gopalan (VP of Products) demonstrate various ways in which account takeover can happen, along with practices to protect your websites and APIs against ATO attacks.
View Video
keeper

Seven Types of Spoofing Attacks and How To Avoid Them

Feb 27, 2024 By Tim Tran In Keeper
Cybercriminals often use spoofing attacks to disguise themselves as a familiar face or legitimate business to trick people into revealing sensitive information. They use a variety of techniques such as creating fake websites or emails. Some of the different types of spoofing attacks include call spoofing, email spoofing, website spoofing and IP spoofing. Continue reading to learn more about spoofing attacks, the seven common types of spoofing attacks and how to stay protected from them.
Read Post
datadog

Monitor network attacks with Google Cloud Armor and Datadog

Feb 27, 2024 By Addie Beach In Datadog
Network security services like Google Cloud Armor enable you to filter incoming traffic so that you can prevent attacks from overwhelming your system or from reaching critical components of your application. However, these services often handle threats automatically, making it difficult to gain visibility into attempted security breaches.
Read Post
11:11 systems

Did you leave your front door open? Why cyberattacks surge using valid credentials

Feb 26, 2024 By Scott Gray In 11:11 Systems
Have you ever been locked out of the house? Maybe you forgot your keys on the kitchen table, lost them running errands, or unknowingly dropped them while attempting the It doesn’t matter how you got locked out, or how you got back in. What’s more important, for the purposes of this thought exercise, at least, is how you responded.
Read Post
knowbe4

Nearly One in Three Cyber Attacks In 2023 Involved The Abuse of Valid Accounts

Feb 23, 2024 By Stu Sjouwerman In KnowBe4
Thirty percent of all cyber incidents in 2023 involved abuse of valid credentials, according to IBM X-Force’s latest Threat Intelligence Index. This represents a seventy-one percent increase compared to 2022. “One of the top initial access vectors in 2023—jumping from third to first place— was the abuse of valid accounts identified in 30% of the observed incidents X-Force responded to,” the researchers write.
Read Post
memcyco

Top 11 Website Security Software Solutions for 2024

Feb 22, 2024 By Ori Mazin In Memcyco
It’s surprising how much website security today is often lacking, even across major and popular sites. Needless to say, such security gaps leave businesses vulnerable to hackers, viruses, and other cyber threats. Consider this: A recent brand impersonation fraud campaign targeted over 100 popular apparel brands with a vast network of 3,000+ spoofed brand websites.
Read Post
knowbe4

QR-Code Attacks Target the C-Suite 42 Times More than Standard Employees

Feb 21, 2024 By Stu Sjouwerman In KnowBe4
QR-code attacks leveraging QR-codes are kicking into high gear and becoming a common method used in phishing attacks, according to new data from Abnormal Security. We saw a surge in QR-code based phishing attacks late last year. And new data in security vendor Abnormal Security’s H1 2024 Email Threat Report gives us some additional insight into how these attacks are being executed.
Read Post
SecurityScorecard

Chinese Hacking Group Targets US Critical Infrastructure

Feb 20, 2024 By SecurityScorecard In SecurityScorecard
Earlier this month, the FBI and the Cybersecurity and Infrastructure Security Agency (CISA) issued a joint warning that the hacking group known as “Volt Typhoon” has been lurking in US critical infrastructure systems for at least five years.
Read Post
indusface

Web Browser-Based Attacks - Types, Examples, and Prevention

Feb 20, 2024 By Indusface In Indusface
Web browsers are now essential for any business, offering a convenient window to websites and a single platform for accessing content. However, this convenience comes at the cost of browser security. 95% of undetectable malware is spread through web browsing. Even more alarming is that browse-borne malware costs organizations an average of $ 3.2M. So, how do you protect your end-users from these attacks?
Read Post
Snyk

Preventing SQL injection attacks in Node.js

Feb 20, 2024 By Lucien Chemaly In Snyk
As reliance on software systems continues to grow, so does the emergence of numerous security threats. One notable threat for developers, especially those working with Node.js, is SQL injection. SQL injection is a malicious attack where nefarious SQL code is injected into a system, exposing sensitive information, corrupting or deleting data, and sometimes, granting unauthorized access to attackers.
Read Post
Featured Post
a10 networks

How Telecommunications Providers Can Best Tackle DDoS Attacks

Feb 19, 2024 By Terry Young, Director of Service Provider Product Marketing In A10 Networks
The UK's 2023 National Risk Register, published by the government in the summer, highlights the increasing cyberthreat posed to telecommunications providers who are a vital part of the communications critical national infrastructure (CNI) sector. The report lays out the volatile landscape these providers operate in and the government's acknowledgement of the seriousness of cyber threats to telecommunications infrastructure. It also details the difficulty in implementing the Telecommunications (Security) Act 2021, which establishes guidelines for telcos to follow.
Read Post
knowbe4

Only 7% of Organizations Can Restore Data Processes within 1-3 Days After a Ransomware Attack

Feb 19, 2024 By Stu Sjouwerman In KnowBe4
New data on how organizations are able to respond to ransomware attacks also shows that paying a ransom is highly likely, despite having a policy of “Do Not Pay.” New research from security vendor Cohesity says organizations are overconfident in their ability to recover from a ransomware attack. According to the data: And even if you do have an outstanding recovery plan, when’s the last time you tested it?
Read Post
Featured Post
ThreatQuotient

Leveraging Threat Intelligence for Regulatory Compliance

Feb 16, 2024 By Cyrille Badeau, Vice-President International Sales In ThreatQuotient
The US Government recently announced that state-sponsored Chinese cyber group Volt Typhoon has compromised multiple critical infrastructure organisations' IT networks in the US and is preparing "disruptive or destructive cyber attacks" against communications, energy, transport, water and waste water systems. The announcement, which was supported by national cybersecurity agencies in Australia, Canada, UK, and New Zealand, is a sobering reminder that modern life relies on digital networks. From healthcare, banking, and socialising, to energy, water, local and national government - everything has a digital aspect.
Read Post
elastic

Strengthening small utilities: The power of public-private partnership

Feb 16, 2024 By Bill Wright In Elastic
In the wake of recent cyber attacks against US water utilities, the vulnerability of local entities dependent on operational technology (OT) has been starkly highlighted. This danger was further emphasized last week when Congress held a hearing titled Securing Operational Technology: A Deep Dive into the Water Sector. Witnesses at the hearing painted a stark picture of the significant cybersecurity risks facing small utility companies today.
Read Post
Forescout

Department of Justice disrupts Moobot botnet commandeered by Russian APT28: analysis of attacks against routers and malware samples

Feb 16, 2024 By Forescout Vedere Labs In Forescout
On February 15, the US Department of Justice announced “Operation Dying Ember”: the takedown of a botnet controlled by APT28, the Russian military cyber threat actor also known as Fancy Bear. APT28 was previously known for developing the VPNFilter botnet, which targeted routers and network attached storage devices and was also disrupted by the DoJ in 2018.
Read Post
manageengine

Top tips: Four ways to protect your organization from increasingly advanced social engineering attacks

Feb 15, 2024 By General In ManageEngine
Top tips is a weekly column where we highlight what’s trending in the tech world and list ways to explore these trends. This week we’re looking at four ways you can protect yourself from increasingly advanced social engineering attacks.
Read Post
idstrong

National Vascular Care Provider Confirms Cyber Attack; 348k Exposures

Feb 15, 2024 By Steven In IDStrong
Azura Vascular Care operates a national network of health and wellness centers. They specialize in minimally invasive procedures and strive to treat vascular conditions in comfortable, out-patient settings. They offer healthcare in 25 states with multiple facilities and specialized teams. At the end of last year (2023), Azura discovered a threat actor within their network environment; officials removed the threat, but not before the criminals obtained 348k patient records.
Read Post
Trustwave

Lessons to be Learned: Attacks on Higher Education Proliferate

Feb 15, 2024 By Trustwave In Trustwave
Trustwave SpiderLabs is wrapping up a multi-month investigation into the threats facing the education sector, across higher education, primary and secondary schools. Trustwave will post the 2024 Education Threat Landscape: Trustwave Threat Intelligence Briefing and Mitigation Strategies report on February 22, but here are a couple of early findings along with a round-up of some of the higher-profile attacks on education targets that have taken place in the last year.
Read Post
netskope

Defending Against OAuth App-Based Attacks on Enterprise SaaS

Feb 13, 2024 By Dev CK In Netskope
The phenomenal growth in the adoption of software as a service (SaaS) has prompted enterprises of all sizes to move their critical data to SaaS-based applications. And as attackers tend to follow data to induce a breach, their new area of focus is enterprise SaaS. The recent Midnight Blizzard attack by nation-state actors clearly reinforces the fact that this trend has only just begun.
Read Post

#101 - WiFi attacks and defense with Lennart Koopmann, Founder of the Nzyme Network Defense System

Feb 13, 2024 By LimaCharlie In LimaCharlie
In this episode of The Cybersecurity Defenders Podcast, we take a close look at WiFi attack methods, and the defenses to them, with Lennart Koopmann, Founder of the Nzyme Network Defense System. Lennart Koopman, a tech enthusiast originally from Germany, now calling Houston, TX home. He began coding at a young age and chose to forgo formal education, diving straight into the world of computers after high school.
View Video
knowbe4

Security Teams Spend 71 Hours Responding to Every One Hour in a Cyber Attack

Feb 12, 2024 By Stu Sjouwerman In KnowBe4
New data sheds light on what kinds of cyber attacks are targeting your cybersecurity team, what it’s costing them, why it’s taking so much time to fix, and where you should focus resources. Barracuda’s Cybernomics 101 report provides a lot of insight into the current economics of cyber attacks. According to the report: The average largest ransom any organization paid is $1.38 million, with an average cost of $5.34 million to respond to compromises!
Read Post
Arctic Wolf

PRC State-Sponsored Threat Actors (Volt Typhoon) Target Critical Infrastructure Entities

Feb 9, 2024 By Andres Ramos In Arctic Wolf
On February 7, 2024, CISA issued an advisory detailing their discoveries concerning state-sponsored cyber actors linked to the People’s Republic of China (PRC). Notably, the PRC-affiliated threat actor, Volt Typhoon, is actively engaged in efforts to infiltrate IT networks, with the potential aim of launching cyber attacks on vital U.S. infrastructure in the event of a substantial crisis or conflict with the United States.
Read Post
knowbe4

Browser-Based Phishing Attacks Increase 198%, With Evasive Attacks Increasing 206%

Feb 9, 2024 By Stu Sjouwerman In KnowBe4
A new report shows massive increases in browser attacks in the second half of 2023, with over 31,000 threats specifically designed to bypass security solution detection. I spend a lot of time on this blog talking about phishing, social engineering, smishing, deepfakes and more – all topics centered around attack techniques designed to interact and fool a user.
Read Post
cyberark

APT29's Attack on Microsoft: Tracking Cozy Bear's Footprints

Feb 8, 2024 By Andy Thompson In CyberArk
A new and concerning chapter has unfolded in these troubled times of geopolitical chaos. The Cozy Bear threat actor has caused significant breaches targeting Microsoft and HPE, and more are likely to come. These recent events have sent shockwaves throughout the tech community, and for good reason. As we continue to uncover the fallout from these breaches, it has become apparent that the magnitude of the incident is more significant than we first realized.
Read Post
Arctic Wolf

AnyDesk Confirms Unauthorized Access to Production Systems

Feb 6, 2024 By Stefan Hostetler In Arctic Wolf
On February 2, 2024, AnyDesk confirmed a compromise of its production systems in a security advisory, leading the company to revoke all security-related keys, including the cryptographic code-signing certificate used to publish their software. As an additional precaution, AnyDesk also reset user passwords on the AnyDesk web portal. AnyDesk has started using a new code signing certificate as of AnyDesk version 8.0.8.
Read Post
netacea

Anyone Can Launch a Bot Attack in 2024

Feb 6, 2024 By Alex McConnell In Netacea
Netacea is a noted vendor in a new Forrester report, The Bot Management Software Landscape, Q1 2024. The report provides important independent research into the evolution of automated attacks threatening businesses in the coming year, and how bot management solutions are positioned to defend against them. The main trend cited in the report is that now, anyone can launch a sophisticated bot attack.
Read Post
centripetal

Security Bulletin: AnyDesk Production Systems Breach

Feb 6, 2024 By Lauren Farrell In Centripetal
On February 2nd, 2024, AnyDesk disclosed that their production systems had been compromised and that private code signing keys and source code were stolen, while an unknown number of user accounts had their passwords reset. This is a significant concern, as it would allow a malicious attacker to generate malicious versions of AnyDesk software with compromised code that appears to be legitimate. It is assessed that approximately 18,000 credentials are available for sale on the Dark Web as a result.
Read Post
knowbe4

Synthetic Data: The New Frontier in Cyber Extortion

Feb 6, 2024 By Martin Kraemer In KnowBe4
Organizations are increasingly facing cyber attacks resulting in data breaches, and part of their post-incident responsibilities includes adhering to mandatory reporting requirements. Notably, the infamous BlackCat ransomware group has been exploiting these requirements for their benefit. They apply pressure on victims by threatening to inform the Securities and Exchange Commission (SEC) about the company's supposed failure to report significant data breaches.
Read Post
idstrong

Orthopaedic Surgeon Group Breached by Vendor Cyberattack; 307k Exposed

Feb 6, 2024 By Steven In IDStrong
Des Moines Orthopaedic Surgeons, P.C. (DMOS) has three clinics throughout Iowa’s capital; they offer comprehensive solutions for ortho-care, from joints to extremities and MRI imaging to outpatient surgery. DMOS utilizes a variety of third-party vendors to serve their patients and the surrounding regions; almost a year ago, DMOS experienced a cybersecurity event through one of these vendors. The unauthorized actors broke into their system and compromised the information of 307,864 individuals.
Read Post
SecurityScorecard

DDoS Attacks: What You Need To Know

Feb 6, 2024 By SecurityScorecard In SecurityScorecard
In the intricate web of digital security threats, one particularly disruptive technique stands out: the Distributed Denial of Service (DDoS) attack. This form of cyber assault involves numerous compromised systems, often referred to as bots or zombies, which are used to overwhelm a target website with an avalanche of requests. The result? Legitimate users find themselves unable to access the site, leading to significant operational disruptions.
Read Post
CrowdStrike

CrowdStrike Defends Against Azure Cross-Tenant Synchronization Attacks

Feb 5, 2024 By Manoj Ahuje - Matt Johnston In CrowdStrike
As Microsoft Azure continues to gain market share in the cloud infrastructure space, it has garnered attention from adversaries ranging from hacktivist and eCrime threat actors to nation-state adversaries. Recent attacks on Microsoft by cloud-focused threat actors like COZY BEAR are becoming more frequent and garnering huge attention.
Read Post

Network Analytics Logs: Using Splunk to view network traffic and DDoS attacks

Feb 2, 2024 By Cloudflare In Cloudflare
Cloudflare Magic Transit is a network security solution that offers DDoS protection, traffic acceleration, and much more from every Cloudflare data center— for on-premise, cloud-hosted, and hybrid networks. In this video, we show how to integrate Cloudflare Network Analytics logs to view network traffic and DDoS attacks in your Splunk dashboard.
View Video
fireblocks

How to protect your business from NFT phishing attacks and spam

Feb 1, 2024 By Fireblocks In Fireblocks
The Web3 ecosystem has experienced a sharp increase in spam NFTs. While spam NFTs may seem benign – commonly used as promotions for new NFT collections – they can also be used as a method for phishing unsuspecting users. Today, threat actors are using spam NFTs to drain wallets in a variety of ways. In this blog post, we take a closer look at some of these methods and the new security protections Fireblocks has developed to safeguard our customers.
Read Post
knowbe4

Microsoft Teams: The New Phishing Battlefront - How Attackers Are Exploiting Trusted Platforms

Feb 1, 2024 By Stu Sjouwerman In KnowBe4
Attackers are abusing Microsoft Teams to send phishing messages, according to researchers at AT&T Cybersecurity. “While most end users are well-acquainted with the dangers of traditional phishing attacks, such as those delivered via email or other media, a large proportion are likely unaware that Microsoft Teams chats could be a phishing vector,” the researchers write.
Read Post

Deloitte & Memcyco Exclusive Panel: The Untold Cost of website and SSO impersonation attacks

Feb 1, 2024 By Memcyco In Memcyco
Cyber iCON 2024: Event sponsor, Memcyco, and host, Deloitte, present their cybersecurity partnership and market offering that will redefine what “cyber threat intelligence” can and should mean. Alongside exclusively invited partners, they’ll be sharing expert insight and stunning innovations in digital domain protection. This will be a unique platform for industry leaders hungry to fortify cyber threat defenses and exchange ideas while discovering breakthrough strategies and technologies.
View Video

Copyright © 2026 OpsMatters™. All rights reserved.