Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

A browser hijacker is a type of malware that infects an internet browser. When your Internet browser becomes infected, it’s done without your knowledge or consent so you may not even notice it’s there until it’s too late. Typically, browser hijackers are used by cybercriminals to redirect users to malicious websites for financial gain, but they can also be used to gather your personal information and spy on your online activity.

With the growing volume of data and increasing cost of breaches, organizations must find ways to manage and protect their ever-expanding datasets. To address this escalating threat landscape, Rubrik and CrowdStrike have joined forces to redefine cyber defense, with several integration points between our platforms. This partnership is not about bolting on more security tools; rather, it's about gaining more leverage out of what customers already have.

Cyber attacks at government organizations are prevalent in 2024, as the government continues to be one of the most targeted sectors. Research by IT Governance has found that in January alone there have been 183 incidents in the public sector, including both ransomware attacks and data breaches. Cybercriminals target government agencies because they store valuable personal data and perform critical functions and services.

Cybersecurity threats loom large over businesses across various sectors. Cyberattacks may lead to data breaches, operational disruptions, monetary loss, reputational loss, and other negative impacts. The first step to preventing cyberattacks is identifying possible threats. The list of threats mainly depends on your industry and the types of data you store.

New data shows increased expertise in leveraging and exploiting cloud environments. CrowdStrike’s 2024 Global Threat Report shows that targeted attacks on cloud environments have increased, signaling that the cybercrime economy has realized the “untapped market” of the cloud environment.

All industries are at risk of credential stuffing and account takeover (ATO) attacks. However, some industries are at a greater risk because of the sensitive information or volume of customer data they possess.

It’s no secret that the manufacturing industry has found themselves in the crosshairs of threat actors in recent years. With a low tolerance for downtime, international operational footprints, and servers full of valuable information, these organizations represent riches for ransomware gangs and individual hackers alike.

As humans, we tend to trust the people around us in most situations simply by default. We usually don’t assume that the cook in a restaurant will poison our food or that the pharmacist will intentionally swap our medications, and for good reason. One of humanity’s superpowers, which allows all civilization to function, is cooperation. Being suspicious of everyone around you isn’t only exhausting, but it grinds society to a halt.

Serialization is the process of converting data structures or object states into a format that can be easily stored, transmitted, or reconstructed later. While serialization facilitates data maintenance and communication between different systems, it also introduces security risks. Serialization attacks exploit vulnerabilities in the serialization process to manipulate data, execute arbitrary code, or gain unauthorized access to systems.

Clickjacking, also known as UI redress attack or user interface (UI) manipulation, is a malicious technique used to trick users into clicking on elements of a web page without their knowledge or consent. By overlaying transparent or opaque layers on legitimate web content, attackers can trick users into performing unintended actions, such as clicking on hidden buttons or links.

An addition to the A10 Defend suite has arrived. A10 Defend Threat Control, a necessary and proactive DDoS intelligence SaaS platform, is here to establish and amplify your holistic DDoS defense system. Backed by A10’s proprietary “zero-atrophy” data gathering and validation method, Threat Control provides actionable insights and proactively establishes a first layer of defense for your DDoS protection needs.

Supply chain attack is a kind of cyberattack which targets the network that is made up of suppliers, vendors, contractors and other business partners that organizations rely on to provide goods and services. As opposed to directly attacking a target organization’s systems or infrastructure, attackers use supply chain vulnerabilities to gain unauthorized access or compromise the integrity of products or services.

Denial of service attacks pose a significant threat to online services, with the power to disrupt and disable critical operations. This guide uncovers the numerous tactics attackers use, the motivations behind their malicious activities, and provides actionable strategies to fortify your network against these insidious threats.

DDoS attacks affect millions of websites every day. AppTrana blocked over 4.25 million DDoS attacks on 709 websites in 2023. Indusface continues to observe a steady flow of DDoS attempts against customers: DDoS attack trends – The State of Application Security, 2023 No business is safe. How can you protect your business against DDoS? DDoS attack mitigation solution is the best weapon to protect your business against the attack.

Social engineering and phishing are involved in 70% to 90% of all successful cybersecurity attacks. No other initial root hacking cause comes close. This is not a recent development. Social engineering has been the number one type of attack since the beginning of networked computers. Despite this long-time fact, most organizations do not spend 3% of their IT/IT Security budget to fight it.

Arctic Wolf has recently observed an uptick in detected password spraying for multiple Firewall and VPN appliances. This activity began on February 28, 2024. A variety of products are affected by this activity, including but not limited to devices from vendors such as Cisco, Palo Alto Networks, and WatchGuard. Further investigation revealed that authentication against web-based applications in general was being targeted as opposed to a selection of firewall vendors.

With QR-code phishing attacks on the rise, new data sheds light on just how unprepared organizations actually are in stopping and detecting these device-shifting attacks. One of the challenges with attacks is that we rely on security solutions to look for indicators of malicious intent. Content within an email, where a link points to, and the insides of an attachment can indicate potential foul play.

Since the discovery of CRIME, BREACH, TIME, LUCKY-13 etc., length-based side-channel attacks have been considered practical. Even though packets were encrypted, attackers were able to infer information about the underlying plaintext by analyzing metadata like the packet length or timing information. Cloudflare was recently contacted by a group of researchers at Ben Gurion University who wrote a paper titled “What Was Your Prompt?

We’re back again with a monthly-ish blog reflecting on major goings on in the security world. I am writing the first draft on the rarest of holidays, leap day1! February gets extended by a day every four years, and if we had to guess Ivanti wishes this month would end.

The attacks are ongoing as of this writing. Here are a few screenshots of data and some insight. I’ll make sure to keep it brief since you have seen this news in various outlets.

On February 2, the popular remote access tool AnyDesk disclosed that it had suffered a cyberattack that had compromised its production systems. Although AnyDesk has not revealed specific details about the root cause of the attack, the measures taken to mitigate it, such as mandatory password resets and code signing certificate renewals, suggest that cybercriminals gained access to user passwords and the company's code signing certificate.

Every year, millions of people get victimized by data breaches. Criminals steal their data from the network environments of organizations, vendors, providers, institutions, and governments; with ever-increasing frequency, cybercriminals are making big moves in the cyber wars—and making billions of dollars.

The Sysdig Threat Research Team (TRT) discovered a malicious campaign using the blockchain-based Meson service to reap rewards ahead of the crypto token unlock happening around March 15th. Within minutes, the attacker attempted to create 6,000 Meson Network nodes using a compromised cloud account. The Meson Network is a decentralized content delivery network (CDN) that operates in Web3 by establishing a streamlined bandwidth marketplace through a blockchain protocol.

Kerberoasting is a form of cyber attack that targets service accounts using the Kerberos authentication protocol. Attackers exploit the authentication protocol to extract password hashes and crack the plaintext passwords attached to the account. These attacks are prevalent because they can be difficult to notice and mitigate.

Cybercriminals are always on the lookout for vulnerabilities to exploit and steal sensitive information. One such threat is credential stuffing, a type of cyberattack that can cause significant damage to both individuals and businesses. Credential stuffing is a cyberattack that involves the use of stolen account credentials to gain unauthorized access to user accounts on other systems.

In this blog, we will demonstrate how Zeek’s metadata approach can help focus patching efforts related to the recent SSH “Terrapin” attack. One of the interesting aspects to bear in mind as you read this is that Zeek provides visibility of the vulnerable elements of this encrypted protocol, and thus serves as a reminder that network monitoring is still very much relevant, even in a heavily encrypted world.

We're proud to introduce the Advanced DNS Protection system, a robust defense mechanism designed to protect against the most sophisticated DNS-based DDoS attacks. This system is engineered to provide top-tier security, ensuring your digital infrastructure remains resilient in the face of evolving threats. Our existing systems have been successfully detecting and mitigating ‘simpler’ DDoS attacks against DNS, but they’ve struggled with the more complex ones.

The Marvin Attack, named after the vulnerability it exploits, poses a significant threat to systems relying on RSA encryption and signing operations. It's a variation of the Bleichenbacher attack, which exploits errors in PKCS #1 v1.5 padding to perform adaptive-chosen ciphertext attacks. The attack leverages timing information obtained from RSA encryption or signing operations.

New analysis of DNS queries shows material growth in phishing, malware and botnets and offers insight into how many threats the average person experiences. Most of the reports I cover use detection on an endpoint, a security solution, or the corporate network for their analysis, but the 2024 Annual Security Report from DNSFilter feels a bit more impartial because it uses DNS queries to determine whether whether malicious activity is occuring.

A ransomware attack can demoralize or debilitate organizations quite like no other. Not only does ransomware strike a company's morale, but it also causes massive financial losses along with reputational damage that could prove difficult to repair. Cybersecurity Ventures predicted global ransomware damage costs to reach $20 billion annually in 2021, up from $325 million in 2015. In eight years from now, the costs will exceed $265 billion.

In a bold move aimed at raising awareness and protest against the pro-Ukrainian stance of the Polish authorities, the notorious NoName hacking group launched a series of cyber attacks targeting critical infrastructure in Poland. The group's motive was clear - to disrupt transportation services and infrastructure to show solidarity with Polish farmers' plight. Who is NoName hacking group and what is their motive?

Brand impersonation attacks are a type of phishing attack where a scammer pretends to be a trusted company or brand. The goal is to trick victims into believing they're interacting with the company so they'll be more willing to share their personal information. Brand impersonation attacks can target both individuals and large groups of people. Scammers may use phony websites, mobile apps, or social media pages, as well as bogus emails, voicemails, or text messages.

In the intricate realm of cybersecurity, the relentless surge of cyber threats demands a constant reassessment of defensive strategies. Amidst this dynamic landscape, a subtle yet indispensable player takes center stage — Security Configuration Management (SCM). This blog embarks on an insightful journey into the critical role played by SCM in the ongoing battle against cyberattacks, shedding light on its ability to pinpoint and rectify system misconfigurations.

In today's expanding cyber threat landscape, infiltrating a system goes beyond unauthorized access or malware installation. To achieve their ultimate objectives, cybercriminals need to maintain an undetected presence in the system or network to control or extract data according to their needs. Command and Control attacks, also known as C&C or C2 attacks, create a covert link between the compromised system and a C2 server.

A brute-force attack is a trial-and-error method hackers use to guess login information, and encryption keys, or find hidden web pages. In a brute force attack, an attacker tries as many combinations as possible, systematically incrementing through all possibilities until the correct password is discovered. This can be done manually, but it is usually automated using specialized software tools designed for this purpose.

Azure customers are facing the biggest threat to their privileged accounts. A cybersecurity firm has identified the spread of a new phishing campaign aimed at privileged users like sales directors, account managers, finance managers, vice presidents, presidents, chief financial officers, and CEOs. The campaign’s first set of attacks started around November 2023 and is still a looming threat. The good thing is that you can safeguard against and mitigate this attack.

Analysis of the second half of 2023 shows attackers are getting more aggressive with email-based phishing attacks in both frequency and execution. Until there’s a catch-all way to stop malicious emails from being an effective means of initial attack, phishing will continue to grow as the primary initial attack vector for cybercriminals.

Password spraying and credential stuffing have a lot in common, but the main difference is in the way the attack is executed. With credential stuffing, the cybercriminal already has a set of verified login credentials, whereas, with password spraying, the cybercriminal has to guess the login credentials by matching a list of usernames with a commonly used password.