Author: Jai Vijayan Contributing Writer

Organizations that don’t implement end-to-end HTTP/2 are vulnerable to attacks that redirect users to malicious sites and other threats, security researcher reveals at Black Hat USA.

Organizations that don’t implement end-to-end HTTP/2 are vulnerable to attacks that redirect users to malicious sites and other threats, security researcher reveals at Black Hat USA.

DOJ indicts four Chinese individuals for alleged role in attacks targeting intellectual property, trade secrets belonging to defense contractors, maritime companies, aircraft service firms, and others.

Many organizations remain unprepared to detect, respond, and contain a breach, a new survey shows.

Eradicating ‘privileged intruders’ from the network in the aftermath of an attack poses major challenges, experts say.

Organizations should apply principles of least privilege to mitigate threats, security researcher says.

Ten years of passive DNS data shows classic TLDs such as .com and .net dominate newer TLDs in popularity and use, new report says.

Hardware maker has issued an update to fix multiple critical privilege escalation vulnerabilities that have gone undetected since 2009.

UNC2447 observed targeting now-patched vulnerability in SonicWall VPN.

Ironically, EDR’s success has spawned demand for technology that extends beyond it.

Several gigabytes of sensitive data stolen from one restricted network, with organizations in more than 12 countries impacted, Kaspersky says.

LazyScript bears similarities to some Middle Eastern groups but appears to be a distinct operation of its own, Malwarebytes says.

The tactic makes it much harder for defenders to take down botnets via sinkholing and other standard techniques, Akamai says.

FireEye Mandiant says it discovered data stolen via flaw in Accellion FTA had landed on a Dark Web site associated with a known Russia-based threat group.

In a nearly 200-page document, company offers a detailed overview of Secure Enclave and multiple other security controls in Apple silicon-based Macs and other platforms.

FBI, CISA, and Treasury Department also release details about North Korean malware used in cryptocurrency thefts since 2018.

The third stage, when threat actors rush to use stolen usernames and password pairs in credential-stuffing attacks, is the most damaging for organizations, F5 says.

Consumer banks, exchanges, payment firms, and card issuing companies around the globe were among those hit.

Expect increase in ransomware and ‘triple extortion’ attacks, Cyber Threat Intelligence League says.

Two months after the news first broke, many questions remain about the sophisticated cyber-espionage campaign.

Flaw leaves millions of IT, OT, and IoT devices vulnerable to attack.

A new investigation of two known threat groups show cyber actors are spying on mobile devices and PCs belonging to targeted users around the world.