Microsoft last year described the threat actor — known as UNC3944, Scattered Spider, Scatter Swine, Octo Tempest, and 0ktapus — as one of the most dangerous current adversaries.

The campaign is especially notable for the remarkable lengths to which the threat actor went to maintain persistence on the target environment.

A failure to imagine — and prepare for — threats to outer-space related assets could be a huge mistake at a time when nation-states and private companies are rushing to deploy devices in a frantic new space race.

Why the company took so long to address the issue is not known given that most other stakeholders had a fix out for the issue months ago.

CVE-2024-30080 is the only critical issue in Microsoft's June 2024 Patch Tuesday update, but many others require prompt attention as well.

A threat actor has accessed data belonging to at least 165 organizations using valid credentials to their Snowflake accounts, thanks to no MFA and poor password hygiene.

Since at least February, a threat actor has been attempting to extort victims by stealing or wiping data in their GitHub repositories.

One monitoring firm has detected exploitation attempts targeting CVE-2024-24919 from more than 780 unique IP addresses in the past week.

CVE-2020-1472 is a privilege escalation flaw that allows an attacker to take over an organization's domain controllers.

The campaign uses a multistage payload-delivery process and various mechanisms for evasion and persistence.

MFA and other mechanisms are critical to protect against unauthorized access to data in cloud application environments, but businesses still fall down on the job.

It's unclear whether a dataset for sale on the site allegedly containing data from more than 500 million Ticketmaster users is real or just law enforcement bait.

In attacks over the past three months, threat actors have exploited more than 80 vulnerabilities to accelerate distribution of the Mirai variant.

Despite Microsoft's reassurances, multiple security researchers describe the technology as problematic for users and their organizations.

The severe security vulnerability (CVE-2024-4701, CVSS 9.9) gives remote attackers a way to burrow into Netflix's Genie open source platform, which is a treasure trove of information and connections to other internal services.

The new Secure Alternative Program from Google aims to entice customers away from Exchange Online and break Microsoft's dominance in the enterprise.

The improper input validation issue in Intel Neural Compressor enables remote attackers to execute arbitrary code on affected systems.

Researchers believe the attacker is likely China-affiliated, since a previous version of the malware was used by a China nation-state attack group.

Attackers can exploit the issue to trick users into connecting to insecure networks, but it works only under specific conditions.

While the protocol has made passwordless authentication a reality, token-binding is key to prevent against token theft and reuse, security vendor says.

Researchers discovered seven vulnerabilities — including an unauthenticated RCE issue — in widely deployed Telit Cinterion modems.

Researchers recently spotted the Spanish-speaking threat actor — with nearly 400 previous victims under its belt — in a new campaign in Latin America and Central Africa.

An attacker accessed personal information of over 225,000 active, reserve, and former UK military members from third-party payroll processing system.

At least a portion of executive compensation going forward will be tied to meeting security goals and metrics.

The flaw was nearly identical to last year's CitrixBleed flaw, though not as severe.

Though Olympics officials appear to have better secured their digital footprint than other major sporting events have, significant risks remain for the Paris Games.

Microsoft has uncovered a common vulnerability pattern in several apps allowing code execution; at least four of the apps have more than 500 million installations each; and one, Xiaomi's File Manager, has at least 1 billion installations.

Unmanaged and unknown Web services endpoints are just some of the challenges organizations must address to improve API security.

The purported metadata for each these containers had embedded links to malicious files.

The CVE-2024-27322 security vulnerability in R's deserialization process gives attackers a way to execute arbitrary code in target environments via specially crafted files.

The business intelligence servers contain vulnerabilities that Qlik patched last year, but which Cactus actors have been exploiting since November. Swathes of organizations have not yet been patched.

Eight out of nine apps that people use to input Chinese characters into mobile devices have weakness that allow a passive eavesdropper to collect keystroke data.

Unlike the SolarWinds and CodeCov incidents, all that it took for an adversary to nearly pull off a massive supply chain attack was some slick social engineering and a string of pressure emails.