The previously unknown threat actor uses tools similar to those used by North Korean APT groups, according to Cisco Talos.

Our collection of the most relevant reporting and industry perspectives for those guiding cybersecurity strategies and focused on SecOps. Also included: fighting cybersecurity burnout; BlackSuit ransomware; the SEC breach rules and risk management.

Though information such as dates of birth, email addresses, and home addresses were compromised, "the Beeb" assures individuals that financial information is still protected.

Most of the operations were feckless efforts with little impact, but they illustrate how AI is changing the game for inauthentic content on both the adversary and defense sides.

The Russia-aligned FlyingYeti's phishing campaign exploited Ukrainian citizens' financial stress to spread Cookbox malware.

Consumer data is still a prime target for threat actors, and organizational consumption of data must be aligned to protect it. The new rights act seeks to do some of this, but it still needs tweaking.

Europol undertook dropper malware botnet takedown while US law enforcement dismantled a sprawling cybercrime botnet for hire.

Companies are looking to large language models to help their employees glean information from unstructured data, but vulnerabilities could lead to disinformation and, potentially, data leaks.

This time it's the identity management service provider's cross-origin authentication feature that's being targeted by adversaries.

By adopting a stance of coordinated disclosure for exploits, security researchers can give organizations time to patch vulnerabilities before they are exploited in the wild.

Stealthy ad fraud rings turn legitimate marketing into spam at a large scale, creating 200M+ bid requests daily.

Security teams should understand their providers' approach to data privacy, transparency, user guidance, and secure design and development.

When security professionals are at the end of their rope — feeling both mentally and physically exhausted — it's often because of burnout. Here are ways to combat it.

It's unclear whether a dataset for sale on the site allegedly containing data from more than 500 million Ticketmaster users is real or just law enforcement bait.

North Korea's newest threat actor uses every trick in the nation-state APT playbook, and most of cybercrime's tricks, too. It also developed a whole video game company to hide malware.

The political consultant who wrote the script and paid for the deepfake audio used in robocalls was fined $6 million by the FCC.

Corporate admins should patch the max-severity CVE-2024-23108 immediately, which allows unauthenticated command injection.

Researchers went in-depth on an attack by the threat group, which mainly targets US companies in the education and industrial goods sectors, specifically to maximize financial gain.

It's time to rethink the pivotal role incentives play in shaping behavior to find and disclose software vulnerabilities. More accurate guidance to reflect real-world risks and a tiered verification process to establish potential impact could slow misleading submissions.

Targeting India's government, defense, and aerospace sectors, the cyber-threat group now attacks Linux as well as Windows in its quest to compromise the Indian military's homegrown MayaOS Linux systems.

Reasonable cybersecurity is highly subjective. Organizations need to plan carefully in order to quantify cyber-risk and apply security controls.

In attacks over the past three months, threat actors have exploited more than 80 vulnerabilities to accelerate distribution of the Mirai variant.

Using VPNs as an initial access vector is ironic, given that security is the very reason enterprises employ them in the first place.

The committee is being set up as the ChatGPT creator begins to train its latest large language model, GPT-5, which will reach "a new level of capabilities."

The dangerous Anatsa banking Trojan is among the malware being spread to Android users via decoy mobile apps in recent months.

Insights from three companies that recently reported breaches under the new disclosure regulations.

There's plenty of upside to this emerging technology, especially if organizations smartly plan for GenAI's rollout and long-term management.

So you think you know Interpol? Here are some key details of how this international law enforcement entity disrupts cybercrime worldwide.

Despite Microsoft's reassurances, multiple security researchers describe the technology as problematic for users and their organizations.

Users get duped into downloading malicious files disguised to look like an application that uses artificial intelligence to alter voices.

The tech company has rolled out fixes for a type confusion vulnerability that has already been exploited by malicious actors.

As the digital landscape evolves, these words must become an impetus for innovation and dialogue, not insurmountable barriers.

The SEC's lawsuit may take years to resolve through litigation, but here are five things CISOs should do now to protect both themselves as individuals as well as their organizations.

An effective, long-term XDR strategy will address the ongoing need for rapid analysis and continual vetting of the latest threat intelligence.

CyberArk's $1.54 billion agreement to buy Venafi is a sign of how human and machine identities will converge with certificate life cycle management.

Much like an airplane's dashboard, configurations are the way we control cloud applications and SaaS tools. It's also the entry point for too many security threats. Here are some ideas for making the configuration process more secure.

With more than 10,000 installations across prisons, courts, and governments, impacted Justice AV Solutions users are urged to re-image affected endpoints and reset credentials.

The two MIT graduates discovered a flaw in a common trading tool for the Ethereum blockchain. Does it presage problems ahead for cryptocurrency?

The spyware is able to capture screenshots of a user's device every few seconds from any location globally.

Microsoft researchers discover an old-timey scam with a facelift for the cloud era: hacking retailers' portals to make it rain gift cards.

With the right mix of caution, creativity, and commitment, we can build a future where LLMs are not just powerful, but also fundamentally trustworthy.