Top News

• Thousands of Magento Stores Hacked in Largest-ever Skimming Campaign

"Hackers compromised nearly two thousand Magento stores in the largest ever web skimming campaign that targets Magento stores. The previous record of several stores hacked in a day is 962, that attack happened in July last year."

Link

TLP¹ : Green

• US Staffing Firm Artech Keeps Silent About Data Breach, Leaves Customers at Risk of Fraud for Eight Months

"Artech Information Systems, a minority- and women-owned diversity supplier and one of the largest IT staffing companies in the U.S., has disclosed a data breach exposing personal, financial, and health information of some of its clients. Notably, the attack occurred in January, eight months ago."

Link

TLP¹ : Green

• Large Cloud Providers Much Less Likely Than Enterprises to Get Breached

"Major cloud services providers are about half as likely (46%) to experience a data breach compared with large enterprises, a new study suggests."

Link

TLP¹ : Green

Cybersecurity State: Surveillance, Cyberwarfare, Cybercriminality and Hacktivism

• Vast majority of cyber-attacks on cloud servers aim to mine cryptocurrency

"An analysis of one year's worth of cyber-attacks recorded in cloud honeypot servers reveals that the vast majority of hackers target cloud infrastructure with the purpose of deploying crypto-mining malware rather than exfiltrate sensitive corporate information, set up DDoS infrastructure, or other forms of cybercrime."

Link

TLP¹ : Green

• CIRWA Project tracks ransomware attacks on critical infrastructure

"Researchers from Temple University have been tracking ransomware attacks on critical infrastructure all over the world."

Link

TLP¹ : Green

• FBI says credential stuffing attacks are behind some recent bank hacks

"The FBI is raising a sign of alarm about the rising number of credential stuffing attacks targeting financial institutions."

Link

TLP¹ : Green

Breaches: Data Breaches and Hacks

• Staples discloses data breach exposing customer info

"Giant office retail company Staples informed some of its customers that data related to their orders has been accessed without authorization."

Link

TLP¹ : Green

• Popular Marketing Tool exposes data of users of dating sites

"Personal details of hundreds of users of dating sites were exposed online earlier this month."

Link

TLP¹ : Green

Vulnerabilities: Vulnerability Advisories, Zero-Days,Patches and Exploits

• Vulnerabilities Expose Thousands of MobileIron Servers to Remote Attacks

"Researchers have disclosed the details of several potentially serious vulnerabilities affecting MobileIron’s mobile device management (MDM) solutions, including a flaw that can be exploited by an unauthenticated attacker for remote code execution on affected servers."

Link

TLP¹ : Green

• Zerologon attack lets hackers to completely compromise a Windows domain

"Zerologon attack allows threat actors to take over enterprise networks by exploiting the CVE-2020-1472 patched in the August 2020 Patch Tuesday."

Link

TLP¹ : Green

Incident Response: Infrastructure, Training, SIEM and Incident Handling

• Open Source Security's Top Threat and What To Do About It

"Ninety-nine percent of enterprise codebases contain open source components, according to a recent study. But amid that overwhelming adoption, a hazard has emerged: Organizations have lost visibility of the plethora of open source components being used in their applications and infrastructure, making it harder to identify potential security vulnerabilities."

Link

TLP¹ : Green

• Security Through an Economics Lens: A Guide for CISOs

"Security and IT leaders are familiar with the challenge of making trade-off decisions about how and where to invest resources to best manage risks to the organization. Viewing their problems through the lens of economics may help them reprioritize these tricky investment decisions. "

Link

TLP¹ : Green

Technical Articles: Forensics, Reverse Engineering, Malware, Phishing, Pentesting, Software Security and Cryptography

• Digital Forensics: An Introduction

"Digital Forensics is the application of scientific methods in preserving, recovering, and investigating digital evidence in a Digital crime scenario.  It can be correctly defined as, collection, examination, analysis, and documentation by using scientifically proven methods to investigate a digital crime and present it before the court."

Link

TLP¹ : Green

• TOR Anonymity: Things Not To Do While Using TOR

"The Onion Router has the strength to protect you and hide you from all those stalkers and evil minds who follow you on the internet. Even if you want to be another Edward Snowden, you can very well do so by using the TOR browser."

Link

TLP¹ : Green

• Spyre : Simple YARA-Based IOC Scanner

"Spyre is a simple host-based IOC scanner built around the YARA pattern matching engine and other scan modules. The main goal of this project is easy ope-rationalization of YARA rules and other indicators of compromise."

Link

TLP¹ : Green

¹Traffic Light Protocol (TLP) [1] for information sharing:

• Red:Not for disclosure, restricted to participants only.
• Amber: Limited disclosure, restricted to participants organizations.
• Green: Limited disclosure, restricted to the community.

[1]https://www.first.org/tlp