News

PLUS: Cyber-exec admits selling secrets to Russia; LastPass isn't checking to see if you're dead; Nation-state backed Windows malware; and more

Infosec in brief  Australia’s Signals Directorate (ASD) last Friday warned that attackers are installing an implant named “BADCANDY” on unpatched Cisco IOS XE devices and can detect deletion of their wares and reinstall their malware.…

Rare case of the state turning on its own, but researchers say it may be doing so more often

Russia's Interior Ministry says police have arrested three suspects it believes helped build and spread the Meduza infostealer.…

Bitcoin bridge biz offers 10 percent reward to attackers if they play nice

Blockchain company Garden admits it was compromised and temporarily shut down its app after approximately $11 million worth of assets were stolen.…

Price hikes, politics, and platform fatigue drive organizations back toward open alternatives

OpenInfra Summit  Sovereignty might be the word of the hour, but the OpenStack community has another – resilience.…

Hospitals told to upgrade, but some medical device makers haven't prescribed compatibility yet

NHS hospitals are being blocked from fully upgrading to Windows 11 by a small number of suppliers that have yet to make their medical devices compatible with Microsoft's latest operating system.…

Because fewer people like banknotes, and payment sovereignty is a problem

The Governing Council of the European Central Bank (ECB) has decided the bloc needs a digital version of the Euro, and ordered work that could see it enter circulation in 2029.…

Expired security cert, real Brussels agenda, plus PlugX malware finish the job

Cyber spies linked to the Chinese government exploited a Windows shortcut vulnerability disclosed in March – but that Microsoft hasn't fixed yet – to target European diplomats in an effort to steal defense and national security details.…

Service will tell on compromised organizations, even if they didn't plan on doing so themselves

Some orgs would rather you not know when they've suffered a cyberattack, but a new platform from privacy-focused tech firm Proton will shine a light on the big breaches that might otherwise stay buried.…

Windows Desktop installer also fixed after DLL hijack flaw rated 8.8 severity

Docker Compose users are being strongly urged to upgrade their versions of the orchestration tool after a researcher uncovered a flaw that could allow attackers to stage path traversal attacks.…

PhantomRaven slipped over a hundred credential-stealing packages into npm

A new supply chain attack dubbed PhantomRaven has flooded the npm registry with malicious packages that steal credentials, tokens, and secrets during installation. The packages appear safe when first downloaded, making them particularly difficult for security apps to identify.…

Infosec agency warns hacktivists broke into critical infrastructure systems to tamper with controls

Hacktivists have breached Canadian critical infrastructure systems to meddle with controls that could have led to dangerous conditions, marking the latest in a string of real-world intrusions driven by online activists rather than spies.…

Biz says 'technical error' caused short-lived leak affecting small number of users

A major UK lottery organization says it has resolved a technical error that exposed customer data to other users.…

Governments eye comms alternatives as sovereignty worries mount

Comment  Decentralized communications network Matrix is hoping to be the beneficiary as European public and private sector organizations ponder alternatives to the messaging status quo.…

Edge, Atlas, Brave among those affected

Exclusive  A critical, currently unpatched bug in Chromium's Blink rendering engine can be abused to crash many Chromium-based browsers within seconds, causing a denial-of-service condition – and, in some tests, freezing the host system.…

The Big Four biz’s big fat fail exposed a boatload of secrets online

A Dutch cybersecurity outfit says its lead researcher recently stumbled upon a 4TB+ SQL Server backup file belonging to EY exposed to the web, effectively leaking the accounting and consulting megacorp's secrets.…

Emails confirm payroll and bank details lifted in cyberattack on US subsidiary

Global marketing giant Dentsu is writing to current and former staff after a cyberattack on a subsidiary led to bank, payroll, and other sensitive data being stolen.…

ICO fined Bharat Singh Chand £200,000 after receiving 19,138 complaints

Britain's data watchdog has fined a sole trader £200,000 for nearly a million spam texts targeting people in debt – almost 20 pence per message.…

Dangles £100K for someone to fix £23B tech mess

The UK government is on the hunt for a new CTO after incumbent David Knott announced his departure, citing family reasons.…

Cybersecurity agency urges organizations to upgrade or risk total network compromise

Germany's infosec office (BSI) is sounding the alarm after finding that 92 percent of the nation's Exchange boxes are still running out-of-support software, a fortnight after Microsoft axed versions 2016 and 2019.…

Five Eyes intel alliance has created a team to target these scum who prey on kids

Australia’s Federal Police (AFP) is working on an AI to interpret emojis and the slang used online by Generation Z and Generation Alpha, so it can understand them when they discuss crime online.…