Latest Cybersecurity News and Articles

---

Josh DeFrain named Chief Information Security Officer at Rokt

Ecommerce technology company Rokt has appointed Josh DeFrain as Chief Information Security Officer (CISO) effective immediately. 

---

37% of IT professionals report experiencing a data loss event

Best practices for data protection were analyzed in a report finding that 25% of IT professionals follow industry best practices for backing up data.

---

Security professional's tweet forces big change to Google email authentication

Less than a month after BIMI’s roll-out, scammers found a way around its controls and were able to successfully impersonate brands, sending emails to Google users that impersonated the logistics giant UPS.

---

Asylum Ambuscade: crimeware or cyberespionage?

The group targets bank customers and cryptocurrency traders in various regions, including North America and Europe, as well as government entities in Europe and Central Asia.

---

Interpol: Human Trafficking is Fueling Fraud Epidemic

Interpol is concerned about the threat, which first emerged in 2021, as it has spread from a focus on Chinese-speaking victims based in China, Malaysia, Thailand, and Singapore, to as far afield as South America, East Africa, and Western Europe.

---

German Recruiter Pflegia Leaks 360,000 Files Containing Sensitive Job Seeker Information

The exposed AWS bucket held hundreds of thousands of files with sensitive information, including user-submitted resumes with details such as full names, dates of birth, and occupation history.

---

API Vulnerabilities in Honda eCommerce Platform Exposed Customer, Dealer Data

A researcher has disclosed the details of serious vulnerabilities discovered in a Honda e-commerce platform used for equipment sales. Exploitation of the flaws could have allowed an attacker to gain access to customer and dealer information.

---

Experts Unveil PoC Exploit for Recent Windows Vulnerability Under Active Exploitation

Details have emerged about a now-patched actively exploited security flaw in Microsoft Windows that could be abused by a threat actor to gain elevated privileges on affected systems. The vulnerability, tracked as CVE-2023-29336, is rated 7.8 for severity and concerns an elevation of privilege bug in the Win32k component. "An attacker who successfully exploited this vulnerability could gain

---

FTC charges Amazon for keeping children's voice recordings

Amazon will be required to overhaul how it deletes data and implement new privacy guidelines following FTC and Department of Justice charges.

---

Ascension Seton Reports Data Breach of Two Websites Impacting User Information

Ascension Seton said it did not have specific details about what information had been affected but that some users’ personal details, such as name, address, SSNs, credit card numbers, and insurance information may be at risk.

---

Clop Ransomware Gang Likely Exploiting MOVEit Transfer Vulnerability Since 2021

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) and Federal Bureau of Investigation (FBI) have published a joint advisory regarding the active exploitation of a recently disclosed critical flaw in Progress Software's MOVEit Transfer application to drop ransomware. "The Cl0p Ransomware Gang, also known as TA505, reportedly began exploiting a previously unknown SQL injection

---

Cyber unicorn Snyk acquiring Israeli startup Enso Security for over $50 million

Snyk said it plans to leverage Enso’s Application Security Posture Management (ASPM) solution to offer a developer security platform providing a holistic view of application security posture.

---

New Fractureiser Malware Used CurseForge Minecraft Mods to Infect Windows, Linux

Hackers used the popular Minecraft modding platforms Bukkit and CurseForge to distribute a new 'Fractureiser' information-stealing malware through uploaded modifications and by injecting malicious code into existing projects.

---

Cisco Patches Critical Vulnerability in Enterprise Collaboration Solutions

Cisco on Wednesday announced patches for a critical vulnerability in its Expressway series and TelePresence Video Communication Server (VCS) enterprise collaboration and video communication solutions.

---

BBC and other organizations targeted in recent MOVEit vulnerability

Organizations from around the world, including the BBC and British Airways, have been warned that stolen data will be published if demands aren’t met in a recent hack.

---

Kimsuky's Hack: Targeting North Korean Affairs for Intel

SentinelOne identified the North Korean Kimsuky group targeting experts in North Korean affairs and media to gather intelligence and steal subscription information for news outlets reporting on the country's affairs. These actions likely contribute to its broader goal of gathering strategic intelligence and influencing North Korea's decision-making processes.

---

Zipper Manufacturing Giant YKK Confirms Cyberattack Targeted its U.S. Networks

“There is no evidence that personal or financial information or intellectual property was compromised," Jessica Kennett Cork, VP of corporate communications at YKK Corporation of America said.

---

Biden taps Senate Intel Committee staff director to lead NCSC

The president announced on Wednesday that he would nominate Michael Casey, a longtime Democratic staff director for the Senate Intelligence Committee, to be director of the National Counterintelligence and Security Center (NCSC).

---

Japanese Pharmaceutical Giant Eisai Suffers Ransomware Attack

The attack has affected servers both within and outside Japan and resulted in some of the group’s IT functions, including logistics systems, being taken offline. There’s no clear indication yet whether sensitive data has been leaked.

---

How to Improve Your API Security Posture

APIs, more formally known as application programming interfaces, empower apps and microservices to communicate and share data. However, this level of connectivity doesn't come without major risks. Hackers can exploit vulnerabilities in APIs to gain unauthorized access to sensitive data or even take control of the entire system. Therefore, it's essential to have a robust API security posture to