SecurityWeek Briefing.

"Beware of Shadow AI-Shadow IT's less well-known brother."

Views expressed in this cybersecurity, cyber crime update are those of the reporters and correspondents.  Accessed on 23 December 2024, 2153 UTC.

Content and Source:  Email subscription via https://feedly.com.   https://feedly.com/i/subscription/feed%2Fhttp%3A%2F%2Ffeeds.feedburner.com%2FSecurityweek

Please check link or scroll down to read your selections.  Thanks for joining us today.

Russ Roberts (https://www.hawaiicybersecurityjournal.net).

SecurityWeek

82K followers37 articles per week#security#tech

28

Today

Beware Of Shadow AI – Shadow IT’s Less Well-Known Brother

by Etay Maor / 7h

While AI tools can enable employees to be innovative and productive, significant data privacy risks can stem from their usage. The post appeared first on SecurityWeek .

5.6 Million Impacted by Ransomware Attack on Healthcare Giant Ascension

3 TTPs

•

by Ionut Arghire / 9h

•

Ascension Healthcare ransomware attack exposed

Ascension Health says the personal, medical, and payment information of 5.6 million people was stolen in a May 2024 ransomware attack. The post appeared first on SecurityWeek .

Sophos Patches Critical Firewall Vulnerabilities

2 TTPs

•

by Ionut Arghire / 10h

Sophos has released patches for a critical-severity firewall vulnerability that could lead to remote code execution. The post appeared first on SecurityWeek .

LockBit Ransomware Developer Arrested in Israel at Request of US

Israeli hacker faces US extradition

•

by Eduard Kovacs / 10h

Dual Russian and Israeli national has been arrested in Israel and will be extradited to the US to face charges related to LockBit ransomware development. The post appeared first on SecurityWeek .

Italy’s Privacy Watchdog Fines OpenAI for ChatGPT’s Violations in Collecting Users Personal Data

Italy fines OpenAI 15 million euros

•

by Associated Press / 11h

Italy’s data protection watchdog fined OpenAI 15 million euros ($15.6 million) after wrapping up a probe into collection of personal data. The post appeared first on SecurityWeek .

Apple Complains Meta Requests Risk Privacy in Spat Over EU Efforts to Widen Access to iPhone Tech

Apple criticizes Meta's access requests

•

by Associated Press / 11h

Apple complained that requests from Meta Platforms for access to its operating software threaten user privacy, in a spat fueled by the European Union’s intensifying efforts to get the iPhone maker to open up to products from tech rivals. The post appeared first on SecurityWeek .

Dec 20, 2024

In Other News: McDonald’s API Hacking, Netflix Fine, Malware Kills ICS Process

9 TTPs

•

by SecurityWeek News / 3d

Noteworthy stories that might have slipped under the radar: McDonald’s API hacking, Netflix fined nearly $5 million in Netherlands, experimental malware killing ICS process. The post appeared first on SecurityWeek .

Botnet of 190,000 BadBox-Infected Android Devices Discovered

Germany blocks 30000 BadBox devices

•

by Ionut Arghire / 3d

Bitsight has discovered a BadBox botnet consisting of over 190,000 Android devices, mainly Yandex smart TVs and Hisense smartphones. The post appeared first on SecurityWeek .

Ransomware Group Claims Theft of Personal, Financial Data From Krispy Kreme

6 TTPs

•

by Ionut Arghire / 3d

•

Krispy Kreme suffers cyberattack disruption

The Play ransomware group claims to have stolen sensitive data from donut and coffee retail chain Krispy Kreme. The post appeared first on SecurityWeek .

Another NetWalker Ransomware Affiliate Gets 20-Year Prison Sentence in US

Romanian man sentenced for ransomware

•

by Eduard Kovacs / 3d

A second individual accused of being involved in NetWalker ransomware attacks, a Romanian national, has received a 20-year prison sentence. The post appeared first on SecurityWeek .

CISA Urges Immediate Patching of Exploited BeyondTrust Vulnerability

2 TTPs

•

by Ionut Arghire / 3d

•

CVE-2024-12356

CISA is urging federal agencies to patch a recent critical vulnerability in BeyondTrust remote access products in one week. The post appeared first on SecurityWeek .

Rockwell PowerMonitor Vulnerabilities Allow Remote Hacking of Industrial Systems

4 TTPs

•

by Eduard Kovacs / 3d

Rockwell’s PowerMonitor is affected by critical vulnerabilities that can enable remote access to industrial systems for disruption or further attacks. The post appeared first on SecurityWeek .

Dec 19, 2024

How to Implement Impactful Security Benchmarks for Software Development Teams

by Matias Madou / 4d

Benchmarking is all about taking back control – you’re measuring to gain complete awareness of your development teams’ security skills and practices. The post appeared first on SecurityWeek .

CISA Releases Mobile Security Guidance After Chinese Telecom Hacking

CISA endorses encrypted apps security

•

by Ionut Arghire / 4d

In light of recent Chinese hacking into US telecom infrastructure, CISA has released guidance on protecting mobile communications. The post appeared first on SecurityWeek .

Ukrainian Raccoon Infostealer Operator Sentenced to Prison in US

Ukrainian sentenced for cybercrime conspiracy

•

by Ionut Arghire / 4d

Raccoon Infostealer MaaS operator Mark Sokolovsky was sentenced to 60 months in prison in the US and agreed to pay over $910,000 in restitution. The post appeared first on SecurityWeek .

Cisco to Acquire Threat Detection Company SnapAttack

Cisco acquires SnapAttack for security

•

by Eduard Kovacs / 4d

Cisco has announced its intention to acquire threat detection company SnapAttack to boost Splunk security product capabilities. The post appeared first on SecurityWeek .

Fortinet Patches Critical FortiWLM Vulnerability

2 TTPs

•

by Ionut Arghire / 4d

•

CVE-2023-34990

Fortinet has released patches for a critical-severity path traversal vulnerability in FortiWLM that was reported last year. The post appeared first on SecurityWeek .

SandboxAQ Raises $300 Million at $5.3 Billion Valuation

SandboxAQ raises 300M at 5.6B valuation

•

by Eduard Kovacs / 4d

Alphabet spinoff SandboxAQ has announced raising $300 million in funding at a valuation of $5.3 billion. The post appeared first on SecurityWeek .

Chrome 131 Update Patches High-Severity Memory Safety Bugs

by Ionut Arghire / 4d

Google has released a Chrome 131 update to patch multiple high-severity memory safety vulnerabilities, including three affecting the V8 JavaScript engine. The post appeared first on SecurityWeek .

Juniper Warns of Mirai Botnet Targeting Session Smart Routers

10 TTPs

•

by Ionut Arghire / 4d

Juniper Networks says a Mirai botnet is ensnaring session smart router devices that are using default passwords. The post appeared first on SecurityWeek .

Dec 18, 2024

Bureau Raises $30M to Tackle Deepfakes, Payment Fraud

Bureau raises 30M for fraud prevention

•

by SecurityWeek News / 5d

San Francisco startup scores a Series B round to thwart money mule accounts, deep-fake identities, account takeovers and payment fraud. The post appeared first on SecurityWeek .

Recorded Future Tagged as ‘Undesirable’ in Russia

Russia labels Recorded Future undesirable

•

by Ryan Naraine / 5d

The Russian government accuses the US threat-intel firm of participating in the collection and analysis of data on the actions of the Russia's armed forces. The post appeared first on SecurityWeek .

Regional Care Data Breach Impacts 225,000 People

by Eduard Kovacs / 5d

Healthcare insurance firm Regional Care has disclosed a data breach impacting more than 225,000 individuals. The post appeared first on SecurityWeek .

CISA Issues Binding Operational Directive for Improved Cloud Security

CISA mandates cloud security measures

•

by Ionut Arghire / 5d

CISA’s Binding Operational Directive 25-01 requires federal agencies to align cloud environments with SCuBA secure configuration baselines. The post appeared first on SecurityWeek .

BeyondTrust Patches Critical Vulnerability Discovered During Security Incident Probe

2 TTPs

•

by Ionut Arghire / 5d

•

CVE-2024-12356

A critical vulnerability in BeyondTrust Privileged Remote Access and Remote Support could lead to arbitrary command execution. The post appeared first on SecurityWeek .

AI Regulation Gets Serious in 2025 – Is Your Organization Ready?

by Alastair Paterson / 5d

While the challenges are significant, organizations have an opportunity to build scalable AI governance frameworks that ensure compliance while enabling responsible AI innovation. The post appeared first on SecurityWeek .

Exploitation of Recent Critical Apache Struts 2 Flaw Begins

CVE-2024-53677

•

by Ionut Arghire / 5d

Researchers warn of malicious attacks exploiting a recently patched critical vulnerability in Apache Struts 2 leading to remote code execution (RCE). The post appeared first on SecurityWeek