CyberSecurity news
FlagThis - #enterprises
|
Julian Tuin@Arctic Wolf
//
A critical vulnerability, identified as CVE-2025-23120, has been discovered in Veeam Backup & Replication software. This flaw allows authenticated domain users to execute remote code, potentially leading to the compromise of enterprise backup infrastructures. The vulnerability affects versions 12, 12.1, 12.2, and 12.3 of Veeam Backup & Replication and has been assigned a CVSS score of 9.9, indicating a critical severity. The issue was reported by Piotr Bazydlo of watchTowr and highlights the importance of community engagement in addressing security issues.
Veeam has addressed this vulnerability in version 12.3.1 (build 12.3.1.1139), and users are strongly urged to apply the patch immediately. The vulnerability specifically impacts domain-joined backup servers, which goes against Security & Compliance Best Practices. It is imperative for organizations to prioritize updates to ensure their systems remain secure. The company also emphasizes its commitment to customer security through a Vulnerability Disclosure Program and rigorous internal code audits. Recommended read:
References :
cybernewswire@The Last Watchdog
//
Palo Alto, USA, March 29, 2025 - SquareX has disclosed a new form of ransomware that operates natively within web browsers and is undetectable by traditional antivirus software. This browser-native ransomware poses a significant threat to enterprises, potentially putting millions at risk. The disclosure comes as ransomware continues to be a major cybersecurity concern, with Chainalysis estimating that corporations spend nearly $1 billion annually on ransom payments alone. The true cost, however, is often much higher due to reputational damage and operational disruption.
SquareX's research highlights that unlike traditional ransomware, this new variant does not require victims to download and install malicious files. Instead, it targets the user's digital identity, exploiting the increasing reliance on cloud-based enterprise storage and browser-based authentication. SquareX founder, Vivek Ramachandran, warns that the rise in browser-based identity attacks indicates that the "ingredients" for browser-native ransomware are already being used by adversaries. He emphasizes the need for browser-native solutions to combat this emerging threat, as traditional endpoint security measures are ineffective against these attacks. Recommended read:
References :
Matt Kapko@CyberScoop
//
References:
Threats | CyberScoop
, SiliconANGLE
,
A new report from Cisco Talos reveals that identity-based attacks were the dominant form of cyber incident in 2024, accounting for 60% of all incidents. Cybercriminals are increasingly relying on compromised user accounts and credentials rather than sophisticated malware or zero-day exploits. This shift highlights a significant weakness in enterprise security, with attackers finding it easier and safer to log in using stolen credentials than to deploy more complex attack methods. These attacks targeted Active Directory in 44% of cases and leveraged cloud application programming interfaces in 20% of attacks.
This trend is further exacerbated by weaknesses in multi-factor authentication (MFA). Common MFA failures observed included the absence of MFA on virtual private networks, MFA exhaustion/push fatigue, and improper enrollment monitoring. The primary motivations behind these identity-based attacks were ransomware (50%), credential harvesting and resale (32%), espionage (10%), and financial fraud (8%). These incidents underscore the critical need for organizations to bolster their identity and access management strategies, including stronger password policies, robust MFA implementations, and enhanced monitoring of Active Directory environments. Recommended read:
References :
@www.networkworld.com
//
Versa Networks has launched its Sovereign SASE platform, presenting a new option for enterprises and service providers seeking greater control over their network security. This solution allows organizations to deploy a SASE platform within their own on-premises or private cloud environments, moving away from the traditional cloud-only security model. Versa's Sovereign SASE is designed to run entirely on customer-controlled infrastructure, offering a "do-it-yourself" model for customized networking and security services.
Increased privacy and control, reduced risk of service disruption, and eased regulatory compliance are key benefits. The platform enables organizations to build and manage their SASE environment on their own infrastructure, ensuring greater autonomy and data protection. By eliminating reliance on third-party SaaS platforms, Versa Sovereign SASE reduces operational risks and costs tied to unplanned outages, strengthening business continuity. The "air-gapped" infrastructure also simplifies meeting strict requirements for regulatory compliance, data residency, and security. Recommended read:
References :
Zimperium@Zimperium
//
Zimperium, a mobile security firm, has issued a warning about the persistent and evolving threat that rooted and jailbroken mobile devices pose to enterprises. Their recent report highlights that these compromised devices, which bypass security protocols, make organizations increasingly vulnerable to mobile malware, data breaches, and full system compromises. According to Zimperium's research, rooted Android devices are significantly more susceptible to security incidents, with a 3.5 times greater likelihood of malware attacks and a staggering 250 times higher risk of system compromise.
Rooting and jailbreaking, initially used for device customization, grant users full control but remove crucial security protections. This allows the installation of apps from unverified sources, disabling security features, and modifying system files, making them prime targets for cybercriminals. Hackers are continuously developing sophisticated toolkits, such as Magisk and APatch, to hide their presence and evade detection. These tools employ techniques like "systemless" rooting and on-the-fly kernel memory modification, making it increasingly difficult for cybersecurity researchers to identify compromised devices before they inflict damage, emphasizing the need for constant monitoring and updated security measures. Recommended read:
References :
@cyberalerts.io
//
A newly uncovered ClickFix phishing campaign is tricking victims into executing malicious PowerShell commands, which subsequently deploy the Havok post-exploitation framework. This framework grants attackers remote access to compromised devices. The attackers cleverly conceal the different stages of their malware within SharePoint sites and employ a modified version of Havoc Demon in tandem with the Microsoft Graph API. This tactic is used to obfuscate command-and-control (C2) communications, making them appear as legitimate traffic within trusted Microsoft services.
The attack starts with a phishing email that has a HTML attachment, when opened, displays an error message, which uses the ClickFix technique to trick users into copying and executing a malicious PowerShell command into their terminal or PowerShell, thereby triggering the next-stage. The command downloads and executes a PowerShell script hosted on a server controlled by the attacker. This script checks for sandboxed environments, downloads the Python interpreter if needed, and executes a Python script serving as a shellcode loader for KaynLdr, launching the Havoc Demon agent on the infected host. Recommended read:
References :
toddrweiss@gmail.com (Todd R. Weiss)@Blog (Main)
//
The push for compliance as cybersecurity is under scrutiny, as risk management risks becoming a simple checkbox exercise. While compliance to standards is vital, it doesn't guarantee complete protection against threats. Experts like Chris Hughes, CEO of Aquia, view compliance as a starting point to make cybersecurity a priority. He argues it is a major factor in prompting organizations to invest in security, especially when cyberattack impact on share prices is often minimal. Compliance is essential to aim for to ensure stealthier cybersecurity for enterprises.
However, there is growing concern that the emphasis on compliance is shifting power from security professionals to legal departments. This trend is further fueled by the SEC's recent push for disclosure by public companies and guidelines from CISA. A recent blog post cited by Hughes, argues that this compliance-as-security trend means "that the future of security will be defined by lawyers, not security practitioners." Additionally, research has shown cybersecurity is becoming increasingly intertwined with legal issues. The move towards compliance shouldn't overshadow sound security practices which are needed to manage cyber security. Recommended read:
References :
|