Our adversaries certainly have diversity — so cybersecurity teams need it, too.

As cybersecurity's cat-and-mouse game starts to look more like Tom and Jerry, attackers develop a method for undermining Android app security with no obvious fix.

The China-nexus cyber-threat actor has been operating since at least 2019 and has notched victims in multiple countries.

The high-severity CVE-2024-5806 allows cyberattackers to authenticate to the file-transfer platform as any valid user, with accompanying privileges.

More than 200 regional and national government agencies have been impacted by the ransomware attack, and few of them are once again operational.

An unknown adversary compromised a CISA app containing the data via a vulnerability in the Ivanti Connect Secure appliance this January.

Injected malicious JavaScript code gives attackers administrator rights on websites, and fills sites with SEO spam.

Knowledge institutions with legacy infrastructure, limited resources, and digitized intellectual property must protect themselves from sophisticated and destructive cyberattacks.

For a while, the botnet spread but did essentially nothing. All the malicious payloads came well after.

In the latest breaches, threat groups compromised telecommunications firms in at least two Asian nations, installing backdoors and possibly eavesdropping or pre-positioning for a future attack.

Daily operations at some 15,000 automotive dealers remain impacted as CDK works to restore its dealer management system, following what appears to be a ransomware attack last week.

AppSec is hard for traditional software development, let alone citizen developers. So how did two people resolve 70,000 vulnerabilities in three months?

In an incident with direct parallels to the recent Ticketmaster compromise, an Aussie live events giant says it was breached via a third-party cloud provider, as ShinyHunters takes credit.

The settlement between the SEC and the owner of the New York Stock Exchange is a critical reminder of the vulnerabilities within financial institutions' cybersecurity frameworks as well as the importance of regulatory oversight.

After Sept. 29, 2024, organizations and individuals that continue using the vendor's products will no longer receive any updates or support.

Government ministries keep falling victim to relatively standard-fare cyber-espionage attacks, like this latest campaign with hazy Chinese links.

Our collection of the most relevant reporting and industry perspectives for those guiding cybersecurity strategies and focused on SecOps. Also included: Inside China's civilian hacker army; outer space threats; and NIST 2.0 Framework secrets for success.

The nonprofit Security Alliance is providing funds to protect security researchers who illegally access crypto assets with the aim of improving security.

Ticketmaster, Santander Bank, and other large firms have suffered data leaks from a large cloud-based service, underscoring that companies need to pay attention to authentication.

Audit compliance not only demonstrates commitment to data security and privacy but also builds trust with customers and stakeholders.

CDK Global, which makes software for car dealers, experienced a cyber incident that halted vehicle sales and service across the US.

The notorious cyber espionage group has been harrying French interests for years, and isn't flagging now as the Paris Olympics approach.

The old, but newly disclosed, vulnerability is buried deep inside personal computers, servers, and mobile devices, and their supply chains, making remediation a headache.

Had the bill become a law, it would have given consumers the right to sue companies that violate their privacy.

The stream was briefly knocked offline, preventing millions of fans from accessing the game. Poland's head of digital services says "all leads lead to the Russian Federation."

The "Markopolo" threat actors built a convincing brand and Web presence for fake software to deliver the dangerous Atomic macOS stealer, among other malware, to carry out cryptocurrency heists.

The updated framework is an equalizer for smaller organizations to meet the industry at its breakneck pace of innovation.

The consortium of private companies and academia will focus on ways to protect hardware memory from attacks.

By integrating environmental initiatives, social responsibility, and governance into their strategies, security helps advance ESG goals.

The service, likely a rebrand of a previous operation called "Caffeine," mainly targets financial institutions in the Americas and EMEA and uses malicious QR codes and other advanced evasion tactics.

By offering to buy Atos' big data and cybersecurity operations. Paris is trying to make sure key technologies do not fall under foreign control.

Cops decimate cybercrime infrastructure used to steal data from nearly 2,000 people in Singapore last year.

The US passenger rail giant said attackers used previously compromised credentials to crack accounts and access a freight train of personal data.

A trio of bugs could allow hackers to escalate privileges and remotely execute code on virtual machines deployed across cloud environments.

Threat actors were able to breach Blackbaud's systems and compromise sensitive data, largely because of the company's poor cybersecurity practices and lack of encrypted data, the AG said.

"ClearFake" and "ClickFix" attackers are tricking people into cutting and pasting malicious PowerShell scripts to infect their own machines with RATs and infostealers.

Forcing Microsoft to compete fairly is the most important next step in building a better defense against foreign actors.

Microsoft last year described the threat actor — known as UNC3944, Scattered Spider, Scatter Swine, Octo Tempest, and 0ktapus — as one of the most dangerous current adversaries.

The company has emerged from stealth with an AI-powered platform designed to give organizations visibility into unmanaged data.

With the requirement that all vulnerabilities first get reported to the Chinese government, once-private vulnerability research has become a goldmine for China's offensive cybersecurity programs.

Accused of hacking into more than 45 companies in the US, a 22-year-old British man was arrested by Spanish police and found to be in control of more than $27 million in Bitcoin.

Pakistani hackers are spying (▀̿Ĺ̯▀̿ ̿) on the highly sensitive organizations in India by using emojis (Ծ_Ծ) as malicious commands (⚆ᗝ⚆) and the old Dirty Pipe Linux flaw.

Threat actors were able to breach the department using the credentials accessed through phishing emails.