Aggregator

Security teams drown in alerts but starve for insight. Blocklists catch the obvious. SIEM correlation gives clues. But only context reveals what an alert really means, and what you should do about it.  Every SOC sees thousands of signals: odd domains, masquerading binaries, strange persistence artifacts. On their own, these indicators mean almost nothing. A suspicious […]

The post Beat Threats with Context: 5 Actionable Tactics for SOC Analysts  appeared first on Cyber Security News.

Behavioral User-driven Deceptive Activities Framework (BUDA) is a cutting-edge solution designed to enhance deception operations in cybersecurity by

The post Cyber Deception: BUDA Framework Automates Realistic User Behavior to Trap Attackers appeared first on Penetration Testing Tools.

Microsoft has uncovered a new strain of malware, dubbed SesameOp, and released detailed findings on its operation. This

The post AI Backdoor: SesameOp Malware Uses OpenAI API as Covert Command-and-Control Channel appeared first on Penetration Testing Tools.

Huawei has unveiled two new desktop PCs for the Chinese domestic market — the Qingyun W515y and Qingyun

The post China Chip Power: Huawei Unveils Qingyun Desktops with New Kirin 9000X & Linux OS appeared first on Penetration Testing Tools.

XLoader remains one of the most challenging malware families confronting cybersecurity researchers. This sophisticated information-stealing loader emerged in 2020 as a rebrand of FormBook and has evolved into an increasingly complex threat. The malware’s code decrypts only at runtime and sits protected behind multiple encryption layers, each locked with different keys hidden throughout the binary. […]

The post XLoader Malware Analyzed Using ChatGPT’s, Breaks RC4 Encryption Layers in Hours appeared first on Cyber Security News.

Cybercriminals have discovered a way to exploit digital tools to steal tangible goods from trucks and warehouses. According

The post Digital Highwaymen: Hackers Use RMM Tools to Hijack Physical Cargo Shipments appeared first on Penetration Testing Tools.

You must login to view this content

Hackers have breached the DeFi protocol Balancer, stealing over $120 million worth of cryptocurrency. Analysts estimate that roughly

The post DeFi Disaster: Hackers Steal $120 Million in ETH from Balancer Protocol in Massive Breach appeared first on Penetration Testing Tools.

You must login to view this content

目前，Open VSX代码仓库已轮换访问令牌——此前开发者在公共代码库中意外泄露了这些令牌，导致威胁者得以通过供应链攻击发布恶意扩展程序。

此次泄露由Wiz公司研究人员于两周前发现，他们当时报告称，微软VSCode和Open VSX应用市场共暴露了550余个敏感信息。

据悉，其中部分敏感信息可用于访问下载量达15万次的项目，使威胁者能够上传恶意版本的扩展程序，造成严重的供应链安全风险。

Open VSX由Eclipse基金会主导开发，是微软Visual Studio应用市场的开源替代方案，后者为VSCode集成开发环境（IDE）提供扩展程序。 Open VSX作为社区驱动的代码仓库，提供与VSCode兼容的扩展程序，供无法使用微软平台的人工智能驱动衍生工具（如Cursor和Windsurf）使用。

GlassWorm恶意软件 campaign

泄露的部分令牌在数日后被用于一场名为“GlassWorm”的恶意软件攻击活动。Koi Security研究人员报告称，GlassWorm将一款自我传播型恶意软件隐藏在不可见的Unicode字符中，试图窃取开发者凭证，并在所有可触及的项目中引发连锁性数据泄露。这些攻击还针对49个扩展程序中的加密货币钱包数据，表明攻击者的动机可能是获取经济利益。

Open VSX团队及Eclipse基金会发布博客文章回应此次攻击活动与令牌泄露事件，称GlassWorm实际上并不具备自我复制能力，但确实以开发者凭证为攻击目标。

Open VSX团队澄清道：“涉事恶意软件旨在窃取开发者凭证，进而扩大攻击者的影响范围，但它不会自主通过系统或用户设备传播。”报告中提到的3.58万次下载量高估了实际受影响用户数量，其中包含攻击者利用机器人和提升曝光度的手段制造的虚假下载量。”

尽管如此，事件在接到通知后迅速得到控制。截至10月21日，所有恶意扩展程序已从Open VSX代码仓库中移除，相关访问令牌也已完成轮换或撤销。

Open VSX目前已确认，事件已完全得到控制，无持续影响，且计划实施额外安全措施以防范未来攻击。

四、后续安全强化措施

此次将实施的安全增强措施如下：

1. 缩短令牌有效期，降低泄露后的影响范围；

2. 推出更快速的泄露凭证撤销流程；

3. 扩展程序发布时进行自动化安全扫描；

4. 与VSCode及其他应用市场合作，共享威胁情报。 

需要注意的是，有媒体向Eclipse基金会发送邮件，询问总共轮换了多少个令牌，但截至目前尚未收到回应。

与此同时，Aikido公司报告称，GlassWorm背后的同一批威胁者已转向GitHub平台，他们采用相同的Unicode隐写术技巧隐藏恶意负载。

研究人员表示，该攻击活动已扩散至多个代码仓库，其中大部分集中在JavaScript项目。此次转向GitHub表明，该威胁仍在活跃，在被曝光后迅速在开源生态系统中转移攻击目标。

South Korea’s largest mobile carrier, SK Telecom, has reported a dramatic decline in operating profit for the third

The post Cyber Fines & Fallout: SK Telecom Profit Plunges 90% After Massive Data Breach appeared first on Penetration Testing Tools.

Former employees of the U.S.-based company DigitalMint, which specialized in negotiating with hackers on behalf of ransomware victims,

The post The Betrayal: Feds Charge DigitalMint Employees with Running ALPHV/BlackCat Ransomware Attacks appeared first on Penetration Testing Tools.

Peter Williams, former chief executive of Trenchant—a division within the defense contractor L3Harris—has recently pleaded guilty to stealing

The post The Betrayal: Defense Exec Stole 8 Zero-Days Valued at $35M, Sold to Foreign Broker appeared first on Penetration Testing Tools.