SEARCH
All Articles
CISA Directive Aims to Help Federal Agencies Detect Flaws on Network
CISA hopes the new directive will improve and provide measurable processes for asset detection and vulnerability discovery across U.S. federal agencies.
Bumblebee Loader Evolves to Drop New Payloads
The Bumblebee malware loader is delivering separate payloads for different machines and using new evasion techniques.
Lazarus Group Exploited Dell Driver Flaw to Disable Windows Monitoring Features
Researchers said the Lazarus Group attacks were the first recorded abuse of the known Dell driver flaw (CVE-2021-21551) in the wild.
Attackers Exploiting Two Microsoft Exchange Zero Days
Attackers are exploiting two new Microsoft Exchange zero days ( CVE-2022-41040 and CVE-2022-41082) in the wild. Microsoft is working on a patch.
Decipher Podcast: Source Code 9/30
Welcome back to Source Code, Decipher's weekly security news podcast.
Threat Actor Delivered Malware Via Trojanized Live Chat Installer
The trojanized file was identified at organizations in the industrial, healthcare, technology, manufacturing, insurance and telecommunications sectors in North America and Europe, according to researchers.
Novel Malware Installed in VMware ESXi Attacks
Attackers used a unique tactic to install backdoors after compromising multiple organizations' VMware ESXi servers.
Lazarus Group Affiliate Uses Trojanized Open Source Apps in New Campaigns
Zinc, a Lazarus group offshoot, is using trojanized versions of open source apps such as KiTTY and PuTTY in a new phishing campaign.
New Chaos Malware Targets Windows and Linux Devices
A new piece of malware known as Chaos that is built for Windows and Linux systems is infecting home routers, enterprise servers, and other devices and launching DDoS attacks.
Phishing Attack Targets Microsoft Flaw to Deliver Cobalt Strike
The attack was first discovered in August after victims received phishing emails containing malicious document attachments.
Node.js Update Fixes High Severity Flaws
An update for the Node.js framework includes fixes for DNS rebinding and HTTP smuggling vulnerabilities.
Watchdog Report Highlights Nuclear Agency’s Security Shortcomings
The Government Accountability Office criticized the National Nuclear Security Administration's mixed risk management practices around operational technology devices and its lax oversight of subcontractor cybersecurity practices.
CISA: Critical Zoho ManageEngine Flaw Actively Exploited
The critical-severity unauthenticated remote code execution flaw is now being actively exploited, according to CISA.
Decipher Podcast: Source Code 9/23
Welcome to Source Code: Decipher's behind-the-scenes look at the weekly news with input from our sources.
The NSA is Here to Help
The NSA's new Cybersecurity Collaboration Center is the centerpiece of an effort to provide more information and context for private sector defenders.