Vanderbilt University is bringing systems back online after a cybersecurity incident claimed by the BYOD ransomware group. Vanderbilt University is a private research university in Nashville, Tennessee. Founded in 1873, it now serves more than 13,800 undergraduate, graduate, and professional students across 12 schools and colleges, with programs ranging from engineering and education to law, medicine, and nursing. READ MORE...
Shipping giant Maersk has confirmed that hackers extracted data from one of its IT systems, while an extortion group claims to have stolen sensitive information and is demanding $5 million. In a November 11 statement, the Danish company said the affected system was inherited through an earlier acquisition. Maersk has not identified the acquired business. The company said its cybersecurity team discovered the intrusion and launched an investigation. READ MORE...
Google and Mozilla have released fresh Chrome and Firefox security updates that resolve more than 180 vulnerabilities. The Chrome refresh fixes 83 security defects, including five critical-severity use-after-free issues in ServiceWorker, CSS, Layout, Skia, and Accessibility. All the remaining 78 bugs are high-severity weaknesses, mostly use-after-free (24), out-of-bounds read/write (10), type confusion (9), uninitialized resource (9), and incorrect/missing authorization (8). READ MORE...
The cybercrime group Qilin has emerged as the world's most active ransomware affiliate program, claiming at least 365 victim organizations in the past three months alone. But even top Russian hackers make operational security mistakes, and the administrator of Qilin has made a few key missteps over the last decade that point to a 36-year-old man living in St. Petersburg, Russia. Operating since September 2022, the Russia-based ransomware group Qilin is currently the most industrious RAAS gang. READ MORE...
A threat actor deployed an AI model during a stalled cyberattack and rescued the campaign, achieving lateral movement in the process. The attack, detailed today by Symantec, targeted an unnamed US retail organization in September. The threat actor's hand-typed commands were repeatedly blocked, so the attacker switched to what appeared to be AI-generated commands and rapidly broke through the retailer's defenses. The attacker harvested credentials and achieved lateral movement within minutes. READ MORE...
Over one week in October, an online marketplace took 414,210 visits from traffic wearing the name of a widely used consumer AI agent. Every visit went for the sign-in page, and every one returned errors. Behind the name was a credential stuffing operation, with attackers running stolen username and password pairs against the site in bulk. The fake agent was busier than the real ones. Its volume came to about one and a half times all the genuine agent visits Cequence counted that week. READ MORE...
N-able is navigating a hectic crisis-management situation after the discovery of more than 30 alleged zero-day flaws in its N-central remote monitoring and management (RMM) platform, as well as the disclosure of exploits allowing attackers to execute commands, create administrator accounts, and escalate privileges to root. Realizing the critical security nature of the situation, N-able took its hosted N-central environments offline earlier this week. READ MORE...
Darktrace researchers turned Claude Code into a remote-controlled implant in a lab test, steering the coding agent through the memory stores feature of Anthropic's Claude platform and pulling a 1 GB file out through the Claude Files API. Once the agent was set up, every job and every result traveled through api.anthropic.com, the endpoint the agent already calls for inference, so the attacker's traffic looked like a coding agent doing its job. READ MORE...
Former certification authority eMudhra has claimed a buggy Python script is the main reason it issued laughably insecure digital certificates. eMudhra aimed to create eight ECDSA P-384 private keys which should have been 48 bytes long. But the script contained what they described as "a bug/defect in the import code [which] resulted in a read-back from the unwrapped object that truncated the private value." READ MORE...