Software supply chain security takes center stage at Black Hat 2022
software-supply-chain-security-takes-center-stage-at-black-hat-2022
Software supply chain security takes center stage at Black Hat 2022
OpenSSF's open source security mobilization initiative: Inside the 10-point action plan
Here is a run-down of the 10 streams from OpenSSF's Open Source Software Security Mobilization Plan.
New Features for TitaniumScale, version 3.0
Updates include: Improved static analysis, improved integrations and automation, smoother workflows for a better user experience, and ease of administration.
Threat analysis: Follina exploit fuels 'live-off-the-land' attacks
An analysis of three in-the-wild payloads delivered using the recently discovered Follina exploit shows how attackers can use it to achieve persistent access in victim environments and turbo-charge efforts to ‘live off the land’ and avoid detection by security monitoring tools.
New Features for the A1000, version 6.4
Better threat hunting and investigations with flexibility in threat status classifications, reliable dynamic and network analysis, and smoother workflows and maintenance.
The Week in Cybersecurity: SolarWinds attackers tap Google Drive, malware spreads via Play Store apps
Cozy Bear APT group is using Dropbox and Google drive to cover up attacks, malware is spreading via Google Play Store apps, and more.
Three decades later, ransomware's first act still resonates
More than 30 years after the AIDS computer virus spread via infected floppy disks, ransomware has taken the world by storm. But echoes of that first attack can still be heard today.
CISA: Log4j threat will linger for years—so be prepared
A survey of the post-Log4j landscape found few successful hacks linked to it. The bad news? Log4Shell will linger for years — so you need to prepare.
The Week in Cybersecurity: Chips hit by 'Retbleed', journalists the chosen target of APTs
A new attack known as ‘Retbleed’ impacts microprocessors, journalists are becoming desirable targets for cybercriminals, and more.
The Week in Cybersecurity: NPM removes malicious modules, Microsoft backtracks on macros
Fallout from another supply chain attack involving malicious npm modules. Also: Microsoft backtracks on a pledge to disable Office macros.
Update: IconBurst npm software supply chain attack grabs data from apps and websites
ReversingLabs researchers have uncovered a widespread campaign to install malicious npm modules that are harvesting sensitive data from forms embedded in mobile apps and websites.
The Week in Cybersecurity: NATO creates cyber rapid response
International relations intersects with cybersecurity, learn how to leverage YARA rules, plus new developments on AstraLocker 2.0.
SBOM Facts: Know what's in your software to fend off supply chain attacks
SBOM Facts: Know what's in your software to fend off supply chain attacks
Smash-and-grab: AstraLocker 2.0 pushes ransomware direct from Office docs
ReversingLabs recently discovered instances of the AstraLocker 2.0 malware distributed directly from Microsoft Word files used in phishing attacks.
The Week in Cybersecurity: Austrian hackers-for-hire KNOTWEED serve up Subzero malware
Austrian group KNOTWEED spreads malware via Microsoft products, new malware-infested apps pop up in the Google Play store, and mo