May 25, 2024

Weekly Cyber Security
News Events &Information

From sources found online in the past seven days

Hello all,

Thankfully, this week has been somewhat low in major vulnerability and attack reveals. There are still enough, and if a product or service that you use is mentioned in our lists below, then to your organization it is major and needs to be treated as such. Google appears to be throwing some stones at Microsoft, but their glass house is getting some chips while they’re at it. Read on.

The volume of news and other can appear overwhelming, the best strategy is to read the Notable Callouts below and then skim the full list of linked news item titles that follow for things that pertain to you or your environment or simply interest you, and then selecting them for more information. So, let’s get to it. And don’t forget, our site, https://red-n-security.com also has searchable archives of past newsletters.

Notable Callouts:

Fortinet patched flaws in FortiOS and FortiProxy SSL-VPN. Since threat actors search for theses like ravenous wolves, it is critical to patch ASAP.
Google Chrome received several update cycles this past week, including a fix for the eighth actively exploited zero day this year. Update your browser now.
Google has come out and said that, based on the US Government’s report about Microsoft’s security lapses, it is clear that Microsoft is insecure and government entities and corporations should switch to Google. Microsoft, for their part, has doubled down on their security efforts and are even tying executive compensation to security. However, Google isn’t quite the shining star they make themselves out to be. Read on below.
Microsoft announced a new feature for Windows 11 called Recall for Copilot+PCs. Critics immediately pounced on it, calling it spyware – which by definition it actually is. It’ll be interesting to see how this plays out. But for now, you’re safe. Due to power requirements, it will need one of the new spiffy Copilot+PCs that were just unveiled.
Ivanti, just reading the name in the news makes me shudder, released patches this week. Several vulnerabilities were plugged in Endpoint Manager. Update now. Stop reading and go do it. We’ll still be here.
QNAP patched a few more items that needed fixing, with a few still pending. Update as appropriate.
Rockwell Automation issued an advisory “…urging all customers to take IMMEDIATE action to assess whether they have devices facing the public internet and, if so, urgently remove that connectivity for devices not specifically designed for public internet connectivity”. Rockwell further advised that clients should ensure that all devices were checked for outstanding updates. CISA followed suit and issued a notice reiterating what Rockwell published.

In Ransomware, Malware, and Vulnerabilities News:

Deepfakes Rank as the Second Most Common Cybersecurity Incident. That is staggering, and scary. That was fast. What will the next 12 months bring?
Scattered Spider was responsible for several very high-profile casino attacks. Good news from the FBI is that they are closing in on the criminals. Some arrests have already been made, and more are on the way. Hooray for the good guys!

In Other News Events of Note and Interest:

Google, as promised above, recently lost everything belonging to a very large client. The only way the client was able to recover was because they’d created backups that were not being held by Google. And in another “don’t throw stones” event, Google’s cloud went down twice this month already. I think losing everything would be worse than having someone exfil. But what do I know?
Malwarebytes apparently has a scanning tool that will let you know if you’ve had data breached and more. Check it out.

In Cyber Insurance News:

SEC turns up heat, boosting importance of cyber insurance. A good quote from the article reads, “Any business that has customers, a bank account or holds information about any customer or client should have cybersecurity coverage”. Did that leave anyone out?

It is only May, and unfortunately the airborne army of darkness, aka mosquitoes, are out in force where I live. They are blood-thirsty, horrible, merciless, relentless, unwanted invaders that will do anything to get at their desired goal – a gallon of my blood! And if they get any blood, they’ll just breed more! They remind me of cyber criminals, blood-thirsty, horrible, merciless, relentless, unwanted invaders that will do anything to get at their desired goal – your money or secrets. And if cyber criminals get paid, it’ll just breed more. So, just like with the diminutive menaces, make sure you employ the correct defenses. Otherwise, you’re in for a painful experience when they bite.

Headline NEWS

Ransomware, Malware, and Vulnerabilities News

Other News Events of Note and Interest

Cyber Insurance News

Like this: