Supplemental Cyber Highlights – December 28, 2023
Created: Thursday, December 28, 2023 - 20:26
Categories: Cybersecurity, Security Preparedness
The following posts are useful for general awareness of current threats, vulnerabilities, guidance, and other cyber-related news or updates. These resources have been curated by the WaterISAC analyst team as items of broad relevance and benefit that do not need supplemental analysis at this time.
IT Vulnerabilities
- Barracuda Zero-Day Used to Target Government, Tech Organizations in US, APJ (Security Week)
- Yet Another Apache Struts 2 Vulnerability – CVE-2023-50164 (Qualys)
- Critical Zero-Day in Apache OfBiz ERP System Exposes Businesses to Attack (The Hacker News)
IT Malware, Threats & Risks
- In Cybersecurity and Fashion, What’s Old Is New Again (Dark Reading)
- Essential DDoS statistics for understanding attack impact (HelpNetSecurity)
- Careless oversight of Linux SSH servers draws cryptominers, DDoS bots (The Record)
- How the new Instegogram threat creates liability for organizations (CSO Online)
- ‘BattleRoyal’ Hackers Deliver DarkGate RAT Using Every Trick (Dark Reading)
- Fake VPN Chrome extensions force-installed 1.5 million times (Bleeping Computer)
- New Rugmi Malware Loader Surges with Hundreds of Daily Detections (The Hacker News)
Ransomware Awareness
- Ransomware Leak Site Victims Reached Record-High in November (InfoSecurity Magazine)
Cyber Resilience
- Understanding the NSA’s latest guidance on managing OSS and SBOMs (CSO Online)
- A practical guide to measurable phishing simulation testing (SC Magazine)
- Cloud Security Optimization: A Process for Continuous Improvement (Tripwire)
General Awareness & Reports
- 12 Months of Fighting Cybercrime & Defending Enterprises | SentinelLabs 2023 Review (Sentinel One)
- 4 sneaky scams from 2023 (Malwarebytes)
- Malicious GPT Can Phish Credentials, Exfiltrate Them to External Server: Researcher (Security Week)
- NSA Releases 2023 Cybersecurity Year in Review Report (Heimdal Security)
Technical Posts (for network defenders, security analysts, sysadmins, and other nerds)