Breaches, vulnerabilities and the people cleaning up after them. Reporting for defenders, not for panic.
A 35-year-old man pleaded guilty to participating in Ryuk attacks that targeted U.S. organizations and generated over $15 million in ransom payments between 2019 and 2020.
F5 has released patches for a critical remote code execution vulnerability in BIG-IP APM that is already being exploited in the wild. The flaw affects OAuth Authorization Server configurations and has prompted CISA to add it to its Known Exploited Vulnerabilities catalog.
Researchers at Varonis Threat Labs have uncovered an attack that exploits Microsoft Entra's external MFA provider model to capture user credentials during login. The technique, which requires prior compromise of a privileged account, inserts a fake password prompt into the authentication flow.
Sweden's IMY data protection authority has penalized the HR systems vendor for inadequate monitoring and software validation practices that enabled a ransomware attack affecting over 200 municipalities.
The extortion group claims it exploited an unpatched Oracle PeopleSoft vulnerability to breach FBI infrastructure, access AWS GovCloud, and steal sensitive records on employees and job applicants. The group says it is now using the same zero-day against Fortune 500 companies.
Microsoft's Digital Crimes Unit has coordinated a takedown of the EvilTokens phishing-as-a-service operation, which exploited device-code authentication to breach over 12,000 accounts across more than 10,000 organizations worldwide.
A September 23 webinar will examine how attackers leverage social engineering and malicious OAuth applications to compromise Google Workspace environments, and what defenders should prioritize in response.
D-Link has disclosed a maximum-severity stack-based buffer overflow in its legacy DIR-822A Wi-Fi routers that can be exploited remotely without authentication, with proof-of-concept code already public and no patch available.
