September 2021

Apple Pay With VISA Lets Hackers Force Payments On Locked iPhones Academic researchers have found a way to make fraudulent payments using Apple Pay from a locked iPhone with a Visa card in the digital wallet with express mode enabled. The method is akin to a digital version of pickpocketing. Read more…

Facebook Open-sources Tool To Find Android App Security Flaws Facebook today open-sourced a static analysis tool its software and security engineers use internally to find potentially dangerous security and privacy flaws in the company’s Android and Java applications. This security-focused tool, dubbed Mariana Trench (MT), can analyze large codebases of tens of millions of lines of Read more…

Russia Arrests Cybersecurity Firm CEO After Raiding Offices Russian law enforcement on Tuesday has arrested Ilya Sachkov, the co-founder and CEO of cybersecurity company Group-IB, on suspicion of high treason resulting from sharing data with foreign intelligence. While details about the accusations have yet to be disclosed, a court in Moscow decided Read more…

CISA Releases Tool To Help Orgs Fend Off Insider Threat Risks The US Cybersecurity and Infrastructure Security Agency (CISA) has released a new tool that allows public and private sector organizations to assess their vulnerability to insider threats and devise their own defense plans against such risks. The Insider Risk Mitigation Read more…

Trucking Giant Forward Air Reports Ransomware Data Breach Trucking giant Forward Air has disclosed a data breach after a ransomware attack that allowed threat actors to access employees’ personal information. In December 2020, Forward Air suffered a ransomware attack by what was believed to be a new cybercrime gang known as Hades. Read more…

New Tomiris backdoor likely developed by SolarWinds hackers Kaspersky security researchers have discovered a new backdoor likely developed by the Nobelium hacking group behind last year’s SolarWinds supply chain attack. This comes on the heels of another report published by Microsoft two days ago detailing FoggyWeb, a “passive and highly targeted” Read more…

New Android Malware Steals Millions After Infecting 10M Phones A large-scale malware campaign has infected more than 10 million Android devices from over 70 countries and likely stole hundreds of millions from its victims by subscribing to paid services without their knowledge. GriftHorse, the trojan used in these attacks, was Read more…

NSA, CISA Share VPN Security Tips To Defend Against Hackers (edited) The U.S. Cybersecurity and Infrastructure Security Agency (CISA) and the National Security Agency (NSA) have released guidance for hardening the security of virtual private network (VPN) solutions. The two agencies created the document to help organizations improve their defenses Read more…

FinFisher Malware Hijacks Windows Boot Manager With UEFI Bootkit Commercially developed FinFisher malware now can infect Windows devices using a UEFI bootkit that it injects in the Windows Boot Manager. FinFisher (also known as FinSpy and Wingbird) is a surveillance solution developed by Gamma Group that also comes with malware-like capabilities often found Read more…