Cybersecurity Highlights

Credential stuffing cyberattack aimed at The North Face

The North Face, an American sportswear retailer, has reported unauthorized access to its IT network.The incident, which took place on 8th and 9th of October, consisted of a credential stuffing...

References:

oag.ca.gov

bleepingcomputer.com

unaaldia.hipasec.com

Tags:

Cybercriminal steals $ 24 million from cryptocurrency service Harvest Finance

About 24 million USD in tokens have been stolen from Harvest Finance, a decentralized finance protocol (DeFi), by a cybercriminal.The incident, detected on October 26, thanks to analytics service...

References:

medium.com

zdnet.com

es.beincrypto.com

criptonoticias.com

technadu.com

Tags:

Microsoft and several cybersecurity firms dismantle the TrickBot botnet

Microsoft and Lumen's cybersecurity firms ESET, FS-ISAC, NTT, Symantec and Black Lotus Labs have teamed up to dismantle the TrickBot botnet, one of the most active and dangerous in the world,...

References:

blogs.microsoft.com

microsoft.com

welivesecurity.com

Symantec Enterprise Blogs

zdnet.com

news.microsoft.com

xataka.com

Tags:

Industrial Control System

Other critical infrastructures

Public administration

Tool

Leaked Bing search data through an Elasticsearch server

Ata Hakcil, a security researcher at WizCas, discovered an information leak in Microsoft's Bing search service. Through a misconfigured Elasticsearch server, 6.5TB of information from searches made...

References:

zdnet.com

blogs.masterhacks.net

wizcase.com

theregister.com

unaaldia.hispasec.com

Tags:

Vulnerabilities in the EMV protocol allow payments without PIN

The contactless payment protocol for EMV bank cards, named after its founders Europay, Mastercard and Visa, contains several security flaws that allow criminals to make payments without using the...

References:

emvrace.github.io

hackread.com

welivesecurity.com

europapress.es

xataka.com

Tags:

Freepik Company suffers credential theft due to SQL injection

Freepik Company, a company oriented to the search and purchase and sale of resources for designers such as photographs, icons or PSD templates, has suffered a security incident that affected its...

References:

freepik.com

bleepingcomputer.com

businessinsider.es

databreachtoday.com

welivesecurity.com

Tags:

FCM keys expose millions of users to spam and phishing

Security researcher Abhishek Dharani, known as Abss, has blogged an investigation related to a vulnerability in Firebase Cloud Messaging (FCM), a cloud solution for messages and notifications on...

References:

abss.me

portswigger.net

cybernews.com

nakedsecurity.sophos.com

Tags:

Canada Revenue Agency suffers credential stuffing attacks

The CIO office of the Government of Canada has issued a statement in which it reports cyberattacks of credential stuffing directed against the GCKey service (single sign-on system used to access...

References:

canada.ca

bleepingcomputer.com

hotforsecurity.bitdefender.com

cnnespanol.cnn.com

Tags:

Public administration

Tool

Garmin is a victim of the WastedLocker ransomware

The American company, Garmin, specialized in GPS technology for automotive, aviation, marine, outdoor and sports activities, has suffered a ransomware-like incident called WastedLocker.According to...

References:

garmin.com

bleepingcomputer.com

elmundo.es

elpais.com

unaaldia.hispasec.com

elespanol.com

Tags:

Cryptocurrency mining and DDoS attacks on Docker servers

Cyberattackers are taking the opportunity to target exposed Docker API endpoints, a project that automates the deployment of applications within software containers, to create images infected with...

References:

blog.trendmicro.com

unit42.paloaltonetworks.com

thehackernews.com

zdnet.com

unaaldia.hispasec.com

Tags:

Corporate access

Cybersecurity Highlights

Credential stuffing cyberattack aimed at The North Face

Cybercriminal steals $ 24 million from cryptocurrency service Harvest Finance

Microsoft and several cybersecurity firms dismantle the TrickBot botnet

Leaked Bing search data through an Elasticsearch server

Vulnerabilities in the EMV protocol allow payments without PIN

Freepik Company suffers credential theft due to SQL injection

FCM keys expose millions of users to spam and phishing

Canada Revenue Agency suffers credential stuffing attacks

Garmin is a victim of the WastedLocker ransomware

Cryptocurrency mining and DDoS attacks on Docker servers

Pages