Code Defender

All enterprises conduct security awareness training for their employees. But whether this has tangible benefits is debatable.

The post Security Awareness Training Isn’t Dead, but It Needs a Rethink appeared first on SecurityWeek.

The security defects could lead to unauthorized access, information leaks, privilege escalation, DoS attacks, and remote code execution.

The post Cisco Patches a Dozen Critical Vulnerabilities appeared first on SecurityWeek.

Cyber-espionage actor UAC-0099 has been steadily refining its flagship dropper in campaigns targeting Ukrainian organizations.

The first cybercriminal to ever make the FBI’s “10 Most Wanted Fugitives” list allegedly infused Tren de Aragua’s violent criminal operations with cash.

A now-patched vulnerability in AWS Bedrock AgentCore could allow an attacker to use one AI chatbot to take over an organization’s entire fleet.

The crooks have trust problems of their own. One ransomware affiliate decided to keep the profits for himself. Elsewhere, an attacker left a server exposed, complete with tools and traces of an intrusion. Apparently, keeping things secure is a problem on both sides of the fence.

The rest of the week isn’t much more reassuring. Malicious code turned up in developer packages and extensions that

Hackers tied to a Chinese cybersecurity company stole email from government organizations, law enforcement agencies, healthcare systems, and religious institutions in Southeast Asia, the FBI and agencies in 6 other countries said on October 8.

The company, Integrity Technology Group, has been sanctioned by the U.S. and the UK. The hackers scanned websites for flaws using a tool containing more

The company said its investigation, carried out with external experts, found the attackers had accessed “some personal information, including names and contact details, and certain non-personal account related information.”

The owner of a ransomware recovery firm was hit with wire fraud charges for allegedly making secret ransom payments while overcharging the victims of attacks.

The U.S. and other nations took down digital tools and infrastructure by Beijing-based Integrity Tech that allowed “widespread vulnerability scanning and, in some cases, intrusions” as part of the Flax Typhoon campaign.