News

The City of Knoxville, Tennessee, was forced to shut down its entire computer network following a ransomware attack that took place overnight and targeted the city's offices. Knoxville has a population of over 180,000, it's Tennessee's third-largest city after Nashville and Memphis, and it's also part of the Knoxville Metropolitan Statistical Area, with a reported population of almost 870,000 in 2015. Computers on Knoxville's network were encrypted overnight, with the attack being noticed by employees of the city's fire department around...

Fortune 500 insurance holding company Genworth Financial disclosed a data breach after an unauthorized party gained access to insurance agents' online accounts using compromised login credentials. The U.S. mortgage and long term care insurer had revenue of $8,6 billion during the last fiscal year and it reached a deal with China Oceanwide Holdings Group that will allow the Chinese company to buy Genworth for $2.7 billion. Genworth's services and products are offered through financial advisors, intermediaries, as...

TAIT, one of the world's leading live event solutions providers, disclosed a data breach that led to the exposure of personal and financial information stored on a server and on the email accounts of some of its employees. The TAIT group of companies (Brilliant, Kinesys, Production Glue, Stage Technologies, TAIT UK, and TAIT Navigator) employs over 900 people in 14 office locations around the world and has been a provider of live experience solutions in over 30...

The increasingly prevalent GuLoader malware has been traced back to a far-reaching encryption service that attempts to pass as above-board. An Italian company that sells what it describes as a legitimate encryption utility is being used as malware packer for the cloud-delivered malicious GuLoader dropper, claim researchers. The tool, according a recent investigation, creates GuLoader samples and helps the malware avoid antivirus detection. For its part, the company claims it has taken steps to prevent...

Slovak authorities have arrested four suspects on Tuesday as part of an investigation into a series of suspicious devices found connected to the government's official IT network. According to local news site Aktuality, the equipment is believed to have been used for wiretapping purposes and would have allowed threat actors to intercept both internet and telephony operations. The devices, believed to be some type of servers, were connected to GOVNET, a network that interconnects different Slovak...

Microsoft has published a report today detailing a never-before-seen series of attacks against Kubeflow, a toolkit for running machine learning (ML) operations on top of Kubernetes clusters. The attacks have been going on since April this year, and Microsoft says its end-goal has been to install a cryptocurrency miner on Kubernetes clusters running Kubeflow instances exposed to the internet. According to Yossi Weizman, a security researcher with Microsoft's Azure Security Center, the company has detected...

The Thanos ransomware is the first to use a researcher-disclosed RIPlace anti-ransomware evasion technique as well as numerous other advanced features that make it a serious threat to keep an eye on. Thanos first began private distribution at the end of October 2019, but it was not until January 2020 when victims seeking help for what was called then the Quimera Ransomware. As time went on, victims continued to seek help in the BleepingComputer forums for the...

A phishing email campaign asking you to vote anonymously about Black Lives Matter is spreading the TrickBot information-stealing malware. Started as a banking Trojan, the TrickBot has evolved to perform a variety of malicious behavior. This behaviour includes spreading laterally through a network, stealing saved credentials in browsers, stealing Active Directory Services databases, stealing cookies and OpenSSH keys, stealing RDP, VNC, and PuTTY Credentials, and more. TrickBot also partners with ransomware operators, such as Ryuk, to give access to a compromised...

You only have to read the news on this very website to find countless stories of instances where companies have inadvertently left a database exposed on the web - it’s every security professional’s worst nightmare.   Researchers at Comparitech, who will often be the source of finding these misconfigured databases to alert the unsuspecting company, decided to set up a honeypot experiment to see just how little time it would take before such a database...

One Identity has recently introduced a new feature within One Identity Safeguard for Privileged Passwords 6.6, which manages and secures the use of corporate personal passwords to access corporate third-party accounts. Corporate users can store their passwords for online accounts to services within a new Personal Password Vault. By leveraging the feature - which is free for all users at Safeguard licensed companies - organisations can ensure proper control over, as well as policy adherence...