Attacks/Breaches

A recent analysis of breaches involving application programming interfaces (APIs) arrives at some eye-popping damage figures, but which companies are most affected, and in what ways?

Malicious ISS module exploitation is the latest trend among threat actors targeting Exchange servers, analysts say.

Titaniam’s ‘State of Data Exfiltration & Extortion Report’ also finds that while over 70% of organizations had heavy investments in prevention, detection, and backup solutions, the majority of victims ended up giving into attackers' demands.

There were a record number of zero-day attacks last year, but some basic cyber-hygiene strategies can help keep your organization more safe.

The malware has been in circulation since 2020, with sophisticated, advanced malicious actors taking advantage of the vulnerabilities in SOHO routers as the work-from-home population expands rapidly.

In the always-changing world of cyberattacks, preparedness is key.

The clever, interactive phishing campaign is a sign of increasingly complex social-engineering attacks, researchers warn.

Researchers this week said they had observed criminals using a new and improved version of the prolific malware, barely three months after its authors announced they were quitting.

The previously unknown state-sponsored group is compromising industrial targets with the ShadowPad malware before burrowing deeper into networks.

Swarms of breach attempts against the Atlassian Confluence vulnerability are likely to continue for years, researchers say, averaging 20,000 attempts daily as of this week.

Developers need to think like WAF operators for security. Start with secure coding and think of Web application firewalls not as a prophylactic but as part of the secure coding test process.

Like a hydra, every time one ransomware gang drops out (REvil or Conti), plenty more step up to fill the void (Black Basta).

Abuse primitives have a longer shelf life than bugs and zero-days and are cheaper to maintain. They're also much harder for defenders to detect and block.

Researchers have created a new community website for reporting and tracking security issues in cloud platforms and services — plus fixes for them where available.

If you haven't properly addressed the issue, you're already behind. But even if you've had a false start, it's never too late to get back up.