Welcome to our weekly roundup, where we share what you need to know about cybersecurity news and events that happened over the past few days. This week, read about how the world’s largest meatpacker, JBS, was the target of an organised cybersecurity attack. Also, learn how a DarkSide ransomware variant is targeting virtual machine-related files on VMware ESXI servers.
Cybercriminal forums shows that cybercriminals have specific preferences, shown by the exploits they requisition, and that bug bounty programmes either are too slow, don’t pay enough, or are just the start of profit-making. In this Threatpost podcast episode, Mayra Fuentes, senior threat researcher at Trend Micro, discusses the people who are buying and selling exploits in the underground and why.
The DarkSide ransomware group is targeting organisations in manufacturing, finance, and critical infrastructures in regions such as the U.S., France, Belgium and Canada. In this blog, Trend Micro discusses how DarkSide targets virtual machine-related files on VMware ESXI servers, parses its embedded configuration, kills virtual machines (VMs), encrypts files on the infected machine, collects system information, and sends it to the remote server.
New security segment XDR combines elements of SIEM; security orchestration, automation, and response (SOAR); endpoint detection and response (EDR); and network traffic analysis (NTA) in a cloud-based platform. This centralises security data, threat hunting, and incident response. In this article, learn how analysts predict that XDR and SIEM are colliding.
The adoption of open-source code has increased exponentially over the past decade, with a large percentage of commercial software now using it. Developers are constantly sharing common features and code functionality across the internet and globe. In this blog, learn best practices to mitigate the unique risks that accompany its use.
On May 30, the world’s largest meatpacker, JBS USA, reported that it was the target of an organised cybersecurity attack, affecting some of the servers supporting its North American and Australian IT systems. The attack shut down operations across several Australian states, delaying certain transactions with customers and suppliers.
A new paper from the Cybersecurity Infrastructure Agency (CISA), National Security Agency, and the Office of the Director of National Intelligence has found three major potential threat vectors to 5G infrastructure: policy and standards, supply chain, and 5G systems architecture. There are two sub-threat vectors on the policies and standards category: open standards and optional controls. Learn more about the new report in this blog.
Over the past month, operators of Russian underground forums have been running a competition asking for papers that examine "how to target cryptocurrency-related technology." The contest requests unorthodox methods from the theft of private keys and wallets used to store cryptocurrency including Bitcoin and Ethereum, to submissions for "unusual" cryptocurrency mining software and proposals relating to smart contracts and non-fungible tokens (NFTs).
The rapidly evolving threat landscape requires partnership with a trusted cybersecurity expert that can provide protection across distributed endpoints, networks, cloud infrastructure and hybrid environments. Independent research plays a vital role for the cybersecurity buyer and that’s why Trend Micro is delighted to have maintained its leadership position across multiple cybersecurity environments—according to some of the world’s most respected authorities.
Researchers have disclosed significant security weaknesses in popular software applications that could be abused to deactivate their protections. Twin attacks aim at circumventing the protected folder feature offered by antivirus programmes to encrypt files and disable their real-time protection by simulating mouse "click" events.
Trend Micro researchers discovered a vulnerability in macOS rooted in the Core Virtual Machine Server (CVMServer). The vulnerability, labelled CVE-2021-30724, is triggered by an integer overflow leading to an out-of-bounds memory access, from which point privilege escalation can be attained. It affects devices running older versions of macOS Big Sur 11.4, iOS 14.6, and iPadOS 14.6.
What are your thoughts on the JBS attack? Share in the comments below or follow me on Twitter to continue the conversation: @JonLClay.