Afraid of missing important security news during the week? We’re here to help! Every week we put together a curated list of all important security news in one place, for your reading pleasure. Enjoy!
For the less technical
- WebAssembly and back again: Fine-grained sandboxing in Firefox 95
- Users with a pirated version of Office are getting a discount offer for a Microsoft 365 subscription
- Amazon is shutting down web ranking site Alexa.com
- New German government coalition promises not to buy exploits
- Swiss tech company boss accused of selling mobile network access for spying
- The popular family safety app Life360 is selling precise location data on its tens of millions of users
- Privacy predictions 2022
- Russia’s Internet censorship machine is going after Tor
- Responding to Tor censorship in Russia
- UK High Court reverses course, approves Julian Assange’s extradition to US
- FIN7 hacker trialed in Russia gets no prison time
- BitMart security breach
- Colorado energy company loses 25 years of data after cyberattack while still rebuilding network
- Operation Ironside Phase 2 to land second blow to organised crime
For the more technical
- Log4Shell: RCE 0-day exploit found in log4j2, a popular Java logging package
- Researchers release ‘vaccine’ for critical Log4Shell vulnerability
- Microsoft’s response to CVE-2021-44228 Apache Log4j 2
- Windows 10 RCE: The exploit is in the link
- QNAP warns of new crypto-miner targeting its NAS devices
- Security and privacy of VPNs running on Windows 10 (PDF)
- The hidden side of Seclogon: Abusing leaked handles to dump LSASS memory
- Tracking a P2P network related to TA505
- Awesome Telegram OSINT
- MANGA aka Dark Mirai-based campaign targets new TP-Link router RCE vulnerability
- When honey bees become murder hornets
- 1.6 million WordPress sites hit with 13.7 million attacks in 36 hours from 16,000 IPs
- Grafana fixes zero-day vulnerability after exploits spread over Twitter
- Malicious npm packages are after your Discord tokens – 17 new packages disclosed
- LaserShark: Establishing fast, bidirectional communication into air-gapped systems (PDF)
- Phishing attacks use QR codes to steal banking credentials
- The life cycle of phishing pages
- Emotet now drops Cobalt Strike, fast forwards ransomware attacks
- Magnat campaigns use malvertising to deliver information stealer, backdoor and malicious Chrome extension
- ALPHV BlackCat – This year’s most sophisticated ransomware
- New Yanluowang ransomware found to be code-signed, terminates database-related processes
- Confluence and GitLab servers targeted by new ransomware strain
- BlackCat: New Rust based ransomware borrowing BlackMatter’s configuration
- A Special Investigation exposing a ransomware group’s clear-web IP and their duplicate identities
- Chasing Shadows: A deep dive into the latest obfuscation methods being used by ShadowPad + more information
- Suspected Russian activity targeting government and business entities around the globe
- Is “KAX17” performing de-anonymization attacks against Tor users?
- Microsoft seizes domains used by Chinese cyber-espionage group Nickel (APT15)
- Karakurt rises from its lair
- Disrupting the Glupteba operation
Did you enjoy this list? You can subscribe to one of our feeds on Twitter, Facebook or RSS.