Threat Management

Mandiant warns of attacks on newly-disclosed Ivanti remote takeover threat

A previously unknown remote code execution vulnerability in the Ivanti Connect Secure VPN platform is being actively exploited in the wild by Chinese threat actors, prompting alerts from Google’s Mandiant team

Threat Intelligence

WordPress attackers hide malware in overlooked plugins directory

The mu-plugins directory automatically loads files and is not listed with other plugins.

Ransomware

EDR killer links RansomHub with Play, Medusa, BianLian gangs

EDRKillShifter was used by the same affiliate in multiple attacks for different RaaS groups.

Security Operations

New research reveals flaws in security team performance metrics

IDC's survey of 900 security leaders reveals widespread use of volume-based metrics for team performance. How do we shift from measuring activity to measuring true impact?

Identity

Novel technique can unmask up to 70% of crooks hiding behind VPNs, proxies, Tor

Technique claims it can unmask crooks hiding behind VPNs, proxy servers and Tor browsers with up to 70% reliability.

DevSecOps

Dangerous npm package ‘patches’ legitimate software with malware

The malware targets the “ethers” package and opens a reverse shell.

The vast majority of cybersecurity pros would not recommend their current employers. (Adobe Stock)

MDR

How two organizations beat the cyber insurance maze

Boosting digital protections can lead to reduced cybersecurity insurance premiums. Here’s how two firms achieved that after signing up with a managed detection and response (MDR) provider.