SecurityWeek

Italian siblings Giulio Occhionero and Francesca Maria Occhionero have been arrested in Rome, charged with conducting a long-running cyber espionage campaign against leading Italian politicians, businessmen and Masons.

Trend Micro’s Zero Day Initiative (ZDI) published 674 advisories last year and paid out nearly $2 million to researchers who submitted vulnerabilities, the company said in its “2016 Retrospective” report.

A newly spotted piece of ransomware allows users not only pay to recover their encrypted files, but also for immunity from future attacks, Emsisoft security researchers warn.

The smartphones of dozens of Israeli soldiers were hacked by Hamas militants pretending to be attractive young women online, an Israeli military official said Wednesday.

The group calling itself “Shadow Brokers” has apparently decided to start selling Windows exploits and what appear to be anti-virus bypass tools on a BitTorrent-powered ZeroNet peer to peer web platform.

Nearly 33,000 MongoDB databases have been hijacked as of today, the latest numbers associated with a series of attack campaigns that have been picking up pace over the past couple of weeks show.

Updates released on Monday for the Ansible IT automation platform address a security bypass vulnerability that can be exploited to execute arbitrary commands on the Ansible controller and gain access to the hosts connected to it.

The RIG exploit kit (EK) managed to grab nearly 35% of the overall EK activity during the last month of 2016, retaining the leading spot in the landscape for the fourth month in a row, Symantec reports.

Machine Learning Speed Up Remediation, But Will it Ever be Able to Autonomously Protect Organizations Against Cyber-attacks?

Proof-of-concept (PoC) code released by a researcher for a denial-of-service (DoS) vulnerability affecting the Local Security Authority Subsystem Service (LSASS) in Windows has led to the discovery of a different, but similar, flaw.

Connectivity solutions provider D-Link Systems has retained the Cause of Action Institute to help it fight against the “unwarranted and baseless” charges brought by the U.S. Federal Trade Commission (FTC).

Microsoft has addressed vulnerabilities affecting Windows, Office and the Edge web browser, but the company’s January 2017 Patch Tuesday updates include only four security bulletins.

SAP on Tuesday released its first set of monthly security patches for 2017, which addresses numerous Cross-Site Scripting (XSS) and Missing Authorization Check issues across its products.

Adobe informed users on Tuesday that updates released for Acrobat, Reader and Flash Player patch a total of 42 vulnerabilities, including many that could lead to arbitrary code execution.

After the fall of the Nuclear and Angler exploit kits (EKs), overall activity generated from exploit kits has dropped to only a fraction of what used to be.

E-Sports Entertainment Association (ESEA) Becomes the Latest Data Breach Victim With Data of 1.5 Million Users Stolen

Phantom, a cybersecurity startup that has developed a community-powered security automation and orchestration platform, announced that it has raised $13.5 million in a Series B funding round led by iconic Silicon Valley VC firm Kleiner Perkins.

Fortinet announced on Tuesday said that it has hired former NSA Cyber Task Force Chief, Phil Quade, as Chief Information Security Officer (CISO).

The California Department of Insurance on Friday revealed that an investigation into the data breach of health insurance giant Anthem Inc. has concluded that a foreign country was behind the attack.

St. Jude Medical has released security updates to patch some of the flaws discovered by MedSec in its cardiac devices, but the manufacturer insists that the risk of cyberattacks is very low.