SecurityWeek

A team of researchers has demonstrated a new attack method that affects iPhone owners who use Apple Pay and Visa payment cards. The vulnerabilities exploited in the attack remain unpatched, but the impacted vendors say they are not concerned.

A Turkish national has been indicted in the Northern District of Illinois for launching a distributed denial-of-service (DDoS) attack against a hospitality company headquartered in the United States.

How do you make sure you are choosing the right solutions for your organization?

Facebook's security team on Wednesday pulled the curtain on Mariana Trench, an open-source tool that it has been using internally to identify vulnerabilities in Android and Java applications.

Real-time user behavior analysis platform ForMotiv this week announced it has raised $6 million in a third seed funding round. The company has raised a total of $7.5 million to date.ForMotiv’s new funding round was led by Vestigo Ventures. DreamIt Ventures and Plug & Play Ventures also participated.

Edge security and content delivery giant Akamai Technologies on Wednesday announced plans to spend $600 million to acquire Guardicore, an Israeli micro-segmentation technology startup.Akamai said the deal would add new capabilities to help customers thwart ransomware attacks by blocking the spread of malware within an already-compromised enterprise.

Threat hunters at Kaspersky have intercepted a new cyberespionage implant being delivered via targeted DNS hijacking of government zones in Eastern Europe and published a new report Wednesday with clues linking the malware to the SolarWinds attackers.

Root out ineffective security practitioners to keep your security teams protected and engaged in a productive manner

Several China-linked cyberespionage groups were observed intensifying attacks on a major telecom firm in Afghanistan just as the United States was finalizing its withdrawal from the country.

The COVID-19 pandemic has enlarged the threat landscape for all industry sectors; but none more so than healthcare. The primary areas of concern include insecure working from home, and stress related lax behavior at the office.

The National Security Agency (NSA) and the Cybersecurity and Infrastructure Security Agency (CISA) this week published a new document to help government organizations select and secure virtual private network (VPN) solutions.

Google this week announced that it is offering monetary payouts to individuals who help expand the detection capabilities of the Tsunami security scanner.Two types of contributions are currently accepted in the experimental reward program, namely vulnerability detection plugins and web application fingerprints.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday informed organizations that some cameras made by Chinese video surveillance vendor Hikvision are affected by a critical vulnerability.

Russia on Wednesday detained the head of one of the country's leading cybersecurity firms on charges of treason, in a move that targets a company collaborating with the West on stemming cyberattacks.

Microsoft on Monday published a blog post detailing a piece of malware used by the threat actor behind the SolarWinds attack to exfiltrate data from compromised servers.

A new ransomware family called Colossus has snagged at least one victim in the United States as of last week, according to security researchers at ZeroFox.Targeting Windows systems, the Colossus ransomware was used in an attack on an automotive group of dealerships based in the U.S., with its operators threatening to leak 200 GB of stolen data.

Security researchers at Kaspersky have spotted signs of the notorious FinSpy surveillance spyware hijacking -- and replacing -- the Windows UEFI bootloader to perform stealthy infections on target machines.

QNAP, the Taiwan-based maker of network-attached storage (NAS) appliances, this week announced the availability of patches for a couple of critical vulnerabilities in its QVR video management solution.Tracked as CVE-2021-34348 and CVE-2021-34351 and featuring a CVSS score of 9.8, the vulnerabilities could be abused remotely to run arbitrary commands on affected systems.

Enterprise users have been warned that cybercriminals may be trying to phish their credentials by luring them with fake emails that appear to be related to services offered by security company Zix.