SecurityWeek

A group of academic researchers has devised practical attacks against major standards in email end-to-end encryption, which could lead to the exfiltration of sensitive information.

Security researchers at IBM have discovered a potentially serious vulnerability in a communications module made by Thales for IoT devices. Millions of devices could be impacted, but the vendor released a patch six months ago.

Chinese hackers infiltrated at least 10 Taiwan government agencies and gained access to around 6,000 email accounts in an attempt to steal data, officials said Wednesday.The damage done was "not small", according to a top Taiwan cyber official, who said the full impact was still being assessed. 

An ongoing cybercrime campaign is employing a technique known as HTML smuggling to deliver malware onto the victim’s machine, Menlo Security reports.Referred to as Duri, the campaign started in early July and continues to date, attempting to evade network security solutions, including proxies and sandboxes, to deliver malicious code.

Microsoft this week announced a new feature in Microsoft Defender Advanced Threat Protection (ATP) that is designed to block and contain malicious behavior.

Carnival Corp. says it was the victim of a ransomware attack that likely got some personal information about the cruise company’s guests and employees.

A new report from the Senate intelligence committee on Russia’s interference in the 2016 presidential election in the United States says WikiLeaks knowingly assisted the Kremlin’s influence efforts.

Beijing on Tuesday hit out at new US sanctions against telecom giant Huawei, accusing Washington of an "abuse of national power" to block the rise of Chinese companies.

TikTok has stepped up its defense against US accusations that the popular video app is a national security threat, denouncing what it called "rumors and misinformation" about its links to the Chinese government.

A remote code execution (RCE) vulnerability addressed recently in Concrete5 exposed numerous websites to attacks, Edgescan reports.A point and click, open-source content management system, Concrete5 allows users create websites at ease and is used by many high-profile entities worldwide, including BASF, GlobalSign, REC, the U.S. Army, and more.

Password management solutions provider Keeper Security on Monday announced that it has raised $60 million in growth funding from private equity company Insight Partners.

Anti-fraud platform provider SpyCloud on Tuesday announced that it raised $30 million in a Series C funding round. To date, the company has received $58.5 million in investments.

A report published recently by the U.S. Army describes North Korea’s cyber warfare capabilities and provides information on various units and their missions.

In the last few years, we’ve seen ample evidence of how cyberattacks on critical infrastructure can be leveraged by nation-states and other powerful adversaries as weapons in geopolitical conflicts.

Google is working on improving the security of Chrome users by alerting them when filling out forms on secure pages that are delivered insecurely.Set to be introduced in Chrome 86, the feature targets the so-called mixed forms (they are found on HTTPS pages that submit over HTTP), which are considered a risk to users’ security and privacy.

Cybercriminals claiming to represent well-known threat groups such as Fancy Bear and Armada Collective have been threatening organizations with distributed denial of service (DDoS) attacks, Akamai warns.

Trustwave’s security researchers have identified a total of five uninstallers meant to remove the GoldenSpy backdoor from infected computers.

The actively exploited Windows spoofing vulnerability patched last week by Microsoft has been known for more than two years, researchers pointed out.

Industrial cybersecurity solutions provider Radiflow recently announced the launch of an automated risk analysis platform for industrial automation and control systems.