REPORT BREACH
admin

admin

  • Joined: September 10, 2024
  • Articles: 1670

Wiz Reports: Microsoft Attack Using Azure AD Token Forging Technique Has Wider Implications Beyond Outlook

On July 21, 2023, it was revealed that the recent breach of Microsoft’s email services by the Chinese state-sponsored group Storm-0558 is more extensive than initially suspected. According to cloud security firm Wiz, the attack exploited an inactive consumer signing key from Microsoft accounts (MSA) to forge Azure Active Directory (Azure AD) tokens, allowing unauthorized access not just to Outlook Web Access (OWA) and Outlook.com, but potentially to a wide range of Azure AD applications. This includes major platforms like OneDrive, SharePoint, and Teams, as well as customer applications utilizing "Login with Microsoft" features, and certain multi-tenant applications under specific conditions. Wiz’s CTO, Ami Luttwak, emphasized, "Everything in the world of Microsoft leverages Azure Active Directory auth tokens for access," highlighting the far-reaching implications of this vulnerability.

In a recent report by Wiz, a cloud security firm, it has come to light that the recent breach of Microsoft’s email infrastructure by the Chinese state-sponsored group known as Storm-0558 has broader implications than initially perceived. The breach exploited…

SpyNote Malware Aims at Android Users with Antivirus Software

Endpoint Security, Fraud Management & Cybercrime, Social Engineering Malware Disguised as Avast Antivirus Detected Prajeet Nair (@prajeetspeaks) • November 12, 2024 Image: Shutterstock The Android SpyNote malware is utilizing a deceptive tactic by posing as an antivirus application to exploit…

OPSEC Slip Exposes North Korean Nation-State Actors Behind JumpCloud Breach

On July 25, 2023, Cyber Threat Intelligence revealed that North Korean state-sponsored hackers connected to the Reconnaissance General Bureau (RGB) were linked to the JumpCloud breach due to a significant operational security (OPSEC) error that revealed their IP address. Google’s threat intelligence firm Mandiant has identified this group as UNC4899, which overlaps with known clusters like Jade Sleet and TraderTraitor—hackers notorious for targeting the blockchain and cryptocurrency sectors. Furthermore, UNC4899 shares connections with APT43, another hacking group affiliated with North Korea, previously exposed in March for conducting intelligence-gathering campaigns and stealing cryptocurrency from various companies. Their tactics include employing Operational Relay Boxes (ORBs) using L2TP IPsec tunnels along with commercial VPN services to conceal their identity.

North Korean State-Sponsored Hackers Identified in JumpCloud Breach Due to Operational Security Oversight On July 25, 2023, cybersecurity experts revealed that the recent breach of JumpCloud, a directory-as-a-service provider, has been linked to North Korean state-sponsored hackers associated with the…

The True Issue with Prohibiting Masks at Protests

Emerging Concerns over Law Enforcement Surveillance Technologies and Implications for Privacy Recent discussions have highlighted the extensive array of tools available to law enforcement agencies, notably facial recognition technologies. Nicole Napolitano, director of research at the Center for Policing Equity,…

New SEC Regulations Mandate U.S. Companies Disclose Cyber Attacks Within 4 Days The U.S. Securities and Exchange Commission (SEC) recently approved regulations requiring publicly traded companies to disclose details about cyber attacks within four days of determining that the incident has a “material” impact on their financials. This marks a significant change in the way data breaches are reported. SEC Chair Gary Gensler stated, “Whether a company loses a factory in a fire or millions of files in a cybersecurity incident, it may be material to investors.” He emphasized that while many public companies currently offer cybersecurity disclosures, there would be greater benefits from a more consistent, comparable, and useful approach. The new rules stipulate that companies must share information regarding the incident’s nature, scope, and timing, along with its financial impact. However, companies may request a postponement of up to 60 days for such disclosures if it is deemed necessary.

New SEC Regulations Mandate Prompt Disclosure of Cyber Incidents by Public Companies On July 26, 2023, the U.S. Securities and Exchange Commission (SEC) enacted new regulations requiring publicly traded companies to disclose significant cyber attacks within four days of recognizing…