Citrix fixes major security flaws across several services
Citrix released a patch for a number of high-severity vulnerabilities affecting multiple offerings, the company confirmed in a security bulletin earlier this week. Given the severity of the flaws, the prevalence of the tools in question, and the fact that there are no workarounds and other mitigations, the company said it was pivotal for the affected organizations to apply the fix immediately. The Us Cybersecurity & Infrastructure Security Agency (CISA) also chimed in, issuing an alert of its own, urging Citrix customers to not stall with the updates, BleepingComputer has found.
Atlassian says recent data leak stems from third-party vendor hack
Atlassian has confirmed that a breach at a third-party vendor caused a recent leak of company data and that their network and customer information is secure. As first reported by Cyberscoop, a hacking group known as SiegedSec leaked data on Telegram yesterday, claiming to be stolen from Atlassian, a collaboration software company based out of Australia. “We are leaking thousands of employee records as well as a few building floorplans. These employee records contain email addresses, phone numbers, names, and lots more~!,” said the SiegedSec hackers.
Australians able to opt out of targeted ads and erase their data under proposed privacy reforms
Australians would gain greater control of their personal information, including the ability to opt out of targeted ads, erase their data and sue for serious breaches of privacy, under a proposal to the Albanese government. On Thursday the attorney general, Mark Dreyfus, will release a review conducted by his department into modernisation of the Privacy Act which calls to expand its remit to small businesses and add new safeguards for use of data by political parties. Although the document is not government policy, in January Dreyfus told Guardian Australia the right to sue for privacy breaches and European-style reforms such as the right to be forgotten would be considered for the next tranche of legislation.
Alert and investigation fatigue is playing a role in employee burnout
According to a Magnet Forensics survey, cybercrime is taking its toll on company employees. The survey revealed that the rapid evolution of cybercrime is weighing on security teams substantially more than it did last year, leading to widespread burnout and potential regulatory risk. The annual survey polled 492 digital forensics and incident response (DFIR) decision makers and practitioners who are predominately located in North America, Europe, the Middle East and Africa. Its respondents described the current cybercrime landscape as one that is evolving beyond ransomware and taking a toll on their ability to investigate.
Espionage malware targeted telecoms in Middle East using Microsoft, Google, Dropbox tools
An espionage campaign targeting telecommunications providers across the Middle East hid its activities through a range of popular tools from Microsoft, Google and Dropbox, according to a report released Thursday. Researchers at cybersecurity company SentinelOne named the campaign “WIP26” — work in progress — because they were unable to attribute it to any actor or country. But the campaign stood out because it relied heavily on the exploitation of public cloud infrastructure that allowed the hackers to evade detection by making malicious traffic look legitimate, the researchers said. Microsoft Azure and Dropbox instances were used to hold stolen data and host malware that abused Microsoft 365 Mail and Google Firebase services.
