cisa Archives - AboutDFIR - The Definitive Compendium Project

02 Jun 2025

InfoSec News Nuggets 6/2/2025

US community bank says thieves drained customer data through third party hole Community bank MainStreet Bancshares says thieves stole data belonging to some of its customers during an attack on a third-party provider. Showing how vendors along the supply chain are often the weak link, the holding company that primarily oversees MainStreet Bank told America's Securities and Exchange Commission (SEC) about the snafu on Friday, saying it was made aware of a break-in at the provider…

30 May 2025

By Mary

InfoSec News Nuggets 5/30/2025

Google warns of Vietnam-based hackers using bogus AI video generators to spread malware Fake AI-powered video generators are being used to spread infostealers and other types of malware, Google researchers have found. A group of cybercriminals created a network of fraudulent websites masquerading as cutting-edge AI tools and then bought ads on social media platforms to promote the sites, the researchers said. Experts from the tech giant’s Mandiant unit published a report backing previous assessments by Facebook and…

29 May 2025

By Mary

InfoSec News Nuggets 5/29/2025

Most of CISA’s senior leaders are leaving the agency The US Cybersecurity and Infrastructure Security Agency (CISA) is reportedly experiencing a serious flight of senior personnel, with most planning to leave by the end of May 2025. CISA is responsible for safeguarding US critical infrastructure, and its senior personnel are critical in the agency’s ability to liaise with its strategic partners, other federal agencies, and international security organizations. The sudden exodus in senior leadership across…

15 May 2025

By Mary

InfoSec News Nuggets 5/15/2025

CISA Planned to Kill .Gov Alerts, Then It Reversed Course The United States' top cyber defense agency reversed a decision Tuesday to stop posting cybersecurity alerts and guidance on its website after announcing 24 hours earlier that it would favor the X social media platform. The Cybersecurity and Infrastructure Security Agency said Monday it planned to scale back the steady stream of alerts posted to its cybersecurity advisories webpage, refocusing the site on "urgent information tied to…

22 Apr 2025

By Mary

InfoSec News Nuggets 4/22/2025

Phishers abuse Google OAuth to spoof Google in DKIM replay attack In a rather clever attack, hackers leveraged a weakness that allowed them to send a fake email that seemed delivered from Google’s systems, passing all verifications but pointing to a fraudulent page that collected logins. The attacker leveraged Google’s infrastructure to trick recipients into accessing a legitimate-looking “support portal” that asks for Google account credentials. The fraudulent message appeared to come from “no-reply@google.com” and…

17 Apr 2025

By Mary

InfoSec News Nuggets 4/17/2025

CISA extends funding to ensure 'no lapse in critical CVE services' CISA says the U.S. government has extended MITRE's funding to ensure no continuity issues with the critical Common Vulnerabilities and Exposures (CVE) program. "The CVE Program is invaluable to cyber community and a priority of CISA," the U.S. cybersecurity agency told BleepingComputer. "Last night, CISA executed the option period on the contract to ensure there will be no lapse in critical CVE services. We…

07 Apr 2025

By Mary

InfoSec News Nuggets 4/7/2025

CISA braces for deep staffing cuts The Cybersecurity and Infrastructure Security Agency is looking to push out as much as a third of the agency's total headcount, in addition to contract personnel from a major threat hunting team, according to three sources familiar with the matter. The cuts are likely to impact "every single part of the agency," one of those sources told Axios — dealing a huge blow to the country's cybersecurity posture following earlier rounds…

13 Mar 2025

By Mary

InfoSec News Nuggets 3/13/2025

Beware of Deepfakes: A New Age of Deception Steve was at his desk when he received a frantic video call from his manager, Bela. She looked stressed in the video call, her voice hurried. “I need you to send the confidential client report to this new email right away!” she insisted. Seeing her familiar face and hearing her distinct voice, he didn’t hesitate, he sent the confidential report to the new email address. Hours later,…

20 Dec 2024

By Mary

InfoSec News Nuggets 12/20/2024

Don't fall for a mail asking for rapid Docusign action – it may be an Azure account hijack phish Unknown criminals went on a phishing expedition that targeted about 20,000 users across the automotive, chemical and industrial compound manufacturing sectors in Europe, and tried to steal account credentials and then hijack the victims' Microsoft Azure cloud infrastructure. After taking over victims' accounts, the miscreants signed into new devices using stolen creds so they could maintain…

30 Sep 2024

By Mary

InfoSec News Nuggets 9/30/2024

Microsoft: Windows Recall now can be removed, is more secure Microsoft has announced security and privacy upgrades to its AI-powered Windows Recall feature, which now can be removed and has stronger default protection for user data and tighter access controls. Today's announcement comes in response to customer pushback requesting stronger default data privacy and security protections, which prompted the company to delay its public release by making it first available for preview with Windows Insiders. Redmond also…

16 Jul 2024

By Mary

InfoSec News Nuggets 7/16/2024

Infoseccers claim Squarespace migration linked to DNS hijackings at Web3 firms Security researchers are claiming a spate of DNS hijackings at web3 businesses is linked to Squarespace's acquisition of Google Domains last year. The theory is that cybercriminals may have picked up on a flaw in the method Squarespace used to migrate Google Domains customer data over to its servers, allowing them to guess the email addresses associated with admin accounts and register the account…

11 Mar 2024

By Mary

InfoSec News Nuggets 3/11/2024

Microsoft says Russian hackers stole source code after spying on its executives Microsoft revealed earlier this year that Russian state-sponsored hackers had been spying on the email accounts of some members of its senior leadership team. Now, Microsoft is disclosing that the attack, from the same group behind the SolarWinds attack, has also led to some source code being stolen in what Microsoft describes as an ongoing attack. “In recent weeks, we have seen evidence that Midnight Blizzard…

11 Jan 2024

By Mary

InfoSec News Nuggets 1/11/2024

Here’s Some Bitcoin: Oh, and You’ve Been Served! A California man who lost $100,000 in a 2021 SIM-swapping attack is suing the unknown holder of a cryptocurrency wallet that harbors his stolen funds. The case is thought to be first in which a federal court has recognized the use of information included in a bitcoin transaction — such as a link to a civil claim filed in federal court — as reasonably likely to provide…

03 Aug 2023

By Mary

InfoSec News Nuggets 08/03/2023

Reddit beats film industry, won’t have to identify users who admitted torrenting Film companies lost another attempt to force Reddit to identify anonymous users who discussed piracy. A federal court on Saturday quashed a subpoena demanding users' names and other identifying details, agreeing with Reddit's argument that the film companies' demands violate the First Amendment. The plaintiffs are 20 producers of popular movies who are trying to prove that Internet service provider Grande is liable for its subscribers' copyright…

15 Mar 2023

By Mary

InfoSec News Nuggets 03/15/2023

Cybercriminals exploit SVB collapse to steal money and data The collapse of the Silicon Valley Bank (SVB) on March 10, 2023, has sent ripples of turbulence throughout the global financial system, but for hackers, scammers, and phishing campaigns, it's becoming an excellent opportunity. As multiple security researchers report, threat actors are already registering suspicious domains, conducting phishing pages, and gearing up for business email compromise (BEC) attacks. Two U.S. Men Charged in 2022 Hacking of…

08 Sep 2022

By Mary

InfoSec News Nuggets 09/08/2022

Minecraft is hackers’ favorite game title for hiding malware Security researchers have discovered that Minecraft is the most heavily abused game title by cybercriminals, who use it to lure unsuspecting players into installing malware. Based on stats collected by the security firm between July 2021 and July 2022, Minecraft-related files accounted for roughly 25% of malicious files spreading via game brand abuse, followed by FIFA (11%), Roblox (9.5%), Far Cry (9.4%), and Call of Duty…

30 Aug 2022

By Mary

InfoSec News Nuggets 08/30/2022

Justice Department in early stages of filing an antitrust lawsuit against Apple, says report The U.S. Department of Justice is in the early stages of drafting an antitrust lawsuit against Apple, according to sources cited by Politico in a report released just ahead of the weekend. While the new report suggested a potential suit could arrive by the end of the year, it also stressed that a final decision about if or when to sue Apple had…

19 Jul 2022

By Mary

InfoSec News Nuggets 7/19/2022

US Cybersecurity Agency CISA to Open London Office The US Cybersecurity and Infrastructure Security Agency (CISA) announced on Monday that it’s set to open an office in the United Kingdom in an effort to boost international cooperation and collaboration. The cyber defense agency’s first Attaché Office will open later this month in London and its goal is to “serve as a focal point for international collaboration between CISA, UK government officials, and other federal agency…

23 Jun 2022

By Mary

InfoSec News Nuggets 06/23/2022

Mega says it can’t decrypt your files. New POC exploit shows otherwise In the decade since larger-than-life character Kim Dotcom founded Mega, the cloud storage service has amassed 250 million registered users and stores a whopping 120 billion files that take up more than 1,000 petabytes of storage. A key selling point that has helped fuel the growth is an extraordinary promise that no top-tier Mega competitors make: Not even Mega can decrypt the data it stores. On…

10 Jun 2022

By Mary

InfoSec News Nuggets 06/10/2022

Researchers Detail How Cyber Criminals Target Cryptocurrency Users Cybercriminals are impersonating popular crypto platforms such as Binance, Celo, and Trust Wallet with spoofed emails and fake login pages in an attempt to steal login details and deceptively transfer virtual funds. "As cryptocurrency and non-fungible tokens (NFTs) become more mainstream, and capture headlines for their volatility, there is a greater likelihood of more individuals falling victim to fraud attempting to exploit people for digital currencies," Proofpoint said in…

18 Apr 2022

By Mary

InfoSec News Nuggets 04/18/2022

CISA Alert on ICS, SCADA Devices Highlights Growing Enterprise IoT Security Risks On April 13, the Department of Energy (DoE), the Cybersecurity and Infrastructure Security Agency (CISA), the National Security Agency (NSA), and the Federal Bureau of Investigation (FBI) released a joint Cybersecurity Advisory to warn that certain industrial control systems (ICS) and supervisory control and data acquisition (SCADA) devices can be targeted by advanced persistent threat (APT) actors who have the capability to gain full system access.…

16 Dec 2021

By Mary

InfoSec News Nuggets 12/16/2021

CISA warns critical infrastructure to stay vigilant for ongoing threats The Cybersecurity and Infrastructure Security Agency (CISA) warned critical infrastructure organizations today to strengthen their cybersecurity defenses against potential and ongoing threats. The federal agency also issued guidance to help executives and senior leaders proactively reinforce their orgs' resilience against threats arising from malicious activity coordinated by nation-state-sponsored threat actors and their proxies. "In the lead up to the holidays and in light of persistent and ongoing cyber threats,…

24 Sep 2021

By Mary

InfoSec News Nuggets 09/24/2021

A new APT is targeting hotels across the world A new advanced persistent threat (APT), a term used to describe state-sponsored cyber-espionage groups, has been spotted mounting attacks against hotels across the world. Codenamed FamousSparrow, this new APT was discovered by Slovak security firm ESET, which said it’s been tracking its attacks as far back as 2019. “FamousSparrow’s victims are located in Europe (France, Lithuania, the UK), the Middle East (Israel, Saudi Arabia), the Americas (Brazil,…

11 Jan 2021

By Mary

InfoSec News Nuggets 01/11/2021

Russian Hacker Sentenced To 12 Years In Prison For Involvement In Massive Network Intrusions At U.S. Financial Institutions, Brokerage Firms, A Major News Publication, And Other Companies Audrey Strauss, the Acting United States Attorney for the Southern District of New York, announced today that ANDREI TYURIN, a/k/a “Andrei Tiurin,” was sentenced in Manhattan federal court to 144 months in prison for computer intrusion, wire fraud, bank fraud, and illegal online gambling offenses in connection with…

23 Oct 2020

By Mary

InfoSec News Nuggets 10/23/2020

Quibi is shutting down Quibi — the shortform mobile-focused streaming service — is shutting down after just over six months of operation, making it one of the shortest-lived streaming services to date, according to The Wall Street Journal. The company since confirmed that it’ll be shutting down in a Medium post from Jeffrey Katzenberg and Meg Whitman. “We feel that we’ve exhausted all our options. As a result we have reluctantly come to the difficult decision to wind down the…

19 Feb 2020

By Mary

InfoSec News Nuggets 2/19/2020

1 - IRS Urges Taxpayers to Enable Multi-Factor Authentication The US Internal Revenue Service (IRS) and Security Summit partners urged tax professionals and taxpayers today to enable multi-factor authentication (MFA) in their tax preparation software products to defend against data theft. "Already, nearly two dozen tax practitioner firms have reported data thefts to the IRS this year," the IRS said. "Use of the multi-factor authentication feature is a free and easy way to protect clients and practitioners' offices…