Juniper Releases Critical Patches for Vulnerabilities in Junos OS, Contrail Networking, Northstar Controller Products

Critical patches are being released for a range of operating systems.

Er worden kritieke patches uitgebracht voor een reeks besturingssystemen.

Weet uw weg in netwerken en client-server Linux-systemen - technieken, commandoregel, shellscripting en meer

Know Your Way Around Networks and Client-Server Linux Systems — Techniques, Command Line, Shell Scripting, and More

Juniper Releases Patches for Critical Flaws in Junos OS and Contrail Networking

Black Kite released FocusTags, helping users to track high-profile cyber events and identify which vendors have been affected.

A cybersecurity firm has added a new capability to help vendors manage cyber attacks.

Een cyberbeveiligingsbedrijf heeft een nieuwe capaciteit toegevoegd om verkopers te helpen cyberaanvallen te beheren.

Black Kite released FocusTags, helping users to track high-profile cyber events and identify which vendors have been affected within their supply chain. FocusTags are automatically applied following high-profile cyberattacks but can also be added to help with supply chain organization. Black Kite FocusTags can also be used to filter vendor ecosystems.

Black Kite heeft FocusTags uitgebracht, waarmee gebruikers spraakmakende cybergebeurtenissen kunnen volgen en kunnen nagaan welke leveranciers in hun toeleveringsketen zijn getroffen. FocusTags worden automatisch toegepast na ophefmakende cyberaanvallen, maar kunnen ook worden toegevoegd om te helpen bij de organisatie van de toeleveringsketen. Er kan bijvoorbeeld een aangepaste tag worden toegevoegd om kritieke leveranciers te identificeren die een grote hoeveelheid PII in hun bezit hebben of om leveranciers aan te duiden die mogelijk toegang hebben tot interne systemen.

Black Kite released FocusTags, helping users to track high-profile cyber events and identify which vendors have been affected within their supply chain.

This latest capability furthers the company’s mission to provide continuous monitoring of vendors to identify and mitigate ransomware and other risks. FocusTags are automatically applied following high-profile cyberattacks but can also be added to help with supply chain organization.

“Time is of the essence when a cyber event disrupts the digital supply chain. You need immediate visibility into what happened and which of your vendors are at risk so you can take action,” said Chris Bush, CCO of Black Kite. “Our FocusTags give users the speed, clarity and visibility they need to manage incidents at scale and protect their bottom-line.”

Examples of incidents that trigger FocusTags include known ransomware attacks (such as those by Conti, Clop and REvil), data breaches (such as Lapsus$), geopolitical events that affect vendors in conflicted areas (such as the current war in Ukraine) and violations of the National Defense Authorization Act 2019 Section 889.

Black Kite FocusTags can also be used to filter vendor ecosystems. For example, a custom tag can be added to identify critical vendors who hold a large amount of PII or to indicate vendors that may have internal systems access.

“Our clients need continuous monitoring so they can ensure the safety and reliability of their supply chains. Point-in-time monitoring is simply not an effective strategy for combating the complexity of cyber incidents today,” said Chuck Schauber, VP of Product Strategy for Black Kite. “FocusTags makes it easy to see, organize and collaborate with vendors at scale.”

Black Kite provides technical, financial, and compliance-related third-party cyber risk intelligence. The technology eliminates false positives and ensures a holistic approach to vendor risk management.

Black Kite FocusTags are available now.

Black Kite FocusTags allows users to track high-profile cyber events

De Bossche ict-dienstverlener Emma Solutions komt in handen van BT Groep ICT en dus van investeringsmaatschappij Riverdam. De twee ict-bedrijven gaan verder onder de naam ...

A Dutch company has been bought by BT Group ICT in the Netherlands.

Een Nederlands bedrijf is gekocht door BT Group ICT in Nederland.

De Bossche ict-dienstverlener Emma Solutions komt in handen van BT Groep ICT en dus van investeringsmaatschappij Riverdam. De twee ict-bedrijven gaan verder onder de naam Emma Solutions. Door de samenvoeging met BT Groep ICT kan Emma Solutions sneller groeien, is het idee.

The Bossche ict-service provider Emma Solutions comes into the hands of BT Groep ICT and thus of investment company Riverdam. The two ict companies will continue under the name Emma Solutions. Merging with BT Group ICT will allow Emma Solutions to grow faster, is the idea.

De Bossche ict-dienstverlener Emma Solutions komt in handen van BT Groep ICT en dus van investeringsmaatschappij Riverdam. De twee ict-bedrijven gaan verder onder de naam Emma Solutions. Naar verwachting worden meer bedrijven overgenomen en ondergebracht bij deze gecombineerde onderneming.

Emma Solutions werd opgericht in 1999. Het bedrijf legt zich de laatste jaren voornamelijk toe op implementatie en beheer van cloudoplossingen voor het midden- en kleinbedrijf in Noord-Brabant. Door de samenvoeging met BT Groep ICT kan Emma Solutions sneller groeien, is het idee. Ook zou de organisatie ermee verder professionaliseren.

Na de overname vertrekt Emma-oprichter en directeur Alexander Remi. Zijn taak wordt overgenomen door Luuk Carpaij, directeur van BT Groep ICT. Carpaij meldt dat ze actief op zoek gaan naar meer overnamekandidaten in Noord-Brabant.

BT Groep ICT is sinds mei vorig jaar onderdeel van investeerder Riverdam. Daarvoor behoorde het bij printerleverancier en kantoorinrichter BT Groep in Oisterwijk. Het feit dat dit laatstgenoemde bedrijf nog bestaat, is waarschijnlijk de reden waarom BT Groep ICT de naam aanneemt van het overgenomen bedrijf Emma Solutions.

Riverdam is het investeringsvehikel van Derk van Wingerden en Manuel Leussink. Het richt zich op Nederlandse mkb'ers met een omzet tussen de twee miljoen en twintig miljoen euro. Afgelopen december nam Riverdam softwareontwikkelaar HTI Group over. Van Wingerden was na zijn studie bedrijfskunde als marketingdirecteur betrokken bij de start van HelloFresh Benelux en diens beursgang in 2017. Inmiddels is hij interim manager, investeerder en adviseur bij diverse startups en scale-ups. Leussink leerde de kneepjes van het investeringsvak direct na zijn studie econometrie, bij investeringsmaatschappijen HAL Investments en Egeria.

BT Groep ICT gaat verder als Emma Solutions

Picprosto.click tries to make users allow notifications by using scam messages. Picprosto.click is a misleading website designed by scammers. Users do not visit this site

Warning: This article contains a full text of information about push notification scams.

Waarschuwing: Dit artikel bevat een volledige tekst van informatie over push notification scams.

Intego scanner and manual repair option is free. More information about Reimаge and Uninstall Instructions . Reimаge scanner and manual repair option is free.

Intego scanner en handmatige reparatie optie is gratis. Meer informatie over Reimаge en Uninstall Instructies . Reimаge scanner en handmatige reparatie optie is gratis.

More information about Intego and Uninstall Instructions . Please review Intego EULA and Privacy Policy . Intego scanner and manual repair option is free. An advanced version must be purchased.

More information about Reimаge and Uninstall Instructions . Please review Reimаge EULA and Privacy Policy . Reimаge scanner and manual repair option is free. An advanced version must be purchased.

Picprosto.click is a suspicious website that uses fake alerts to make users allow the notifications to be shown. You can prevent this from continuing by blocking the website's access within the browser settings. Checking the system for adware is also imperative for your online security

Picprosto.click tries to make users allow notifications by using scam messages

Picprosto.click is a fake website that shouldn't be trusted

Picprosto.click is a misleading website designed by scammers. Users do not visit this site intentionally, although there is a bigger chance of encountering it when browsing insecure websites such as torrents or illegal video streaming platforms. After being redirected to the site, users are then shown a fake message which encourages click the “Allow” button within the push notification prompt shown at the top-left corner of the page.

Those who get tricked by the scam can later witness intrusive Picprosto.click ads coming up at random times. Not only can they be annoying, but they often carry malicious links. If you are suffering from this problem, you came to the right place. We explain how to deal with the unwanted activity and provide more information about push notification scams.

Users would not intentionally subscribe to fraudulent websites to receive intrusive ads, and crooks are well aware of that. Therefore, they always come up with elaborate ideas on how to trick users into doing something they otherwise wouldn't.

Notifications are a relatively new feature in the desktop environment, as they were originally introduced on mobile devices. An API[1] later was introduced, allowing any app to send notifications if the user wants them. In the case of the Picprosto.click scam, users are tricked into subscribing.

Here are a few examples of messages you might come across:
• Click “Allow” to win a prize and get it in our shop!
• Download is Ready – click Allow to download your file
• Please tap the Allow button to continue
• Click “Allow” to verify that you are not a robot
• Browser verification in progress, click the button “Allow” to access, etc.

Keep in mind that the functionality of the push notification prompt never changes, regardless of what the background message or the picture claims.

Redirects to Picprosto.click might be a sign of adware infection

Ads within push notifications might be dangerous

People who accept push notifications from a scam site immediately see no significant differences and quickly forget about the ordeal. Online sometime later, users would notice the intrusive Picprosto.click ads showing up directly on their desktops. Since they have already forgotten about them encountering the scam in the first place, they are confused about where the activity is coming from.

The push notification feature is enabled on the system level, which means that it can be triggered at any time, as long as the browser is either actively being used or is running in the background. This means that push notifications would show up even if you aren't actually doing anything on your browser.

Unfortunately, the scammers often choose insecure advertising networks, which results in malicious ads being pushed by Picprosto.click. They may include get-rich-quick schemes, fake virus infection prompts, fake giveaways, etc. Even if you do not directly click on these pop-ups, you might do so accidentally, so you should get rid of the ads ASAP.

Push notification scams are widespread and are probably one of the most common online fraud types you might encounter while browsing the web (usually shady websites). While they are likely to be made by many groups of crooks, it is not a secret that they work under the exact same principle, as we explained previously.

It is not uncommon for various scam pages to copy one another and use the same messages and even images in the background. For example, you can see a message used by Picprosto.click on many alternative scam sites, including Freenotifications.com, Rincipledecli.xyz, Myauto.site, and many others. Once you see a few of these scams, it will be much easier for you to recognize them in the future and avoid being scammed in the process.

When enabled via fraudulent sources, many users believe that push notifications are the same as a virus infection. Push notifications run on the system level because you must have allowed it at some point before, be it intentionally or not. However, it is important to note that those affected by adware[2] or malware might be redirected to suspicious websites more often and also encounter more ads while browsing the web.

Even if you don't notice adware infection symptoms, we recommend you perform a full system scan with SpyHunter 5Combo Cleaner, Malwarebytes, or another powerful anti-malware software so you can be sure that nothing malicious is running in the background. If malware is found, security software will automatically quarantine and remove it for you.

After you are done with unwanted or malicious software removal, you should also repair virus damage if such has occurred. The easiest way of doing this is by employing the ReimageIntego maintenance utility, which can also clean your browsers from various trackers[3] and other leftover files.

Once you have checked your system with security software, you can now be sure that it is secure. The only thing left to do is remove the annoying push notifications from Picprosto.click – proceed with the instructions below:
• Open Google Chrome browser and go to Menu > Settings.
• Scroll down and click on Advanced.
• Locate the Privacy and security section and pick Site Settings > Notifications.
• Look at the Allow section and look for a suspicious URL.
• Click the three vertical dots next to it and pick Block. This should remove unwanted notifications from Google Chrome.
• Open Mozilla Firefox and go to Menu > Options.
• Under Permissions, you should be able to see Notifications. Click the Settings button next to it.
• In the Settings – Notification Permissions window, click on the drop-down menu by the URL in question.
• Select Block and then click on Save Changes. This should remove unwanted notifications from Mozilla Firefox.
• Go to the Websites tab and, under General, select Notifications.
• Select the web address in question, click the drop-down menu and select Deny.
• Open Microsoft Edge, and go to Settings.
• Go to Notifications on the right.
• Under Allow, you will find the unwanted entry.
• Click on More actions and select Block.
• Open Internet Explorer, and click on the Gear icon at the top-right of the window.
• Select Internet options and go to the Privacy tab.
• In the Pop-up Blocker section, click on Settings.
• Locate the web address in question under Allowed sites and pick Remove.

Remove Picprosto.click ads (Tutorial)

The most heavily targeted flaw last quarter was a remote code execution vulnerability in Microsoft Office that was disclosed and patched four years ago.

Microsoft has reported a sharp rise in attacks on older versions of its Windows Office.

Microsoft heeft een sterke toename gemeld van aanvallen op oudere versies van zijn Windows Office.

Attacks targeting a remote code execution vulnerability in Microsoft's MSHTML browser engine — which was patched last September — soared during the second quarter of this year, according to a Kaspersky analysis. Researchers from Kaspersky counted at least 4,886 attacks targeting the flaw (CVE-2021-40444) last quarter, an eightfold increase over the first quarter of 2022. The attacks targeting the MSHTML flaw were part of a broader set of exploit activity last quarter that overwhelmingly targeted Microsoft vulnerabilities.

Aanvallen gericht op een kwetsbaarheid voor het uitvoeren van code op afstand in Microsofts MSHTML-browser-engine - die in september vorig jaar werd gepatcht - zijn in het tweede kwartaal van dit jaar sterk toegenomen, zo blijkt uit een analyse van Kaspersky. Onderzoekers van Kaspersky telden het afgelopen kwartaal ten minste 4.886 aanvallen gericht op de fout (CVE-2021-40444), een verachtvoudiging ten opzichte van het eerste kwartaal van 2022. De aanvallen die gericht waren op de MSHTML-fout maakten deel uit van een bredere reeks exploitactiviteiten in het afgelopen kwartaal, die voornamelijk gericht waren op kwetsbaarheden van Microsoft.

Attacks targeting a remote code execution vulnerability in Microsoft's MSHTML browser engine — which was patched last September — soared during the second quarter of this year, according to a Kaspersky analysis.

Researchers from Kaspersky counted at least 4,886 attacks targeting the flaw (CVE-2021-40444) last quarter, an eightfold increase over the first quarter of 2022. The security vendor attributed the continued adversary interest in the vulnerability to the ease with which it can be exploited.

Kaspersky said it has observed threat actors exploiting the flaw in attacks on organizations across multiple sectors including the energy and industrial sectors, research and development, IT companies, and financial and medical technology firms. In many of these attacks, the adversaries have used social engineering tricks to try and get victims to open specially crafted Office documents that would then download and execute a malicious script. The flaw was under active attack at the time Microsoft first disclosed it in September 2021.

The attacks targeting the MSHTML flaw were part of a broader set of exploit activity last quarter that overwhelmingly targeted Microsoft vulnerabilities. According to Kaspersky, exploits for Windows vulnerabilities accounted for 82% of all exploits across all platforms during the second quarter of 2022. While attacks on the MSHTML vulnerability increased the most dramatically, it was by no means the most exploited flaw.

Old Is Gold for Threat Actors

Kaspersky's telemetry showed far more attacks on a handful of other vulnerabilities from 2018 and 2017. One of them was CVE-2018-0802, a remote code execution (RCE) vulnerability in Microsoft Office that was attacked some 345,827 times last quarter. Another similar memory corruption flaw from 2017 (CVE-2017-11882) was targeted in 140,623 attacks while a Microsoft Office/WordPad remote code execution flaw also from 2017 (CVE-2017-0199) was involved in 60,132 attacks.

The so-called Follina vulnerability in Microsoft Support Diagnostic Tool (MSDT) (CVE-2022-30190) was among the most targeted of recent vulnerabilities. The RCE flaw was one of at least five zero-day flaws that Microsoft has disclosed this year.

In total, Kaspersky found vulnerabilities in older versions of Microsoft Office being used in attacks against more than half a million users in second quarter. The attacks are another reminder of how unpatched vulnerabilities in older technologies remain a popular and highly attractive target for threat actors, the security vendor noted. "Old versions of applications remain the main targets for attackers, with almost 547,000 users in total being affected through corresponding vulnerabilities in the last quarter," Kaspersky said.

Kaspersky's report is another reminder of why security experts advocate quick patching of Microsoft vulnerabilities. Recent data has shown attackers have gotten much faster at exploiting flaws than before. A study that Rapid7 conducted last year showed that the mean time to known exploitation for vulnerabilities in 2021 was just 12 days — a 71% decrease from 42 days in 2020. The company explained the numbers as being driven by a sharp rise in zero-day exploit activity. "A drastic reduction in time to exploitation year over year means that not only are well-worn emergency patching procedures necessary, incident response protocols are likely to require repeated use as well," Rapid7 noted at the time.

Most Q2 Attacks Targeted Old Microsoft Vulnerabilities

When choosing an MSSP, organizations look for providers that can establish a robust set of technologies and services that address various security concerns. Learn more.…

Cybersecurity is one of the biggest challenges facing companies across the world.

Cyberbeveiliging is een van de grootste uitdagingen voor bedrijven over de hele wereld.

In response to the evolving threat landscape, more companies have turned to managed security service providers (MSSPs) who can provide access to hard to find security expertise and the latest technology. To position themselves competitively in a crowded market, MSSPs must offer the right combination of services, around-the-clock protection as well as, cost effective solutions that deliver better risk management and compliance. To help customers achieve these goals, an MSSP must establish a robust set of offerings that offer access to the latest technologies and security expertise at a price point that makes sense.

In reactie op het veranderende bedreigingslandschap hebben meer bedrijven zich gewend tot aanbieders van managed security services (MSSP's) die toegang kunnen bieden tot moeilijk te vinden beveiligingsexpertise en de nieuwste technologie. Het creëren van een succesvol dienstenaanbod betekent inzicht in de beveiligings- en bedrijfsdoelstellingen van de klant. Om klanten te helpen deze doelen te bereiken, moet een MSSP een robuust aanbod hebben dat toegang biedt tot de nieuwste technologieën en beveiligingsexpertise tegen een redelijke prijs.

Complicated IT environments and expanding network edges create new cybersecurity risks. In response to the evolving threat landscape, more companies have turned to managed security service providers (MSSPs) who can provide access to hard to find security expertise and the latest technology. To position themselves competitively in a crowded market, MSSPs must offer the right combination of services, around-the-clock protection as well as, cost effective solutions that deliver better risk management and compliance. It’s a two-fold challenge that requires speed and scale in detection and response for more competitive value propositions.

Creating a successful service offering means understanding customers’ security and business objectives. To help customers achieve these goals, an MSSP must establish a robust set of offerings that offer access to the latest technologies and security expertise at a price point that makes sense.

Most customers begin their evaluation process by reviewing an MSSP’s solutions. Information overload and alert fatigue is a common problem facing security teams so the ability to address security monitoring is a key requirement. Without high-fidelity alerts that correlate events effectively, security teams find themselves spending too much time investigating false alerts.

To help address these problems, MSSPs must provide customers with aggregated alerts enriched with context that reduce false positives, while also helping to define, guide, and accelerate investigations. MSSPs who can enable prioritization based on severity levels with technology that streamlines task assignments and automate response can differentiate themselves from other providers.

In addition to alerts, advanced threat detection is also tied to the MSSP’s ability to incorporate advanced threat intelligence into its offering. With threat actors continually improving their tactics, techniques and procedures customers want a provider with real-time access to robust threat intelligence that can quickly detect attacks at machine speed. While many customers may already subscribe to threat intelligence feeds, disaggregated information across a fragmented security architecture actually creates security gaps and increases key metrics like mean times to detect and respond.

MSSPs need to support actionable alerts with high-quality threat intelligence. When combining the two in a single pane of glass, an MSSP can help customers respond to zero-day attacks other emerging threats, as well as variations of known attacks more rapidly, and thereby reduce the likelihood of a data breach.

MSSPs offer more than just access to the latest technologies. Customers also turn to their providers for services, including talking to experienced people who can guide them through the incident response process. The cybersecurity talent gap leaves many companies struggling to find the right staffing to protect their systems, network, and data. Often, customers turn to an MSSP to act as their security operations center (SOC) or support their current team.

With this in mind, MSSPs must deliver a range of services from their own SOC, specifically those that can be offered at particular service levels or tailored to individual customer needs. By delivering a fully managed or co-managed SOC service, MSSPs can fill the talent gap by providing the human resources customers need, not just the technology and tools.

Some customers may have SOC teams that need augmentation because they are bogged down by manual, inefficient, error-prone, and time-consuming steps. These customers need automation so that their teams can effectively filter repetitive tasks and focus on more critical issues.

MSSPs that offer automated response capabilities can address higher level requirements to address a larger market with more advanced requirements. By offering Security Orchestration, Automation and Response (SOAR) with updated playbooks, MSSPs can offer highly differentiated services featuring enhanced detection and accelerated incident investigation and response.

Today, nearly every customer has a complex environment, regardless of company size. Most customers have multiple point products that create gaps in visibility and control. To gain that visibility, many work with an MSSP who can cost-effectively provide them with a cohesive Security Information and Event Management (SIEM) solution.

One of the keys to SIEM effectiveness is the ability to ingest large volumes of data from a wide arrange of vendor products. The ability to provide centralized management and customization options using API integrations is one way MSSPs can distinguish themselves within the market. In addition, MSSPs should consider services like granular reporting with event management that highlights important activity and alerts – providing a cost effective alternative to traditional in-house SIEM depoloytmens.

Many organizations are implementing digital transformation and research consistently shows that security is the primary concern. Cloud adoption, distributed computing, remote working, complexity and increasing threats are key challenges driving customers to seek MSSPs with flexible solutions.

Most customers want their MSSP to be their “one-stop-shop” for managing cyber risk and compliance. To differentiate themselves, MSSPs need to offer customizable solutions with flexible technology in the form of appliances, virtual machines or cloud delivered services along with pay-as-you-go options that allow customers to onboard new solutions quickly and efficiently as their needs change. To do this, MSSPs need to offer on-demand services with extensive self-service catalogs – especially incident response and reporting.

The Business Benefits of Choosing & Working with an MSSP

Beyond providing the right services and technologies, MSSPs must also demonstrate their business value. Many customers recognize their security problems but cannot articulate where the MSSP fits into solving them. To demonstrate the vital role they can play in securing customer networks and enabling the business, MSSPs should consider offering the following:

For most customers, gaining access to the skills and services that help them solve their unique security issues poses a significant challenge. While no two customer requirements are the same, all organizations are seeking cost effective ways to access scarce security skills and services.

MSSPs should focus on platform scalability that allows efficient customer focus without the cost of dedicated staffing. MSSPs need flexible solutions that evolve with customer needs. In some cases, a customer may want a comprehensive technology and services package that gives them an entire team and all capabilities. In other cases, the customer may just be building out a SOC and looking to grow over time. Being able to meet customers where they are now, as they are now, and evolve with them is key to helping them understand the value.

MSSP Checklist: Tips for Achieving Success

Microsoft disrupts Russian APT actor, cutting off access to accounts used for pre-attack reconnaissance, phishing, and email harvesting.

Microsoft has warned that a Russian threat actor is using social media platforms to target sensitive groups.

Microsoft heeft gewaarschuwd dat een Russische bedreiger socialemediaplatforms gebruikt om gevoelige groepen te viseren.

Microsoft on Monday announced another major disruption of an APT actor believed to be linked to the Russian government, cutting off access to accounts used for pre-attack reconnaissance, phishing, and email harvesting. The threat actor, identified by Microsoft as SEABORGIUM, has been documented since at least 2017 actively conducting cyberespionage attacks against military personnel, government officials, think tanks, and journalists in Europe and the South Caucasus. In a note announcing the disruption, Microsoft also exposed the Russian threat actor’s malware infrastructure and released IoCs (indicators of compromise) to help defenders hunt for signs of infections.

De teams voor beveiligingsonderzoek en opsporing van bedreigingen in Redmond werkten samen met misbruikteams bij Microsoft om OneDrive en andere aan Microsoft gelinkte accounts uit te schakelen en de Defender SmartScreen-technologie te versterken om phishingdomeinen te blokkeren. In een bericht waarin de verstoring werd aangekondigd, heeft Microsoft ook de malware-infrastructuur van de Russische bedreiger blootgelegd en IoC's (indicators of compromise) vrijgegeven om verdedigers te helpen bij de jacht op tekenen van infecties. Op basis van IOC's en actortactieken bevestigde Microsoft dat SEABORGIUM overlappingen vertoont met eerder gepubliceerde documentatie van Google (codenaam COLDRIVER) en F-Secure (codenaam Callisto Group) en waarschuwde het dat de doelstellingen en victimologie van de APT-groep nauw aansluiten bij de belangen van de Russische staat.

Microsoft on Monday announced another major disruption of an APT actor believed to be linked to the Russian government, cutting off access to accounts used for pre-attack reconnaissance, phishing, and email harvesting.

The threat actor, identified by Microsoft as SEABORGIUM, has been documented since at least 2017 actively conducting cyberespionage attacks against military personnel, government officials, think tanks, and journalists in Europe and the South Caucasus.

Redmond’s security research and threat hunting teams partnered with abuse teams in Microsoft to disable OneDrive and other Microsoft-linked accounts and beef up its Defender SmartScreen technology to block phishing domains.

In a note announcing the disruption, Microsoft also exposed the Russian threat actor’s malware infrastructure and released IoCs (indicators of compromise) to help defenders hunt for signs of infections.

Based on IOCs and actor tactics, Microsoft confirmed SEABORGIUM overlaps with previously published documentation from Google (codename COLDRIVER) and F-Secure (codename Callisto Group) and warned that the APT group’s objectives and victimology align closely with Russian state interests.

Microsoft said the group abused the OneDrive service and fake LinkedIn accounts in campaigns that include persistent phishing, credential theft and data theft.

Based on some of the impersonation and targeting observed, we suspect that the threat actor uses social media platforms, personal directories, and general open-source intelligence (OSINT) to supplement their reconnaissance efforts. MSTIC, in partnership with LinkedIn, has observed fraudulent profiles attributed to SEABORGIUM being used sporadically for conducting reconnaissance of employees from specific organizations of interest. In accordance with their policies, LinkedIn terminated any account identified as conducting inauthentic or fraudulent behavior.

In addition to reconnaissance on LinkedIn, Microsoft caught the threat actor registering email accounts at consumer email providers for the specific purpose of impersonating individuals for add-on phishing lures.

The SEABORGIUM actor has been observed embedding malicious links and PDF files into the body of phishing emails and using OneDrive to host booby-trapped documents.

The group has also been caught using stolen credentials to directly sign-in to victim email accounts and stealing emails and attachments from compromised inboxes.

In limited cases, Microsoft warned that SEABORGIUM set up forwarding rules from victim inboxes to actor-controlled dead drop accounts where the actor has long-term access to collected data.

“On more than one occasion, we have observed that the actors were able to access mailing-list data for sensitive groups, such as those frequented by former intelligence officials, and maintain a collection of information from the mailing-list for follow-on targeting and exfiltration,” the company added..

Microsoft Announces Disruption of Russian Espionage APT | SecurityWeek.Com

AWS is excited to announce the launch of the AWS Wickr ATAK Plugin, which makes it easier for ATAK users to maintain secure communications. The Android Team Awareness Kit (ATAK)—also known as Android Tactical Assault Kit (ATAK) for military use—is a smartphone geospatial infrastructure and situational awareness application. It provides mapping, messaging, and geofencing capabilities […]

The Amazon Security Service (AWS) has launched a secure collaboration service for military personnel.

De Amazon Security Service (AWS) heeft een beveiligde samenwerkingsdienst voor militair personeel gelanceerd.

AWS is excited to announce the launch of the AWS Wickr ATAK Plugin, which makes it easier for ATAK users to maintain secure communications. ATAK users, referred to as operators, can view the location of other operators and potential hazards—a major advantage over relying on hand-held radio transmissions. While ATAK was initially designed for use in combat zones, the technology has been adapted to fit the missions of local, state, and federal agencies.

AWS is verheugd om de lancering van de AWS Wickr ATAK Plugin aan te kondigen, die het gemakkelijker maakt voor ATAK-gebruikers om beveiligde communicatie te onderhouden. Hoewel ATAK oorspronkelijk was ontworpen voor gebruik in gevechtszones, is de technologie aangepast aan de missies van plaatselijke, staats- en federale instanties. AWS Wickr is een veilige samenwerkingsdienst die ondernemingen en overheidsinstellingen voorziet van geavanceerde beveiligings- en administratieve controles om hen te helpen voldoen aan beveiligings- en compliance-eisen.

AWS is excited to announce the launch of the AWS Wickr ATAK Plugin, which makes it easier for ATAK users to maintain secure communications.

The Android Team Awareness Kit (ATAK)—also known as Android Tactical Assault Kit (ATAK) for military use—is a smartphone geospatial infrastructure and situational awareness application. It provides mapping, messaging, and geofencing capabilities to enable safe collaboration over geography.

ATAK users, referred to as operators, can view the location of other operators and potential hazards—a major advantage over relying on hand-held radio transmissions. While ATAK was initially designed for use in combat zones, the technology has been adapted to fit the missions of local, state, and federal agencies.

ATAK is currently in use by over 40,000 US Department of Defense (DoD) users—including the Air Force, Army, Special Operations, and National Guard—along with the Department of Justice (DOJ), the Department of Homeland Security (DHS), and 32,000 nonfederal users.

AWS Wickr is a secure collaboration service that provides enterprises and government agencies with advanced security and administrative controls to help them meet security and compliance requirements. The AWS Wickr service is now in preview.

With AWS Wickr, communication mechanisms such as one-to-one and group messaging, audio and video calling, screen sharing, and file sharing are protected with 256-bit end-to-end encryption (E2EE). Encryption takes place locally, on the endpoint. Every message, call, and file is encrypted with a new random key, and no one but the intended recipients can decrypt them. Flexible administrative features enable organizations to deploy at scale, and facilitate information governance.

AWS Wickr supports many agencies that use ATAK. However, until now, ATAK operators have had to leave the ATAK application in order to use AWS Wickr, which creates operational risk.

AWS Wickr has developed a plugin that enhances ATAK with secure communications features. ATAK operators are provided with a Wickr Enterprise or Wickr Pro account, so they can use AWS Wickr within ATAK for secure messaging, calling, and ﬁle transfer. This helps reduce interruptions, and the complexity of configuration with ATAK chat features.

The AWS Wickr ATAK Plugin has multiple use cases.

The military uses ATAK for blue force tracking to locate team members, red force tracking to locate enemies, terrain and weather analysis, and to visually communicate their movements to friendly forces.

The AWS Wickr ATAK Plugin enhances the ability of military personnel to maintain the situational awareness ATAK provides, while quickly receiving and reacting to Wickr communications. Ephemeral messaging options allow unit leaders to send mission plans, GPS points of interest, and set burn-on-read and expiration timers. Information can be deleted from the device, while being retained on the AWS Wickr service to help meet compliance requirements, and facilitate the creation of after-action reports.

ATAK is a powerful tool for team tracking and mission planning that promotes a safer and better response to critical law enforcement and public-safety events.

The AWS Wickr ATAK Plugin adds to the capabilities of ATAK by supporting secure communications between tactical, negotiation, and investigative teams.

ATAK aids in search-and-rescue and multi-jurisdictional natural disaster responses, such as hurricane relief efforts.

The AWS Wickr ATAK Plugin provides secure, uninterrupted communication between all levels of first responders to help them get oriented quickly, and support complex coordination needs.

AWS customers can sign up to use AWS Wickr at no cost during the preview period. For more information about the AWS Wickr ATAK Plugin, email wickr-interest@amazon.com, and visit the AWS Wickr web page.

If you have feedback about this blog post, let us know in the Comments section below.

Want more AWS Security news? Follow us on Twitter.

AWS launches AWS Wickr ATAK Plugin

ZTNA brings only marginal benefits unless you ensure that the third parties you authorize are not already compromised.

Companies are moving to a zero-trust system to protect their corporate assets from third-party attacks. But what does this mean?

Bedrijven stappen over op een zero-trust systeem om hun bedrijfsmiddelen te beschermen tegen aanvallen van derden. Maar wat houdt dit in?

Not only must the IT team recognize and validate every corporate employee, their computing devices, and their applications, but they also must do so for key nonemployees, third-party vendors, and partners who access corporate assets. While many of today's zero-trust network access (ZTNA) products claim to offer ongoing authentication and authorization of every known and registered user, device, and application trying to access a network all the time, often what companies actually experience is slightly different, says Jason Georgi, field CTO at Palo Alto Networks. Today, he says, ZTNA products excel at the microsegmentation of networks and providing very limited access to corporate assets on the network, but he expects next-generation ZTNA products to provide greater security for the data being processed.

Het IT-team moet niet alleen elke werknemer, zijn computerapparatuur en zijn toepassingen herkennen en valideren, maar moet dit ook doen voor belangrijke niet-werknemers, externe verkopers en partners die toegang hebben tot bedrijfsmiddelen. Hoewel veel van de huidige zero-trust network access (ZTNA) producten claimen voortdurend authenticatie en autorisatie te bieden van elke bekende en geregistreerde gebruiker, elk apparaat en elke applicatie die probeert toegang te krijgen tot een netwerk, is wat bedrijven in werkelijkheid ervaren vaak iets anders, zegt Jason Georgi, field CTO bij Palo Alto Networks. Vandaag de dag, zegt hij, blinken ZTNA-producten uit in het microsegmenteren van netwerken en het verschaffen van zeer beperkte toegang tot bedrijfsmiddelen op het netwerk, maar hij verwacht dat de volgende generatie ZTNA-producten een betere beveiliging zullen bieden voor de gegevens die worden verwerkt.

The transition to a zero-trust architecture is rife with challenges that can put a 10,000-piece, monochromatic jigsaw puzzle to shame. Not only must the IT team recognize and validate every corporate employee, their computing devices, and their applications, but they also must do so for key nonemployees, third-party vendors, and partners who access corporate assets.

It is a difficult enough task when one knows who their primary third-party supply chain partners are; it becomes almost impossible to manage secondary, tertiary, and other partners as well. And therein lies the challenge of defining who is an authorized and authenticated user and who is not.

While many of today's zero-trust network access (ZTNA) products claim to offer ongoing authentication and authorization of every known and registered user, device, and application trying to access a network all the time, often what companies actually experience is slightly different, says Jason Georgi, field CTO at Palo Alto Networks. Instead of constant authentication, they get initial authentication for each access.

Today, he says, ZTNA products excel at the microsegmentation of networks and providing very limited access to corporate assets on the network, but he expects next-generation ZTNA products to provide greater security for the data being processed.

A white paper by John Grady, a senior analyst at Enterprise Strategy Group, and commissioned by Palo Alto Networks asserts that there are several areas where current ZTNA products are falling short. Among the improvements Grady called for are prevention of violations of least privilege, the ability to cancel an application's access if it starts behaving in an unanticipated or unacceptable manner after granted access, and the ability to do security inspections of data not currently being inspected.

Companies working to improve their risk profile by employing ZTNA are gaining only marginal benefits if they do not ensure that the third parties they authorize are not already compromised. To accomplish this, companies moving to zero trust also need to improve their third-party risk management (TPRM).

Organizations that employ ZTNA require that remote users be entered into a Microsoft Active Directory or other authentication system. While that works well for remote employees, it falls short when the remote access user is a business partner or vendor. Because of this, these partners often need to access the corporate environment over a virtual private network (VPN). But VPNs have inherent security limitations and do not scale well. As a result, someone who uses a VPN to access corporate assets behind the corporate firewall already has more access than they require; malicious users could leverage this to attack the network from the inside.

"If you think about all the bad things that have occurred, it's always through that backdoor of a vendor connection because you have a wide-open pipe on a VPN," says Dave Cronin, vice president of cybersecurity strategy for Capgemini Americas.

But VPNs, despite having less comprehensive security than zero-trust offerings, are not going away, he cautions. A zero-trust architecture requires that every user be preauthorized within a trusted environment, such as by being listed in Microsoft Active Directory or some similar application. That will not happen when organizations have hundreds or thousands of supply chain partners who are not individually identified, authenticated, and registered.

"In a lot of cases, organizations are layering additional sets of controls around specifically the third-party access component because, in some cases, the third parties are using unmanaged devices, meaning they're using their own corporate devices or even personal devices to access a company's enterprise applications," says Andrew Rafla, a partner and principal, as well as the cyber-risk and zero trust leader, at Deloitte. "There's a greater need to shift toward more modern ZTNA or [Secure Access Service Edge] SASE-type solutions, specifically for third-party access."

Rafla adds that the zero-trust edge (ZTE), sometimes referred to as SASE, can be seen as a compensating control to help mitigate the potential threats brought on by third parties and other managed constituents. Such compensating controls — including edge security, TPRM, multifactor authentication, and perhaps a dozen more controls together — can help companies demonstrate that they should qualify for cyber insurance, which has become more difficult to obtain recently.

"The more agile you are able to be as an organization to enable remote workforces, the easier, generally speaking, it is for you to do the right thing for derisking third-party access to your application systems environments," says Josh Yavor, CISO at Tessian. "The reason for that is because by pushing security down to the devices and then to the application layer, it means that while the networks are absolutely still relevant and critical, we're logically building our defensive risk bubbles around the applications themselves, and then the devices and identities that are in use when accessing them.

"By separating what used to be entirely network-dependent thinking to those layers, it means that we have more granular options for enabling access securely from our third parties."

That said, while hybrid VPN and ZTNA networks are likely here to stay for the foreseeable future, VPN security needs to be enhanced by adding more authentication controls and the ability to shut down the connection should the user access inappropriate data or applications. This could include improving port and protocol controls to contain the risk.

Transitioning From VPNs to Zero-Trust Access Requires Shoring Up Third-Party Risk Management

Victims of the Scheme were in at least Five States including California, Tennessee, Michigan, Hawaii, and Illinois Greenbelt, Maryland – Njuh Valentine...

A former fugitive has been arrested in the US state of Maryland on charges of wire fraud and money laundering.

Een voormalige voortvluchtige is in de Amerikaanse staat Maryland gearresteerd op beschuldiging van telefraude en het witwassen van geld.

The arrest and indictment were announced by United States Attorney for the District of Maryland Erek L. Barron; Special Agent in Charge James C. Harris of Homeland Security Investigations (HSI) Baltimore; Chief Melissa R. Hyatt of the Baltimore County Police Department; and Chief Russell E. Hamill III of the Laurel Police Department. Fombe and his co-conspirators then allegedly used the illegally obtained personal information to obtain counterfeit checks in the name and information of the victims’ bank accounts. Victims of the alleged BEC scheme span across five states including California, Tennessee, Michigan, Hawaii, and Illinois.

Fombe en zijn mede-samenzweerders zouden vervolgens de onrechtmatig verkregen persoonsgegevens hebben gebruikt om valse cheques te verkrijgen op naam en met de gegevens van de bankrekeningen van de slachtoffers. Fombe en zijn mede-samenzweerders zouden ook frauduleuze lege vennootschappen hebben geregistreerd om de regeling mogelijk te maken. In de tenlastelegging wordt voorts gesteld dat leden van de samenzwering valutarekeningen op naam van frauduleuze lege entiteiten en hun eigen namen en aliassen beheerden om de opbrengsten van de BEC- en chequeregelingen te sturen en te ontvangen.

Foreign National Faces Federal Charges for Wire Fraud, Money Laundering and Aggravated Identity Theft Related to a Business Email Compromise Scheme

Victims of the Scheme were in at least Five States including California, Tennessee, Michigan, Hawaii, and Illinois

Greenbelt, Maryland – Njuh Valentine Fombe, a/k/a “Valentine”, age 36, formerly of Beltsville, Maryland, had an initial appearance in U.S. District Court in Greenbelt on August 8, 2022, after being a fugitive for almost three years until his arrest on August 6, 2022. A federal grand jury indicted Fombe on September 23, 2019, on charges of conspiracy to commit wire fraud, conspiracy to commit money laundering, aggravated identity theft. At his initial appearance, U.S. Magistrate Judge Timothy J. Sullivan ordered that Fombe remains detained pending trial.

The arrest and indictment were announced by United States Attorney for the District of Maryland Erek L. Barron; Special Agent in Charge James C. Harris of Homeland Security Investigations (HSI) Baltimore; Chief Melissa R. Hyatt of the Baltimore County Police Department; and Chief Russell E. Hamill III of the Laurel Police Department.

According to the three-count indictment, from at least September 2016 to August 2018, Fombe conspired with others to commit wire fraud by conducting business email compromise schemes (“BEC schemes”) in which the defendants gained unauthorized access to email accounts, personal identifying information, and bank accounts by sending false wiring instructions to the victims’ email accounts. Fombe and his co-conspirators then allegedly used the illegally obtained personal information to obtain counterfeit checks in the name and information of the victims’ bank accounts. Victims of the alleged BEC scheme span across five states including California, Tennessee, Michigan, Hawaii, and Illinois. Fombe and his co-conspirators also allegedly registered fraudulent shell entities to facilitate the scheme. The indictment further alleges that members of the conspiracy managed drop accounts held in fraudulent shell entities’ names, as well as their names and aliases to direct and receive proceeds of the BEC and check schemes.

If convicted, Fombe faces a maximum sentence of 20 years in federal prison for conspiracy to commit wire fraud, 20 years in federal prison for conspiracy to commit money laundering, and a mandatory two years in federal prison consecutive to any other sentence imposed for aggravated identity theft. Actual sentences for federal crimes are typically less than the maximum penalties. A federal district court judge will determine any sentence after taking into account the U.S. Sentencing Guidelines and other statutory factors.

An indictment is not a finding of guilt. An individual charged by indictment is presumed innocent unless and until proven guilty at some later criminal proceedings.

United States Attorney Erek L. Barron commended HSI, the Baltimore County Police Department and the Laurel Police Department for their work in the investigation. Mr. Barron thanked Assistant U.S. Attorneys Kelly Hayes, and Christopher Sarma, who are prosecuting the case.

For more information on the Maryland U.S. Attorney’s Office, its priorities, and resources available to help the community, please visit www.justice.gov/usao-md and https://www.justice.gov/usao-md/community-outreach.

Juniper brengt patches uit voor kritieke fouten in Junos OS en Contrail Networking

Vergelijkbare publicaties

De meeste aanvallen in Q2 waren gericht op oude Microsoft-kwetsbaarheden

MSSP Checklist: Tips voor het bereiken van succes

Microsoft kondigt ontwrichting aan van Russische spionage APT | SecurityWeek.Com

AWS lanceert AWS Wickr ATAK Plugin

Overgang van VPN's naar zero-trust toegang vereist versterking van third-party risicomanagement

Buitenlands onderdaan wordt federaal aangeklaagd wegens telefraude, witwassen van geld en ernstige identiteitsdiefstal in verband met een regeling voor de aantasting van zakelijke e-mail

Gevonden topics

Black Kite FocusTags stelt gebruikers in staat om high-profile cyber gebeurtenissen te volgen

BT Groep ICT gaat verder als Emma Solutions

Picprosto.click advertenties verwijderen (Handleiding)