Security Bulletin

Unauthorized access into the HSCs' network from Sep. 17 to 19 enabled the varying exposure of individuals' full names, birthdates, Social Security numbers, physical addresses, driver's license and government ID numbers, financial account details...

"When a NetScaler appliance is sized for handling a typical volume of authentication attempts, the high number of login attempts from large password spraying attacks can overwhelm the appliance, potentially leading to service and/or operational...

This bulletin includes coordinated influence operation campaigns terminated on our platforms in Q4 2024. It was last updated on December 17, 2024.OctoberWe terminated 11…

Attackers can use tools like Shodan to hone-in on which water facilities are vulnerable, then take control of a facility.

Cybersecurity’s role in safeguarding executive leaders—both in the digital and physical realms—has never been more vital.

The cyberattack impacts at least 1.4 million patients, as tranches of highly sensitive personal, medical, and financial data fall into the hands of cyber crooks who have everything they need to carry out convincing social engineering and fraud...

Actions direct agencies to deploy specific security configurations to reduce cyber-risk.

Attacks involved the addition of a BeMob URL to the ad management system of the Monetag website monetization platform, also known as Omnatuor or Vane Viper, in an effort to enable TDS redirection to fake CAPTCHA pages hosted on various legitimate...

More than 300 SMTP servers have been leveraged by yet-to-be-identified threat actors to facilitate the automated distribution of phishing emails purporting to be business proposals, contracts, or promotional materials from widely known brands...

Threat actors commenced scanning vulnerable online webcams and DVRs in the U.S., Canada, Australia, New Zealand, and the UK impacted by the CVE-2017-7921, CVE-2018-9995, CVE-2020-25078, CVE-2021-33044, and CVE-2021-36260 flaws, as well as default...

Intrusions were initially conducted by the Monstrous Mantis operation, which exfiltrated DrayTek device credentials later shared with its partners Ruthless Mantis, also known as PTI-288, and LARVA-15, also known as Wazawaka, according to an analysis...