US Media, Retailers Targeted by New SparklingGoblin APT
The new APT uses an undocumented backdoor to infiltrate the education, retail and government sectors.
Hacks
Poly Network Recoups $610M Stolen from DeFi Platform
The attacker returned the loot after being offered a gig as chief security advisor with Poly Network.
Pegasus Spyware Uses iPhone Zero-Click iMessage Zero-Day
Cybersecurity watchdog Citizen Lab saw the new zero-day FORCEDENTRY exploit successfully deployed against iOS versions 14.4 & 14.6, blowing past Apple’s new BlastDoor sandboxing feature to install spyware on the iPhones of Bahraini activists – even one living in London at the time.
Joseph Carson, chief security scientist & advisory CISO at ThycoticCentrify, discusses how to implement advanced privileged-access practices.
Multiple vulnerabilities in software used by 65 vendors under active attack.
Campaign emails company insiders and initially offers 1 million in Bitcoin if they install DemonWare on an organization’s network.
Yaron Kassner, CTO at Silverfort, discusses authentication-bypass bugs in Cisco ASA, F5 Big-IP, IBM QRadar and Palo Alto Networks PAN-OS.
Valve plugs an API bug found in its Steam platform that that abused the Smart2Pay system to add unlimited funds to gamer digital wallets.
Amazon is considering rolling out keyboard-stroke monitoring for its customer-service reps.
