Distributed Workforce

More than 400 custom web injects for mobile malware are being offered for sale by the InTheBox darknet marketplace, which is thought to emerge in January 2020, reports The Hacker News.

SecurityWeek reports that Sophos has fixed seven code execution vulnerabilities in Sophos Firewall as part of the version 19.5 update.

Several U.S. federal agencies have been pushed by the Government Accountability Office to perform cybersecurity risk assessments on internet of things and operational technology systems in a bid to bolster critical infrastructure sectors' cybersecurity posture, according to SecurityWeek.

Numerous companies and organizations including Global Ordnance, UMO Poland, Blue Sky Network, and The Commission for International Justice and Accountability have been impersonated by Russian state-sponsored threat group SEABORGIUM, also known as TA446, Callisto, and COLDDRIVER, to serve as lures in a phishing operation, according to The Record, a news site by cybersecurity firm Recorded Future.

In an emergency cybersecurity directive issued Tuesday, the state flagged technologies from eight companies and prohibited state government employees from using them for official business.

Phosphorus Labs finds that 68% of xIoT devices have CVSS scores of 8 and above, and that 80% of security teams can't identify most of their devices.