SC Awards Winners Circle:    2:52 / 25:28   Lessons from Ukraine

Qualys

Lessons from Ukraine: How cyberwar shapes security at home

Malware

<body><h3>Interview with Anna Pham</h3></body>

<body>Breaking in with ClickFix: Anatomy of a modern endpoint attack</body>

<body>Breaking in with ClickFix: Anatomy of a modern endpoint attack</body>

<body>Cybersecurity company Huntress just published a report on a new ClickFix variant they’ve discovered, which they’ve dubbed CrashFix. This technique was developed by KongTuke to serve as the primary lure within a new custom malicious browser extension also created by the group.</body>

<body>Cybersecurity company Huntress just published a report on a new ClickFix variant they’ve discovered, which they’ve dubbed CrashFix. This technique was developed by KongTuke to serve as the primary lure within a new custom malicious browser extension also created by the group. </body>

<body>In short, the team observed the threat actors using KongTuke’s malicious browser extension to display a fake security warning, claiming the browser had “stopped abnormally” and prompting users to run a “scan” to remediate the threats. Upon “running the scan,” the user is presented with a fake “Security issues detected” alert and instructed to manually “fix” the issue by opening the Windows Run dialog, pasting from their clipboard, and pressing Enter.</body>

<body>In short, the team observed the threat actors using KongTuke’s malicious browser extension to display a fake security warning, claiming the browser had “stopped abnormally” and prompting users to run a “scan” to remediate the threats. Upon “running the scan,” the user is presented with a fake “Security issues detected” alert and instructed to manually “fix” the issue by opening the Windows Run dialog, pasting from their clipboard, and pressing Enter. </body>

<body>The malicious extension silently copies a PowerShell command to the clipboard, disguised as a legitimate repair command. From there, they execute the malicious command.</body>

<body>The malicious extension silently copies a PowerShell command to the clipboard, disguised as a legitimate repair command. From there, they execute the malicious command. </body>

<body><ul><li>BLOG - <a rel="noreferrer noopener" target="_blank" href="https://www.huntress.com/blog/malicious-browser-extention-crashfix-kongtuke">Dissecting CrashFix: KongTuke's New Toy</a></li></ul></body>

<body>Interview with David Zendzian</body>

<body><h3>Interview with David Zendzian</h3></body>

<body>Continuous compliance and real security lifecycle management</body>

<body>Continuous compliance and real security lifecycle management</body>

<body>Supply chain attacks are not just on the rise; attackers are learning from the past, making these attacks even more effective and dangerous than before. It was just over a month ago when the Shai-Hulud attack first impacted NPM packages, forcing enterprises around the world into lockdown. While only 187 packages were compromised in that initial incident, it served as a wake-up call for many: an accurate inventory of systems is good, but a clear, real-time Software Bill of Materials (SBOM) for applications is non-negotiable.</body>

<body>Supply chain attacks are not just on the rise; attackers are learning from the past, making these attacks even more effective and dangerous than before. It was just over a month ago when the Shai-Hulud attack first impacted NPM packages, forcing enterprises around the world into lockdown. While only 187 packages were compromised in that initial incident, it served as a wake-up call for many: an accurate inventory of systems is good, but a clear, real-time Software Bill of Materials (SBOM) for applications is non-negotiable.</body>

<body>In this world of manifest based infrastructure and container based applications with (real) "devsecops", the dream of continuous upgrades of OS/Runtime/Stack/App and App Dependencies is very mature and there are solid examples of companies and federal entities managing this at scale without thousands of teams and people.</body>

<body>In this world of manifest based infrastructure and container based applications with (real) "devsecops", the dream of continuous upgrades of OS/Runtime/Stack/App and App Dependencies is very mature and there are solid examples of companies and federal entities managing this at scale without thousands of teams and people.</body>

<body><ul><li>BLOG - <a rel="noreferrer noopener" target="_blank" href="https://blogs.vmware.com/tanzu/supply-chain-security-how-accurate-sboms-can-deliver-proactive-threat-mitigation/">Supply Chain Security: How accurate SBOMs can deliver proactive threat mitigation</a></li></ul></body>

<body><h3>Interview with Jacob Horne</h3></body>

<body>CMMC Phase 1 Enforcement — What the November 10 Deadline Means for the Defense Supply Chain</body>

<body>CMMC Phase 1 Enforcement — What the November 10 Deadline Means for the Defense Supply Chain</body>

<body>With the upcoming CMMC Phase 1 enforcement on November 10, cybersecurity teams across the defense and federal supply chain are facing new compliance requirements that directly affect contract eligibility and data-protection standards. Jacob Horne, Chief Cybersecurity Evangelist at Summit 7, can break down what this milestone means for enterprise security leaders, MSPs/MSSPs, and contractors preparing for audits.</body>

<body>With the upcoming CMMC Phase 1 enforcement on November 10, cybersecurity teams across the defense and federal supply chain are facing new compliance requirements that directly affect contract eligibility and data-protection standards. Jacob Horne, Chief Cybersecurity Evangelist at Summit 7, can break down what this milestone means for enterprise security leaders, MSPs/MSSPs, and contractors preparing for audits.</body>

Featured image for {“vendor”:”ppworks”,”type”:”segment”,”id”:”14481″} podcast from PPWorks

Supply chain

Government Regulations

Breaking in with CrashFix, supply chain security, and CMMC phase 1 – Anna Pham, David Zendzian, Jacob Horne – ESW #449

alert_malware_AdobeStock_119534602

Brief

Browser extension weaponization for malware delivery examined

Privacy concept: pixelated words Malware on digital background, 3d render

Privacy concept: Malware on digital background

Stealer malware distributed via bogus GitHub tools

Business man using computer hand close up futuristic cyber space decentralized finance AI chatbot coding background business data analytics programming network metaverse digital world technology

Business man using computer hand close up futuristic cyber space

AI/ML

Threat Intelligence

AI-generated vibeware spread in new APT36 campaign

China Flag Made of Binary Code and Chinese Symbols on Red Backgr

Critical Infrastructure Security

Chinese APT taps novel malware in telco attacks

<body>Iran vs Everyone: 2FA-Bypass Phish, APT41 Drive, iOS 0days, Josh Marpet, and More on the Security Weekly News</body>

<body>Iran vs Everyone: 2FA-Bypass Phish, APT41 Drive, iOS 0days, Josh Marpet, and More on the Security Weekly News</body>

Featured image for {“vendor”:”ppworks”,”type”:”segment”,”id”:”14575″} podcast from PPWorks

Security Operations

Iran vs Everyone: 2FA-Bypass Phish, APT41 Drive, iOS 0days, Josh Marpet, and More – SWN #561

RCE bug found in platform that powers Wikipedia, other "Wiki" sites

Wiki Article Image

Wikimedia Foundation hit by JavaScript worm; editing restricted

Laptop screen showing malware warning sign with digital circuit background on desk in modern office environment with natural light and creative concept.

Malware

Related Videos