Are you a security researcher or a journalist in the cybersecurity/cybercrime space? DataBreaches.net and Zack Whittaker at this.weekinsecurity.com are conducting a survey on the types of threats that researchers and journalists have experienced, including legal threats or legal process and threats of violence by cybercriminals. The survey is at https://forms.gle/. The survey runs until January…
Brian Krebs reports: Federal authorities have arrested and indicted a 20-year-old U.S. Army soldier on suspicion of being Kiberphant0m, a cybercriminal who has been selling and leaking sensitive customer call records stolen earlier this year from AT&T and Verizon. As first reported by KrebsOnSecurity last month, the accused is a communications specialist who was recently stationed in South Korea….
New research has uncovered continued risk from a known security weakness in Microsoft’s Entra ID, potentially enabling malicious actors to achieve account takeovers in susceptible software-as-a-service (SaaS) applications. Identity security company Semperis, in an analysis of 104 SaaS applications, found nine of them to be vulnerable to Entra ID cross-tenant nOAuth abuse. First disclosed by
Sharon Otterman reports: A potential cyberattack continued for a second day to cause widespread computer system outages at Columbia University on Wednesday as the school’s engineers worked to investigate the problem and restore service. The attack, which began in the early morning hours on Tuesday, initially shut down all systems on the school’s Morningside campus…
Cassandre Coyer reports: As another cybersecurity compliance deadline hits in New York, the impact may be most deeply felt by smaller companies—as well as vendors and other businesses outside the financial sector that technically aren’t within scope of the regulation. The New York Department of Financial Services’ (NYDFS) latest Cybersecurity Regulation amendments go into effect…
Sergiu Gatlan reports: Four REvil ransomware members arrested in January 2022 were released by Russia on time served after they pleaded guilty to carding and malware distribution charges. As they confirmed, Andrey Bessonov, Mikhail Golovachuk, Roman Muromsky, and Dmitry Korotayev were involved in the Revil gang’s carding activities between October 2015 and January 2022, according…
Hackers have long used Word and Excel documents as delivery vehicles for malware, and in 2025, these tricks are far from outdated. From phishing schemes to zero-click exploits, malicious Office files are still one of the easiest ways into a victim’s system. Here are the top three Microsoft Office-based exploits still making the rounds this…
