The Salt configuration tool patched two vulnerabilities, through which it was easy to expose the Salt installation to the full control of the attacker. The patch has been released, but unfortunately the systems are not automatic updates so they may still be vulnerable.
https://www.theregister.co.uk/2020/04/30/salt_automation_tool_vulnerable_to/
The pharmaceutical organization that deals with EcecuPharm clinical trials has been infected with ransomware. During the attack, personal data of employees, social security numbers, personal data of taxpayers, bank accounts, passports and credit cards were disclosed.
Internal threats are the most important for a security leader because some organizations fail to deal with outsiders. According to surveys, employee neglect is around 62% through which security incidents are generated.
https://www.cisomag.com/insider-threats-rise-by-47-in-two-years-report/
Malicious cybercriminals use network shells to access victims’ networks. Network shell malware is a significant threat and still difficult to detect by most security tools. Cybercriminals are increasingly using this type of malware.
In today’s world, data plays a significant role. Gadgets that have become our everyday life in a modern way of life collect confidential information about us. When publishing our private information passionately on social media, we must be aware of its use by third parties. Either way, inadequate data protection can have devastating effects.
A banking Latin American Trojan called Grandoreiro attacks Brazil, Mexico, Spain, and Peru. Grandoreiro is spread via spam.
https://www.welivesecurity.com/2020/04/28/grandoreiro-how-engorged-can-exe-get/
In the age of vast numbers of cyber attacks, most companies have dozens of cybersecurity products and tools. Constant changes are caused by the desire to protect the company and keep pace with opponents. The problem is involved, the number of devices will not ensure security until they will cooperate, and what often happens there is no such cooperation.
Employees themselves are the greatest threat to the cybersecurity program in companies. Most respondents say that human behavior is of great importance for security.
https://www.welivesecurity.com/2016/04/26/insider-threats-persistent-widespread-problem/
Security researchers have publicly disclosed the technical details and PoC4 certification for four unpatched zero-day vulnerabilities that have an impact on IBM’s security software.
https://thehackernews.com/2020/04/ibm-data-risk-manager-vulnerabilities.html
Microsoft patched the worm vulnerability in video chat and the Teams collaboration platform, which could allow the entire list of Teams accounts to be taken over by attackers who sent participants a malicious link in an invisible-looking picture.
https://thehackernews.com/2020/04/microsoft-teams-vulnerability.html