Category: Cybersecurity & Digital Resilience

<p>The updated CJIS v6.1 standards introduce more rigorous requirements for agencies, necessitating a shift in how they manage system security and data protection. To maintain compliance, organizations must prioritize robust authentication measures and ongoing audit capabilities.</p><p>According to guidance from Specops, there are five practical priority areas that agencies should address to align with the v6.1 framework:</p><ul><li><strong>Multi-Factor Authentication (MFA):</strong> Implementing strong, reliable MFA to prevent unauthorized access.</li><li><strong>Account Management:</strong> Ensuring lifecycle management practices that verify user identity and access levels.</li><li><strong>Password Security:</strong> Enforcing strict password policies that mitigate the risks associated with compromised credentials.</li><li><strong>Logging:</strong> Maintaining comprehensive and accurate logs to support security monitoring and incident response.</li><li><strong>Audit Readiness:</strong> Establishing a proactive posture to demonstrate continuous compliance during assessment periods.</li></ul><p>These priorities are intended to help agencies satisfy the standard's demands for strong authentication, secure account control, and verifiable audit trails. By focusing on these five core pillars, organizations can better secure their environments while ensuring they meet the necessary regulatory obligations for handling sensitive criminal justice information.</p>

Source: BleepingComputer
Original article: https://www.bleepingcomputer.com/news/security/cjis-v61-compliance-5-practical-priorities-for-agencies/

<p>The U.S. Department of Homeland Security (DHS) has issued a formal directive ordering federal civilian agencies to cease the use of DeepSeek products. Under this new mandate, agencies are required to identify and remove all instances of DeepSeek software or services from government systems.</p><p>This directive reflects an ongoing effort by U.S. regulatory bodies to secure federal infrastructure against potential risks associated with foreign-developed software. The move effectively bars the deployment of these AI products within the federal civilian space.</p><p>The DHS action serves as an administrative control measure aimed at protecting sensitive government data and maintaining the integrity of digital infrastructure. Further details regarding the implementation timeline or specific remediation steps for agencies have not been publicly elaborated beyond the initial order to cease use and remove the technology.</p>

Source: BleepingComputer
Original article: https://www.bleepingcomputer.com/news/security/dhs-bans-deepseek-products-across-us-federal-civilian-agencies/

<p>Cybersecurity reports indicate that a Chinese-speaking threat actor is actively abusing Cairn, an AI-powered penetration testing tool, to conduct a large-scale series of cyberattacks. The campaign has resulted in the compromise of hundreds of websites across the globe.</p><p>The scope of the attacks has targeted several prominent organizations, including agricultural machinery leader John Deere, consumer product developer SharkNinja, and engine manufacturer Cummins. By utilizing an automated tool originally designed for security assessment and penetration testing, the attacker has successfully scaled their operations to infiltrate numerous targets.</p><p>The incident highlights growing concerns regarding the dual-use nature of artificial intelligence in cybersecurity. While tools like Cairn are developed to assist security professionals in identifying vulnerabilities, their automation capabilities can be repurposed by malicious actors to expedite reconnaissance and exploitation phases of an attack.</p><p>As of this reporting, the specific technical mechanisms through which the attacker is weaponizing the tool remain under investigation. The scale of the breach underscores the risks associated with the proliferation of AI-assisted offensive security technologies and the ongoing challenge for enterprises to defend against automated, intelligent threats.</p>

Source: Dark Reading
Original article: https://www.darkreading.com/cyberattacks-data-breaches/hackers-abuse-ai-pen-test-tool-cairn

<p>Ahold Delhaize, a major global food retail chain, has confirmed that it experienced a cyberattack that impacted its operations. The incident, which occurred last week, resulted in service disruptions across the company's retail locations throughout both the United States and Europe.</p><p>As of this reporting, the organization is managing the aftermath of the security incident. Ahold Delhaize is one of the world's largest operators in the grocery sector, managing a complex network of digital infrastructure to support its regional chains. The confirmation of this incident highlights the ongoing challenges large-scale retailers face in maintaining operational resilience against cyber threats that can affect cross-border business services.</p>

Source: BleepingComputer
Original article: https://www.bleepingcomputer.com/news/security/ahold-delhaize-cyberattack-affects-services-across-us-and-europe/

<p>French cloud and hosting provider OVHcloud has issued a security alert to users regarding the compromise of its open-source command-line interface (CLI) tool. The company confirmed that unauthorized actors successfully modified its software releases hosted on GitHub to include malicious code.</p><p>According to the company, these compromised versions were designed to function as information-stealing malware. The incident highlights the risks associated with supply chain security, where attackers target developer tools to gain access to sensitive information or credentials held by users of those tools.</p><p>OVHcloud is currently working to address the security breach and inform its user base. Users who have interacted with the affected CLI tool releases are advised to take necessary precautions to secure their environments and protect any developer secrets or credentials that may have been exposed.</p>

Source: BleepingComputer
Original article: https://www.bleepingcomputer.com/news/security/ovhcloud-cli-releases-backdoored-on-github-to-steal-developer-secrets/

AOMEI has faced a security incident involving its update servers, which were reportedly compromised to facilitate the distribution of malware. According to reports, attackers gained unauthorized access to the servers and utilized a built-in promotional feature within the company's backup software to deliver the malicious payload.

To facilitate the attack and remain undetected, the hackers briefly manipulated configuration files associated with the update process. Once the deployment was executed, the files were reverted to their original state, an attempt to hide the intrusion. The extent of the compromise and the total impact on users remain limited to the information currently available regarding this server-side manipulation.

Source: BleepingComputer
Original article: https://www.bleepingcomputer.com/news/security/hackers-hijack-aomei-update-servers-to-secretly-spread-malware/

Researchers have identified a growing trend in which spyware vendors exploit the digital advertising ecosystem to conduct surveillance. By manipulating targeted ad bidding processes, these actors can identify and track specific individuals and organizations of interest. This technique leverages the infrastructure of online advertising to facilitate the delivery of spyware, presenting a significant challenge for digital security and user privacy.

Source: Dark Reading
Original article: https://www.darkreading.com/data-privacy/adfection-online-ads-spyware-delivery

A large-scale fraudulent operation impersonating Microsoft technical support has been identified by researchers. The scheme relies on a malicious traffic distribution system (TDS) reportedly managed by a Russian organization to redirect unsuspecting users.

To facilitate the scam, the operators are abusing thousands of links hosted on the Cloudflare platform. The sophistication of the infrastructure highlights ongoing risks associated with malicious traffic redirection and the impersonation of major technology firms to deceive users.

Source: Dark Reading
Original article: https://www.darkreading.com/threat-intelligence/microsoft-tech-support-scam-operation

A security incident involving the Rank Math PRO WordPress plugin has been identified, resulting in a supply-chain attack. According to reports, specific versions of the plugin downloaded directly from the vendor's official website were found to contain malware. This malicious code was designed to install hidden backdoors on affected websites. The breach took place last week.

Source: BleepingComputer
Original article: https://www.bleepingcomputer.com/news/security/wordpress-seo-plugin-rank-math-compromised-to-backdoor-websites/

Nikkei Inc. has officially disclosed a new data breach, marking the third incident of this nature reported by the organization within approximately one month. According to the disclosure, this latest security event has resulted in the exposure of 1.83 million records containing personal information.

Source: BleepingComputer
Original article: https://www.bleepingcomputer.com/news/security/nikkei-discloses-third-data-breach-in-a-month-18m-records-exposed/