News & Announcements

Be the first to know all the things: product updates, support announcements, company news, upcoming events, etc.

  • 157 Topics
  • 112 Replies

157 Topics

T
ThreatModeler
published in News & Announcements

Iranian State-Linked Hackers Target Israeli Entities in Advanced Spear-Phishing Campaign.Blog

Ever wondered how vulnerable our digital world can be? Meet MuddyWater, a group linked to the Iranian state, weaving cunning spear-phishing tactics to target Israeli organizations. The effort, which was made public by cybersecurity companies Group-IB and Deep Instinct, reveals a worrying uptick in the threat actor's method of operation and illuminates the expanding strategies they use to breach systems.  The attack's specifics: This recent move marks a notable shift from MuddyWater's past strategies. Their adoption of N-able's Advanced Monitoring Agent, a legitimate remote administration tool, signifies a substantial change in their cyber defense arsenal. Intriguingly, this marks the first instance of MuddyWater utilizing N-able software, signaling a tactical shift for successful breaches.The attack vectors predominantly revolve around spear-phishing emails featuring direct links or file attachments housing deceptive content like HTML, PDF, and RTF files. These attachments lead to arch

50
T
4 days ago
T
ThreatModeler
published in News & Announcements

Webinar: Bringing AI to Threat Modeling - ThreatModeler v7.0Blog

Join us on Wednesday, December 6th, at 11:00 ET for a game-changing webinar: "Bringing AI to Threat Modeling - ThreatModeler v7.0." This session is your key to unlocking the potential of DevSecOps Automated Threat Modeling.Why should you attend? Addressing the Pain Point: In today’s digital world, managing threats across intricate environments can be daunting. ThreatModeler v7.0 acts as your strategic ally, providing solutions to enhance collaboration between development and security teams. With the introduction of ThreatModeler Wingman™️, our new AI Virtual Security Assistant, and enhanced real-time collaboration features, v7.0 simplifies threat modeling for large, multinational teams.Key Take-Aways: Revolutionize Collaboration: Witness how Devs and Security teams can seamlessly collaborate using ThreatModeler Wingman™️ AI technology.   Real-Time Threat Surface Analysis: Explore how the ThreatModeler Platform, IaC-Assist, and CloudModeler tools empower your organization to review and

70
T
10 days ago
T
ThreatModeler
published in News & Announcements

Windows Drivers at Risk: 34 Vulnerable to Complete TakeoverBlog

Did you know your everyday devices could be a ticking time bomb? In a recent cybersecurity revelation, researchers have unearthed a startling fact: 34 Windows drivers, the unsung heroes running your tech, are vulnerable to a full-blown takeover. Yes, you read that right—hackers, without any special access, could seize control of your devices, running their code and wreaking havoc.Think about it. Your device's firmware, system privileges—everything up for grabs.This is not just a hypothetical scenario; it's a real danger. Leveraging research from projects like ScrewedDrivers and POPKORN, this study uses symbolic execution to automate the discovery of vulnerable drivers. The main culprits? Drivers that enable firmware access through port I/O and memory-mapped I/O. Let's break down the complexity and understand the risk your devices are facing. Let's take a closer look at the Windows Driver System Simply put, the Windows Driver System is like the backstage manager in the Microsoft Windows

160
T
10 days ago
T
ThreatModeler
published in News & Announcements

An Automotive Hacking: Driving into the Danger ZoneBlog

In the age of interconnected vehicles and smart technologies, our cars have become more than mere modes of transportation. They are now rolling computers, brimming with sensors, software, and intricate networks that offer us convenience and connectivity on the go. However, as we immerse ourselves in the world of smart cars, we must also confront an alarming concern: automotive hacking and the multitude of cybersecurity threats that accompany it. What Is Automotive Hacking? Imagine your car, a target for digital intruders, its systems manipulated remotely, and its passengers at risk. Now, welcome to the world of automotive hacking.Automotive hacking refers to the act of exploiting vulnerabilities in a vehicle's software, electronics, or communication systems to gain unauthorized access, manipulate, or control various aspects of the vehicle. This can encompass a range of attacks, from relatively benign pranks, such as changing the radio station, to far more sinister actions like taking c

180
T
11 days ago
T
ThreatModeler
published in News & Announcements

Healthcare's Battle Against Ransomware: Lessons from a $100,000 SettlementBlog

In 2017, Massachusetts-based medical management company, Doctors’ Management Services, fell prey to the GandCrab ransomware gang. The breach, initially unnoticed since April, only came to light in December when hackers encrypted the company's files. A subsequent HHS report filed four months later, revealed that 206,695 individuals had their information compromised. This is the account of a significant ransomware attack, highlighting the delayed detection and the staggering impact on thousands of individuals.This incident marks the first settlement reached by OCR with an organization affected by ransomware. Alongside the fine, OCR plans to monitor the company for three years, ensuring compliance with HIPAA's cybersecurity regulations. Doctors’ Management Services has committed to a corrective plan, including risk management updates, vulnerability identification, policy revisions, and employee training on HIPAA compliance. However, the issue extends beyond this specific case. OCR highlig

20
T
12 days ago
T
ThreatModeler
published in News & Announcements

Multi-Factor Authentication: Protecting Your Digital SpaceBlog

Ever wonder if your passwords are the digital equivalent of leaving your front door wide open? In the ever-changing world of cybersecurity, the vulnerabilities of traditional passwords have become glaringly apparent. From commonplace attacks like relaying and spraying to the more sophisticated threats of spear-phishing and pharming, hackers have mastered their skills in stealing credentials and gaining unauthorized access. Enter multi-factor authentication (MFA), a robust electronic authentication method that demands users to provide two or more forms of identity verification before accessing a system. Unveiling the Layers of MFA MFA operates on three pillars: something you know like passwords, PINs, something you have like physical objects like keys or smart cards, and something you are- biometric verification such as fingerprints or retina scans. Two-factor authentication (2FA) employs two of these checks, while MFA goes a step further, employing two or more, rendering it a formidabl

207
D
6 days ago
T
ThreatModeler
published in News & Announcements

A Growing Concern in Healthcare CybersecurityBlog

Are you ever haunted by the thought that a simple scan could unleash chaos on your digital life? Imagine this: a seemingly innocent QR code, a quick scan, and suddenly you find yourself at the mercy of cyber criminals. In a world where QR codes have become our digital gateway, the very technology designed for seamless information exchange has turned into a potential Pandora's box. The Health Sector Cybersecurity Coordination Center (HC3) has recently delved into the shadows of this menace, exposing the rising threat of "quishing" - a cunning cyberattack exploiting QR codes for phishing. Brace yourself as we unravel the unsuspecting risks lurking behind those pixelated squares, endangering not just your data, but the very fabric of cybersecurity, especially in the realm of healthcare. Understanding QR Codes and Quishing QR codes, short for Quick Response codes, are machine-readable images represented as matrices that convey information when scanned by an information system. Legitimate Q

208
D
3 days ago
T
ThreatModeler
published in News & Announcements

Social Engineering Attacks on RiseBlog

A term that's been making waves in the cyber security world is - Social Engineering.This relatively new concept has been steadily evolving in the cybersecurity world, becoming a major player in the realm of digital threats. Social engineering is not about hacking computers; it's about manipulating people. This tactic is continually growing in sophistication and poses a significant risk in our interconnected digital age. A testament to this threat comes from IBM's 2022 Cost of a Data Breach report, which reveals that the average cost of a data breach initiated through social engineering now surpasses a staggering $4 million. This figure underscores the profound impact and financial implications of social engineering in the cybersecurity landscape. What is Social Engineering Social engineering is a form of malicious manipulation that exploits human psychology to deceive individuals or organizations into taking specific actions, providing confidential information, or making security mista

151
Harsh Patel
25 days ago
T
ThreatModeler
published in News & Announcements

Threema's Security Shake-Up: Crafting Safer Messaging Apps with Threat ModelingBlog

Is Your Privacy at Risk? The Shocking Truth About Threema's Security!Threema, the trusted messenger of over ten million users, has been thrust into the spotlight for all the wrong reasons. A team of Swiss computer scientists from ETH Zurich has exposed not one, not two, but a staggering seven security flaws within this once-untouchable fortress of privacy.In a high-stakes showdown between these researchers and Threema's developers, the vulnerabilities are laid bare. Join us on a journey through the heart of this digital storm as we unveil these critical issues and shine a spotlight on the game-changing power of threat modeling. Your messaging app might not be as secure as you think – and we've got the answers you need to protect your data!" The Threema Security Flaws: Forward Security and Post-Compromise Security Absence: Threema lacked both forward security, which prevents decryption of past data even after a compromise, and post-compromise security, which can restore security after a

255
vaidehirana
18 days ago
T
ThreatModeler
published in News & Announcements

New Security Challenge: Malicious generative AIBlog

Imagine a world where technology keeps evolving, pushing the boundaries of what's possible. Now, picture a new, unsettling threat - malicious Generative AI. It's real, and it's here. Recent creations like FraudGPT and WormGPT have unveiled a fresh breed of vulnerabilities, putting our digital security at risk. In this article, we dive deep into the realm of Generative AI, unraveling the very nature of these risks. But don't worry, we won't leave you hanging – we'll present a proactive strategy to bolster your cybersecurity defenses. In our hyper-connected world, understanding and addressing this issue is paramount. Understanding Generative AI Threats:FraudGPT, a subscription-based malicious Generative AI, leverages advanced machine learning algorithms to generate deceptive content. Unlike ethical AI models, it knows no boundaries, enabling it to craft tailored spear-phishing emails, counterfeit invoices, and fabricated news articles for cyberattacks, scams, and public opinion manipulat

217
D
6 days ago
T
ThreatModeler
published in News & Announcements

Secure Surfing: How to Safeguard Your Online Privacy on Public Wi-FiBlog

Today’s world is defined by remote work, frequent travel, and an insatiable appetite for uninterrupted connectivity, the likelihood is high that you've embraced the convenience of public Wi-Fi hotspots. These free hotspots provide unmatched convenience, allowing us to access online accounts, catch up on work, and stay connected while on the move. However, this convenience comes with a significant trade-off: the security risks associated with public Wi-Fi networks. The Perils of Public Wi-Fi: Public Wi-Fi networks, while omnipresent, often lack robust security measures, leaving users vulnerable to a range of cyber threats. It's essential to understand these risks to protect your sensitive data.Man-in-the-Middle Attacks (MITM): MITM attacks are a prevalent threat on public networks. Attackers intercept data between your device and the internet, potentially exposing your private information. Phishing emails can also be used to carry out MITM attacks.   Unencrypted Networks: Many public Wi

232
E
1 month ago
T
ThreatModeler
published in News & Announcements

"Massive Toyota Data Exposure Caused by Improper Cloud Configuration"Blog

For over eight years, Toyota Motor faced a substantial data breach caused by a cloud misconfiguration, affecting over 260,000 customers. This misconfiguration within Toyota’s The cloud environment led to the exposure of vehicle data and customer information for approximately 260,000 individuals, not only in Japan but also in certain regions of Asia and Oceania. This incident underscores the critical importance of threat modeling in securing cloud environments. Threat modeling involves identifying potential vulnerabilities and security risks, allowing organizations to proactively address and mitigate these issues before they lead to data breaches. Had Toyota employed threat modeling in their cloud environment, they might have identified and addressed the misconfiguration early on. Threat modeling helps organizations anticipate and plan for potential threats, such as misconfigurations, and implement security measures to prevent them. It would have provided a structured approach to identi

60
T
1 month ago
T
ThreatModeler
published in News & Announcements

Addressing the Cisco E-Responder VulnerabilityBlog

Organizations and individuals alike rely on network infrastructure to stay connected. However, this interconnected world isn't without its vulnerabilities. Recently, Cisco, a major player in the networking equipment industry, discovered and promptly addressed a critical security flaw that could have had severe consequences if left unattended. This flaw, tracked as CVE-2023-20101, highlights the importance of proactive security measures and the role threat modeling plays in safeguarding against potential threats. The Vulnerability The vulnerability found in Cisco Emergency Responder, known as CVE-2023-20101, earned a CVSS (Common Vulnerability Scoring System) score of 9.8, indicating its critical nature. The issue arises from the presence of hard-coded credentials for the root account, typically intended for development purposes. This flaw would allow unauthenticated, remote attackers to access susceptible systems, enabling them to execute arbitrary commands as the root user. Implicatio

101
Harsh Patel
1 month ago
T
ThreatModeler
published in News & Announcements

Decoding Loda RAT: A Persistent Cyber ThreatBlog

The emergence of advanced threats presents a serious challenge to both individuals and organizations in the constantly changing field of cybersecurity today. The Loda Remote Access Trojan (RAT) is one of the most dangerous of these viruses. Loda RAT, created in AutoIT, a user-friendly scripting language for Windows automation, has been actively used by a number of threat actors and has shown a range of capabilities that require our attention. How Common Loda RAT Is Due to its reputation for delivering harmful payloads such as keyloggers, data theft, and the unapproved acquisition of private data, Loda RAT has become well-known. The most common way that it is disseminated is through phishing email operations, which have been around since 2016. The Loda Malware's Capabilities Loda RAT is a versatile tool for cybercriminals, offering a range of capabilities, including:Utilizing Remote Desktop Protocol (RDP) for remote access to compromised systems. Data and file theft. Execution of additi

111
Harsh Patel
1 month ago
T
ThreatModeler
published in News & Announcements

The Importance of Protecting Voter DataBlog

In an era where cybersecurity threats are a big concern for many aspects of our lives, the recent breach of voter data in the District of Columbia serves as a reminder of the critical importance of safeguarding this sensitive information. The breach, attributed to a threat actor known as RansomedVC, not only expose vulnerabilities in our electoral systems but also underscores the need for robust protection of voter data to preserve the integrity of democracy. This article goes deeper into the significance of voter data, the possible repercussions of a data leak, and how threat modeling can be used in protecting this invaluable asset. District of Columbia confirms Voter data leak: The District of Columbia Board of Elections (DCBOE) is investigating a data leak  involving an unknown number of voter records after claims by a threat actor named RansomedVC. The breach occurred through the web server of DataNet, the hosting provider for DC's election authority, but didn't compromise DCBOE's

141
Harsh Patel
1 month ago
T
ThreatModeler
published in News & Announcements

Airbus Data Breach and Impending Attacks on Defense GiantsBlog

The global cybersecurity landscape faces increased challenges as a threat actor, known as "USDoD," has compromised the confidential information of 3,200 Airbus vendors. This breach has exposed sensitive details, including names, phone numbers, and email addresses. Furthermore, the perpetrator behind this attack has announced their intention to target aerospace and defense giants Lockheed Martin and Raytheon in upcoming attacks. This alarming development underscores the growing threat of cyberattacks on critical infrastructure and organizations. This threat actor has gained notoriety in the cybercrime landscape. This actor previously made headlines by selling the FBI's InfraGrad database in December 2022. The sale of the InfraGrad database occurred on the now-defunct "Breached" forum and led to the seizure of the domain by authorities. Info-Stealer Infections on the Rise Reports indicate a staggering 6000% increase in info-stealer infections since 2018. Info-stealers have become the pri

313
M
1 month ago
T
ThreatModeler
published in News & Announcements

OriginBotnet and Its Malicious PayloadsBlog

In the ever-evolving realm of cybersecurity threats, a highly complex cyber attack campaign has emerged as a pressing concern. This insidious attack strategy utilized a  misleading Word document as its initial weapon, leveraging phishing emails to dupe unsuspecting victims into unintentionally downloading a bitter loader.  Once activated, this loader dispatched  poisonous payloads, each with a unique and threatening objective.This revelation underscores the urgency of the issue, demanding heightened vigilance and proactive measures in the face of increasingly Clever and multifaceted cyberattacks. Origin Botnets identity revealed OriginBotnet, an important player in this cyber attack campaign, possesses a complex set of capabilities. Upon infecting a target system, it initiates a series of actions aimed at gathering sensitive information, establishing communication with its Command and Control (C2) server, and downloading additional files to execute keylogging and password recovery oper

132
Anjali RAii
1 month ago
T
ThreatModeler
published in News & Announcements

Smart City : Balancing Innovation and Cyber SecurityBlog

SMART CITY, the term refers to the implementation of information and communication technologies (ICT) aimed at improving urban services and infrastructure. There is a growing trend and considerable buzz surrounding smart city technologies. According to a research conducted by consulting firm Frost & Sullivan, investments in smart cities are projected to reach $327 billion by 2025, a substantial increase from $96 billion in 2019.     However, amidst this enthusiasm, there are critics who raise important concerns when local governments embrace these digital systems. A significant apprehension revolves around cybersecurity. Addressing cybersecurity concerns in smart cities is very important. If we fail to do so, it puts the entire idea of these advanced cities at risk and can lead to serious problems with public safety and trust. As we use more and more connected devices, rely on data for decision-making, and automate various processes in cities, we must make protecting against cyber

252
K
1 month ago
T
ThreatModeler
published in News & Announcements

The Growing Threat of Mac OS InfoStealers Revealed in MetaStealerBlog

The cybersecurity environment is constantly changing and threat actors are continually adapting their tactics to target a broader range of systems. One alarming trend is the increasing focus on macOS users. A recent addition to the macOS threat landscape is the MetaStealer malware, a refined information-stealing tool built using the Go programming language. Distribution Strategies: Luring Victims with Social Engineering MetaStealer uses a crafty strategy to enter macOS systems, focusing especially on corporate users. Attackers lure victims into executing malicious payloads by disguising themselves as fictitious design clients and engaging in social engineering techniques. These malicious payloads frequently appear as disc image bundles (.dmg) with names that seem exoneratedSome notable examples include-"Brief_Presentation-Task_Overview-(SOW)-PlayersClub" and "CONCEPT A3 full menu with dishes and translations to English" are examples of brief presentations. Attackers have been known to

152
Anjali RAii
1 month ago
T
ThreatModeler
published in News & Announcements

Understanding the Remcos RAT Campaign's ComplexitiesBlog

A recent study from McAfee Labs uncovered a highly sophisticated Remcos RAT campaign. This campaign showcased the malware's complexity with multiple stages. It all started with phishing emails containing encrypted VBS files hidden in ZIP/RAR attachments. The Remcos RAT, known for its ability to gather information and gain secret access, used advanced techniques like obfuscation and anti-debugging tricks. This involved using VBS and PowerShell scripts, along with encrypted PE files as part of the attack. Finally, they deployed the Sky Crypter Trojan, which decrypted a final payload and revealed how the attack would keep working, inject into processes, and had advanced settings. This complex threat highlights the ever-evolving nature of cyberattacks and the crucial need for robust cybersecurity measures to detect and stop such advanced threats. How Does a Remote Access Trojan Work? A RAT is intended to allow an attacker to remotely operate a computer in the same way that RDP and TeamView

311
Harsh Patel
2 months ago
Shaiphali Mishra
Shaiphali Mishra
published in News & Announcements

Microsoft AI Data BreachBlog

In the age of rapidly advancing technology and artificial intelligence, data security and privacy have become paramount concerns. Companies and organizations invest heavily in safeguarding their confidential information, but even the most diligent can fall victim to unintended data breaches. Microsoft recently responded to a security incident that exposed 38 terabytes of private data. The breach was discovered on Microsoft's AI GitHub repository and resulted from the accidental publication of open-source training data. The exposed data included a disk backup of two former employees' workstations, which contained sensitive information such as secrets, keys, passwords, and internal Teams messages. The compromised repository, named "robust-models-transfer," has since been taken down. Before its removal, it contained source code and machine learning models related to a 2020 research paper titled "Do Adversarially Robust ImageNet Models Transfer Better?" The security lapse occurred due to a

72
A
2 months ago
T
ThreatModeler
published in News & Announcements

SapphireStealer: An Evolving Threat in the World of Information StealersBlog

A new threat has appeared in the constantly changing environment of cyber threats, raising severe concerns in the cybersecurity industry. Open-source information thief SapphireStealer originally surfaced in public malware repositories in December 2022, and since then, it has caused a stir. In-depth analysis of SapphireStealer's complexities, capabilities, effects, and cybercriminals' reactions to this evolving threat are provided in this paper. We'll also look at the crucial role threat modeling can play in protecting against such dangers.  The Rise of Information Stealers SapphireStealer has gained popularity among cybercriminals in recent years. These threats offer a straightforward way to compromise and distribute sensitive information and account-related details, making them attractive to financially motivated attackers. The stolen credentials often include corporate account information, access tokens, and other data that can be used to infiltrate corporate networks and execute var

153
Harsh Patel
2 months ago
T
ThreatModeler
published in News & Announcements

NoEscape Ransomware Group Attacks US-Canada Water Rights BodyBlog

In a recent turn of events,  the International Joint Commission, responsible for managing water rights along the US-Canada border, fell victim to a ransomware attack. The incident raised concerns as the attackers, NoEscape ransomware group, claimed to have stolen a substantial 80GB of sensitive data, including contracts, employee information, and legal documents.  According to Verizon’s 2022 data breach report, ransomware attacks saw a 13% increase in the past five years. This shows the rising threat of ransomware groups and the importance of adopting cyber security measures. Who is NoEscape? NoEscape is a ransomware-as-a-service operation that emerged in May, employing a double-extortion approach. Rather than immediately encrypting victims' files and demanding a ransom, NoEscape first exfiltrates the data and then threatens to leak it if the ransom is not paid. Notably, the group avoids targeting organizations within the former Soviet Union, aligning with the strategies of ransomware

942
Harsh Patel
2 months ago
T
ThreatModeler
published in News & Announcements

🏆🎉 Congratulations to Our Capture the Flag Challenge Winners! 🎉🏆Blog

We're thrilled to announce the triumphant champions of our recent Capture the Flag challenge! 🚩 Your skills and determination have truly impressed us, and it's time to celebrate your outstanding achievements!🥇 First Place: Zajt - Prizes: $250 Gift Card + ThreatModeler's SWAG🥈 Second Place: Securisec - Prizes: $150 Gift Card + ThreatModeler's SWAG🥉 Third Place: Conrad - Prizes: $100 Gift Card + ThreatModeler's SWAGBut wait, there's more! We've got exciting giveaways and surprises lined up for our community. 🎁 Stay tuned for exclusive announcements, competitions, and rewards that you won't want to miss!And the adventure doesn't end here! Our next event is just around the corner, promising more challenges, fun, and camaraderie. 🚀 Get ready to test your skills and make new memories!Thank you to all participants for making this challenge a tremendous success. 🙌 To the winners, your achievements inspire us all, and we can't wait to see what you'll conquer next!#CaptureTheFlagWinners #

759
P
2 months ago
T
ThreatModeler
published in News & Announcements

Cybersecurity in Healthcare: Protecting Patients and Data from Evolving ThreatsBlog

The problems here are about cybersecurity challenges in healthcare organizations that are significant and pose serious risks to patient safety, data security, and overall operational integrity. ThreatModeler, a threat modeling tool, can play a crucial role in helping healthcare organizations address these challenges. Threats to Healthcare Cyber-physical systems vulnerabilitiesThe increasing interconnectivity of cyber-physical systems in healthcare makes them vulnerable to cyberattacks. An attack on these systems can have devastating consequences for patient care and safety. High incidence of cybersecurity IncidentsThe healthcare sector is experiencing a high incidence of cybersecurity incidents, including those affecting critical systems like medical devices and building management. These incidents can disrupt care delivery and compromise patient data. Ransomware threatRansomware attacks are prevalent in healthcare, and some organizations have paid ransoms, which is not advisable. Payi

483
Vastris31
1 month ago
Terms & ConditionsCookie settings