Skip to main content

News & Announcements

Be the first to know all the things: product updates, support announcements, company news, upcoming events, etc.

  • 156 Topics
  • 112 Replies
156 Topics
A
Anonymous
published in News & Announcements
Get Ready to Unleash Your Cyber Skills at ThreatModeler 2023 Capture the Flag Event!News

We invite you to participate in our first inaugural Capture the Flag (CTF) event and experience the thrill of cybersecurity! Brace yourself for a riveting competition where you'll go head-to-head with fellow hackers, tackling diverse challenges to capture "flags."The ultimate prize? The winner is the one who gathers the most flags the quickest! Mark Your Calendar: September 18  Who Can Join? Whether you're a seasoned cyber maestro or just starting your cybersecurity odyssey, this event is tailor-made for and open to cybersecurity enthusiasts of all skill levels. Our mission is to craft an electrifying, accessible experience that celebrates cybersecurity passion in all its forms. Why Participate? Sharpen Your Skills: Hone your cybersecurity prowess in a dynamic, real-world setting.Forge Connections: Network with kindred cybersecurity spirits and expand your professional circle.Epic Thrills: Engage in pulse-pounding challenges designed to push your limits and ignite your competitive spir

1235
S
1 year ago
T
ThreatModeler
published in News & Announcements
NoEscape Ransomware Group Attacks Water Rights BodyBlog

In a recent turn of events,  the International Joint Commission, responsible for managing water rights along the US-Canada border, fell victim to a ransomware attack. The incident raised concerns as the attackers, NoEscape ransomware group, claimed to have stolen a substantial 80GB of sensitive data, including contracts, employee information, and legal documents.  According to Verizon’s 2022 data breach report, ransomware attacks saw a 13% increase in the past five years. This shows the rising threat of ransomware groups and the importance of adopting cyber security measures. Who is NoEscape? NoEscape is a ransomware-as-a-service operation that emerged in May, employing a double-extortion approach. Rather than immediately encrypting victims' files and demanding a ransom, NoEscape first exfiltrates the data and then threatens to leak it if the ransom is not paid. Notably, the group avoids targeting organizations within the former Soviet Union, aligning with the strategies of ransomware

1182
A
1 year ago
T
ThreatModeler
published in News & Announcements
Congratulations to Our Capture the Flag Challenge Winners!🏆Blog

We're thrilled to announce the triumphant champions of our recent Capture the Flag challenge! 🚩 Your skills and determination have truly impressed us, and it's time to celebrate your outstanding achievements!🥇 First Place: Zajt - Prizes: $250 Gift Card + ThreatModeler's SWAG🥈 Second Place: Securisec - Prizes: $150 Gift Card + ThreatModeler's SWAG🥉 Third Place: Conrad - Prizes: $100 Gift Card + ThreatModeler's SWAGBut wait, there's more! We've got exciting giveaways and surprises lined up for our community. 🎁 Stay tuned for exclusive announcements, competitions, and rewards that you won't want to miss!And the adventure doesn't end here! Our next event is just around the corner, promising more challenges, fun, and camaraderie. 🚀 Get ready to test your skills and make new memories!Thank you to all participants for making this challenge a tremendous success. 🙌 To the winners, your achievements inspire us all, and we can't wait to see what you'll conquer next!#CaptureTheFlagWinners #

979
P
1 year ago
T
ThreatModeler
published in News & Announcements
Protecting Healthcare from Evolving Cyber ThreatsBlog

The problems here are about cybersecurity challenges in healthcare organizations that are significant and pose serious risks to patient safety, data security, and overall operational integrity. ThreatModeler, a threat modeling tool, can play a crucial role in helping healthcare organizations address these challenges. Threats to Healthcare Cyber-physical systems vulnerabilitiesThe increasing interconnectivity of cyber-physical systems in healthcare makes them vulnerable to cyberattacks. An attack on these systems can have devastating consequences for patient care and safety. High incidence of cybersecurity IncidentsThe healthcare sector is experiencing a high incidence of cybersecurity incidents, including those affecting critical systems like medical devices and building management. These incidents can disrupt care delivery and compromise patient data. Ransomware threatRansomware attacks are prevalent in healthcare, and some organizations have paid ransoms, which is not advisable. Payi

613
Vastris31
11 months ago
T
ThreatModeler
published in News & Announcements
Typosquatting Threat: Malicious npm Packages Deploying Luna Token GrabberBlog

The problem here is the discovery of more than a dozen malicious packages on the npm (Node Package Manager) repository since the beginning of August 2023. These packages have the capability to deploy an open-source information stealer known as Luna Token Grabber onto systems belonging to Roblox developers. The malicious packages masquerade as a legitimate package called "noblox.js," which is an API wrapper used for creating scripts that interact with the Roblox gaming platform. Implications These malicious packages could potentially compromise the security and privacy of Roblox developers by deploying an information stealer.The packages were downloaded 963 times before they were taken down, which means that a significant number of developers may have been affected.The attack demonstrates a trend of malicious actors using typosquatting to trick developers into downloading malicious code, which can have wide-reaching implications for the trustworthiness of software supply chains. How Thr

591
P
1 year ago
T
ThreatModeler
published in News & Announcements
Threema's Security Enhancements with Threat ModelingBlog

Is Your Privacy at Risk? The Shocking Truth About Threema's Security!Threema, the trusted messenger of over ten million users, has been thrust into the spotlight for all the wrong reasons. A team of Swiss computer scientists from ETH Zurich has exposed not one, not two, but a staggering seven security flaws within this once-untouchable fortress of privacy.In a high-stakes showdown between these researchers and Threema's developers, the vulnerabilities are laid bare. Join us on a journey through the heart of this digital storm as we unveil these critical issues and shine a spotlight on the game-changing power of threat modeling. Your messaging app might not be as secure as you think – and we've got the answers you need to protect your data!" The Threema Security Flaws: Forward Security and Post-Compromise Security Absence: Threema lacked both forward security, which prevents decryption of past data even after a compromise, and post-compromise security, which can restore security after a

585
vaidehirana
10 months ago
T
ThreatModeler
published in News & Announcements
Get Started with the Threat Modeling Community

Is this your first time visiting the ThreatModeler Community? Welcome! We’re so glad you found us. If you’ve been here before, welcome back! This thread will prepare you to get the most out of the community, explain the purpose of each of the sections, and explore what you can expect to learn in them.   Why are we here?This community is built for those who hope to use ThreatModeler to minimize risk with threat modeling. Whether you’re new to our product or to threat modeling as a practice, or you’re seasoned and looking for ways to take the next step, this community is for you. As the foremost expert in threat modeling, ThreatModeler is hyper-focused on helping DevOps teams make proactive security decisions instead of reacting to vulnerabilities and threats. We’ve curated this space with experts who are here to help you succeed, answer your questions along the way, and educate you as you learn how threat modeling can decrease risk for your organization. You’ll also find those peers who

571
Kristen Canady
1 year ago
T
ThreatModeler
published in News & Announcements
A Growing Concern in Healthcare CybersecurityBlog

Are you ever haunted by the thought that a simple scan could unleash chaos on your digital life? Imagine this: a seemingly innocent QR code, a quick scan, and suddenly you find yourself at the mercy of cyber criminals. In a world where QR codes have become our digital gateway, the very technology designed for seamless information exchange has turned into a potential Pandora's box. The Health Sector Cybersecurity Coordination Center (HC3) has recently delved into the shadows of this menace, exposing the rising threat of "quishing" - a cunning cyberattack exploiting QR codes for phishing. Brace yourself as we unravel the unsuspecting risks lurking behind those pixelated squares, endangering not just your data, but the very fabric of cybersecurity, especially in the realm of healthcare. Understanding QR Codes and Quishing QR codes, short for Quick Response codes, are machine-readable images represented as matrices that convey information when scanned by an information system. Legitimate Q

518
Vastris31
8 months ago
T
ThreatModeler
published in News & Announcements
Smart City : Balancing Innovation and Cyber SecurityBlog

SMART CITY, the term refers to the implementation of information and communication technologies (ICT) aimed at improving urban services and infrastructure. There is a growing trend and considerable buzz surrounding smart city technologies. According to a research conducted by consulting firm Frost & Sullivan, investments in smart cities are projected to reach $327 billion by 2025, a substantial increase from $96 billion in 2019.     However, amidst this enthusiasm, there are critics who raise important concerns when local governments embrace these digital systems. A significant apprehension revolves around cybersecurity. Addressing cybersecurity concerns in smart cities is very important. If we fail to do so, it puts the entire idea of these advanced cities at risk and can lead to serious problems with public safety and trust. As we use more and more connected devices, rely on data for decision-making, and automate various processes in cities, we must make protecting against cyber

492
K
1 year ago
T
ThreatModeler
published in News & Announcements
Understanding the Remcos RAT Campaign's ComplexitiesBlog

A recent study from McAfee Labs uncovered a highly sophisticated Remcos RAT campaign. This campaign showcased the malware's complexity with multiple stages. It all started with phishing emails containing encrypted VBS files hidden in ZIP/RAR attachments. The Remcos RAT, known for its ability to gather information and gain secret access, used advanced techniques like obfuscation and anti-debugging tricks. This involved using VBS and PowerShell scripts, along with encrypted PE files as part of the attack. Finally, they deployed the Sky Crypter Trojan, which decrypted a final payload and revealed how the attack would keep working, inject into processes, and had advanced settings. This complex threat highlights the ever-evolving nature of cyberattacks and the crucial need for robust cybersecurity measures to detect and stop such advanced threats. How Does a Remote Access Trojan Work? A RAT is intended to allow an attacker to remotely operate a computer in the same way that RDP and TeamView

471
A
1 year ago
T
ThreatModeler
published in News & Announcements
Airbus Data Breach and Impending Attacks on Defense GiantsBlog

The global cybersecurity landscape faces increased challenges as a threat actor, known as "USDoD," has compromised the confidential information of 3,200 Airbus vendors. This breach has exposed sensitive details, including names, phone numbers, and email addresses. Furthermore, the perpetrator behind this attack has announced their intention to target aerospace and defense giants Lockheed Martin and Raytheon in upcoming attacks. This alarming development underscores the growing threat of cyberattacks on critical infrastructure and organizations. This threat actor has gained notoriety in the cybercrime landscape. This actor previously made headlines by selling the FBI's InfraGrad database in December 2022. The sale of the InfraGrad database occurred on the now-defunct "Breached" forum and led to the seizure of the domain by authorities. Info-Stealer Infections on the Rise Reports indicate a staggering 6000% increase in info-stealer infections since 2018. Info-stealers have become the pri

443
M
11 months ago
T
ThreatModeler
published in News & Announcements
BlueShell Malware Attacks on Windows, Linux, and MacBlog

In recent developments, the Asian Security and Emergency Center (ASEC) has released a concerning report regarding the increasing threat of BlueShell malware in cyberattacks across Korea and Thailand. This sophisticated malware, known for its multi-platform capabilities, poses a significant threat to Windows, Mac, and Linux operating systems in the region. Understanding BlueShell Malware:- BlueShell, a malicious software first detected in 2020, is written in the Go programming language. What makes it particularly insidious is its use of TLS encryption to conceal communication with its command and control (C2) server, evading network detection. The malware relies on three critical configuration parameters: the IP address of the C2 server, the port number, and a specified waiting time.Researchers have identified the Dalbit Group, a threat actor based in China, as one of the perpetrators behind BlueShell attacks. This group primarily targets vulnerable servers to pilfer critical data, whic

431
catiecangialosi
1 year ago
T
ThreatModeler
published in News & Announcements
New 'RustBucket' Malware Risks for macOS UsersBlog

Recently, security experts discovered an improved version of RustBucket, a malicious application that especially targets Apple macOS users. This new RustBucket variation has been enhanced to make it even more hazardous. Notably, it has improved properties that enable it to remain undetected on infected systems for extended periods of time, escaping detection by security software.Elastic Security Labs reported the discovery of this upgraded version in a recent investigation, noting that it includes the capacity to persistently live on compromised macOS machines without raising suspicion. Furthermore, for command and control operations, the malware leverages a method known as dynamic network infrastructure. Implications RustBucket's expanded capabilities represent a serious threat to macOS users. Users are exposed to substantial dangers as a result of this enhanced stealth capability, including potential data breaches, loss of sensitive information, and unwanted access to their machines.

420
T
1 year ago
T
ThreatModeler
published in News & Announcements
New Security Challenge: Malicious generative AIBlog

Imagine a world where technology keeps evolving, pushing the boundaries of what's possible. Now, picture a new, unsettling threat - malicious Generative AI. It's real, and it's here. Recent creations like FraudGPT and WormGPT have unveiled a fresh breed of vulnerabilities, putting our digital security at risk. In this article, we dive deep into the realm of Generative AI, unraveling the very nature of these risks. But don't worry, we won't leave you hanging – we'll present a proactive strategy to bolster your cybersecurity defenses. In our hyper-connected world, understanding and addressing this issue is paramount. Understanding Generative AI Threats:FraudGPT, a subscription-based malicious Generative AI, leverages advanced machine learning algorithms to generate deceptive content. Unlike ethical AI models, it knows no boundaries, enabling it to craft tailored spear-phishing emails, counterfeit invoices, and fabricated news articles for cyberattacks, scams, and public opinion manipulat

397
D
10 months ago
A
Anonymous
published in News & Announcements
Is Threat Modeling the Answer to OT Security?Blog

Threat modeling, from its very inception, was envisioned as a solution to information technology (IT) threats. After all, IT is where the data is, which is nominally the fastest and surest path to a ransom for bad actors. Sometimes, bad actors want something other than money. They want to disrupt (at best) or bring down (at worst) and organization. And while that can certainly be done by “attacking” a company’s data, for some companies, it can also be done by attacking their operations. The OT Security Problem What is OT? From RedHat, “OT, or operational technology, is the practice of using hardware and software to control industrial equipment, and it primarily interacts with the physical world. OT includes industrial control systems (ICSs) like programmable logic controllers (PLCs), distributed control systems (DCSs), and supervisory control and data acquisition (SCADA) systems.” What is the OT security problem? Legacy OT hardware and software was never designed to protect itself from

394
P
1 year ago
A
Anonymous
posted in News & Announcements
ThreatModeler Wins CyberSecurity Excellence Award 2023

We’re proud to announce our award in the category of Best Cybersecurity Startup - North America (between 50 to 99 employees):https://cybersecurity-excellence-awards.com/2023-cybersecurity-company-awards-winners/https://cybersecurity-excellence-awards.com/candidates/threatmodeler-6/ 

5
A
1 year ago
T
ThreatModeler
published in News & Announcements
Hackers Exploit Zero-Day Vulnerability in Resort Management SoftwareBlog

In the digital age where resorts and hotels rely heavily on property management software, a shadowy group of financially motivated hackers has orchestrated a chilling attack. These cybercriminals have exploited a likely zero-day vulnerability in popular property management software, throwing the hospitality industry into turmoil. Security researchers at Bitdefender have shed light on this alarming breach, revealing not only the extent of the attack but also the urgent need for robust threat modeling. The Hackers' Ingenious Techniques:- The hackers' tactics are as sophisticated as they are alarming. Bitdefender's investigation uncovered a custom malware designed explicitly for this malicious endeavor. This malware easily integrated with legitimate network traffic, enabling the covert exfiltration of sensitive data.The attack utilized an undisclosed initial attack vector, presumably tied to the vulnerable property management software. Among the vulnerabilities exploited were hardcoded cr

382
E
11 months ago
T
ThreatModeler
published in News & Announcements
Multi-Factor Authentication: Protecting Your Digital SpaceBlog

Ever wonder if your passwords are the digital equivalent of leaving your front door wide open? In the ever-changing world of cybersecurity, the vulnerabilities of traditional passwords have become glaringly apparent. From commonplace attacks like relaying and spraying to the more sophisticated threats of spear-phishing and pharming, hackers have mastered their skills in stealing credentials and gaining unauthorized access. Enter multi-factor authentication (MFA), a robust electronic authentication method that demands users to provide two or more forms of identity verification before accessing a system. Unveiling the Layers of MFA MFA operates on three pillars: something you know like passwords, PINs, something you have like physical objects like keys or smart cards, and something you are- biometric verification such as fingerprints or retina scans. Two-factor authentication (2FA) employs two of these checks, while MFA goes a step further, employing two or more, rendering it a formidabl

367
D
10 months ago
T
ThreatModeler
published in News & Announcements
Silent Infiltrators: Chinese Espionage Malware Evolves via USBBlog

Recent findings by the CheckPoint Incident Response Team (CPIRT) have unveiled a disconcerting cybersecurity incident. It sheds light on the activities of Camaro Dragon, a Chinese state-sponsored APT group also known as Mustang Panda and LuminousMoth.  WispRider-Malware Infiltrating Systems via USB Drives:- A healthcare institution in Europe fell victim to a malware attack that penetrated its systems via an infected USB drive. This incident prompted CheckPoint Research (CPR) to conduct an extensive investigation, leading to the identification of newer malware variants. These malicious programs possess the alarming capability to self-propagate through USB drives, effectively turning these harmless devices into potent carriers of infection. This makes them capable of spreading malware far beyond their intended targets. One of the malware variants, known as WispRider, emerged as the primary culprit behind the infection. Its creators have enhanced its capabilities, equipping it with backdo

361
A
1 year ago
T
ThreatModeler
published in News & Announcements
Defending Against Cloudflare Tunnel ExploitationNews

The article discusses the increasing exploitation of Cloudflare Tunnels by malicious actors for nefarious purposes. Cloudflare Tunnels, a legitimate feature provided by Cloudflare, are being misused to establish encrypted connections that enable cybercriminals to infiltrate compromised devices and networks. This technique allows hackers to sidestep traditional security measures like firewalls and maintain a hidden and persistent presence within targeted environments.The abuse of Cloudflare Tunnels for malicious activities is not an entirely new concept, as evidenced by a prior instance where threat actors employed this technique to steal data or remotely access devices. However, the recent rise in such incidents, as reported by GuidePoint's DFIR and GRIT teams, suggests an emerging trend where more hackers are recognizing the potential of Cloudflare Tunnels for their illicit activities. This Poses Significant Cybersecurity Implications Stealthy attacksHackers can establish discrete com

350
T
1 year ago
A
Anonymous
published in News & Announcements
Protect IoT Systems with Threat Modeling: Discover HowBlog

If you know about threat modeling, then you know it can help protect applications and cloud infrastructure from security threats. If you’re really up on threat modeling, then you also know it can be used to help protect connected devices, so-called internet-of-things (IoT). Theoretically, any device or system of devices exposed to the internet can be protected by threat modeling. The most common IoT devices include industrial controllers, smart devices, sensors, fire alarms and CCTV cameras. A new and growing category of IoT devices is medical sensors.  But there is another new and growing systems of IoT devices that you may not have considered: automobiles. It’s not an over exaggeration to say that today, automobiles are computers on wheels. And those computers are connected to the internet. There is an estimated 1,400 semiconductor chips in a typical automobile today and many of them are microprocessors or microcontrollers, which are part of the car’s network. That’s a lot of IoT dev

351
A
1 year ago
T
ThreatModeler
published in News & Announcements
Safeguard Online Privacy on Public Wi-FiBlog

Today’s world is defined by remote work, frequent travel, and an insatiable appetite for uninterrupted connectivity, the likelihood is high that you've embraced the convenience of public Wi-Fi hotspots. These free hotspots provide unmatched convenience, allowing us to access online accounts, catch up on work, and stay connected while on the move. However, this convenience comes with a significant trade-off: the security risks associated with public Wi-Fi networks. The Perils of Public Wi-Fi: Public Wi-Fi networks, while omnipresent, often lack robust security measures, leaving users vulnerable to a range of cyber threats. It's essential to understand these risks to protect your sensitive data.Man-in-the-Middle Attacks (MITM): MITM attacks are a prevalent threat on public networks. Attackers intercept data between your device and the internet, potentially exposing your private information. Phishing emails can also be used to carry out MITM attacks.   Unencrypted Networks: Many public Wi

332
E
11 months ago
T
ThreatModeler
published in News & Announcements
Windows Drivers at Risk: 34 Vulnerable to Complete TakeoverBlog

Did you know your everyday devices could be a ticking time bomb? In a recent cybersecurity revelation, researchers have unearthed a startling fact: 34 Windows drivers, the unsung heroes running your tech, are vulnerable to a full-blown takeover. Yes, you read that right—hackers, without any special access, could seize control of your devices, running their code and wreaking havoc.Think about it. Your device's firmware, system privileges—everything up for grabs.This is not just a hypothetical scenario; it's a real danger. Leveraging research from projects like ScrewedDrivers and POPKORN, this study uses symbolic execution to automate the discovery of vulnerable drivers. The main culprits? Drivers that enable firmware access through port I/O and memory-mapped I/O. Let's break down the complexity and understand the risk your devices are facing. Let's take a closer look at the Windows Driver System Simply put, the Windows Driver System is like the backstage manager in the Microsoft Windows

320
T
10 months ago
T
ThreatModeler
published in News & Announcements
Preventing API Misuse and Protecting Privacy With Threat ModelingNews

The problem is centered around the potential abuse of certain APIs by app developers to collect device signals and perform fingerprinting, which can be used to uniquely identify users across various apps and websites. Apple's response to this problem is to require developers to provide reasons for using specific APIs and restrict the usage of these APIs to the declared reasons only. Implications of API Misuse User privacy violationUnrestricted use of these APIs can lead to unauthorized data collection, violating user privacy by allowing apps to track user behavior and uniquely identify them without their consent. Fingerprinting and trackingFingerprinting techniques can be used to create a unique identifier for a user based on various device characteristics. This can be exploited for targeted advertising, user profiling, and potentially even malicious activities. Data monetizationDevelopers or third parties might exploit collected data for monetization purposes, potentially selling user

323
U
1 year ago
A
Anonymous
published in News & Announcements
The Extreme Vulnerability of the Healthcare-IoT Venn DiagramBlog

If you’ve been in the workforce for any length of time, you’ve undoubtedly encountered a Venn diagram. A Venn diagram is an illustration that uses circles to show the relationships among things or finite groups of things. Circles that overlap have a commonality while circles that do not overlap do not share those traits. As it turns out, a Venn diagram is really useful at depicting what is probably the most extreme vulnerability in cybersecurity today. Vulnerability #1: Healthcare If you haven’t heard, healthcare is one of the top targets for bad actors today. Some of the statistics are staggering. Hospitals account for 30% of all data breaches. There is a 75.6% chance of a breach of at least 5 million records in the next year. 95% of identity theft comes from stolen healthcare records. 89% of healthcare providers have suffered data breaches in the past two years. And healthcare breaches are the most expensive too. According to IBM’s Cost of a Data Breach Report 2023, “The highly regul

322
Vastris31
10 months ago
Terms & ConditionsCookie settings