risk Archives - Recon Bee

19Jun

By RBNo Comments

Risk Management

Smarter Risk Management with Portend AI

Risk isn't just a checklist anymore—it's a constantly shifting challenge shaped by digital exposure, regulatory demands, brand reputation, and global connections. Companies stuck with outdated or fragmented risk management methods often realize the threat when it's too late—after the damage is done. Portend AI offers a smarter way forward, a unified, AI-powered platform that empowers businesses to manage risk proactively and intelligently across the whole organization. Proactive, Not Reactive Portend AI takes risk management from being reactive to becoming a real-time, insight-driven strategy. Its AI works around the clock, scanning for potential vulnerabilities by monitoring websites, APIs, third-party systems, and digital assets—spotting threats before they grow into seriou...

Researchers Warn of Privilege Escalation Risks in Google’s Vertex AI ML Platform

18Nov

By RBNo Comments

News

Researchers Warn of Privilege Escalation Risks in Google’s Vertex AI ML Platform

Two security holes in Google's Vertex machine learning (ML) platform have been found by cybersecurity experts. If successfully exploited, these vulnerabilities might enable malevolent actors to escalate privileges and steal models from the cloud. In an analysis released earlier this week, researchers Ofir Balassiano and Ofir Shaty of Palo Alto Networks Unit 42 stated, "We were able to escalate our privileges and gain unauthorized access to all data services in the project by exploiting custom job permissions." All other fine-tuned models were exfiltrated when a poisoned model was deployed in Vertex AI, creating a significant danger of a sensitive and proprietary data exfiltration assault read more about Researchers Warn of Privilege Escalation Risks in Google's Vertex AI ML Platform...

Understanding Governance, Risk, and Compliance (GRC)

29Aug

By RBNo Comments

Security

Understanding Governance, Risk, and Compliance (GRC)

The current business environment presents organizations with many issues that require strategic management of GRC. The idea that links these three elements is GRC: an important framework that provides concepts for achieving organizational goals in compliance with legal requirements and ensuring ethical management of risks. In this article you will Understanding Governance Risk and Compliance (GRC), why it is important and how it provides an edge to organizations for sustainable success. What is GRC? The complete strategy known as Governance, Risk, and Compliance (GRC) is employed by firms to manage their overall governance structures, detect and address potential hazards, and guarantee adherence to pertinent laws, regulations, and internal policies. The GRC framework safeguards ...

North Korea’s Lazarus Group Launders $900 Million in Cryptocurrency

9Oct

By RBNo Comments

News

North Korea’s Lazarus Group Launders $900 Million in Cryptocurrency

The Lazarus Group, which has ties to North Korea, has been implicated in the theft of almost $900 million of those revenues between July 2022 and July of this year. As much as $7 billion in bitcoin has been illegally laundered through cross-chain crime. Blockchain analytics company Elliptic stated in a new research released this week that "chain- or asset-hopping typologies are also on the rise" as traditional institutions like mixers continue to be the target of seizures and sanctions scrutiny. Cross-chain crime is the act of moving crypto assets quickly across tokens or blockchains in an effort to conceal their origin. It is a profitable way to cover up crypto thefts read more North Korea's Lazarus Group Launders $900 Million in Cryptocurrency. Stay informed with the best cyber...

NSA and CISA reveal top 10 cybersecurity misconfigurations

6Oct

By RBNo Comments

News

NSA and CISA reveal top 10 cybersecurity misconfigurations

The top ten most prevalent cybersecurity errors found by the red and blue teams of the National Security Agency (NSA) and the Cybersecurity and Infrastructure Security Agency (CISA) in the networks of big businesses were made public today. The current warning also describes the methods, techniques, and procedures (TTPs) threat actors employ to successfully exploit these misconfigurations in order to achieve a variety of objectives, such as gaining access to, lateral movement, and targeting sensitive information or systems. The Red and Blue teams from the two agencies gathered the data for the report during evaluations and incident response activities read more NSA and CISA reveal top 10 cybersecurity misconfigurations. Stay informed with the best cybersecurity news and raise your...

Apple Rolls Out Security Patches for Actively Exploited iOS Zero-Day Flaw

5Oct

By RBNo Comments

News

Apple Rolls Out Security Patches for Actively Exploited iOS Zero-Day Flaw

On Wednesday, Apple released security updates to fix a fresh zero-day vulnerability in iOS and iPadOS that the company claimed was already being actively exploited in the wild. The kernel vulnerability, identified as CVE-2023-42824, could be exploited by a local attacker to gain elevated privileges. The iPhone manufacturer claimed that better checks were used to address the issue. Apple stated in a succinct advisory that it was "aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.6." Even while more information about the attacks' nature and the threat actors who carried them out is still unclear, successful exploitation most certainly requires an attacker to have already established a foothold through some other method read mor...

China-Linked Budworm Targeting Middle Eastern Telco and Asian Government Agencies

28Sep

By RBNo Comments

News

China-Linked Budworm Targeting Middle Eastern Telco and Asian Government Agencies

A threat actor with ties to China known as Budworm has launched a new wave of attacks against telecom and governmental organizations. The Symantec Threat Hunter Team, a division of Broadcom, claimed that the attacks, which were launched in August 2023 and targeted a Middle Eastern telecom company and an Asian government, involved the adversary using an upgraded version of its SysUpdate toolset. In order to further its information collecting objectives, Budworm, also known as APT27, Bronze Union, Emissary Panda, Iron Tiger, Lucky Mouse, and Red Phoenix, has been known to be operating since at least 2013. The nation-state group uses a variety of tools, including the China Chopper web shell read more China Linked Budworm Targeting Middle Eastern Telco and Asian Government Agencies. ...

Google assigns new maximum rated CVE to libwebp bug exploited in attacks

27Sep

By RBNo Comments

News

Google assigns new maximum rated CVE to libwebp bug exploited in attacks

A security flaw in libwebp that was patched two weeks ago and exploited as a zero-day in attacks has received a new CVE ID from Google (CVE-2023-5129). Instead of attributing the vulnerability to the free and open-source libwebp library, which is used to encode and decode images in the WebP format, the business initially identified the problem as a Chrome weakness, listed as CVE-2023-4863. The Citizen Lab at The University of Toronto's Munk School and Apple Security Engineering and Architecture (SEAR) jointly disclosed this zero-day problem on Wednesday, September 6, and Google rectified it less than a week later. Citizen Lab's security researchers have a proven track record of finding and disclosing zero-day vulnerabilities that have been used in specialized spyware campaigns re...

Microsoft is Rolling out Support for Passkeys in Windows 11

27Sep

By RBNo Comments

News

Microsoft is Rolling out Support for Passkeys in Windows 11

As part of a significant update to the desktop operating system, Windows 11 now formally introduces support for passkeys. Through the use of their device PIN or biometric data, users are able to log into websites and applications without having to enter their username and password. Passkeys was initially introduced in May 2022 as a password replacement that is both secure and resistant to phishing attacks based on FIDO standards. Since then, Apple, Google, and a number of other services have all adopted it. Passkey management was already a function in the tech giant's Windows Insider program as of June 2023 read more Microsoft is Rolling out Support for Passkeys in Windows 11. Stay informed with the best cybersecurity news and raise your cybersecurity awareness with our compre...

Xenomorph Banking Trojan Targeting 35+ U.S. Financial Institutions

26Sep

By RBNo Comments

News

Xenomorph Banking Trojan Targeting 35+ U.S. Financial Institutions

Over 35 financial institutions in the United States have been targeted by the Xenomorph banking virus, an enhanced variant of the Android banking trojan. According to Dutch security company ThreatFabric, the operation makes use of phishing websites that are intended to get users to download malicious Android apps that target a wider range of apps than its forerunners. Spain, Canada, Italy, and Belgium are a few of the other well-known nations targeted. The business stated in an analysis released on Monday that the latest list "adds dozens of new overlays for institutions from the United States, Portugal, and multiple crypto wallets, continuing a trend that has been consistent amongst all banking malware families in the last year read more Xenomorph Banking Trojan Targeting 35+ U.S. ...