Les actus cybersécurité

Voici le rapport de veille de la semaine faisant le tour des actualités les plus intéressantes. Certaines d’entre elles seront développées dans les prochains articles. Bonne lecture et merci pour le café 😉

Vol / perte de données

MailChimp breach exposes email addresses and Callback phishing – CyberTalk
MailChimp data breach affects 214 customers. DigitalOcean first reported the incident. Get information about who it affected.

Des documents secrets de l’armée française auraient fuité sur un forum JV
Des documents a priori confidentiel de l’armée française auraient fuité sur le forum de War Thunder.

https://www.ictjournal.ch/news/2022-08-19/mise-a-jour-les-cff-mettent-trois-ans-a-colmater-la-fuite-de-donnees

Cyberattaques / fraudes

U.K. Water Supplier Hit with Clop Ransomware Attack
The incident disrupted corporate IT systems at one company while attackers misidentified the victim in a post on its website that leaked stolen data.

Hackers Attack UK Water Supplier, Apparently Send Ransom Demand to the Wrong Company
A cyber-attack hit South Staffordshire Water, which supplies 1.3 million people. But hackers claimed they had breached the much larger Thames Water.

LockBit claims ransomware attack on security giant Entrust, leaks data
The LockBit ransomware gang has claimed responsibility for the June cyberattack on digital security giant Entrust.

APT Lazarus Targets Engineers with macOS Malware
The North Korean APT is using a fake job posting for Coinbase in a cyberespionage campaign targeting users of both Apple and Intel-based systems.

China-linked RedAlpha behind multi-year credential theft campaign
A China-linked APT group named RedAlpha is behind a long-running mass credential theft campaign aimed at organizations worldwide.

North Korea-linked APT targets job seekers with macOS malware
The North Korea-linked Lazarus Group has been observed targeting job seekers with macOS malware working also on Intel and M1 chipsets.

Estonia blocked cyberattacks claimed by Pro-Russia Killnet group
Estonia announced to have blocked a wave of cyber attacks conducted by Russian hackers against local institutions.

Failles / vulnérabilités

Apple patches double zero-day in browser and kernel – update now!
Double 0-day exploits – one in WebKit (to break in) and the other in the kernel (to take over). Patch now!

Xiaomi Phones Found Vulnerable to Payment Forgery
Mobile transactions could’ve been disabled, created and signed by attackers.

Two years on, Apple iOS VPNs still leak IP addresses
Privacy, it’s a useful marketing term. *Offer does not apply in China

The Pentagon may require vendors certify their software is free of known flaws. Experts are split.
The debate is over whether the provision is unrealistic or if it’s a game changing move to cut down on software vulnerabilities.

Justice / police / réglementation

Developer with suspected ties to Tornado Cash nabbed in NL
The arrest comes days after US Treasury levies sanctions against the crypto mixing service

Suisse

L’administration fédérale teste l’identification vidéo
Quiconque souhaite accéder aux applications internes de l’administration fédérale doit au préalable faire contrôler son identité en se déplaçant physiquement. La Confédération teste une procédure alternative faisant appel à la vidéo, basée sur une solution de la société Intrum.

Le Tribunal administratif fédéral devra statuer sur le projet de cloud public de la Confédération
Le Tribunal administratif fédéral doit clarifier s’il existe une base légale suffisante pour le projet de cloud public de la Confédération. En l’absence d’une telle base, un plaignant demande l’arrêt immédiat du projet.

https://netguardians.ch/regtech-analyst-zurich-cantonal-bank-teams-up-with-netguardians-for-payment-fraud/

Swiss Post relaunches e-voting bug bounty program
Ethical hackers invited to stress test election infrastructure

Divers

Google: Here’s how we blocked the largest web DDoS attack ever
Google Cloud says it protected one customer from a Mēris botnet attack that peaked at 46 million requests per second.

Un logiciel espion au cœur d’un scandale politique en Grèce
La vie politique grecque est secouée par une affaire de cyberespionnage. Le logiciel Predator, développé par la société Cytrox, a été…-Cybersécurité

Catégories

Sur les réseaux sociaux

Contact

Les actus cybersécurité | 21 août 2022

Vol / perte de données

MailChimp breach exposes email addresses and Callback phishing – CyberTalk

Des documents secrets de l’armée française auraient fuité sur un forum JV

Cyberattaques / fraudes

U.K. Water Supplier Hit with Clop Ransomware Attack

Hackers Attack UK Water Supplier, Apparently Send Ransom Demand to the Wrong Company

LockBit claims ransomware attack on security giant Entrust, leaks data

APT Lazarus Targets Engineers with macOS Malware

China-linked RedAlpha behind multi-year credential theft campaign

North Korea-linked APT targets job seekers with macOS malware

Estonia blocked cyberattacks claimed by Pro-Russia Killnet group

Failles / vulnérabilités

Apple patches double zero-day in browser and kernel – update now!

Xiaomi Phones Found Vulnerable to Payment Forgery

Two years on, Apple iOS VPNs still leak IP addresses

The Pentagon may require vendors certify their software is free of known flaws. Experts are split.

Justice / police / réglementation

Developer with suspected ties to Tornado Cash nabbed in NL

Suisse

L’administration fédérale teste l’identification vidéo

Le Tribunal administratif fédéral devra statuer sur le projet de cloud public de la Confédération

Swiss Post relaunches e-voting bug bounty program

Divers

Google: Here’s how we blocked the largest web DDoS attack ever

Un logiciel espion au cœur d’un scandale politique en Grèce

Mots-clés

1 commentaire

Catégories

Sur les réseaux sociaux

Contact

Les actus cybersécurité | 21 août 2022

Vol / perte de données

Cyberattaques / fraudes

Failles / vulnérabilités

Justice / police / réglementation

Suisse

Divers

Partager cette info

S'incrire à la newsletter

Mots-clés

Vous devriez également aimer

1 commentaire

S'incrire à la newsletter