Security Leftovers
-
CBC ☛ Insurance provider for public servants abroad detects ‘cybersecurity incident’
The insurance provider for members of the Public Service Health Care Plan who are posted abroad or travelling says it recently detected a “cybersecurity incident” involving its systems, but hasn’t determined what information may have been accessed.
MSH International Canada said it detected the incident on Feb. 9., and immediately paused services. Law enforcement was notified and a thorough investigation is underway, the insurance provider said in a statement.
-
LWN ☛ Security updates for Thursday
Security updates have been issued by Debian (edk2, postgresql-13, and postgresql-15), Fedora (engrampa, vim, and xen), Mageia (mbedtls and quictls), Oracle (nss, openssh, and tcpdump), Red Hat (.NET 8.0), SUSE (hugin, kernel, pdns-recursor, python3, tomcat, and tomcat10), and Ubuntu (clamav, edk2, linux-gcp-6.2, linux-intel-iotg-5.15, linux-oem-6.1, and ujson).
-
TechTarget ☛ Eclypsium: Ivanti firmware has 'plethora' of security issues
In its firmware analysis, Eclypsium found that the Ivanti Pulse Secure appliance used a version of Linux that was more than a decade old and several years past end of life.
-
Computer Weekly ☛ New variants of Qakbot malware under development
Despite its infrastructure being seized and dismantled in a multinational law enforcement sting in the summer of 2023, the Qakbot malware that some of the world’s most dangerous ransomware crews used as a remote access trojan (RAT) appears to be under active development once more, according to new intelligence from Sophos researchers.
-
TechTarget ☛ Proofpoint: 'Hundreds' of Azure accounts compromised
In a blog post, Proofpoint's Cloud Security Response Team detailed how unknown threat actors were combining spear phishing attacks with cloud account takeover techniques to target a wide range of individuals in different organizations across the globe. The emails contained "individualized phishing lures" in shared documents with malicious links for viewing the documents that redirected users to attacker-controlled domains.