Windows TCO: SharePoint, Microsoft Word, and More
-
Microsoft SharePoint RCE under active exploit
CISA added the deserialization vulnerability, tracked as CVE-2024-38094, to its Known Exploited Vulnerabilities Catalog and noted that it's "unknown" whether this security flaw is being used in any ransomware campaigns.
-
Penn State settles cybersecurity compliance case for $1.25M
In addition, the government argued (as did Decker) that Penn State abandoned its contract with government-compliant cloud host Box in favor of OneDrive, which doesn't meet NIST's CUI security requirements, to save money - hopefully more than $1.25 million.
As Decker brought the original action, he's eligible for a piece of the settlement pie, with the DoJ indicating he'll be getting $250k of the settlement.
-
Threat actor abuses Gophish to deliver new PowerRAT and DCRAT
When a victim opens the Microsoft Word document and enables the view contents button displayed in the document banner, the malicious VB macro program executes.
-
Ransomware gang stoops to new low, targets prominent nonprofit for disabled people
The Rhysida ransomware group stooped to new lows this week when it attempted to extort $1.3 million from the organization, which provides support to disabled children, seniors, military veterans and others.
Easterseals did not respond to requests for comment but filed breach notification documents with regulators in Maine saying its Peoria-based Central Illinois location dealt with a cyberattack in April. The filing did not mention the ransomware group, but the cybercriminals claimed the attack this week.
-
White House reviewing HIPAA cybersecurity updates
“We’ve seen tremendous increases in the use of ransomware and [crcking] to obtain unauthorized access to ePHI, and since 2003 there’s been an evolution in technical capabilities of record systems that are used to maintain health information, and there have been changes in the costs of variety of security measures,” Marissa Gordon Nguyen, HHS OCR senior advisor for health information privacy, data and cybersecurity, said during a conference today hosted by HHS and the National Institute of Standards and Technology.
“The changes we think support updating the security rule to help ensure that it can continue to provide a baseline of security standards to meet current and emerging security risks and threats to ePHI,” Nguyen added.