The Botnet appears to use a new delivery method for compromising Windows systems after Microsoft disables VBA macros by default.

https://threatpost.com/emotet-back-new-tricks/179410/

Four months after the critical flaw was discovered, attackers have a massive attack surface from which they can exploit the flaw and take over systems, researchers found.

https://threatpost.com/java-apps-vulnerable-log4shell/179397/

Researchers propose fresh approaches to cloud-security bugs and mitigating exposure, impact and risk.

https://threatpost.com/cve-cloud-bug-system/179394/

How to use zero-trust architecture effectively in today’s modern cloud-dependent infrastructures.

https://threatpost.com/zero-trust-guide/179377/

A full 89 percent of organizations experienced one or more successful email breaches during the previous 12 months, translating into big-time costs.

https://threatpost.com/email-security-fail-block-threats/179370/

Last year, Google Project Zero tracked a record 58 exploited-in-the-wild zero-day security holes.

https://threatpost.com/google-2021-0-days/179355/

Exploring what’s next for public-cloud security, including top risks and how to implement better risk management.

https://threatpost.com/cyber-defense-public-cloud/179342/

Fortinet’s Derek Manky discusses the exponential increase in the speed that attackers weaponize fresh vulnerabilities, where botnets and offensive automation fit in, and the ramifications for security teams.

https://threatpost.com/cyberattackers-speed-fortinet-podcast/179294/

For April Patch Tuesday, the computing giant addressed a zero-day under active attack and several critical security vulnerabilities, including three that allow self-propagating exploits.

https://threatpost.com/microsoft-zero-days-wormable-bugs/179273/

Researchers discovered the vulnerability in an API already integrated into many bank systems, which could have defrauded millions of users by giving attackers access to their funds.

https://threatpost.com/ssrf-flaw-fintech-bank-accounts/179247/

The vulnerabilities could allow threat actors to disrupt or access kernel activity and may be under active exploit.

https://threatpost.com/apple-rushes-out-patches-0-days-macos-ios/179222/

A bug in Honda is indicative of the sprawling car-attack surface that could give cyberattackers easy access to victims, as global use of ‘smart car tech’ and EVs surges.

https://threatpost.com/automaker-cybersecurity-lagging-tech-adoption/179204/

QNAP is warning clients that a recently disclosed vulnerability affects most of its NAS devices, with no mitigation available while the vendor readies a patch.

https://threatpost.com/qnap-customers-adrift-fix-openssl-bug/179197/

The so-called ‘Spring4Shell’ bug has cropped up, so to speak, and could be lurking in literally millions of Java applications.

https://threatpost.com/critical-rce-bug-spring-log4shell/179173/

The active attacks could result in critical-infrastructure damage, business disruption, lateral movement and more.

https://threatpost.com/cyberattackers-ups-backup-power-critical-environments/179169/

The internet giant issued an update for the bug, which is found in the open-source V8 JavaScript engine.

https://threatpost.com/google-chrome-bug-actively-exploited-zero-day/179161/

Researchers have found three backdoors and four miners in attacks exploiting the Log4Shell vulnerability, some of which are still ongoing.

https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/

The ever-evolving malware shows off new tactics that use email thread hijacking and other obfuscation techniques to provide advanced evasion techniques.

https://threatpost.com/exchange-servers-speared-in-icedid-phishing-campaign/179137/

The security vendor’s appliance suffers from an authentication-bypass issue.

https://threatpost.com/critical-sophos-security-bug-rce-firewalls/179127/

The supply-chain attack on the U.S. energy sector targeted thousands of computers at hundreds of organizations, including at least one nuclear power plant.

https://threatpost.com/doj-indicts-russian-govt-employees-over-targeting-power-sector/179108/