Home / Security journal
CyberWall security journalUnderstand the threat.
Prepare for what’s next.
Explore 31 concise briefings drawn from public U.S. cybersecurity advisories across all 12 months of 2024.
Historical archive · Dates refer to FBI archive listings, not publication dates. For current guidance, check the linked source and your vendors.
Cameras and DVRs: an overlooked security boundary
The FBI warned about HiatusRAT scanning campaigns against certain web cameras and digital video recorders, including devices with known vulnerabilities or weak credentials. A connected camera can be part of an organization’s attack surface.
Read the analysisTelecom intrusions: visibility at the network edge
U.S. and international agencies published hardening and visibility guidance after compromises affecting telecommunications networks. Although written for communications infrastructure, parts may also apply to enterprise networks.
Read the analysisBianLian and the shift toward data extortion
Federal partners updated their advisory on BianLian data extortion. The report illustrates that stolen information can create serious pressure even without a new encryption event.
Read the analysisRoutinely exploited vulnerabilities: lessons from 2023
A multi-agency report identified vulnerabilities routinely exploited in 2023. The historical list helps explain the importance of a risk-based vulnerability management process; it is not a current priority list.
Read the analysisCredential attacks against critical infrastructure
A joint advisory described Iran-linked actors using brute force and credential access techniques against critical infrastructure organizations. An identity attack can precede activity elsewhere in a network.
Read the analysisA vulnerability-management lesson from SVR activity
Federal and international partners updated guidance on SVR cyber operations and vulnerability exploitation. The advisory is a reminder to connect asset inventory, remediation and detection.
Read the analysisCompromised routers and the botnet problem
A joint advisory described PRC-linked actors compromising routers and other internet-connected devices for botnet operations. Devices outside the data center can still affect an organization’s security.
Read the analysisCross-site scripting: keeping untrusted content in its place
A CISA and FBI alert addressed cross-site scripting vulnerabilities in software. These flaws can allow untrusted content to affect a user’s browser session when applications handle it unsafely.
Read the analysisCritical infrastructure and Russian military cyber activity
U.S. and international partners described cyber activity targeting U.S. and global critical infrastructure. The advisory provided technical details and mitigation guidance for network defenders.
Read the analysisRansomHub: the many paths into a network
The FBI and partner agencies described RansomHub ransomware activity and methods including phishing and exploitation of known vulnerabilities. Their advisory highlights both encryption and data theft.
Read the analysisWhen initial access becomes a ransomware risk
A joint advisory described Iran-based actors gaining access to U.S. organizations and enabling ransomware operations. The agencies described activity affecting several sectors, including education, finance and healthcare.
Read the analysisBlackSuit: an updated ransomware advisory
FBI and CISA updated their Royal ransomware advisory to address BlackSuit. The advisory provides observed tactics and technical details for defenders.
Read the analysisCyber espionage and protecting sensitive research
A joint advisory described a North Korean cyber group conducting an espionage campaign. The report connects cyber intrusion activity with risks to sensitive technical information.
Read the analysisOS command injection: a preventable design risk
CISA and the FBI published a secure-by-design alert on operating-system command injection. The issue arises when untrusted input can influence commands executed by software.
Read the analysisAPT40 and the need to patch internet-facing systems
An international advisory described APT40 tradecraft and its interest in vulnerable, internet-facing infrastructure. The report shows why identifying exposed assets and responding to vendor fixes matters.
Read the analysisMemory safety in critical open-source software
A federal report examined memory safety in critical open-source projects. Memory-safety vulnerabilities can create security risks in software that many organizations depend on.
Read the analysisSocial engineering against health care help desks
Federal agencies warned about social engineering targeting healthcare and public health organizations. Attackers can try to exploit support workflows as well as technical weaknesses.
Read the analysisRethinking network access beyond a traditional VPN
Federal guidance on modern network access examines approaches that reduce implicit trust in network location. It encourages organizations to consider identity, device and access controls as part of remote access design.
Read the analysisBlack Basta: ransomware and data theft together
Federal agencies reported that Black Basta affiliates used a double-extortion model involving both data theft and encryption. Their advisory identified impacts across businesses and critical infrastructure, including health care.
Read the analysisGift card fraud starts with convincing messages
The FBI warned that criminals used phishing and smishing to target U.S. retail corporations for gift card fraud. The incident pattern illustrates how a convincing request can exploit normal business workflows.
Read the analysisDMARC and spearphishing: why email policy matters
A joint advisory warned that North Korean actors exploited weak DMARC policies to make spearphishing emails appear more credible. Domain authentication can help recipients assess whether a message is authorized.
Read the analysisAkira ransomware: what defenders should know
A joint advisory described Akira ransomware and observed tactics. It provides technical information intended to help defenders recognize and respond to activity associated with the group.
Read the analysisSQL injection: prevent a familiar application flaw
CISA and the FBI issued a secure-by-design alert on SQL injection, a class of vulnerability in which untrusted input can affect database queries. The alert asks software manufacturers to address the problem at its source.
Read the analysisCritical infrastructure leaders and cyber resilience
Federal partners published guidance for critical infrastructure leaders on the threat from PRC state-sponsored activity. The guidance frames cyber resilience as an operational leadership issue as well as a technical one.
Read the analysisIvanti gateway exploitation: a perimeter lesson
A joint advisory documented exploitation of multiple vulnerabilities in Ivanti Connect Secure and Policy Secure gateways. A network appliance can become an entry point when an attacker reaches an unremediated service.
Read the analysisPhobos ransomware and exposed remote access
An FBI and partner advisory described Phobos ransomware and the tactics associated with its operators. Ransomware can interrupt operations and expose sensitive information.
Read the analysisCloud access: lessons from an SVR advisory
A joint advisory described how Russian SVR actors adapted their approach to initial cloud access. Cloud accounts and their authentication controls can become the front door to important business information.
Read the analysisVolt Typhoon and the challenge of persistent access
A joint advisory described PRC state-sponsored actors maintaining access to U.S. critical infrastructure and using living-off-the-land techniques. Familiar administrative tools can make malicious activity harder to distinguish from routine work.
Read the analysisWhy small-office routers deserve security attention
A federal secure-by-design alert addressed risks from vulnerable small-office and home-office devices. Routers are part of the security boundary even when they are easy to overlook.
Read the analysisA response plan for water and wastewater operators
Federal agencies published an incident response guide tailored to water and wastewater utilities. It addresses preparing for and responding to cyber incidents in operational environments.
Read the analysisAndroxgh0st malware: protecting cloud credentials
FBI and CISA described malware activity associated with exploiting vulnerabilities and harvesting credentials from exposed configuration files. Cloud credentials can turn a web-server compromise into a broader account incident.
Read the analysisNo matching articles. Try a broader search or another month.