A post on the English-language cybercriminal forum RaidForums has leaked about 3.27 billion stolen user credentials comprising cleartext email addresses and passwords, Threatpost reports. The post was made by user Singularity0x01 and was titled “Compilation of Many Breaches (COMB) 3.8Billion (Public),” according to Digital Shadows cyberthreat intelligence analyst Ivan Righi. Dustin Warren, a researcher at SpyCloud, said that a check of the data revealed most of it had already been accessible on the Dark Web for some time, and appears to include parts of information leaked in previous collections from 2016 and 2019, with some modifications for ease of use. However, threat actors may still use those old credentials to mount brute-force or credential-stuffing attacks, Warren notes. The leak was not received positively because of its poor quality and corruption of some files, and Singularity0x01 took a negative hit in popularity before being banned from the forums for “leaking hidden content,” Righi reports.
Jill Aitoro leads editorial for SC Media, and content strategy for parent company CyberRisk Alliance. She 20 years of experience editing and reporting on technology, business and policy.
Organizations remediated security issues added to the Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities catalog 3.5 times faster than those that are not in the catalog, according to The Record, a news site by cybersecurity firm Recorded Future.
Software firms have been urged by the FBI and Cybersecurity and Infrastructure Security Agency to ensure the absence of path traversal or directory traversal vulnerabilities in their products prior to shipping, BleepingComputer reports.
International development firm Chemonics, which mainly caters to the United States Agency of International Development, has not yet provided more extensive information regarding a cyberattack that compromised more than 6,000 individuals initially reported in July 2021, reports FedScoop.