Ransomware Attack on Rhode Island Benefits System Leads to Data Leak on Dark Web
Hackers responsible for a December 2024 ransomware attack on RIBridges, Rhode Island's health and benefits system, have released stolen files on the dark web.
Hackers responsible for a December 2024 ransomware attack on RIBridges, Rhode Island's health and benefits system, have released stolen files on the dark web.
he FunkSec ransomware group emerged in late 2024, quickly gaining attention by claiming over 85 victims in December, more than any other ransomware group during that period. Despite their rapid rise, analysis reveals that much of their activity may be overstated.
n December 2024, two critical vulnerabilities in Microsoft's Windows Lightweight Directory Access Protocol (LDAP) were addressed via Microsoft's monthly Patch Tuesday release.
The Banshee infostealer, a sophisticated malware targeting macOS systems, has been leveraging a stolen Apple encryption algorithm to evade detection by antivirus solutions.
UPDATE: Ivanti has issued an urgent warning about a critical zero-day vulnerability, CVE-2025-0282, which attackers exploited to install malware on Ivanti Connect Secure appliances.
Researchers have identified a rise in sophisticated phishing and malspam campaigns employing email spoofing, neglected domains, and social engineering to bypass traditional security measures.
SonicWall released a security bulletin on January 7, 2025, warning customers to upgrade their firewall's SonicOS firmware to patch an authentication bypass vulnerability in SSL VPN and SSH management that SonicWall deemed susceptible to in-the-wild attacks.
Threat actors are actively attempting to exploit CVE-2024-52875, a critical CRLF injection vulnerability in the GFI KerioControl firewall, which can lead to 1-click remote code execution (RCE) attacks.
A Mirai botnet variant has been observed exploiting a newly disclosed security flaw impacting Four-Faith industrial routers since early November 2024 with the intention of conducting DDoS attacks.
Ivanti has issued an urgent warning regarding a critical remote code execution vulnerability, CVE-2025-0282, that is being actively exploited in zero-day attacks targeting Ivanti Connect Secure appliances.
A new phishing technique exploiting PayPal's money request feature has been identified in a recent advisory by Fortinet. This method uses legitimate-looking PayPal payment requests to deceive recipients, making them appear genuine and bypassing traditional email security checks.
Researchers at Cyfirma have discovered a new remote access trojan called NonEuclid, written in C#, which provides attackers with comprehensive control over compromised Windows systems.
The U.S. government has officially launched the U.S. Cyber Trust Mark, a cybersecurity safety label designed for Internet-of-Things (IoT) consumer devices.
In August, 2024 SonicWall addressed a critical improper access control flaw (CVE-2024-40766) in its SonicOS management access and SSLVPN, potentially leading to unauthorized resource access and in specific conditions, causing the firewall to crash.
A malicious plugin recently discovered on a Russian cybercrime forum manipulates WordPress sites into phishing pages by creating fake online payment processes that impersonate trusted checkout services. This attack masquerades as a legitimate e-commerce app like Stripe to steal customer payment data and browser metadata.
Telegram disclosed that it fulfilled 900 requests from U.S. law enforcement in 2024, resulting in the sharing of phone numbers or IP addresses of 2,253 users. This represents a sharp increase from prior years, largely attributed to a significant policy shift in September 2024.
Moxa, a provider of industrial networking solutions, has issued an urgent advisory regarding two severe vulnerabilities affecting several models of its cellular routers, secure routers, and network security appliances.
The Salt Typhoon cyber-espionage campaign continues to escalate as Charter Communications, Consolidated Communications, and Windstream have been identified as the latest U.S. telecom companies breached by Chinese state-sponsored hackers, according to a report from The Wall Street Journal.
Kaspersky researchers recently identified a campaign being deployed against ISPs and governmental entities in the Middle East following their investigation into the EAGERBEE backdoor. T
Cybersecurity researchers have uncovered a new and sophisticated malware strain, PLAYFULGHOST, which exhibits a wide array of information-gathering capabilities, including keylogging, screen and audio capture, remote shell access, file transfer, and execution.
During the end-of-year holiday season, a series of distributed denial-of-service attacks severely disrupted operations across several major Japanese organizations, including leading airlines, financial institutions, and telecommunications providers.
ASUS has released security updates to address two high severity flaws impacting several of its router models.
On December 31, 2024, Tenable Nessus vulnerability scanner agents were taken offline due to a buggy differential plugin update that impacted users globally. This issue affected Nessus Agent versions 10.8.0 and 10.8.1 across the Americas, Europe, and Asia. Tenable has since pulled these faulty versions and released Nessus Agent version 10.8.2 to resolve the problem and restore agent functionality.
A new and sophisticated variation of clickjacking attacks, termed DoubleClickjacking, has been identified by cybersecurity expert Paulos Yibelo. This novel technique exploits the timing of double-click mouse actions to deceive users into performing sensitive operations on legitimate websites.
Researchers have discovered a malicious npm package, ethereumvulncontracthandler, masquerading as a library for detecting vulnerabilities in Ethereum smart contracts.
On January 2, 2025, NTT Docomo, Japan's largest mobile operator, experienced a DDoS (Distributed Denial of Service) attack that disrupted several services for nearly 12 hours.
Symantec has uncovered a new ransomware operation, dubbed Nitrogen, which has been notably active over the past four months. This group has targeted a wide range of industries, including construction, financial services, manufacturing, and technology.
Threat actors are actively exploiting a critical remote command injection vulnerability, tracked as CVE-2024-12856, in Four-Faith routers, specifically models F3x24 and F3x36. These devices are commonly deployed in critical sectors such as energy, utilities, transportation, telecommunications, and manufacturing, making the potential impact of exploitation significant. T
A phishing campaign has compromised at least 35 Chrome extensions, including those from cybersecurity firm Cyberhaven, where actors have injected malicious code into compromised extensions to steal user data.
The Lumma Stealer malware has experienced a significant rise in usage, with ESET reporting a 369% increase in detections during the second half of 2024. First discovered in 2022, Lumma has become one of the top ten most-detected infostealers, targeting high-value assets such as two-factor authentication browser extensions, user credentials, and cryptocurrency wallets.
Threat actors are actively exploiting a critical remote command injection vulnerability, tracked as CVE-2024-12856, in Four-Faith routers, specifically models F3x24 and F3x36.
A phishing campaign has compromised at least 35 Chrome extensions, including those from cybersecurity firm Cyberhaven, where actors have injected malicious code into compromised extensions to steal user data. I
December has continued to see targeted spearphish involving compromised mailboxes across Texas and Kentucky, as well as a massive surge in USPS phishing around the holidays.
Cybercriminals are increasingly combining traditional and new tactics to steal sensitive information, using remote access tools (RATs) like AsyncRAT and SectopRAT. Recent trends show attackers exploiting SEO poisoning, typosquatting, and legitimate remote monitoring software to breach systems.
Adobe has released some emergency security updates to address a critical ColdFusion vulnerability with proof-of-concept (PoC) exploit code. The company released an advisory on Monday, December 23, 2024, stating that the flaw, tracked as CVE-2024-53961 is caused by a path traversal weakness that impacts Adobe ColdFusion versions 2023 and 2021 and can enable attackers to read arbitrary files on vulnerable servers.
Security Researchers at IProov, a biometric threat intelligence service, have urged customer-facing businesses to improve their verification checks after they uncovered a large-scale identity data farming operation conducted by an unnamed underground group on the dark web.
The developers of Rspack, a popular high-performance JavaScript bundler written in Rust, have discovered that two of their npm packages, @rspack/core and @rspack/cli, were compromised in a software supply chain attack. This supply chain attack granted the attacker the capability to publish malicious versions of these packages to the official package registry.
A new phishing-as-a-service platform dubbed "FlowerStorm" is quickly gaining traction, stepping in to replace the now-defunct Rockstar2FA cybercrime service. Rockstar2FA, which was first documented by Trustwave in late November 2024, enabled large-scale adversary-in-the-middle (AiTM) attacks targeting Microsoft 365 credentials.
Cybercriminals are taking advantage of a newly discovered Microsoft Office vulnerability to deliver malware and gain access to systems. Researchers have found that attackers are sending out malicious Office documents that exploit the flaw, allowing them to run harmful code without the victim realizing it.
In a detailed report from Picus Security, the Volt Typhoon cyber espionage campaign has been exposed as one of the most advanced and stealthy operations targeting critical infrastructure and government organizations.
In a significant move against cybercrime, the U.S. Department of Justice has charged an Israeli-Russian national for allegedly developing software used by the notorious LockBit ransomware gang.
The LockBit ransomware group is signaling a potential comeback after a challenging period marked by a significant takedown in February 2024. On December 19, LockBitSupp, believed to be an administrator for the group, announced the forthcoming release of "LockBit 4.0," scheduled for February 3, 2025. T
The Lazarus Group, a North Korean state-sponsored threat actor, has been linked to sophisticated cyberattacks targeting employees of a nuclear-related organization in January 2024. These attacks used a complex infection chain culminating in the deployment of a new modular backdoor, CookiePlus.
Threat actors are actively exploiting a recently patched security flaw impacting Fortinet FortiClient EMS in a campaign that installs remote desktop software like AnyDesk and ScreenConnect. The vulnerability is tracked as CVE-2023-48788 (CVSS score: 9.8) and is an SQL injection bug that allows attackers to execute unauthorized code or commands by sending specially crafted data packets.
CISA is advising organizations to promptly patch a critical vulnerability in BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS).
In a report from Security Intelligence, it was found that 2024 saw several high-profile data breaches that highlighted critical vulnerabilities across industries. Among the most notable was a breach in the healthcare sector, where attackers targeted a major hospital network, compromising sensitive patient records, insurance information, and medical histories.
A report from the Canadian Centre for Cyber Security highlights the increasing sophistication of Iranian state-sponsored cyber campaigns, focusing on social engineering and spear-phishing techniques.
Google Calendar, a widely used scheduling tool with over 500 million users in 41 languages, has become a significant target for cybercriminals exploiting its features to conduct phishing campaigns. Researchers at Check Point uncovered an ongoing campaign affecting over 300 brands, with more than 4,000 phishing emails sent in just four weeks.
Recent research by Forescout's Vedere Labs sheds light on the mechanisms driving the rise of malware targeting operational technology and industrial control systems.
Google Calendar, a widely used scheduling tool with over 500 million users in 41 languages, has become a significant target for cybercriminals exploiting its features to conduct phishing campaigns. Researchers at Check Point uncovered an ongoing campaign affecting over 300 brands, with more than 4,000 phishing emails sent in just four weeks.
In a complex threat landscape undergoing constant evolution, targeted phishing campaigns have become more sophisticated due to attackers leveraging new techniques and analyzing the platform-specific behaviors of organizations' defenses they target.
Sublime Security recently reported that it was successfully able to intercept a phishing campaign targeting end users with Xloader malware. The attack begins with the victim receiving an email designed to resemble a legitimate SharePoint file-sharing notification.
The Trend Micro Managed Detection and Response (MDR) team analyzed a recent security incident in which a user was targeted by an attacker posing as an employee of a known client on a Microsoft Teams call to gain remote access to the victim's system.
The rise of generative AI has introduced advanced capabilities but also new security vulnerabilities, including prompt injection attacks. Traditionally, these attacks exploit how AI processes inputs, often requiring permissions for external interactions.
Unit 42 researchers recently investigated a sophisticated phishing campaign targeting European companies, particularly in Germany and the UK, with a focus on the automotive, chemical, and industrial compound manufacturing sectors.
UAC-0099, a cyber-espionage threat actor linked to advanced persistent threats (APTs), has been identified targeting organizations with sophisticated campaigns. According to a recent analysis by SOC Prime, UAC-0099 employs a combination of spear-phishing emails, malicious attachments, and advanced malware to infiltrate targeted networks.
A recent scan conducted by cybersecurity firm Bishop Fox uncovered 430,363 SonicWall publicly exposed firewall appliances. Among these, 25,485 SonicWall SSLVPN devices were found to be vulnerable to critical security flaws, while an additional 94,018 were vulnerable to high-severity issues.
The Securonix Threat Research team has been monitoring a new tax-related phishing campaign where threat actors leveraged MSC files and advanced obfuscation techniques to execute a stealthy backdoor payload. Securonix is tracking this activity as FLUX#CONSOLE and the adversary employs tax-themed social engineering lures.
The Mask, also known as Careto, is a highly sophisticated cyber espionage group that has been active since at least 2007, primarily targeting high-profile organizations such as governments, diplomatic entities, and research institutions.
Earth Koshchei (APT29/Midnight Blizzard) conducted a large-scale rogue RDP campaign in October 2024, targeting governments, military, think tanks, academic researchers, and Ukrainian entities. The group used spear-phishing emails containing malicious RDP configuration files that redirected victims' connections to rogue servers via 193 RDP relays.
Firefighters have issued an urgent warning about the fire hazards associated with lithium-ion battery-powered devices, a popular category of Christmas gifts, including e-bikes, e-scooters, and hoverboards.
On Monday, the FBI released an advisory warning of a new HiatusRAT malware campaign that is actively scanning for and infecting vulnerable Chinese-branded web cameras and DVRs that are exposed online.
Dragos has released its Q3 2024 Industrial Ransomware Analysis, which highlights a continued increase in ransomware attacks targeting industrial sectors, including manufacturing, energy, and transportation.
A high-severity Windows kernel vulnerability, identified as CVE-2024-35250, is currently being exploited in the wild. This flaw, stemming from an untrusted pointer dereference in the Microsoft Kernel Streaming Service (MSKSSRV.SYS), allows local attackers to escalate privileges to SYSTEM level without user interaction.
QiAnXin XLab researchers have uncovered the use of a new PHP backdoor named Glutton they have observed in a global campaign targeting China, the United States, Cambodia, Pakistan, and South Africa. The malicious activity was discovered in April 2024 and Glutton has been attributed to the Chinese nation-state group APT41 (Winnti) with moderate confidence. To the researchers' surprise, some of these Glutton attacks are part of targeted operations against cybercrime systems.
A recent campaign exploiting fake CAPTCHA pages has been identified as a sophisticated method to deliver malware through malvertising networks. Cybercriminals use these fake CAPTCHA pages to lure users into clicking on malicious links or downloading harmful files, under the guise of proving they are not bots.
The Clop ransomware gang has claimed responsibility for a series of recent data-theft attacks targeting Cleo's managed file transfer platforms—Harmony, VLTrader, and LexiCom—leveraging vulnerabilities to breach corporate networks and steal sensitive information.
A recent campaign exploiting fake CAPTCHA pages has been identified as a sophisticated method to deliver malware through malvertising networks. Cybercriminals use these fake CAPTCHA pages to lure users into clicking on malicious links or downloading harmful files, under the guise of proving they are not bots.
Threat actor MUT-1244, tracked by DataDog, has been conducting a widespread and multifaceted campaign targeting a range of individuals, including academics, security researchers, pentesters, red teamers, and even other threat actors. The group's primary goal is to steal sensitive data such as AWS access keys, WordPress credentials, private SSH keys, bash history, and other critical system information.
Corvus Insurance reported a surge in ransomware attacks in November 2024, with 632 victims being listed on ransomware groups' data leak sites. This number is more than double the monthly average of 307 victims and exceeds the previous peak of 528 victims recorded in May 2024.
IOCONTROL is a custom-built IoT/OT malware linked to Iranian state-sponsored threat actors, specifically the CyberAv3ngers group. It targets critical infrastructure in Israel and the United States, including routers, IP cameras, firewalls, PLCs, HMIs, and fuel management systems such as Orpak and Gasboy devices.
Elastic Security has discovered a new Linux rootkit called Pumakit. This rootkit uses stealth and sophisticated privilege escalation techniques to maintain persistence on compromised systems.
Two Russian hacktivist groups, the People's Cyber Army (PCA) and Z-Pentest, have intensified their attacks on critical infrastructure in the U.S. and allied nations.
As the holiday shopping season intensifies, UK consumers are increasingly frustrated by the prevalence of bots that snap up popular items before human shoppers have a chance.
In October, Cleo patched a remote code vulnerability (CVE-2024-50623) in its LexiCom, VLTrader, and Harmony software, which is commonly used to manage file transfers. However on December 3, Huntress identified actors targeting fully patched Cleo software.
EagleMsgSpy is a newly identified Android surveillance tool reportedly employed by Chinese law enforcement agencies to conduct targeted monitoring and tracking of individuals.
Prometheus is a popular monitoring tool used extensively in DevOps and cloud-native environments. However, the default configurations often prioritize accessibility over security, leaving systems vulnerable to exploitation.
AWS Single Sign-On (SSO) access tokens are critical credentials used for authenticating users to AWS resources. If these tokens are exposed or mishandled, they can be exploited by threat actors to assume the identity of legitimate users, bypassing standard authentication mechanisms.
Zscaler's ThreatLabz team has uncovered a new version of ZLoader (2.9.4.0), that features an interactive shell for hands-on keyboard activity and a Domain Name System tunnel for C2 communications.
The Shiny Nemesis Cyber Operation highlights a highly sophisticated campaign targeting misconfigured public websites, predominantly hosted on AWS, to exploit vulnerabilities and gain unauthorized access to sensitive data, credentials, and proprietary resources.
Earlier this year, a large U.S. organization with operations in China experienced a targeted cyberattack attributed to China-based threat actors, likely for intelligence gathering.
Yesterday, Ivanti released a security advisory regarding a new maximum-severity authentication bypass flaw in Ivanti's Cloud Services Appliance (CSA) solution. The critical vulnerability is tracked as CVE-2024-11639 and was reported to Ivanti by CrowdStrike's advanced research team.
As part of the December Patch Tuesday, Microsoft addressed 71 flaws, including a zero-day vulnerability which is actively being exploited in attacks in the wild. Of the 71 flaws, there were 27 elevation of privilege vulnerabilities, 30 remote code execution vulnerabilities, 7 information disclosure vulnerabilities, 5 denial of service vulnerabilities, and 1 spoofing vulnerabilities.
Senator Ron Wyden has introduced a new bill aimed at bolstering the security of U.S. telecommunications infrastructure in the wake of recent hacks by the Salt Typhoon cyber espionage group.
AhnLab Security Intelligence Response Center (ASEC) has released a new blog post uncovering threat actors exploiting a critical Apache ActiveMQ vulnerability, CVE-2023-46604, to deploy Mauri ransomware in attacks most recently against Korean systems.
Huntress researchers have reported active exploitation of a vulnerability (CVE-2024-50623) in Cleo's file transfer software—Harmony, VLTrader, and LexiCom.
A suspected China-linked cyber espionage group targeted major business-to-business IT service providers in Southern Europe as part of a campaign known as Operation Digital Eye, according to a joint report by SentinelOne SentinelLabs and Tinexta Cyber.
A recently uncovered phishing campaign has revealed a new tactic employed by cybercriminals involving fake recruiters targeting unsuspecting victims.
Ukraine's Computer Emergency Response Team (CERT-UA) has issued a warning about a new wave of phishing attacks targeting the country's defense sector, including both defense companies and security forces.
Ukraine's Computer Emergency Response Team (CERT-UA) has issued a warning about a new wave of phishing attacks targeting the country's defense sector, including both defense companies and security forces.
In early October 2024, Rapid7 witnessed a resurgence of activity related to an ongoing social engineering campaign being conducted by Black Basta ransomware operators. This activity was initially reported on by Rapid7 and has been ongoing since at least May 2024.
Mandiant has identified an innovative method to bypass browser isolation technology by leveraging QR codes for command-and-control operations. Browser isolation is a security approach that routes web requests through remote browsers hosted in the cloud, virtual machines, or on-premises environments.
Researchers at Bitsight has identified a malicious botnet called Socks5Systemz, which powers the proxy service PROXY.AM. This malware enables other criminal activities by providing threat actors with anonymous proxy services, leveraging compromised systems as proxy exit nodes.
Generative Artificial Intelligence (AI) has paved the way for criminals to commit fraud at a scale larger than ever before. “Generative AI reduces the time and effort criminals must expend to deceive their targets.
U.S. authorities have arrested 19-year-old Remington Goy Ogletree, a key member of the Scattered Spider cybercrime gang, for breaching a U.S. financial institution and two telecommunications firms.
BlueAlpha, a Russian state-sponsored APT group, has recently refined its malware delivery techniques by abusing Cloudflare Tunnels to distribute its proprietary GammaDrop malware.
Cybersecurity researchers at WatchTowr Labs have released a PoC exploit that chains together a recently patched critical vulnerability impacting Mitel MiCollab, CVE-2024-41713, and an arbitrary file read zero-day vulnerability that requires authentication to exploit.
On December 4, 2024, the ransomware group Brain Cipher publicly claimed responsibility for a breach allegedly targeting Deloitte UK.
According to Citizen Lab, a concerning incident has surfaced where devices confiscated by Russian authorities were returned to their owners with Monokle-type spyware installed. Monokle, a highly advanced spyware tool, is capable of extracting sensitive data such as contact lists, messages, and login credentials, while also intercepting communications and remotely activating device cameras and microphones.
Cado Security Labs recently uncovered a DocuSign spear-phishing campaign targeting tech executives. These campaigns mimic authentic DocuSign communications, luring recipients to input their credentials on fraudulent websites.
Secret Blizzard, a Russian state-sponsored advanced persistent threat group attributed to Center 16 of the FSB, has developed a unique strategy of leveraging tools and infrastructure from other threat actors to enhance its espionage operations.
According to Symantec, they found evidence that a large US organization with a quote-unquote significant presence in China was targeted by China-nexus threat actors earlier this year and was subjected to a four-month-long intrusion where persistence was established on the organization's network seemingly for intelligence gathering purposes.
The manufacturing industry is increasingly targeted by cybercriminals leveraging sophisticated malware campaigns involving Lumma Stealer and Amadey Bot. This attack campaign primarily exploits phishing emails with malicious attachments to infiltrate organizational systems.
The Chinese cyber-espionage group known as Salt Typhoon has significantly broadened its activities, targeting U.S. telecommunications networks with a strategy that extends beyond previously understood objectives.
Microsoft has warned that a recent premature patch could cause issues with the "Recall" feature in Windows, potentially rendering it unable to function properly. The bug, which emerged after the update was rolled out, could lead to a loss of essential data recall functions, disrupting workflows for many users.
Mikhail Matveev, known in the cybercriminal world by the aliases "Wazawaka" and "Boriselcin," has been a prominent figure in several ransomware groups responsible for extorting hundreds of millions of dollars from various sectors, including healthcare, education, government agencies, and private enterprises.
Researchers have disclosed a PoC exploit for CVE-2024-8785, a critical remote code execution vulnerability in Progress WhatsUp Gold, a widely used enterprise network monitoring tool.
Researchers at Trend Micro have observed a significant evolution in the behavior of the Gafgyt malware, which has expanded its targeting scope from vulnerable IoT devices to misconfigured Docker Remote API servers.
A known threat actor in the Malware-as-a-Service business, Venom Spider, has expanded the capabilities of their MaaS platform with a new backdoor and loader malware.
SmokeLoader, which has been around since 2011, is a malware loader that's still being actively used by cybercriminals. Recently, it's been found exploiting outdated vulnerabilities in Microsoft Office documents, particularly old DOC and XLS files.
Researchers at the South Korean cybersecurity company Genians have uncovered a series of email phishing attacks originating from Russian sender addresses that they link to the North Korea-aligned APT, Kimsuky. According to Genians researchers, the phishing emails were delivered through email services in Japan and Korea up until early September.
The Social Design Agency, recently accused by the US government of operating the "Doppelgänger" malign influence campaign, is now running a parallel effort called "Operation Undercut."
Cybersecurity researchers have uncovered malicious email campaigns using a sophisticated phishing-as-a-service toolkit called Rockstar 2FA, designed to steal Microsoft 365 account credentials.
Researchers have disclosed significant vulnerabilities in Palo Alto Networks GlobalProtect and SonicWall SMA100 NetExtender VPN clients for Windows, macOS, and Linux, which could enable attackers to execute remote code and gain elevated access.
A newly uncovered malware campaign, Horns&Hooves, primarily targets private users, retailers, and service businesses in Russia to deploy NetSupport RAT and BurnsRAT.
In September 2024, Fortinet researchers observed a sophisticated phishing attack that utilized SmokeLoader malware to target organizations in Taiwan. SmokeLoader is notorious for conducting attacks against manufacturing, healthcare, information technology, and other critical sectors.
On November 21, 2024, a ransomware attack on Blue Yonder, an Arizona-based supply chain management and cloud services provider, disrupted operations for major clients, including Starbucks, U.K. grocery chain Sainsbury, and potentially Ford.
APT-C-60, the moniker assigned to a South Korea-aligned cyber espionage group, has been linked to a cyber attack targeting an unnamed organization in Japan.
CISA has received recent evidence of threat actors actively exploiting an RCE vulnerability in some SSL VPN products from Array Networks. The products affected are Array Networks AG and vxAG ArrayOS.
Trend Micro has uncovered a new spear-phishing campaign targeting individuals as well as organizations in Japan since at least June 2024.
CyberVolk, also referred to as Gloriamist, is a pro-Russian hacktivist group that emerged in May 2024 and quickly evolved from conducting distributed denial-of-service attacks and website defacements to launching ransomware campaigns.
83% of Organizations Reported Insider Attacks in 2024
The Russia-aligned threat actor RomCom has been linked to the exploitation of two critical zero-day vulnerabilities, one in Mozilla Firefox (CVE-2024-9680, CVSS 9.8) and the other in Microsoft Windows (CVE-2024-49039, CVSS 8.8), as part of a sophisticated campaign to deliver their eponymous backdoor malware.
Google has uncovered a sophisticated pro-China influence network operated by four public relations firms, collectively tracked as "GlassBridge." Active since at least 2022, this network has leveraged deceptive online tactics to spread Chinese state narratives to international audiences.
Surefire Cyber has identified SafePay as a rising ransomware operator, demonstrating advanced capabilities in infiltrating networks and encrypting data. The group is known for targeting organizations across multiple industries and operates with remarkable speed and stealth.
In November, we observed an increase in spear phishing attempts clicked by our user base using discreet redirect tactics. However, this report will focus on a rise in social media phishing, specifically aimed at Instagram accounts.
In November, we observed an increase in spear phishing attempts clicked by our user base using discreet redirect tactics. However, this report will focus on a rise in social media phishing, specifically aimed at Instagram accounts. Here are some examples and highlights.
Trellix researchers have discovered a new threat campaign that leverages the Bring Your Own Vulnerable Driver (BYOVD) technique to disarm security protections and perform operations on the infected system.
Two malicious Python packages, "gptplus" and "claudeai-eng," posed as tools for API integration with popular AI chatbots like OpenAI's GPT-4 Turbo and Anthropic's Claude, but instead delivered a newly documented infostealer called "JarkaStealer."
Russian state-sponsored hackers APT28 (also known as Fancy Bear, Forest Blizzard, and Sofacy) executed a sophisticated breach of a U.S. company's enterprise WiFi network, leveraging an innovative technique termed the "nearest neighbor attack."
A phishing campaign targeting telecommunications and financial sectors was identified in October 2024 by EclecticIQ analysts. The attackers utilized Google Docs to deliver phishing links, which redirected victims to fake login pages hosted on Weebly, a trusted website builder.
ESET researchers have identified multiple samples of a new Linux-based malware backdoor named WolfsBane, attributed to the Gelsemium group with high confidence by ESET. This malware acts as a Linux counterpart to the previously identified Gelsevirine, showing the group's growing interest in cross-platform capabilities.
Email attacks are intensifying in the manufacturing sector, with phishing and business email compromise attacks surging as cybercriminals exploit the industry's low tolerance for downtime.
A helpline service established to assist victims of Yakuza-related crimes has come under scrutiny following reports of a potential data breach.
According to Bitdefender, 77% of Black Friday-themed spam emails in 2024 have been identified as scams, highlighting a 7% rise in the proportion of spam emails identified as scams compared to Black Friday 2023, and a 21% increase compared to 2022.
The US and Australian governments have issued a joint advisory warning critical infrastructure organizations about evolving tactics used by the BianLian ransomware group, a Russia-linked cybercriminal organization.
Lumma Stealer is a sophisticated and fast-spreading information-stealing malware, primarily distributed through Telegram channels disguised as cracked software.
While creating an automatic credential validation system for Fortinet VPN, Pentera says it uncovered a bug that actors can exploit to potentially compromise the security of dozens of organizations. Initially, to automate the validation of credentials, Pentera attempted to use clients like OpenConnect to establish a connection, but this approach proved unreliable.
Security researchers at SentinelOne have provided a new analysis of components of the broader DPRK fake IT worker scheme. This scheme involves the Democratic People's Republic of Korea (DPRK) impersonating U.S.-based software and technology consulting businesses in order to further their financial objectives.
Apple recently released security updates for iOS, iPadOS, macOS, visionOS, and its Safari web browser to address two zero-day flaws that have come under active exploitation according to Clément Lecigne and Benoît Sevens of Google's Threat Analysis Group (TAG) who discovered the flaws.
Earth Kasha, a cyber threat group tracked by Trend Micro, has been active since 2019, leveraging the LODEINFO malware to target organizations in Japan.
The NSOCKS botnet, underpinned by the ngioweb malware, has emerged as a major player in the cybercrime ecosystem, driving criminal proxy services like VN5Socks and Shopsocks5.
CrowdStrike has identified a previously unknown Chinese cyber espionage group, Liminal Panda, which has been active since at least 2020 and is believed to be behind cyber intrusions targeting telecom providers.
According to Semperis' new report, 2024 Ransomware Holiday Risk, ransomware gangs often strike when defenses are the weakest. Semperis conducted a global study of 900 IT and security professionals.
Helldown, a ransomware strain derived from the leaked LockBit 3.0 codebase, has been expanding its operations, with researchers recently identifying a Linux variant. This development indicates the group's growing focus on targeting virtualized infrastructures, such as VMware. First documented in August 2024, Helldown has been described as an aggressive ransomware group targeting sectors like IT services, telecommunications, manufacturing, and healthcare.
Proofpoint has observed a significant rise in the use of the ClickFix social engineering technique, a deceptive method that tricks users into executing malicious PowerShell commands. Initially linked to campaigns by TA571 and the ClearFake threat cluster, the technique has now become a favorite across multiple financially motivated and espionage-focused threat actors.
In July 2024, the operational technology (OT)-centric malware FrostyGoop/BUSTLEBERM became publicly known, after attackers used it to disrupt energy infrastructure for over 600 apartment buildings, leaving people without heat for 2 days in Lviv in April 2024 due to an ICS attack on a municipal energy company.
Between November 13 and 14, 2023, researchers at Cyberint observed a significant increase in activity from the Akira ransomware group, which listed over 30 victims on its data leak site.
Today, as part of National Critical Infrastructure Security and Resilience Month, the National Counterintelligence and Security Center (NCSC) and the Cybersecurity and Infrastructure Security Agency (CISA) released new guidance to help detect and mitigate efforts by foreign intelligence entities to harm or disrupt U.S. critical infrastructure.
According to a blog post by Istvan Marton from Wordfence, over 4 million WordPress sites are exposed to a critical authentication bypass vulnerability in the Really Simple Security plugin for WordPress that can be leveraged to grant an unauthenticated adversary remote administrative access to vulnerable sites.
Palo Alto Networks is aware of active exploitation attempts in the wild leveraging an authentication bypass vulnerability impacting its PAN-OS firewall management interface.
In a recent analysis by Palo Alto Networks' Unit 42, a North Korean hacker group identified as CL-STA-0237 has been connected to a series of phishing attacks using the BeaverTail malware.
Over 1 million domains have been identified as potentially vulnerable to "Sitting Ducks" attacks, a cyber threat that exploits DNS misconfigurations, particularly lame delegation. This misconfiguration occurs when domains mistakenly point to incorrect authoritative name servers, allowing attackers to hijack domains.
Cisco Talos uncovered a new information-stealing campaign orchestrated by a Vietnamese-speaking threat actor targeting government and education entities in Europe and Asia. The campaign leverages a novel Python-based malware dubbed PXA Stealer, designed to exfiltrate sensitive data from victims' systems.
SentinelOne's recent report, The State of Cloud Ransomware in 2024, highlights an increasing trend in ransomware actors exploiting cloud services to directly compromise their victims or exfiltrate sensitive data.
Modern communications networks, particularly those driven by 5G technology, are increasingly relying on Artificial Intelligence (AI) to boost performance, improve reliability, and ensure security. As these networks evolve, AI plays an essential role in real-time data processing, predictive maintenance, and optimizing traffic management.
Global Navigation Satellite Systems (GNSS), which include the U.S. GPS, Russian GLONASS, European Galileo, Chinese BeiDou, Indian NavIC, and Japanese Quazi-Zenith, serve as critical infrastructure providing essential positioning, navigation, and timing (PNT) services for a wide array of industries such as telecommunications, agriculture, finance, banking, transportation, and mobile communications.
On November 14, 2024, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) confirmed active exploitation of two critical vulnerabilities in Palo Alto Networks' Expedition firewall configuration migration tool: CVE-2024-9463 and CVE-2024-9465. These vulnerabilities, with CVSS scores of 9.9 and 9.3 respectively, pose significant risks to affected systems.
On Tuesday, Microsoft released a security patch for a NTLM hash disclosure spoofing vulnerability (CVE-2024-43451) that could exploited to steal a user's NTLMv2 hash. The vulnerability requires minimal user interaction and is exploited by generating a malicious URL file that can be activated through seemingly harmless actions.
The Hamas-affiliated threat group WIRTE, part of the Gaza Cyber Gang, has escalated its cyber operations, moving from espionage to destructive attacks aimed at Israeli entities. According to Check Point, this shift reflects WIRTE's use of recent geopolitical events, specifically the Israel-Hamas conflict, to craft targeted cyber campaigns.
In November 2024, IBM X-Force observed an ongoing Hive0145 campaign targeting Europe, specifically Spain, Germany, and Ukraine using Strela Stealer malware, a credential-theft tool delivered through highly tailored phishing emails. These emails, posing as legitimate invoice notifications, utilize previously compromised email credentials to blend seamlessly into legitimate email traffic.
CISA and the FBI released a joint statement on November 13, 2024, confirming that PRC-affiliated threat actors have compromised the "private communications" of a "limited number" of government officials after breaching multiple U.S. broadband providers in a broad and significant cyber espionage campaign.
SlashNext researchers recently uncovered a new phishing tool called GoIssue, which allows threat actors to extract email addresses from GitHub profiles and send bulk emails to users. Advertised on cybercriminal forums, GoIssue is priced at $700 for a custom build or $3,000 for full source code access.
Iranian threat actor TA455, affiliated with Iran's Islamic Revolutionary Guard Corps (IRGC), has been conducting a sophisticated cyber espionage campaign that mirrors North Korea's “Dream Job” tactic.
Romanian cybersecurity company Bitdefender has developed a free decryptor for ShrinkLocker ransomware victims, offering a way to recover data encrypted by the malware. This decryptor was created after Bitdefender analyzed ShrinkLocker's mechanisms and identified a recovery opportunity right after the removal of BitLocker protectors.
Perception Point researchers published a blog post on November 11, 2024, regarding an observed dramatic increase in two-step phishing attacks targeting hundreds of organizations by leveraging Microsoft Visio's .vsdx files. By weaponizing .vsdx files rarely used in phishing attacks, the adversary exploits user trust in the reputation of Microsoft and concurrently adds a new layer of deception designed to evade detection.
According to a recent report by Group-IB, the Lazarus APT group has started attempting to smuggle code utilizing custom extended attributes, which are metadata associated with files and folders in various file systems. Extended attributes allow users to store additional information beyond standard metadata like file size, timestamps, and permissions.
The US government's Consumer Financial Protection Bureau (CFPB) has advised employees to avoid using cellphones for work after China-linked APT group Salt Typhoon breached major telecom providers. The CFPB, established in 2011 to protect consumers in the financial sector and promote fair, transparent markets, issued a directive urging employees to limit phone use and rely on Microsoft Teams and Cisco WebEx for meetings involving nonpublic data.
Researchers at WatchTowr have disclosed new vulnerabilities in Citrix Virtual Apps and Desktops, particularly affecting the Session Recording component, which administrators use to monitor and record user sessions. These security flaws could potentially allow unauthenticated remote code execution, presenting a serious threat to affected systems.
Ymir, a relatively new ransomware family, has been observed by researchers at Kaspersky encrypting systems that were previously compromised by RustyStealer, an infostealer malware first documented in 2021. Ymir ransomware initiated operations in July 2024 and is known for its in-memory execution, use of PDF files as ransom notes, and extension configuration options.
North Korean-linked threat actors have started embedding malware in applications built using Flutter, a cross-platform development framework, specifically to target Apple macOS devices—a first for this adversary.
AndroxGh0st, a Python-based cloud attack tool that's known for its targeting of Laravel applications with the goal of sensitive data pertaining to services like Amazon Web Services, is being utilized in a campaign exploiting a larger set of security flaws only impacting internet-facing applications.
Cybersecurity firm Malwarebytes is warning of hackers using stolen session cookies to bypass multi-factor authentication (MFA) and take over email accounts. “When you log in and the server has verified your authentication—straight away or after using MFA–the server creates a session and generates a unique session ID.
Fortinet's FortiGuard Labs recently identified a phishing campaign delivering a new Remcos RAT variant through a malicious Excel document attached to a phishing email. The attack starts with a convincing email that includes the Excel file, disguised as an order form to lure the recipient into opening it.
CosmicBeetle, also known as NoName, is a ransomware-as-a-service (RaaS) operation that has been active since 2020. This group is known for exploiting known vulnerabilities, such as EternalBlue (CVE-2017-0144), and the Zerologon vulnerability (CVE-2020-1472) to infiltrate systems.
In November 2023, a security vendor discovered that North Korean threat actors were using the Contagious Interview and WageMole campaigns to procure remote employment opportunities in Western countries, thus evading the financial sanctions against North Korea (DPRK).
On October 31, 2024, telematics provider Microlise disclosed it suffered from a cyberattack that disrupted tracking services for clients like DHL, a global logistics and shipping company, and Serco, a company that manages the transport of prisoners for the Ministry of Justice in the United Kingdom.
Since July 2024, the "CopyRightadamantys" phishing campaign has been exploiting copyright infringement themes to trick victims into downloading a new version of the Rhadamanthys information stealer. Tracked by cybersecurity firm Check Point, this large-scale operation spans the U.S., Europe, East Asia, and South America.
Cybersecurity experts recently uncovered a malicious package on PyPI, "fabrice," which has been secretly stealing AWS credentials from developers since its launch in March 2021.
SentinelLabs has identified a new multi-stage malware campaign, named "Hidden Risk", attributed to the North Korean state-backed threat actor BlueNoroff, which targets businesses in the cryptocurrency industry.
Cleafy's Threat Intelligence team witnessed a significant spike in malicious activity utilizing a new Android malware sample in late October 2024. Initially classified as TgToxic malware, this malware sample was further analyzed and although it has similar bot commands with TgToxic, the code differs greatly in that many TgToxic capabilities are absent and some commands act as placeholders for unimplemented modules, leading Cleafy to classify this malware as a new family called ToxicPanda.
The GoZone ransomware, a new strain identified by SonicWall researchers, targets victims with a relatively low ransom demand of $1,000 in Bitcoin for file decryption. Written in Go, it employs Chacha20 and RSA algorithms to encrypt files, appending a ".d3prU" extension to signal compromise.
Summary: On Tuesday, Interpol announced the takedown of more than 22,000 malicious IP addresses or servers linked to cyber threats, as part of a coordinated operation involving private sector partners and law enforcement agencies from 95 INTERPOL member countries.
ClickFix is a new social engineering tactic that uses deceptive error messages to prompt users into executing malicious code, allowing attackers to infiltrate their devices.
In the first half of 2024, ransomware activity continued to surge, with 75 active ransomware groups and 2,260 organizations falling victim—marking a 24.5% increase compared to H1 2023. LockBit's resurgence in May, following Operation CRONOS, was a significant contributor to this spike.
As part of the November Security updates, Google addressed a total of 51 vulnerabilities, two of which are actively being exploited in attacks in the wild.
Canadian authorities have detained Alexander "Connor" Moucka in connection with an extensive data breach campaign that compromised sensitive information from hundreds of millions of individuals.
Pakistan's APT36 threat group has been observed by Check Point Research utilizing a new and improved ElizaRAT malware in a growing number of successful attacks against Indian government agencies and military entities in the past year.
Researchers at Securonix recently uncovered a sophisticated phishing campaign where attackers trick Windows users into launching a custom Linux virtual machine (VM) with a pre-configured backdoor.
“In 2023, organizations were hit hard by cyberattacks, many of which exposed serious weaknesses in security practices. One of the biggest issues was how patching and vulnerability management was handled. I
LastPass, a popular password manager software, is currently facing an ongoing phishing campaign targeting its users. Cybercriminals are writing fake reviews on the Chrome Web Store for the LastPass extension, promoting a fraudulent customer support phone number: 805-206-2892.
Cybersecurity firm Rapid7 recently shed light on a Microsoft SharePoint remote code execution vulnerability (CVE-2024-38094) which is actively being exploited in attacks in the wild to gain initial access to corporate networks.
Cybercriminals have adopted a sophisticated approach by exploiting DocuSign's API capabilities to send convincing fake invoices that appear to come from reputable companies like Norton Antivirus.
The Interlock ransomware, a relatively new threat that emerged in late September 2024, has been targeting organizations worldwide with a distinctive tactic: it uses an encryptor specifically designed for FreeBSD servers.
The Passion group, which has established connections with notorious hacktivist collectives such as Killnet and Anonymous Russia, has recently emerged as a significant player in the cyber threat landscape by offering DDoS-as-a-Service specifically tailored for pro-Russian hacktivists.
Cisco Talos has identified an ongoing phishing campaign targeting Facebook business and advertising account users in Taiwan since at least July 2024. The campaign leverages social engineering tactics to deceive victims into downloading and executing malware.
The landscape of autonomous systems, particularly in the realms of drones and robotics, has undergone transformative advancements in recent years. These technologies have enhanced operational efficiency and capability across a multitude of sectors, ranging from agriculture and logistics to national defense and emergency response.
U.S. and Israeli cybersecurity agencies have recently linked the Iranian cyber group Emennet Pasargad, now operating under the alias Aria Sepehr Ayandehsazan, to sophisticated cyber operations targeting the 2024 Summer Olympics.
Microsoft has shed light on a botnet dubbed CovertNetwork-1658, aka xlogin and Quad7 (7777), which has enabled Chinese threat actors to steal credentials in highly evasive password spray attacks.
Researchers recently disclosed the Xiū gǒu phishing kit, which has been operational since at least September 2024 in campaigns targeting Australia, Japan, Spain, the U.K., and the U.S. Xiū gǒu is a sophisticated phishing toolkit responsible for over 2,000 phishing websites aimed at various industries, including government, postal services, digital services, and banking.
Trend Micro researchers identified a complex attack exploiting the Atlassian Confluence vulnerability CVE-2023-22527, allowing attackers to achieve remote code execution (RCE) to install cryptomining software on compromised systems using the Titan Network.
QNAP recently published security updates to address two critical zero-day flaws impacting its network-attached storage (NAS) devices, which were exploited by security researchers during the Pwn2Own hacking contest in Ireland last week.
French internet service provider Free has publicly disclosed a significant cyber attack that has compromised certain personal information of its customers. As the second-largest ISP in France, with over 22.9 million mobile and fixed subscribers, Free plays a crucial role in the country's telecommunications landscape.
Strela Stealer, a malware originally identified by the German cybersecurity organization DCSO in late 2022, is an information stealer primarily designed to exfiltrate email account credentials from email clients like Microsoft Outlook.
A critical Remote Code Execution vulnerability in CyberPanel exposed over 22,000 instances online, leading to a large-scale PSAUX ransomware attack that took most affected servers offline. This vulnerability affects CyberPanel versions 2.3.6 and likely 2.3.7 and includes three significant flaws: defective authentication, command injection, and a security filter bypass.
The North Korean APT group Andariel, linked to the Reconnaissance General Bureau, was found to be associated with the Play ransomware operation, likely acting as an affiliate or initial access broker. In May 2024,
Yesterday, the FBI issued an advisory warning about scammers exploiting the 2024 US General election to scam individuals across the United States. The agency has identified four different schemes employed by these fraudsters.
This is a sophisticated campaign with a large scope and it utilizes the commonly used Facebook software as an avenue for initial access. The TA has the infrastructure to impersonate ads for essentially any commonly used software. This malware has the capability to evade AV detection. The possibility of legitimate business accounts being utilized to propagate the malware further, highlights the severity of the threat.
The "EmeraldWhale" campaign, a large-scale malicious operation, has reportedly scanned for exposed Git configuration files, compromising over 15,000 cloud account credentials across thousands of private repositories.
Cybersecurity experts at Proofpoint have reported a concerning rise in online job scams targeting financially vulnerable individuals, especially those seeking remote or flexible work.
Russian threat group UNC5812 has launched a complex espionage and influence campaign targeting Ukrainian military recruits, deploying malware for both Windows and Android devices.
The Canadian Centre for Cyber Security (Cyber Centre) recently stated that a sophisticated Chinese state-sponsored threat actor has performed reconnaissance scanning against numerous domains in Canada.
Evasive Panda, a China-aligned APT group, has been observed utilizing a post-compromise toolset named CloudScout to target government and religious institutions in Taiwan between 2022 and 2023.
Several vulnerabilities have been identified in the Realtek SD card reader driver, RtsPer[.]sys, impacting a broad range of laptops from major brands.
Researchers at ReliaQuest have uncovered a new social engineering technique employed by Black Basta ransomware actors to gain an initial foothold into victim environments. Previously, these actors would overwhelm users with email spam, prompting recipients to create a legitimate help-desk ticket to resolve the issue. From here, Black Basta operators would then contact the end user, posing as the help desk to respond to the ticket. I
The notorious cryptojacking group TeamTNT is gearing up for a large-scale attack campaign targeting cloud-native environments. This new effort focuses on exploiting exposed Docker daemons to deploy the Sliver malware, cryptominers, and a cyber worm. TeamTNT uses compromised Docker servers and Docker Hub as their infrastructure to spread the malware.
Fog and Akira ransomware groups are actively exploiting a critical vulnerability, CVE-2024-40766, in SonicWall SSL VPNs to gain unauthorized access to corporate networks. This flaw, found in SonicOS, affects access controls within SSL VPNs, allowing attackers to bypass security and compromise networks remotely.
A recent surge in phishing activity has been identified by Netskope Threat Labs, with a 10-fold increase in traffic directed towards phishing pages built using Webflow. These campaigns target a range of information, including login credentials for various crypto wallets (Coinbase, MetaMask, Phantom, Trezor, Bitbuy), company webmail platforms, and even Microsoft365 credentials.
The Dutch National Police, in coordination with the FBI and other international agencies, have dismantled the network infrastructure supporting the Redline and Meta infostealer malware operations in an effort known as "Operation Magnus." This disruption serves as a direct warning to cybercriminals that their data is now in the hands of law enforcement.
LinkedIn, Microsoft's professional social network, serves as a vital hub for job recruiters and seekers. Unfortunately, it's also becoming a fertile ground for cybercriminals targeting unsuspecting users. Like other social platforms, LinkedIn is rife with bots that respond to specific keywords or hashtags such as "I was laid off" or "#opentowork."
In June 2024, Aqua Security discovered a security vulnerability in the AWS Cloud Development Kit (CDK), an open-source tool for building cloud infrastructure. This vulnerability could potentially allow attackers to gain administrative access to a target AWS account, allowing account hijacking for executing malicious code.
Amazon recently seized domains used by APT 29, a Russian state-backed actor, in a mass email phishing campaign targeting government agencies, enterprises, and militaries. The campaign which was initially identified and disclosed by Ukraine's Computer Emergency Team (CERT-UA),
LinkedIn, Microsoft's professional social network, serves as a vital hub for job recruiters and seekers. Unfortunately, it's also becoming a fertile ground for cybercriminals targeting unsuspecting users. Like other social platforms, LinkedIn is rife with bots that respond to specific keywords or hashtags such as "I was laid off" or "#opentowork."
UnitedHealth has confirmed that over 100 million individuals had their personal and healthcare data stolen in the Change Healthcare ransomware attack, marking it as the largest healthcare data breach in recent years. CEO Andrew Witty previously warned that "maybe a third" of all Americans' health data was compromised.
A newly enhanced version of the Qilin (Agenda) ransomware, dubbed 'Qilin.B,' has been detected in cyberattacks, showcasing stronger encryption techniques, improved evasion from security tools, and sophisticated methods to disrupt data recovery processes.
Summary: A new vulnerability in Fortinet's FortiManager, known as "FortiJump" and tracked as CVE-2024-47575, has been actively exploited in zero-day attacks since June 2024. The flaw has affected over 50 servers and was first revealed in a report by Mandiant.
Cisco has released security updates to address an actively exploited flaw impacting the Remote Access VPN (RAVPN) service of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software. Tracked as CVE-2024-20481, a successful exploitation could enable an unauthenticated, remote attacker to cause a denial of service of the RAVPN service.
In October 2024, a significant cybersecurity event involving a manufacturing firm was analyzed by ReliaQuest. The investigation attributed the breach to a group called "Scattered Spider," a collective of English-speaking cybercriminals connected to the ransomware organization "RansomHub."
In June 2024, ESET researchers identified a new ransomware group, Embargo, utilizing a Rust-based toolkit for its operations. The toolkit consists of MDeployer, a loader, and MS4Killer, an EDR killer. Both tools are designed to facilitate the deployment and execution of the Embargo ransomware.
A new blog post by Cisco Talos shed light on the activities of Akira ransomware, noting that the group is actively creating new variants of its encryptor and refining its TTPs to adapt to shifts in the threat landscape. In 2023 Akira typically employed a double-extortion tactic where victim data was exfiltrated before encryption.
Cisco Talos recently uncovered a phishing campaign leveraging the open-source Gophish toolkit, executed by an unknown threat actor. The campaign utilizes modular infection chains, either via malicious documents (Maldoc) or HTML files containing JavaScript, which lead to the deployment of two Remote Access Trojans (RATs): PowerRAT, a newly identified PowerShell-based RAT, and DCRAT, a widely recognized malware.
Cybercriminals have compromised a third-party provider linked to Verizon's Push-to-Talk systems, a service used by government agencies, first responders, and enterprises for secure internal communication. This breach, advertised on a Russian-language cybercrime forum, does not impact Verizon's core consumer network but reveals significant vulnerabilities in telecoms' security practices.
A high-severity vulnerability (CVE-2024-38094) impacting Microsoft SharePoint has been identified following the release of a public PoC and subsequently added to CISA's Known Exploited Vulnerabilities (KEV) catalog. This deserialization vulnerability allows an authenticated attacker with Site Owner permissions to inject and execute arbitrary code on the SharePoint server.
In a report from ANY.RUN, DarkComet is highlighted as a highly versatile and dangerous Remote Access Trojan (RAT) that has been a persistent threat since its creation by Jean-Pierre Lesueur in 2008.
ForcePoint has observed an increase in the use of Latrodectus malware by cybercriminals in attacks targeting the financial, automotive, and healthcare sectors. For its part, Latrodectus is a malware downloader that has been around since October 2023. The strain is believed to be developed by LunarSpider, a threat actor who developed the notorious IceID trojan, which has been used by dozens of malware families for distribution purposes.
Two Russian pro-hacker groups, NoName057 and the Russian Cyber Army Team, launched coordinated DDoS attacks against Japanese logistics, shipbuilding companies, and government agencies starting on October 14, 2024.
Attackers are exploiting exposed Docker Remote API servers to deploy the perfctl malware, utilizing a structured attack flow that begins with probing the vulnerable server and ends with payload execution and persistence. The attack starts with the attacker identifying an exposed Docker Remote API server through a ping request. Once the server is located, the attacker creates a Docker container using the ubuntu image.
On Monday, October 21, 2024, the Biden administration officially announced new proposed rules related to a February executive order designed to prevent foreign adversaries such as China and Russia from exploiting easily obtained American financial, biometric, precise geolocation, health, genomic, and other data to carry out future cyberattacks or continue to spy on Americans.
Threat groups are exploiting a critical vulnerability (CVE-2024-40711) in Veeam Backup and Replication software for ransomware attacks, according to researchers and federal authorities. This vulnerability, with a CVSS score of 9.8, was disclosed by Veeam in a security bulletin on September 4.
VMware has released a new security update for CVE-2024-38812, a critical remote code execution (RCE) vulnerability in VMware vCenter Server that wasn't fully addressed by the initial patch in September 2024. The flaw, with a CVSS score of 9.8, stems from a heap overflow issue in the DCE/RPC protocol, affecting vCenter Server and related products like vSphere and Cloud Foundation. It can be exploited without user interaction through specially crafted network packets.
APT41 (also known as Brass Typhoon, Earth Baku, Wicked Panda, or Winnti) launched a sophisticated cyberattack on the gambling and gaming industry. Over a span of six to nine months, the attackers gathered sensitive information such as network configurations, passwords, and data from the LSASS process.
The Bumblebee malware loader appears to have resurfaced after being disrupted by Europol's Operation Endgame in May 2024. A new infection chain deploying Bumblebee has been detected by Netskope Threat Labs, marking its first reappearance since the Europol-led takedown.
Last Friday, ESET announced on X (formerly known as Twitter) that it is aware of a security incident that affected its partner company in Israel. Notably, a phishing campaign initiating on October 8th was observed, where emails branded with ESET's logo were sent from eset[.]co[.]il, a legitimate domain that is operated by ESET's Israel distributor, Comsecure.
In a recent cyberattack, the North Korea-backed advanced persistent threat (APT) group known as APT37 exploited a zero-day vulnerability in Microsoft's Internet Explorer (IE) web browser to launch a zero-click supply chain campaign targeting South Korean entities.
Microsoft has urged all macOS users to update their systems due to a vulnerability (CVE-2024-44133, CVSS 5.5) patched in the September macOS Sequoia updates. The flaw may be exploited by the Adloader macOS malware family. It targets Apple's Transparency, Consent, and Control (TCC) protections, potentially allowing unauthorized access to a device's camera, microphone, and location.
Researchers at Sekoia have shed light on a new social engineering tactic called ClickFix, which involves displaying fake error messages in web browsers to trick users into copying and executing malicious PowerShell code to infect targeted systems. In the last couple of months, ClickFix has been used to distribute Windows and macOS infostealers, botnets, and remote access tools.
Microsoft has identified a vulnerability in macOS, named "HM Surf," that enables attackers to bypass the system's Transparency, Consent, and Control technology, which is responsible for managing user permissions for accessing sensitive data. This flaw, tracked as CVE-2024-44133, allows attackers to gain unauthorized access to user data, including browsing history, camera, microphone, and location.
Group-IB researchers successfully infiltrated the Cicada3301 ransomware-as-a-service group, uncovering significant details about its operations and affiliate panel. Cicada3301, which started recruiting affiliates in June 2024, has targeted approximately 30 victims, primarily in the U.S. and U.K.
The pentester encountered a session fixation vulnerability in a PHP web application, but knew it might not be taken seriously on its own. To demonstrate its severity, they combined it with an existing XSS vulnerability and a lesser-known technique called the Cookie Jar Overflow Attack. This combination allowed them to show how an attacker could bypass security measures and hijack user sessions.
In December, a new ransomware group targeting Russian businesses and government agencies was identified, dubbed “Crypt Ghouls.” Investigation revealed connections to other cybercriminal groups through shared tactics, tools, and infrastructure. The group employs a variety of utilities, including Mimikatz and LockBit 3.0 for ransomware attacks, utilizing compromised contractor credentials to gain access via VPN.
Iranian hackers are increasingly breaching critical infrastructure organizations to steal credentials and network data, which they sell on cybercriminal forums, enabling further cyberattacks by other threat actors.
Secureworks Counter Threat Unit researchers have identified evolving tactics in fraudulent employment schemes involving North Korean IT workers, linked to the NICKEL TAPESTRY threat group. These schemes involve North Korean nationals using stolen or falsified identities to secure employment at Western companies, including those in the U.S., UK, and Australia.
According to Symantec's new report, Ransomware: Threat Level Remains High in Third Quarter, ransomware continues to be a growing threat in the cyber landscape, with Symantec observing 1,255 ransomware attacks in the third quarter of 2024. One of the biggest developments observed by Symantec in Q3 of 2024 was a decline in LockBit activity, a previously dominant player in the ransomware ecosystem.
Cronus is a sophisticated ransomware strain developed using .NET technology, first reported by Seqrite. This analysis arose from the discovery of a malicious document presented as a PayPal invoice, which was submitted to VirusTotal. The investigation outlines the ransomware's method of file encryption, its persistence mechanisms, and a detailed examination of its ransom note.
North Korean threat actor ScarCruft, also known as TA-RedAnt, APT37, and several other aliases, has been linked to the exploitation of a now-patched zero-day vulnerability in Windows, identified as CVE-2024-38178 (CVSS score: 7.5). This flaw, a memory corruption issue in the Windows Scripting Engine, allowed remote code execution when using Microsoft Edge in Internet Explorer Mode. Microsoft patched the vulnerability as part of its August 2024 Patch Tuesday updates.
Fortinet FortiGuard Labs has uncovered a suspected nation-state actor exploiting a chain of three vulnerabilities impacting Ivanti Cloud Service Appliance to gain unauthenticated access to the CSA, enumerate users configured in the appliance, and further attempt to access the credentials of those users.
A newly discovered Golang ransomware variant has been found to abuse Amazon S3's Transfer Acceleration feature to exfiltrate data from victim machines to attacker-controlled S3 buckets. The ransomware samples analyzed contained hardcoded AWS credentials, which were used to create S3 buckets and enable faster data transfers through Amazon's globally distributed CloudFront edge locations.
The Federal Bureau of Investigation (FBI), the Cybersecurity and Infrastructure Security Agency (CISA), the National Security Agency (NSA), the Communications Security Establishment Canada (CSE), the Australian Federal Police (AFP), and Australian Signals Directorate's Australian Cyber Security Centre (ASD's ACSC) are releasing this joint Cybersecurity Advisory to warn network defenders of Iranian cyber actors' use of brute force and other techniques to compromise organizations across multiple critical infrastructure sectors, including the healthcare and public health (HPH), government, information technology, engineering, and energy sectors.
Security teams are increasingly recognizing large language models (LLMs) as vital business tools capable of automating various tasks, thereby allowing employees to focus on more strategic functions and potentially providing a competitive advantage.
Cofense has shared insights on a phishing campaign it detected earlier this year, where actors were observed using GitHub links to bypass email security gateways and distribute malware. These links were generated through the submission of GitHub comments, which can be added to the source code repository and may include but are not limited to proposed changes, more information from a user on an issue, or documentation.
Threat actors are exploiting the open-source EDRSilencer tool to bypass endpoint detection and response systems, according to Trend Micro researchers. Originally designed for red teaming, EDRSilencer leverages the Windows Filtering Platform to block EDR communications by identifying and filtering EDR processes, preventing them from sending alerts or telemetry.
The recent activities of Iranian state-sponsored hacking group APT34, also known as OilRig, have focused on government and critical infrastructure entities in the UAE and Gulf region. Trend Micro researchers identified a new campaign in which OilRig deployed a novel backdoor to target Microsoft Exchange servers for credential theft.
OzarksGo, a fiber ISP based in Fayetteville, Arkansas, experienced a cyber incident on October 7 that specifically targeted the servers responsible for providing linear TV service to approximately 4,500 customers in northwest Arkansas and northeast Oklahoma. Upon discovering the potential issue, the company acted promptly by deactivating the affected equipment and bringing in external experts to assess the situation and mitigate further impact.
Amateur ham radio operators have long served as vital communication links during disasters, providing essential support when conventional systems fail. Despite advancements in technology, these skilled volunteers remain prepared through training and drills, such as the Amateur Radio Emergency Service (ARES) Field Day.
Recently, Tend Micro has been tracking Earth Simnavaz (also known as APT34 and OilRig), a cyber espionage group believed to be linked to Iranian interests. This group primarily targets organizations in the energy sector, particularly those involved in oil and gas, as well as other critical infrastructure.
The FBI, NSA, CNMF, and NCSC-UK have released a joint advisory highlighting the tactics, techniques, and procedures (TTPs) employed by actors associated with the Russian Federation Foreign Intelligence Service (SVR), including APT29, Midnight Blizzard (formerly Nobelium), Cozy Bear, and the Dukes.
CISA has issued a warning that threat actors are exploiting unencrypted persistent cookies managed by the F5 BIG-IP Local Traffic Manager module. These cookies are being leveraged to conduct reconnaissance on target networks, allowing attackers to map out and enumerate non-internet-facing devices.
Ransomware gangs are actively exploiting a critical vulnerability in Veeam Backup & Replication servers, designated as CVE-2024-40711, which allows attackers to achieve remote code execution. This vulnerability was discovered by Florian Hauser, a security researcher at Code White.
Resecurity has reported a growing trend of attacks on AI conversational platforms, particularly those using Natural Language Processing and Machine Learning to simulate human-like interactions. These platforms, commonly used in industries such as finance, e-commerce, and customer support, enable personalized, automated responses to consumers.
The Internet Archive, a nonprofit digital library known for providing free access to archived websites and digital materials, has been facing a distributed denial-of-service attack for three consecutive days, severely limiting users' ability to access the site. Alongside this DDoS attack, a data breach was discovered, exposing 31 million user accounts, including email addresses, screen names, and bcrypt-hashed passwords.
A new, previously undetected loader builder, dubbed "MisterioLNK," has been identified by Cyble Research and Intelligence Labs (CRIL). This versatile tool, publicly accessible on GitHub, poses a significant threat to security defenses due to its ability to generate loader files that largely evade detection by conventional security systems.
There has been a recent increase in actors employing callback phishing to infect unsuspecting victims with malware. Callback phishing, otherwise known as telephone-oriented attack delivery (TOAD), is a hybrid phishing model (a combination of voice and phishing) that aims to take advantage of the trust people often assign to strangers who assume authority over the phone.
Mamba 2FA is an emerging phishing-as-a-service platform that targets Microsoft 365 accounts through adversary-in-the-middle attacks. It uses highly convincing phishing login pages to steal authentication tokens, bypassing multi-factor authentication protections. Priced at $250 per month, Mamba 2FA is gaining popularity due to its accessibility and effectiveness, positioning it as one of the fastest-growing phishing platforms in the market.
In the wake of Hurricane Helene and the impending arrival of Hurricane Milton on October 9th, 2024, Florida faces another threat: a myriad of cyberattacks targeting vulnerable individuals and organizations. Veriti, a cybersecurity research firm based in Israel, identified three key emerging threats exploiting the chaos and urgency surrounding hurricane relief efforts.
Summary: Barracuda threat analysts have identified a new wave of QR code phishing attacks, known as "quishing," that employ sophisticated techniques to bypass traditional security measures. These phishing attempts use QR codes generated from text-based ASCII/Unicode characters instead of conventional static images, making them difficult for optical character recognition systems to interpret.
Actors are increasingly misusing legitimate file hosting services in campaigns intended to conduct identity phishing, commonly leading to business email compromise attacks. SharePoint, OneDrive, and Dropbox are some of the common services being exploited.
Ivanti, a prominent U.S.-based IT software company, has issued critical security updates to fix three newly discovered zero-day vulnerabilities in its Cloud Services Appliance (CSA), which are being actively exploited in ongoing attacks.
Security giant ADT disclosed it suffered a breach after actors gained access to its systems using stolen credentials and exfiltrated employee account data. On Monday, ADT filed a 8-K filing with the SEC, noting that the credentials were stolen from a third-party business partner, thus enabling the actors to breach ADT systems.
Qualcomm has recently issued security updates that address nearly two dozen vulnerabilities in proprietary and open-source components within their systems. Among these vulnerabilities, one of particular concern is a high-severity flaw, identified as CVE-2024-43047, which has been actively exploited in the wild.
Secureworks' 2024 State of the Threat Report highlights a significant 30% rise in active ransomware groups over the past year, despite extensive law enforcement actions aimed at disrupting these operations. In the last 12 months, 31 new ransomware groups have emerged, shifting the landscape from a few dominant players to a more fragmented ecosystem.
Japanese tech giant Casio has recently experienced a significant cyberattack, with unauthorized access to its networks reported on October 5. This incident has led to notable disruptions in its systems, affecting various services that the company offers.
Last week, Microsoft and the U.S. Department of Justice (DOJ) announced that they seized 107 internet domains that were being used by Star Blizzard, a Russian nation-state actor. 66 of these domains were used by Star Blizzard to target over 30 civil society organizations including journalists, think tanks, and non-governmental organizations (NGOs), between January 2023 and August 2024.
A new China-aligned threat actor, dubbed CeranaKeeper, has been identified targeting governmental institutions in Southeast Asia, primarily Thailand. The group has been active since at least early 2022 and is characterized by its relentless pursuit of data exfiltration. CeranaKeeper leverages a variety of techniques and tools, including custom backdoors, exfiltration tools, and the abuse of legitimate cloud and file-sharing services like DropBox and OneDrive, to achieve its objectives.
ESET researchers uncovered a sophisticated cyberespionage campaign by the GoldenJackal APT group, targeting governmental and diplomatic entities across Europe and South Asia from 2019 to 2024. The group primarily focused on breaching air-gapped systems—networks isolated from the internet to protect highly sensitive data—using custom tools delivered via USB drives.
Researchers have identified a new botnet malware family called Gorilla or GorillaBot, which is a variant of the Mirai botnet source code. Discovered by NSFOCUS, this malware has shown significant activity between September 4 and September 27, 2024, during which it executed over 300,000 attack commands, with an average of 20,000 DDoS commands per day.
CISA released its Fiscal Year 2023 (FY23) Risk and Vulnerability Assessments (RVA) Analysis, providing a crucial look into the tactics and techniques threat actors employed to compromise critical infrastructure. The report is part of the agency's ongoing effort to improve national cybersecurity through assessments of vulnerabilities in key sectors.
A cybersecurity campaign targeting organizations in mid-September, in the U.K. and the U.S., employed Prince Ransomware, a freely available variant advertised on GitHub for educational purposes by developer “SecDbg”. The connection to Prince Ransomware was identified due to the observed sample downloading the same PNG from Imgur, and setting the PNG as the background, exactly as Prince Ransomware does in the configuration example on GitHub.
A sophisticated cyberattack targeting organizations worldwide has been uncovered by Cyble Research and Intelligence Labs (CRIL). The threat actor (TA) employed a multi-stage attack, utilizing legitimate tools such as Visual Studio Code (VS Code) and GitHub to gain unauthorized remote access to victims' machines. The attack chain's initial access is achieved through a malicious .LNK file, disguised as a legitimate setup file, which is potentially delivered to victims through spam or phishing emails.
Researchers at Cisco Talos have uncovered a financially motivated threat actor deploying a new MedusaLocker ransomware variant, dubbed “BabyLockerKZ.” First observed in late 2023, this variant distinguishes itself from the original MedusaLocker by using unique autorun keys and an additional public-private key set stored in the registry. Despite these differences, BabyLockerKZ utilizes the same chat and leak site URLs as its predecessor, marking its first identification as a MedusaLocker variant.
Check Point Research uncovered a recent mobile malware campaign exclusively targeting cryptocurrency users through a malicious Android app disguised as the legitimate WalletConnect protocol, taking advantage of its trusted name. This fake app, identified by Check Point, employed various evasion techniques including BASE64 encoding and encryption to avoid detection, deceive users, and steal their crypto assets. It achieved high visibility in Google Play Store search results through fake reviews and consistent branding, leading to over 10,000 downloads. Another malware app identified by Check Point exhibits similar features and achieved more than 5,000 downloads. Once the fake app is installed, it checks if the user isn't on a desktop, taking users to a legitimate website if they are, and then drops the MS Drainer and prompts the user to sign several transactions. The information is transmitted to a C2 server and it sends commands to MS Drainer to transfer funds to the attacker's wallet. This campaign is notable because it represents the first instance of a cryptocurrency drainer focusing exclusively on mobile device users. While the exact number of victims is unknown, over 150 users are estimated to have lost funds.
In a recent development, researchers identified significant security vulnerabilities within the OpenPrinting Common Unix Printing System (CUPS), which is a crucial component in many Linux environments. These vulnerabilities could enable attackers to execute arbitrary code remotely, potentially compromising the integrity of affected systems. Given the widespread use of CUPS in personal and enterprise settings, this poses a substantial threat to printing and document-handling workflows, highlighting the need for immediate attention from cybersecurity professionals.
A recent discovery by Datadog Security Research has unveiled a new cryptojacking campaign targeting Docker and Kubernetes, two widely used platforms for containerized development. The attackers exploit vulnerable Docker Engine APIs exposed to the internet to deploy a cryptocurrency miner on compromised containers. The campaign then utilizes additional malicious scripts to achieve lateral movement across the network, compromising other Docker hosts, Kubernetes deployments, and even SSH servers.
Law enforcement from 12 countries arrested four suspects tied to the LockBit ransomware gang, including a developer, a bulletproof hosting administrator, and two individuals linked to LockBit activities. These arrests were part of Operation Cronos, a global crackdown led by the UK National Crime Agency (NCA), which began in April 2022. A suspected LockBit developer was arrested in August 2024 at the request of French authorities, while two other individuals were arrested in the UK, one for LockBit affiliation and the other for money laundering. Additionally, Spain arrested a bulletproof hosting service administrator used by LockBit.
Last week, Texas healthcare provider UMC Health System disclosed that it detected unusual activity within its IT systems and took steps to proactively disconnect systems to contain the incident. Due to the outage, medical prescription lists are unavailable at UMC clinics. As such, patients have been advised to bring their prescriptions with them when visiting. As a precaution, UMC decided to temporarily divert incoming emergency and non-emergency patients to nearby health facilities. In an update on Monday, the healthcare giant stated that it will start accepting patients via ambulance. However, a select number of patients will still be diverted until all UMC resources are fully functional. As of writing, the investigation is still ongoing, with UMC working with third parties to determine the full scope of the incident and recover systems as soon as possible.
A critical XML external entity reference (XXE) vulnerability, tracked as CVE-2024-34102, has been exploited to compromise five percent of Adobe Commerce and Magento stores. This vulnerability, dubbed CosmicSting, has been exploited by malicious actors to gain remote code execution on vulnerable systems. The flaw was patched by Adobe on June 27th, 2024, but widespread exploitation has continued. Sansec research discovered seven different groups running large-scale campaigns utilizing this CosmicSting vulnerability.
An IT-ISAC member shared some indicators related to Lumma Stealer and it's use of Steam Workshop for C2 communications. Lumma Stealer, a subscription-based malware active since 2022, is believed to be developed by the threat actor "Shamel" under the alias "Lumma." It is promoted on dark web forums and a Telegram channel with over a thousand subscribers, and sold for as little as $250 USD. Lumma Stealer collects system data, sensitive information like cookies, passwords, credit card details, and cryptocurrency wallet data from compromised devices. The malware is typically delivered by users downloading trojanized software or opening malicious emails containing Lumma payloads.
Cloudflare has shared significant insights regarding a notable increase in the frequency and severity of Distributed Denial of Service (DDoS) attacks, particularly starting from early September. During this period, the company successfully neutralized over 100 hyper-volumetric Layer 3 and Layer 4 DDoS attacks. Many of these incidents surpassed critical benchmarks, with some exceeding 2 billion packets per second (Bpps) and reaching impressive peaks of 3 terabits per second (Tbps). One of the most alarming attacks peaked at an extraordinary 3.8 Tbps, which stands as the largest DDoS attack ever made public by any organization.
In May 2024, Ivanti released patches to address a SQL injection vulnerability in its Endpoint Manager. Tracked as CVE-2024-29824, the flaw impacts the Core server of Ivanti EPM 2022 SU5 and prior, and can be exploited by an unauthenticated attacker within the same network to execute arbitrary code. In its initial advisory, Ivanti did not have evidence to suggest that the flaw was exploited in attacks in the wild. However, the vendor recently updated the advisory stating that it is aware of in-the-wild exploitation. According to Ivanti, CVE-2024-29824 has been used against “a limited number of customers.” Details of these attacks have not been disclosed at this time. CISA recently added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, advising organizations to apply patches by October 23.
On July 25, 2024, Rim Jong Hyok, an alleged member of the North Korean threat group Stonefly (aka Andariel, APT45, Silent Chollima, Onyx Sleet), was indicted by the U.S. Justice Department for his involvement in extorting U.S. hospitals and other healthcare providers between 2021 and 2023, laundering the ransom proceeds, and then using these proceeds to fund additional cyberattacks against targets in the defense, technology, and government sectors worldwide.
Linux servers are under threat from a stealthy malware known as "perfctl," aimed at running cryptocurrency mining and proxyjacking software. This malware employs advanced evasion tactics, remaining inactive during user activity and deleting its own files to avoid detection. It exploits a vulnerability in Polkit (CVE-2021-4043) to gain root access and install the miner. The name "perfctl" is a deliberate attempt to mimic legitimate system processes. The attack typically involves exploiting vulnerable Apache RocketMQ instances to deliver the malware. Once activated, perfctl hides itself by copying to different locations and may also download additional proxyjacking tools from remote servers.
The Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), and the Department of Defense Cyber Crime Center (DC3) have released a joint advisory warning against a group of Iran-based cyber actors that has conducted a high volume of computer network intrusion attempts against U.S. and foreign organizations since 2017 and as recently as August 2024, including schools, municipal governments, financial institutions, and healthcare facilities.
A critical security vulnerability tracked as CVE-2024-6386 has been disclosed in the WPML WordPress multilingual plugin. WPML is a popular plugin used for building multilingual WordPress sites. It has over one million active installations. This vulnerability could allow authenticated users with Contributor-level access or higher to execute arbitrary code remotely under certain circumstances.
ESET researchers discovered a remote code execution vulnerability (CVE-2024-7262) in WPS Office for Windows, which was actively exploited by the South Korea-aligned cyberespionage group APT-C-60. This group targeted users in East Asian countries, leveraging the vulnerability to deploy a custom backdoor named "SpyGlace" by ESET, designed for cyberespionage purposes.
The BlackByte ransomware group has been observed likely exploiting a newly patched vulnerability (CVE-2024-37085) in VMware ESXi hypervisors, while simultaneously leveraging various vulnerable drivers to bypass security protections.
Volt Typhoon is a Chinese state-sponsored hacker group known by various aliases such as Vanguard Panda and Bronze Silhouette. Recent developments reveal that these hackers have exploited a high-severity zero-day vulnerability in the Versa Director platform, which is used by ISPs to manage complex networks.
Volt Typhoon is a Chinese state-sponsored hacker group known by various aliases such as Vanguard Panda and Bronze Silhouette. Recent developments reveal that these hackers have exploited a high-severity zero-day vulnerability in the Versa Director platform, which is used by ISPs to manage complex networks.
A significant phishing campaign has leveraged Microsoft Sway, a cloud-based platform for creating online presentations, to host malicious landing pages designed to steal Microsoft 365 credentials.
A sophisticated cyber campaign is currently targeting high-profile organizations in Southeast Asia, employing two advanced and under-the-radar techniques to infiltrate their systems.
The National Cyber Security Centre (NCSC) of Ireland is warning of a growing trend in WhatsApp verification code scams targeting users. These scams initiate with the actors obtaining the victim's phone number and entering the number into WhatsApp's login screen.
A recent discovery by Kaspersky researchers revealed a new macOS version of the HZ RAT backdoor. This backdoor specifically targets users of DingTalk, an enterprise messaging platform, and WeChat, a popular social media app, both widely used and essentially required in China.
Malicious hackers, likely backed by the Chinese government, have exploited a critical zero-day vulnerability in the Versa Director virtualization platform used by ISPs. This vulnerability, tracked as CVE-2024-39717, allowed attackers to infect at least four US-based ISPs with malware named "VersaMem," which steals customer credentials before they are encrypted.
Cybercriminals have expanded the scope of so-called highway toll text scams in recent months, targeting people across multiple states with malicious SMS messages demanding payment for fictitious charges.
Recent research has revealed critical vulnerabilities in several widely-used Python applications for Windows. These vulnerabilities could allow attackers to steal NTLM credentials, which are essential for authenticating users within Windows environments.
A previously undiscovered group, dubbed "Greasy Opal," has been found aiding cyber attackers by providing CAPTCHA-solving services and other tools to bypass security measures. This group, based in the Czech Republic and active since 2009, was recently identified by Arkose Cyber Threat Intelligence Research after its tools were used in attacks on Arkose Labs' customers.
A complex multi-stage malware campaign utilizing a newly documented memory-only dropper has been observed by Mandiant in recent investigations and published on August 22, 2024. This dropper serves as a conduit for launching subsequent-stage malware.
Meta shared insights on a small cluster of likely social engineering activity on WhatsApp that its security team was able to block after investigating user reports. This activity which originated from Iran attempted to target individuals in Israel, Palestine, Iran, the United States and the UK, focusing on political and diplomatic officials, and other public figures, including some associated with administrations of President Biden and former President Trump.
Unit 42's recent investigation uncovered a shift in strategy by the Bling Libra group, which is known for its ShinyHunters ransomware. Instead of just selling stolen data as they have in the past, they've now turned to extorting their victims. This new approach involves using legitimate credentials they found in public repositories to break into and compromise Amazon Web Services (AWS) environments.
A critical security vulnerability (CVE-2024-28000) has been identified in the LiteSpeed Cache plugin for WordPress, a widely used caching plugin with over five million active installations. This vulnerability, discovered by John Blackburn and submitted via the Patchstack Zero Day bug bounty program for WordPress, could allow unauthenticated attackers to gain administrator privileges on vulnerable WordPress websites.
Aqua Security's threat research team, Nautilus, has uncovered PG_MEM, a sophisticated new malware designed to target PostgreSQL databases. This malware exploits weak passwords by launching brute force attacks, gaining unauthorized access to databases, and delivering malicious payloads, including cryptocurrency mining software.
Chinese-language hackers are increasingly leveraging the Windows Installer MSI file format to bypass conventional security measures, marking a shift in how malware is delivered.
Ukraine's Computer Emergency Response (CERT-UA) is warning of a new phishing campaign distributing emails on the subject of ‘prisoners of war' to infect end users with malware. In this case, these emails contain photos of alleged prisoners of war from the Kursk region, urging recipients to click on a link designed to download a malicious Zip archive.
Today, Google released a new Chrome emergency security update to patch a zero-day vulnerability tagged as exploited in attacks. "Google is aware that an exploit for CVE-2024-7971 exists in the wild," the company said in an advisory published on Wednesday.
A critical vulnerability, CVE-2024-6800, was discovered in GitHub Enterprise Server by “ahacker1” through GitHub's Bug Bounty Program. This vulnerability could be exploited by an attacker with network access to bypass authentication and gain administrator privileges on the affected machine.
Based on research conducted by Barracuda Networks, which analyzed 200 reported ransomware incidents from August 2023 to July 2024, more than a fifth of these attacks targeted the healthcare sector, highlighting an 18% increase from the previous year.
A report from Malwarebytes reveals that most ransomware attacks now occur between 1 a.m. and 5 a.m., aiming to catch cybersecurity teams off guard. The 2024 State of Ransomware Report, based on threat intelligence from Malwarebytes' ThreatDown unit, indicates that a majority of incidents happen in the early morning,
A new remote access trojan called MoonPeak has been discovered, being used by a state-sponsored North Korean threat group in a recent cyber campaign. Cisco Talos has attributed this campaign to a hacking group they track as UAT-5394.
A Taiwanese university has recently been targeted by a sophisticated cyberattack involving a previously undocumented Windows backdoor named Msupedge. This malware is distinctive for its use of DNS tunneling—a technique where data is transmitted through DNS queries—to communicate with its command-and-control (C&C) server.
Yesterday, the Office of the Director of National Intelligence (ODNI), the Federal Bureau of Investigation (FBI), and the Cybersecurity and Infrastructure Security Agency (CISA) released a joint statement, highlighting Iran's longstanding interest in exploiting societal tensions, including the use of cyber operations to attempt to gain access to sensitive information related to U.S. elections.
The North Korean Lazarus hacking group exploited a zero-day vulnerability in the Windows AFD.sys driver to elevate privileges and install the FUDModule rootkit on targeted systems. Microsoft addressed this flaw, identified as CVE-2024-38193, during its August 2024 Patch Tuesday, along with seven other zero-day vulnerabilities.
A newly discovered backdoor named Msupedge has been deployed in a cyberattack against an unnamed university in Taiwan. The backdoor stands out due to its unconventional method of communicating with its command-and-control server via DNS traffic, which is a relatively rare and stealthy technique. The origins and objectives behind the Msupedge attack remain unknown.
A recent report by Kaspersky details the activities of BlindEagle, an APT group targeting Latin American entities and individuals since at least 2018. The group employs a variety of tactics, techniques, and procedures (TTPs) to achieve its objectives, which fluctuate between financial gain and espionage. BlindEagle primarily leverages phishing campaigns, often impersonating government or financial institutions, to deliver malicious payloads.
A recent ValleyRAT malware campaign targeting Chinese speakers has been identified by FortiGuard Labs. This multi-stage malware employs sophisticated evasion techniques to establish persistent control over compromised systems. Key characteristics include heavy reliance on shellcode for in-memory execution, reducing file footprint, and the use of legitimate application icons to deceive victims.
Researchers from Check Point have uncovered significant details about Styx Stealer, a new malware strain, due to a major operational security blunder by its developer. The developer leaked sensitive information from their computer, including client data and earnings, which Check Point used to gain insight into the malware's operation.
Researchers have uncovered new infrastructure linked to the financially motivated cybercrime group FIN7. This discovery, detailed in a report by Team Cymru in collaboration with Silent Push and Stark Industries Solutions, reveals two clusters of FIN7 activity connected to IP addresses from Post Ltd in Russia and SmartApe in Estonia.
Sophos uncovered details on a new ransomware operation dubbed Mad Liberator, which uses social engineering to obtain access to victim environments, targeting users who use remote access tools installed on endpoints and servers. Since initiating operations in mid-July, 2024. Mad Liberator has been observed targeting users of Anydesk, a popular software used by IT teams to manage their environments, particularly when working with remote users and devices.
Malicious actors are increasingly using a cloud-based attack tool called Xeon Sender to conduct widespread smishing and spam campaigns by abusing legitimate software-as-a-service (SaaS) platforms. The tool, as noted by SentinelOne security researcher Alex Delamotte, allows attackers to send bulk SMS messages through multiple SaaS providers by using valid credentials for those services. Importantly, Xeon Sender doesn't exploit any inherent vulnerabilities in these providers but instead uses their legitimate APIs to carry out large-scale SMS spam attacks.
A recent surge in malware infections has been attributed to malvertising campaigns targeting users seeking popular business software such as Brave, KeePass, Notion, Steam, and Zoom. The attack vector involves trojanized MSIX installers, which execute PowerShell scripts upon installation of the booby-trapped software to download secondary payloads.
Elastic Security Labs has uncovered a new stealer malware dubbed Banshee Stealer designed to target Apple macOS systems. Banshee Stealer is currently advertised on cybercriminals forums for a price tag of $3,000 per month. The stealer is capable of targeting a wide range of browsers, cryptocurrency wallets, and approximately 100 browser extensions.
Researchers have exposed a sophisticated cybercrime campaign, codenamed "Tusk," orchestrated by Russian-speaking cybercriminals. This campaign is notable for its strategic impersonation of legitimate brands to distribute various forms of malware, including DanaBot and StealC, through a series of interconnected sub-campaigns.
Unit 42 researchers uncovered a highly sophisticated extortion campaign that specifically targeted cloud environments by exploiting exposed environment variable files, commonly referred to as .env files. These files, which are often used to store sensitive information such as cloud service keys, API tokens, and database credentials, were inadvertently exposed due to misconfigurations in web servers and applications.
A recent ransomware attack targeting India's National Payments Corporation (NPCI) has been linked to a flaw in Jenkins, a popular automation tool. The security weakness, known as CVE-2024-23897, was found in Jenkins' Command Line Interface, enabling unauthorized access to sensitive data on servers that hadn't been updated with the latest security patches.
A recent discovery by security researchers at Sonatype, published on August 7th, 2024, highlights a new malicious package on the Python Package Index (PyPI) masquerading as a legitimate Solana blockchain library, "solana-py". This fake package leverages a typosquat technique, exploiting the slight naming discrepancy between the genuine "solana-py" project on GitHub and its simplified name "solana" on PyPI.
On August 8, 2024, Evolution Mining, a prominent Australian gold mining firm, experienced a ransomware attack that impacted its IT systems. The company has engaged external cyber forensic experts to investigate the incident, which is currently believed to be contained. While the attack disrupted IT operations, it is not anticipated to significantly impact overall mining operations.
HUSKY, a products filter plugin for the e-commerce product plugin WooCommerce, developed by “realmag777” which enhances the functionality of the base WooCommerce product for WordPress. Around 478 million websites are built on WordPress. It empowers your website visitors to easily search and filter WooCommerce products based on: categories, attributes, tags, taxonomies, meta fields, and product prices.
In this report, they delve into WormGPT—a Dark Web counterpart to ChatGPT, which is designed to quickly generate phishing emails, malware, and harmful recommendations for hackers. Despite its alarming reputation, many of the concerns surrounding WormGPT are rooted in misunderstandings and exaggerations about AI-based hacking applications.
The Inc ransomware group recently carried out a significant cyberattack on McLaren Health Care, a multibillion-dollar healthcare network operating across Michigan, Indiana, and Ohio. The attack severely disrupted McLaren's IT and phone systems, forcing hospitals and outpatient clinics to implement "downtime procedures."
The China-backed cyber espionage group known as Earth Baku, associated with APT41, has significantly expanded its scope of operations beyond its traditional focus on the Indo-Pacific region.
Wiz Threat Research has shed light on a new phishing campaign targeting AWS accounts. The campaign was spotted after an employee at Wiz received a phishing email containing a PNG image. The email was sent from an AWS account (likely compromised) using a spoofed email address -admin@alchemistdigital[.]ae.
On August 14, 2024, Microsoft issued patches for six actively exploited vulnerabilities as part of its regular Patch Tuesday updates. These flaws affect Microsoft Project, various Windows products, and the Windows Scripting Engine. Notably, one high-severity vulnerability in Microsoft Project (CVE-2024-38189) could allow remote code execution if a victim opens a malicious file.
X (formerly Twitter) and Elon Musk's xAI are facing criticism for allegedly using the personal data of over 60 million EU users without consent to train the conversational AI chatbot, Grok. The European privacy group NOYB has filed GDPR complaints in nine countries, claiming X's practices violate EU data protection laws.
Non-profit organization MITRE announced a call for intelligence contributions for ATT&CK evaluations addressing ICS (industrial control systems) to enrich its emulation. The enhanced insight from contributors enables a more holistic emulation approach that reflects the breadth of adversary behaviors.
Researchers at ReasonLabs have uncovered details of a ongoing widespread malware campaign that is forcefully installing malicious browser extensions on targeted endpoints. To date, ReasonLabs has observed atleast 300,000 impacted users across Google Chrome and Microsoft Edge.
Attackers can leverage a critical flaw associated with the 0.0.0.0 IP address to remotely execute code on major web browsers, including Chrome, Safari, and Firefox. This vulnerability exposes users to risks such as data theft, malware installation, and other malicious activities.
Microsoft has revealed a critical, unpatched zero-day vulnerability in Office that could lead to the unauthorized disclosure of sensitive information if successfully exploited.
A co-founder of transparency activism organization Distributed of Denial of Secrets (DDoSecrets) was a dark web drug kingpin who ran the successor to the infamous Silk Road marketplace and was later convicted of child abuse imagery crimes.
Data exfiltration has become a key component in double extortion ransomware attacks, which are now a prevalent method used by cybercriminals. According to a new report by ReliaQuest, the top three tools used for data exfiltration between September 2023 and July 2024 are Rclone, WinSCP, and cURL.
Iran-linked threat actors are accelerating their malicious online activity intending to influence the United States presidential election by capitalizing on political polarization via TTPs such as creating fake news websites that target extremists, impersonating U.S. political activists, performing email phishing attacks from former political advisors, and making attempts to successfully log into an account belonging to a former presidential candidate, all to stoke division and political tension, especially in swing states where they potentially have the most influence.
Security giant ADT has confirmed that it suffered a data breach after actors allegedly leaked stolen customer data on Breached Forums, a popular cybercriminal platform. In a form 8-K filing with the Securities and Exchange Commission (SEC), ADT stated that it recently “experienced a cybersecurity incident during which unauthorized actors illegally accessed certain databases containing ADT customer order information.”
The U.S. Justice Department arrested Matthew Isaac Knoot, a 38-year-old Nashville man, for aiding North Korean IT workers in obtaining remote work at U.S. companies by posing as U.S.-based individuals. Knoot operated a "laptop farm," using stolen identities, including that of "Andrew M.," to deceive companies into sending laptops to his residence.
The CrowdStrike update from July, which caused significant disruptions across industries, has led to a flurry of lawsuits from investors and affected companies. This update, known as "Channel File 291," resulted in major operational issues, including crashes on 8.5 million computers, with damages estimated at $5.4 billion.
CISA and the FBI have updated a joint advisory released back in March 2023 on the Royal ransomware group, highlighting that the gang has now rebranded into the BlackSuit operation. BlackSuit which is an evolution of the Royal ransomware, has been observed in attacks from September 2022 through June 2023 and shares numerous code similarities with Royal ransomware while exhibiting improved capabilities.
Previous analyses of ICS exposure have focused on the automation protocols themselves, recent research explored the exposure of HMIs and web administration interfaces, which often reveal location information and other identifying details.
Researchers have detailed activities of the North Korean APT group Kimsuky, which has been targeting universities globally for espionage. Active since 2012, Kimsuky primarily targets South Korean entities but has extended its reach to the US, the UK, and Europe. The group specializes in sophisticated phishing campaigns, often impersonating academics or journalists to steal sensitive information.
A phishing campaign leveraging Google Drawings and WhatsApp URL shorteners to evade detection and compromise user accounts has been identified by security researchers at Menlo Security. The attack commences with a phishing email directing recipients to a seemingly legitimate Amazon account verification link hosted on Google Drawings.
In April, FortiGuard Labs uncovered a sophisticated attack using multiple layers of obfuscation and evasion techniques to distribute VenomRAT via ScrubCrypt. This campaign extended beyond VenomRAT, deploying additional malware through a plugin.
Researchers have discovered critical flaws in software that manages 20% of the world's solar electricity, posing significant risks of grid overloads and blackouts. Although solar power currently represents a minor share of U.S. electricity generation, it is projected to grow exponentially and potentially make up half of domestic electricity generation by 2050.
Reputation-based security controls may not be as effective as commonly assumed in protecting organizations against unsafe web applications and content, according to a new study by Elastic Security. Researchers have identified several techniques attackers use to bypass these mechanisms, which rely on the reputation and trustworthiness of applications and content.
A path traversal vulnerability that leads to a critical and unauthenticated remote code execution (RCE) vulnerability, identified as CVE-2024-4885 reported on April 24th, 2024, affecting Progress WhatsUp Gold versions 23.1.2 and earlier has been actively exploited by threat actors since August 1, 2024. Zero Day Initiative (ZDI) publish a related advisory on July 3rd, 2024.
In the past year, there has been an increase in the number of threat actors leveraging legitimate cloud services in attacks. According to researchers at Symantec, trusted services like Microsoft OneDrive or Google Drive are frequently being abused given that traffic to and from such services is less likely to raise red flags than communications with attack-controlled infrastructure.
CrowdStrike has released a root cause analysis for the Falcon Sensor software update crash, which impacted millions of Windows devices globally. The incident, identified as "Channel File 291," was caused by a content validation issue linked to a new Template Type designed to enhance visibility into novel attack techniques.
Qualys' new 2024 Midyear Threat Landscape Review highlights a growing number of reported Common Vulnerabilities and Exposures (CVEs). From January to mid-July 2023-2024, the annual count of reported CVEs increased by 30%, from 17,114 in 2023 to 22,254 in 2024.
Cybersecurity researchers at Aqua Nautilus have identified a new Distributed Denial of Service attack called “Panamorfi,” which exploits misconfigured Jupyter Notebooks. This attack targets data scientists and engineers using these notebooks, which are widely employed for data analysis and visualization.
Evasive Panda, also known as Bronze Highland, Daggerfly, and StormBamboo, is a China-linked cyber espionage group active since at least 2012. In mid-2023, they compromised an unnamed ISP to deliver malicious software updates to target companies, showcasing their sophisticated tactics.
A sophisticated phishing campaign, linked to the Russian state-sponsored threat actor Fighting Ursa (APT28), targeted diplomatic personnel earlier this year was reported by Palo Alto Network's Unit 42. This operation employed a deceptive lure centered around a purported car sale that often resonates with diplomats, designed to entice victims into downloading a malicious ZIP archive.
Millions of nearly undetectable phishing emails impersonating well-known companies spread daily in the first half of 2024 due to certain features in Microsoft 365 and Proofpoint's email protection service.
Enterprise Resource Planning (ERP) software is crucial for managing human resources, accounting, shipping, and manufacturing within enterprises. These systems often become complex and difficult to maintain due to extensive customization, complicating the patching process.
Proofpoint is warning of an increase in malware infections delivered through Cloudflare's TryCloudflare, a feature that allows an actor to create a one-time tunnel without creating a Cloudflare account.
Researchers at Infoblox and Eclypsium have collaborated to uncover a sophisticated new attack vector within the Domain Name System (DNS), dubbed the Sitting Ducks attack. This discovery came while studying the infrastructure used by 404TDS, a Russian-hosted traffic distribution system, indicating the involvement of Russian-nexus cybercriminals.
OneBlood, the not-for-profit blood center serving much of the southeastern United States, stated that it is experiencing a ransomware event impacting its software system. While OneBlood remains operational and continues to collect, test, and distribute blood, the non-profit noted that it is operating at a significantly reduced capacity.
The Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure Security Agency (CISA) have issued a joint advisory warning of Denial of Service (DDoS) attacks on election infrastructure, or adjacent infrastructure that support election operations, as the 2024 U.S. general election approaches closer.
Security researchers have identified a sophisticated information-stealing fraud network, dubbed “Eriakos,” that lures victims to fake web shops through malicious Facebook ads. According to Recorded Future, this campaign exclusively targets mobile devices and users, making the scam websites accessible only via malvertising to evade security scanners.
DigiCert, a certificate authority, has announced that it will revoke a subset of SSL/TLS certificates within 24 hours due to an oversight in verifying domain ownership. The affected certificates lack proper Domain Control Validation. DigiCert validates domain control by methods approved by the CA/Browser Forum, one of which involves setting up a DNS CNAME record with a random value provided by DigiCert.
A new malicious campaign has been observed utilizing Android apps to steal users' SMS messages since at least February 2022 as part of a large-scale operation. These malicious apps, numbering over 107,000 unique samples, are designed to intercept one-time passwords (OTPs) used for online account verification, leading to identity fraud.
The ongoing malware campaign targeting software developers has expanded its focus to Windows, Linux, and macOS systems. Known as DEV#POPPER and linked to North Korea, the campaign targets victims in South Korea, North America, Europe, and the Middle East.
On July 30th, 2024, a distributed denial-of-service (DDoS) attack triggered a service disruption impacting a subset of Microsoft 365 and Azure customers globally. The outage, lasting approximately eight hours between 11:45 UTC and 19:43 UTC, resulted in intermittent errors, timeouts, and latency spikes for affected users.
Black Basta is a ransomware-as-a-service (RaaS) operation that has been active since April 2022. To date, the ransomware gang has been attributed to over 500 attacks targeting organizations across the world. Just this year, the group claimed responsibility for attacks against a couple of notable victims including Veolia North America, Hyundai Motor Europe, and Keytronic.
Ukraine's Computer Emergency Response Team (CERT-UA) in a new alert stated that it recorded a surge in activity of the UAC-0057 (Aka GhostWriter) group between July 12 to 18, 2024.
Walmart's Cyber Intelligence Team has discovered an unknown PowerShell backdoor alongside a new variant of the Zloader/SilentNight malware. The PowerShell backdoor is designed to provide actors further access through reconnaissance activities and deploy additional malware.
A recent cyberattack targeting Israeli companies has been attributed to the Iranian threat actor, Handala. The campaign leveraged the CrowdStrike outage as a pretext to distribute malicious software.
Cybersecurity experts are warning about an ongoing campaign exploiting internet-exposed Selenium Grid services for unauthorized cryptocurrency mining. Wiz, a cloud security firm, is tracking this activity as SeleniumGreed, which has been targeting outdated Selenium versions (3.141.59 and earlier) since April 2023.
A hacktivist group, USDoD, has claimed to have leaked CrowdStrike's internal threat actor list, including indicators of compromise (IoCs). CrowdStrike acknowledged these claims in a blog post on July 25, 2024, noting that USDoD provided a download link for the alleged list and shared sample data on BreachForums.
A targeted cyberattack from an unfamiliar threat actor leveraging the recent CrowdStrike Falcon Sensor update incident has been identified. This threat actor is distributing malicious installers disguised as legitimate CrowdStrike software to targeted German-based organizations.
According to Cisco Talos's new Quarterly Trends report, business email compromise (BEC) and ransomware were the top threats in the second quarter of 2024, accounting for 60 percent of security incidents. Notably, technology was the most targeted vertical in Q2 2024, accounting for 24 percent of engagements, highlighting a 30 percent increase compared to Q1.
French authorities launched a major operation to clean the country's computer systems of malware believed to have affected several thousand users, “particularly for espionage purposes,” Paris's top prosecutor announced shortly before the start of the Olympics.
Researchers at Trend Micro have uncovered a new Linux variant of the Play ransomware that is specially designed to target VMWare ESXi environments. Based on a sample submitted to VirusTotal, the Linux variant is compressed in an RAR file with its Windows variant and is hosted in the URL hxxp://108.[BLOCKED].190/FX300.rar, a domain that has been used to host tools like PsExec, NetScan, WinSCP, WinRAR, and the Coroxy backdoor, which have been used by Play actors in previous attacks.
A now-patched Microsoft Defender SmartScreen vulnerability (CVE-2024-21412) has been exploited to deliver information stealers like ACR Stealer, Lumma Stealer, and Meduza Stealer. This vulnerability allowed attackers to bypass SmartScreen warnings and deliver malicious payloads. The stealer campaign is targeting Spain, Thailand, and the US. The attack chain involves a series of intricately crafted files.
The Department of Homeland Security (DHS) has acquired a dog-like robot called NEO that can overload people's home networks in an attempt to disable any internet of things (IoT) devices they have.
A financially motivated threat actor based in Latin America (LATAM), codenamed FLUXROOT, has been leveraging Google Cloud serverless projects to conduct credential phishing campaigns, underscoring the misuse of cloud computing for nefarious activities.
Last Friday, at 04:09 UTC, CrowdStrike automatically pushed out a configuration update (Channel File) to Windows systems for its endpoint detection and response solution, Falcon sensor.
ESET researchers discovered a critical zero-day vulnerability on June 26th, 2024 named EvilVideo in Telegram for Android versions up to 10.14.4 being sold on an underground cybercriminal forum.
A recent discovery by security researchers at PayPal revealed multiple vulnerabilities in numerous email-hosting platforms that attackers are exploiting to forge emails from trusted organizations.
CrowdStrike is aware of reports of crashes on Windows hosts that have taken place after installing the latest update for CrowdStrike Falcon Sensor. CrowdStrike says that it has identified a content deployment related to this issue and reverted those changes.
Researchers have identified a cybercriminal group known as Revolver Rabbit, which has registered over 500,000 domain names for infostealer campaigns targeting Windows and macOS systems. This operation relies on registered domain generation algorithms, enabling the automated registration of numerous domain names quickly.
CrowdStrike is aware of reports of crashes on Windows hosts that have taken place after installing the latest update for CrowdStrike Falcon Sensor. CrowdStrike says that it has identified a content deployment related to this issue and reverted those changes.
A new report by the Identity Theft Resource Center (ITRC), H1 2024 Data Breach Analysis, highlights a 1000% increase in the number U.S. data breach victims in Q2 2024, despite an overall 12% decrease in the actual number of incidents in those three months.
Security researchers have uncovered a new variant of BeaverTail, an infostealer malware that has been associated with the Democratic People's Republic of Korea (DPRK). BeaverTail was first documented by Palo Alto Networks Unit 42 in November 2023.
Unknown threat actors, tracked by Recorded Future's Insikt Group under the temporary moniker TAG-100, have been leveraging open-source tools in a suspected cyber espionage campaign targeting global government and private sector organizations.
ESET researchers unearthed a malicious program called HotPage that poses as an ad blocker. HotPage dupes users by promising to eliminate ads and malicious websites. However, it surreptitiously installs a kernel driver that grants attackers unrestricted access to run any code on a compromised Windows machine.
This report details the activities of the financially motivated threat actor FIN7. FIN7 has been observed using multiple pseudonyms across various underground forums to advertise a security-bypassing tool known as AvNeutralizer. AvNeutralizer has been used by multiple ransomware groups, including Black Basta.
A China-linked threat actor, APT17, has been observed targeting Italian companies and government entities using a variant of the known malware 9002 RAT. According to an analysis published last week by Italian cybersecurity company TG Soft, the attacks took place on June 24 and July 2, 2024.
A China-linked threat actor, APT17, has been observed targeting Italian companies and government entities using a variant of the known malware 9002 RAT. According to an analysis published last week by Italian cybersecurity company TG Soft, the attacks took place on June 24 and July 2, 2024. I
The SEXi ransomware operation, notorious for targeting VMware ESXi servers, has rebranded as APT INC and has attacked numerous organizations. Since February 2024, the attackers have employed the leaked Babuk encryptor for VMware ESXi servers and the leaked LockBit 3 encryptor for Windows systems.
According to Cloudflare's 2024 Application Security report, threat actors are increasingly quick to weaponize available proof-of-concept (PoC) exploits, sometimes within just 22 minutes of their public release. Covering activity from May 2023 to March 2024, the report highlights several emerging threat trends.
A critical remote code execution vulnerability (CVE-2024-27348, CVSS: 9.8) impacting Apache HugeGraph-Server versions before 1.3.0 has been actively exploited in the wild. The flaw resides in the Gremlin graph traversal language API and allows attackers to bypass security restrictions and gain complete control over vulnerable servers.
Researchers at Check Point have disclosed details of a new backdoor implant dubbed BugSleep that is actively being deployed in attacks by MuddyWater, an Iranian state-sponsored group, to steal files of interest and run commands on compromised systems. These attacks entail the use of phishing emails disguised as invitations to webinars or online courses, designed to redirect targets to archives containing malicious payloads hosted on the Egnyte secure file-sharing platform.
Last Wednesday, a critical vulnerability was patched in Exim, a free mail transfer agent (MTA) that's widely used on Unix-like operating systems. Tracked as CVE-2024-29929, the vulnerability pertains to an incorrect parsing of multiline RFC2231 header filenames, allowing threat actors to remotely deliver malicious executable attachments into end users' mailboxes by circumventing the $mime_filename extension-blocking protection mechanism.
A recent campaign observed by Trustwave researchers utilized Facebook advertisements and hijacked business pages to distribute the SYS01 information-stealing malware. The threat actors disguised the malware as free downloads for popular software, games, and Windows themes.
Microsoft has reported that the Scattered Spider cybercrime gang, also known as Octo Tempest, UNC3944, and 0ktapus, has added Qilin ransomware to its arsenal and is now using it in attacks. In the second quarter of 2024, Octo Tempest, a financially motivated threat actor, incorporated RansomHub and Qilin into its ransomware campaigns.
Summary: Cybereason Security Service Team has released a new blog post highlighting the TTPs employed by HardBit, a ransomware operation that first emerged in October 2022. HardBit seems to take inspiration from the LockBit ransomware gang, with researchers noting a similarity in the marketing tactics deployed by the group including the use of similar group image/icons, image fonts, and ransom notes.
The APT group Void Banshee has been exploiting a newly disclosed security flaw in the Microsoft MHTML browser engine CVE-2024-38112 to deploy the information-stealing malware Atlantida. Cybersecurity firm Trend Micro observed this activity in mid-May 2024, noting that the vulnerability was used in a multi-stage attack involving specially crafted internet shortcut (URL) files.
The article illuminates the intricate web of the cybercriminal ecosystem, with a particular focus on the role of infostealer malware. This kind of malware acts as a digital pickpocket, discretely extracting valuable data from compromised systems. The cybercriminal landscape has undergone a transformation, evolving from solitary actors taking care of the entire process, to a highly specialized marketplace where various threat groups collaborate to maximize their illicit gains, embodying a free market economic system.
Cybercriminals are exploiting legitimate URL protection services to disguise phishing links, according to Barracuda researchers. These services, intended to protect users from malicious websites by rewriting URLs, are being misused to mask phishing URLs and direct victims to credential-harvesting sites.
The recent DarkGate malware campaign, uncovered by Palo Alto Networks Unit 42, highlights a brief yet impactful exploitation of Samba file shares for malware distribution. Spanning March to April 2024, the campaign targeted regions across North America, Europe, and parts of Asia, utilizing Visual Basic Script (VBS) and JavaScript files hosted on public-facing servers.
ANY.RUN, an interactive malware hunting service, warned on X (formerly known as Twitter) of a massive phishing campaign that is abusing SharePoint to store PDFs containing phishing links. In a span of 24 hours ANY.RUN says it observed over 500 public sandbox sessions with SharePoint phishing.
A recent U.S. Department of Justice (DoJ) operation dismantled a large-scale Russian disinformation campaign utilizing AI-powered social media bots. The bot farm, targeting the U.S. and several other countries, employed fictitious online personas disguised as real users to spread pro-Kremlin messages. The operation, believed to be sponsored by the Kremlin and facilitated by an RT employee and an FSB officer, leveraged AI software called Meliorator to create and manage the bot network.
*Severity - Medium: High severity vulnerability exploited to deploy ransomware. This vulnerability has been patched by Veeam and can be eliminated by updating the software. Initial access is acquired without any victim interaction. Attackers utilize methods to avoid detection and hinder forensics efforts following an attack*
Japan's Computer Emergency Response Team Coordination Center (JPCERT/CC) has published a blog post warning about attacks targeting Japanese organizations by a North Korean APT group called Kimsuky.
Multiple threat actors are exploiting the recently disclosed PHP vulnerability CVE-2024-4577 to deliver various malware families, according to the Akamai Security Intelligence Response Team. This vulnerability, which has a CVSS score of 9.8, is a PHP-CGI OS Command Injection flaw in the Best-Fit feature of encoding conversion within the Windows operating system.
China-linked APT41 is suspected of using an advanced version of StealthVector malware, dubbed DodgeBox, to deliver a new backdoor named MoonWalk. Zscaler ThreatLabz discovered DodgeBox, also known as DUSTPAN, in April 2024. Researchers Yin Hong Chang and Sudeep Singh explained that DodgeBox loads MoonWalk, which shares DodgeBox's evasion techniques and uses Google Drive for command-and-control communication.
Ransomware attackers are increasingly focusing on defense evasion tactics to extend their dwell time within victim networks, as highlighted in a new report by Cisco Talos. This shift is primarily driven by the double-extortion ransomware model, where attackers steal sensitive data and threaten to publish it online while locking down victims' systems.
Russian state-sponsored media organization RT, formerly known as Russia Today, has used AI-powered software called Meliorator to create realistic social media personas for spreading disinformation over the past two years.
A new vulnerability, designated CVE-2024-6409 (CVSS score: 7.0), has been discovered in OpenSSH versions 8.7p1 and 8.8p1, specifically those shipped with Red Hat Enterprise Linux 9 (RHEL 9). The current versions of RHEL 7 and RHEL 8 are safe.
Symantec recently published a security bulletin warning about a phishing campaign targeting Apple users in the United States. These campaigns are mostly conducted via email but have increasingly been deployed via malicious SMS text messages (smishing).
A critical vulnerability (CVE-2024-3596) has been identified in the RADIUS protocol, a widely used network authentication system. Dubbed "BlastRADIUS," the flaw allows attackers to potentially bypass security checks and gain unauthorized access to a network.
Beginning in March 2024, law enforcement organizations have been distributing decryptor keys to victims of the DoNex ransomware, according to Avast. The antivirus provider announced on July 8 that they have been quietly offering the decryptor after identifying a cryptographic flaw in the ransomware and its predecessors.
Cybersecurity agencies from Australia, Canada, Germany, Japan, New Zealand, South Korea, the U.K., and the U.S. have issued a joint advisory about the China-linked cyber espionage group APT40, warning of its ability to exploit new security vulnerabilities within hours or days of their public release. APT40, also known by various aliases such as Bronze Mohawk, Gingham Typhoon, ISLANDDREAMS, Kryptonite Panda, Leviathan, Red Ladon, TA423, and TEMP.Periscope, has been active since at least 2013, primarily targeting organizations in the Asia-Pacific region.
A recent surge in attacks by the Mekotio banking trojan has been identified, particularly targeting financial institutions in Latin America since at least 2015. This malware primarily targets users in Brazil, Chile, Mexico, Spain, Peru, and Portugal with the intention of stealing banking credentials.
A major South Korean internet service provider, KT (formerly Korea Telecom), is facing serious allegations after reports surfaced that it installed malware on the computers of over 600,000 customers. The incident primarily targeted users of Webhard, a popular file-sharing service in South Korea.
Researchers have uncovered a sophisticated attack campaign targeting various Israeli entities using publicly available frameworks like Donut and Sliver. HarfangLab, a French cybersecurity firm, detailed the campaign, noting its highly targeted nature and the use of custom WordPress websites as payload delivery mechanisms. This campaign affects entities across unrelated verticals by leveraging well-known open-source malware.
Cyber extortion is rapidly increasing, with a 77% year-on-year growth in victims, according to Orange Cyberdefense (OCD). In its Cy-Xplorer 2024 report, OCD identified 60 distinct ransomware groups responsible for 4,374 victims from Q1 2023 to Q1 2024.
Researchers have uncovered a sophisticated attack campaign targeting various Israeli entities using publicly available frameworks like Donut and Sliver. HarfangLab, a French cybersecurity firm, detailed the campaign, noting its highly targeted nature and the use of custom WordPress websites as payload delivery mechanisms. This campaign affects entities across unrelated verticals by leveraging well-known open-source malware.
A new report by Sekoia highlights an increasing trend in cybercriminals distributing malware via drive-by-download, a technique that typically employs SEO-poisoning, malvertising, and code injection into compromised websites to trick users into downloading fake software installers or browser updates.
A recent attack campaign exploited a now-patched vulnerability (CVE-2021-40444) in Microsoft Office's MSHTML component to deliver MerkSpy spyware. This spyware primarily targeted users in Canada, India, Poland, and the U.S. The attackers meticulously crafted a deceptive Microsoft Word document disguised as a software developer job description to trick users into initiating the exploit.
Censys reports that over 380,000 internet-exposed hosts still reference JavaScript scripts from the recently suspended polyfill[.]io domain. Originally used to provide modern functionality in older browsers, polyfill[.]io was suspended after redirecting visitors to betting and adult sites.
On June 18th, CDK Global, a leading software-as-a-service provider that is used by over 15,000 car dealerships across North America, was the target of a ransomware attack, causing a massive IT outage. In particular, CDK Global's dealer management system was impacted, forcing car dealerships to switch to pen and paper, with buyers unable to purchase cars or receive service for already-bought vehicles.
A financially motivated East European threat actor known as "Unfurling Hemlock" has been employing a sophisticated technique akin to a cluster bomb to deploy up to ten unique malware files simultaneously on systems in the US, Germany, Russia, and other countries.
Cisco has patched a zero-day vulnerability in NX-OS that was exploited in April to install previously unknown malware on vulnerable switches. The cybersecurity firm Sygnia reported the incidents to Cisco, attributing the attacks to a Chinese state-sponsored threat actor, Velvet Ant. Amnon Kushnir, Director of Incident Response at Sygnia, revealed that Velvet Ant used administrator-level credentials to access Cisco Nexus switches and deploy custom malware.
A North Korean APT group, Kimsuky, was discovered using a malicious Google Chrome extension codenamed TRANSLATEXT to target South Korean academia focused on North Korean affairs in March 2024. Kimsuky is a notorious hacking crew from North Korea that's known to be active since at least 2012, orchestrating cyber espionage and financially motivated attacks targeting South Korean entities.
On June 20th, one of Indonesia's temporary National Data Centers suffered from a cyberattack that led to the encryption of the government's servers and disruption of immigration services, passport control, issuing of event permits, and other online services.
BleepingComputer has confirmed that the helpdesk portal of Canadian router manufacturer Mercku has been compromised and is sending MetaMask phishing emails in response to new support tickets. Mercku supplies equipment to several ISPs and networking companies, including Start.ca, FibreStream, Innsys, RealNett, Orion Telekom, and Kelcom.
Fake IT support sites are exploiting common Windows errors like the 0x80070643 error to distribute information-stealing malware through malicious PowerShell "fixes." These sites, identified by eSentire's Threat Response Unit, gain legitimacy by being promoted on compromised YouTube channels.
A critical vulnerability (CVE-2024-6387), dubbed regreSSHion, has been identified in OpenSSH servers, potentially affecting over 14 million instances exposed on the internet. This remote unauthenticated code execution flaw allows attackers to compromise systems, leading to full system control, malware installation, data manipulation, creation of backdoors, and network propagation.
TeamViewer, a prominent developer of remote monitoring and management (RMM) software, reported a breach of their corporate network this week. The company attributes the attack to Midnight Blizzard, a Russian state-sponsored hacking group also known as APT29, Nobelium, or Cozy Bear.
Multiple security vulnerabilities have been identified in Emerson Rosemount gas chromatographs, potentially allowing attackers to access sensitive information, cause denial-of-service (DoS) conditions, and execute arbitrary commands. The affected models include GC370XA, GC700XA, and GC1500XA, with versions 4.1.5 and earlier. Claroty, an operational technology (OT) security firm, highlighted two command injection flaws and two authentication and authorization vulnerabilities.
Apple recently released a firmware update to address a critical vulnerability (CVE-2024-27867) affecting various AirPods models (2nd generation and later), AirPods Pro (all models), AirPods Max, Powerbeats Pro, and Beats Fit Pro. This authentication issue could have allowed a malicious actor within Bluetooth range to impersonate a trusted device and gain unauthorized access to the targeted AirPods.
A critical security flaw in Fortra FileCatalyst Workflow, tracked as CVE-2024-5276 with a CVSS score of 9.8, has been disclosed. This SQL injection vulnerability affects versions 5.1.6 Build 135 and earlier and allows attackers to modify application data, potentially creating administrative users or altering and deleting database information.
The LockBit ransomware group falsely claimed to have breached the Federal Reserve and stolen 33 terabytes of sensitive banking information. This claim was debunked, revealing that LockBit had actually targeted Evolve Bank & Trust.
Ahnlab Security Intelligence Center (ASEC) has released details of a backdoor that they first identified in 2021 and have closely monitoring since then. Dubbed, Happydoor, the backdoor is attributed to the North Korean APT group Kimsuky and has been deployed in several breaches in the last couple of years.
Suspected Chinese and North Korean threat actors have been linked to ransomware and data encryption attacks targeting global government and critical infrastructure sectors between 2021 and 2023, according to a joint report by cybersecurity firms SentinelOne and Recorded Future shared with The Hacker News.
MITRE Engenuity recently conducted an ATT&CK Evaluation focusing on managed security services, where Trend achieved a perfect 100% detection rate across all 15 critical steps. The evaluation simulated a sophisticated attack scenario involving menuPass (APT10) and ALPHV/BlackCat ransomware.
A vulnerability in Progress Software's MOVEit Transfer platform, CVE-2024-5806, allows attackers to authenticate as any valid user, gaining corresponding privileges. This vulnerability which has a CVSS score of 9.1 is actively being exploited just hours after its public disclosure.
In May 2024, researchers at Cleafy uncovered new campaigns distributing the Medusa banking trojan, which has managed to retain a low profile for the past year. Notably, these campaigns entail the use of new Medusa samples that are more light-weight and require fewer permissions than previous variants of the trojan.
The French National Cybersecurity Agency (ANSSI) reported a concerning rise in cyber threats throughout 2023. This coincides with ongoing geopolitical tensions and major international events planned for France in 2024.
The analysis highlights a growing trend where cybercriminals are leveraging cloud services to enhance the capabilities of botnets like UNSTABLE and Condi. These botnets exploit vulnerabilities in various devices to establish command and control (C2) operations through cloud servers, which provides scalability and anonymity that traditional hosting methods lack.
Checkpoint has identified several threat actors including a cyber espionage group dubbed APT-C-35, aka DoNot Team, leveraging an Android open-source administration tool called Rafel in attacks to gain remote access and exfiltrate data of interest from victims' devices.
On June 24th, in Jakarta, Indonesia, the country's national data center experienced a significant cyber attack, as reported by Reuters. The attack had widespread repercussions, particularly disrupting immigration procedures at airports nationwide.
The Lockbit ransomware group recently declared that it had successfully breached the US Federal Reserve, exfiltrating a staggering 33 TB of sensitive data, purportedly including confidential banking secrets of American citizens.
RedJuliett, a likely Chinese state-sponsored hacking group, conducted a cyber espionage campaign targeting Taiwan and other countries from November 2023 to April 2024, according to Recorded Future's Insikt Group. The group compromised 24 organizations, including government agencies in Taiwan, Laos, Kenya, and Rwanda.
According to Recorded Future, the RansomHub operation has been using a Linux encryptor since April 2024 to specifically target VMware ESXi environments in corporate attacks. The ESXi version of RansomHub's encryptor is developed in the C++ programming language and was likely derived from the now-defunct Knight ransomware's source code.
A critical vulnerability (CVE-2024-28995) in SolarWinds Serv-U file transfer software, affecting versions up to and including Serv-U 15.4.2 HF 1, allows attackers to perform directory traversal and access sensitive files on the host machine.
A sophisticated malware distribution campaign has emerged, utilizing fake error messages resembling Google Chrome, Microsoft Word, and OneDrive issues to deceive users into running malicious PowerShell scripts. This campaign involves several threat actors, including ClearFake, ClickFix, and TA571, known for their previous involvement in spam distribution and malware dissemination.
French diplomatic entities have been targeted by Midnight Blizzard, a Russia-backed advanced persistent threat, since at least 2021, according to CERT-FR. This group, infamous for its involvement in the 2016 US elections interference and the 2020 SolarWinds attacks, remains a significant cyber threat.
A new phishing-as-a-service (PhaaS) platform called ONNX Store is targeting Microsoft 365 accounts of employees at financial firms using QR codes embedded in PDF attachments. The platform, which can target both Microsoft 365 and Office 365 email accounts, operates via Telegram bots and includes mechanisms to bypass two-factor authentication (2FA).
The LockBit group has resurfaced as the leading ransomware actor in May 2024, according to NCC Group's analysis. LockBit 3.0 conducted 176 ransomware attacks, accounting for 37% of the month's total, marking a staggering 665% increase from the previous month.
Summary: Researchers at Symantec highlighted in a blog post a campaign that has using tools associated with Chinese espionage groups to breach telecom operators in a single Asian country since at least 2021, with evidence to suggest that some of this activity may even date as far back as 2020.
LevelBlue Labs identified a novel and highly evasive malware loader named SquidLoader. This malware leverages sophisticated techniques to thwart both static and dynamic analysis, making detection difficult. SquidLoader targets Chinese organizations through phishing campaigns, with malicious actors disguising it as legitimate Microsoft Word documents.
A new speculative execution attack named "TIKTAG" targets ARM's Memory Tagging Extension, achieving over a 95% success rate in leaking data and bypassing this security feature. This attack, demonstrated by researchers from Samsung, Seoul National University, and the Georgia Institute of Technology, affects Google Chrome and the Linux kernel.
A cyber incident at CDK Global disrupted thousands of car dealerships across the US on Wednesday, typically a busy holiday. CDK Global, a major software provider for dealers, halted all systems and is gradually restoring them after extensive testing and consulting with experts.
Recent data from Action1 indicates a growing trend of threat actors targeting edge devices, particularly load balancers, resulting in a record exploitation rate over the past three years. The study assessed various product categories from 2021 to 2023, using data from the National Vulnerability Database (NVD) and cvedetails.com to calculate the ratio of exploited vulnerabilities to total vulnerabilities.
UNC3944, a financially motivated threat group, has been active since at least May 2022 and has evolved its tactics from credential harvesting to primarily data theft extortion without ransomware. They exploit vulnerabilities in software-as-a-service (SaaS) applications and leverage social engineering tactics to gain access to privileged accounts.
The compromised data included customers' personal information like names, physical addresses, email addresses, and phone numbers. However, notably, the stolen data did not contain the precise locations of Tile devices, which are typically used for remote monitoring.
CISA has issued a warning about a new phone-based impersonation scam. In this scheme, scammers are pretending to be CISA employees, using the names and titles of real government staff to lend credibility to their deceit.
CronUp security researcher German Fernandez has shed light on a phishing and extortion campaign to target GitHub users. The campaign which has been ongoing for several months takes advantage of GitHub's notification system and a malicious OAuth app to gain access to victims' repositories and extort the contents for ransom.
Ukrainian cyber police have identified a 28-year-old resident of Kyiv as a suspected affiliate of the notorious Conti and LockBit ransomware groups. He allegedly specialized in developing cryptors, which are tools that encrypt malware to evade antivirus detection. The man reportedly sold his services to hackers linked to the Conti and LockBit groups for cryptocurrency rewards.
The Black Basta ransomware group is suspected of leveraging a critical Windows privilege escalation vulnerability, identified as CVE-2024-26169, as a zero-day exploit before Microsoft released a fix. This vulnerability, rated at 7.8 on the CVSS v3.1 scale, affects the Windows Error Reporting Service, enabling attackers to elevate their privileges to SYSTEM level.
The Dutch Military Intelligence and Security Service (MIVD) and NCSC advised yesterday that a Chinese nation-state cyber-espionage attack, first documented in February 2024, is compromising many more devices than previously observed.
Since April 2024, researchers at Elastic Security Labs have observed a wave of phishing campaigns using recruiting and job-themed lures to distribute a novel backdoor called WARMCOOKIE. T
The British and Canadian privacy authorities are collaborating on an investigation into a data breach at 23andMe, a genetic testing company, discovered in October 2023. Cybercriminals accessed information from certain accounts, including DNA profiles, affecting about 0.1% of 23andMe's users.
Researchers at CrowdStrike Falcon Intelligence identified a previously unattributed TA group targeting a U.S.-based think tank with ties to China in April 2017 which revealed a larger campaign attributed to the China-based adversary Mustang Panda. Mustang Panda has likely been operational since 2014 targeting government organizations, nonprofits, religious institutions, and other NGOs across the U.S., Europe, Mongolia, Myanmar, Pakistan, Vietnam, and other regions with LNK files associated with the APT group.
Researchers at Artic Wolf Labs have released details on a new ransomware variant dubbed ‘Fog” that has been targeting the networks of US organizations in the education and recreation sectors since May, 2024. In one of the incidents observed, Fog ransomware actors performed pass-the-hash attacks to gain access to administrator accounts and further establish RDP connections to Windows servers running Hyper-V and Veeam.
Mandiant has identified a campaign by the financially motivated group UNC5537, targeting Snowflake customer database instances to steal data and extort victims. Snowflake is a multi-cloud data warehousing platform used for storing and analyzing large datasets. UNC5537 gains access to these databases using stolen customer credentials, obtained through various info stealer malware campaigns.
The number of vulnerable Internet of Things (IoT) devices has surged by 136% over the past year, according to Forescout's report, "The Riskiest Connected Devices in 2024." This study, which analyzed data from nearly 19 million devices, revealed that the proportion of IoT devices with vulnerabilities increased from 14% in 2023 to 33% in 2024.
Two suspects were apprehended in the United Kingdom in connection with a criminal scheme utilizing a homemade mobile antenna to dispatch fraudulent text messages. Huayong Xu, 32, of Alton Road, Croydon, was charged on May 23 following an arrest made on May 9 in Manchester.
The Boston Red Sox, positioned at the forefront of the American League East in baseball, are also making significant strides in cybersecurity. By adopting a comprehensive strategy that involves transitioning critical operations to a software-as-a-service (SaaS) model and embracing the Internet of Things (IoT) at Fenway Park, the team is actively bolstering its cloud security.
Researchers at Symantec have uncovered similarities between two ransomware families, RansomHub and Knight, indicating a potential rebrand of the now defunct Knight ransomware which went silent after its source code was listed for sale on hacker forums back in February 2024. Similar to Knight ransomware, RansomHub is written in the Go programming language.
A cyberespionage campaign recently targeted a government agency that frequently clashes with China over the South China sea. This campaign used previously undetected backdoors and had links to known Chinese state threat actors. Researchers at Sophos Managed Detection and Response uncovered this complex operation, named "Crimson Palace," and attributed it with high confidence to Chinese state-sponsored hacking clusters.
Zyxel Networks has released an emergency security update to address critical vulnerabilities in its end-of-life NAS devices, specifically NAS326 and NAS542 models. These vulnerabilities, identified as CVE-2024-29972, CVE-2024-29973, and CVE-2024-29974, allow attackers to perform command injection and remote code execution.
Belarusian state-sponsored hackers, UNC1151, targeted Ukraine's Ministry of Defence and a military base in a new cyberespionage operation according to Cyble Research and Intelligence Labs. Mandiant Threat Intelligence uncovered a persistent information operation called “Ghostwriter/UNC1151,” which is part of a larger influence campaign supporting Russian security interests and promoting narratives critical of NATO that has been active since March 2017 targeting audiences in Ukraine, Lithuania, Latvia, and Poland.
ReversingLabs, in their recent exploration of open-source repositories like PyPI, made a significant discovery: the emergence of a suspicious package named xFileSyncerx. Initially appearing as a potential threat due to its anomalous characteristics, this package prompted deeper investigation by the research team.
A massive amount of 361 million email addresses from credentials stolen by password-stealing malware, in credential stuffing attacks have been added to Have I Been Pwned's data breach notification service, allowing anyone to check if their accounts have been compromised.
Snowflake, a cloud computing and analytics company, has released a joint statement in coordination with third-party cybersecurity experts at CrowdStrike and Mandiant stating that it is investigating a threat campaign that targeted a “limited” number of Snowflake customers.
Facing a burgeoning backlog of reported vulnerabilities, the National Institute of Standards and Technology (NIST) has found itself in a predicament, grappling with the daunting task of clearing its National Vulnerability Database (NVD). To tackle this challenge head-on, NIST has decided to extend its existing commercial contract with Analygence, a Maryland-based IT consultancy firm, known for its expertise in IT and security-related work.
A sophisticated cyber attack has been detected targeting devices in Ukraine to deploy Cobalt Strike and take control of the compromised systems. Fortinet FortiGuard Labs reported that the attack initiates with a Microsoft Excel file containing an embedded VBA macro that starts the infection process.
Researchers at eSentire have observed a trend in the employment of fake web browser updates to infect end users with various malware strains including SocGholish as well as Fakebat. In May 2024 eSentire's Threat Response Unit started seeing actors using this tactic to deliver BitRAT, a remote access trojan, and Lumma Stealer, a notorious info stealer malware that has gained popularity within the cybercriminal community.
On September 4, 2023, CERT-UA reported a phishing campaign that leveraged Headlace malware to target a critical energy infrastructure facility in Ukraine. During this campaign, BlueDelta sent phishing emails from a fake sender address that contained links to archive files. The archive files contained lure images and Windows BAT script, which, if executed, would result in the whoami command being run and the results being exfiltrated back to the threat actor.
The North Korean linked threat actor Andariel has been using a new Golang-based backdoor called Dora RAT to target educational institutions, manufacturing firms, and construction businesses in South Korea. The AhnLab Security Intelligence Center reported that Andariel has deployed a variety of malware, including keyloggers, infostealers, and proxy tools, to control and exfiltrate data from infected systems.
Ransomware activity surged in 2023, according to a report by Google-owned Mandiant, despite extensive law enforcement efforts against major ransomware groups like ALPHV/BlackCat. The report, published on June 3, 2024, revealed a 75% increase in posts on ransomware groups' data leak sites compared to 2022, affecting victims in over 110 countries.
Check Point has alerted its customers to a critical zero-day vulnerability (CVE-2024-24919, CVSS 8.6) affecting several products, including CloudGuard Network and Quantum Maestro. Attackers are exploiting this flaw by targeting outdated VPN local accounts using password-only authentication. Immediate software updates are crucial to mitigate the risk of unauthorized access to sensitive data and potential lateral movement within networks.
Lumen Technologies' Black Lotus Labs identified a destructive event, as over 600,000 small office/home office (SOHO) routers were taken offline belonging to a single internet service provider (ISP). The incident took place over a 72-hour period between October 25-27, rendered the infected devices permanently inoperable, and required a hardware-based replacement.
Microsoft has highlighted the urgent need to secure internet-exposed OT devices following a series of cyber attacks targeting such environments since late 2023. The Microsoft Threat Intelligence team stressed that these attacks highlight the critical need to improve OT security and prevent critical systems from becoming easy targets.
A previously undocumented cyber espionage group named LilacSquid has been linked to targeted attacks across various sectors in the U.S., Europe, and Asia as part of a data theft campaign ongoing since at least 2021. This campaign is aimed at establishing long-term access to compromised organizations to siphon data of interest to attacker-controlled servers, according to a new technical report by Cisco Talos researcher Asheer Malhotra.
The adversary behind the RedTail cryptocurrency mining malware has added a new exploit, Palo Alto PAN-OS CVE-2024-3400, to their attack vector quiver. The addition of the PAN-OS vulnerability is not the only upgrade added to the adversary's toolkit. The cryptocurrency malware has received its own updates which now incorporate new anti-analysis techniques.
The Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA) mandates covered entities to report cyber incidents and ransomware payments to the Cybersecurity and Infrastructure Security Agency (CISA). CISA aims to swiftly deploy resources, analyze trends, and share information with network defenders.
Since at least early May, Banking institutions in Brazil have been observed by French cybersecurity company HarfangLab being targeted by a new campaign that deploys a custom payload variant of the Windows-based AllaKore RAT called AllaSenha. The intricate infection chain involves Python scripts and a loader developed in a language called Delphi.
AhnLab Security Intelligence Center is warning of an ongoing campaign where cybercriminals are distributing various malware strains by promoting installers for cracked versions of Microsoft Office on torrent sites. The cracked Microsoft Installer comes with a well-built interface, where users can specify the version they want to install, the language, as well as whether to use 32 or 64-bit variants.
Prescription management company Sav-Rx is warning over 2.8 million people in the United States that it suffered a data breach, stating that their personal data was stolen in a 2023 cyberattack. A&A Services, doing business as Sav-RX, is a pharmacy benefit management (PBM) company that provides prescription drug management services to employers, unions, and other organizations across the U.S.
On February 12, 2024, the NIST National Vulnerability Database significantly slowed its processing and enrichment of new vulnerabilities. Since then, 12,720 new vulnerabilities have been added, but 11,885 remain unanalyzed, hindering security professionals' ability to assess affected software. By February 15, the NVD warned of analysis delays,
A US-led law enforcement operation has dismantled the 911 S5 botnet, believed to be the world's largest. The botnet consisted of millions of compromised residential Windows computers used for cyber-attacks, fraud, child exploitation, and other serious crimes. It included over 19 million unique IP addresses, with 613,841 in the US. Cybercriminals could buy access to these IP addresses for illegal activities.
Identity and Access Management company Okta warns that its cross-origin authentication feature in Customer Identity Cloud (CIC) is susceptible to credential-stuffing attacks. “Okta's Cross-Origin Resource Sharing (CORS) feature allows customers to add JavaScript to their websites and applications to send authentication calls to the Okta API hosted.
Operation Endgame, involving police forces from Germany, the United States, the United Kingdom, France, Denmark, and the Netherlands, resulted in the seizure of over 100 malware loader servers across Europe and North America. These servers hosted over 2,000 domains used for illicit activities, which are now under police control.
Ukraine's Computer Emergency Response Team (CERT-UA) is warning of an increase in cyberattacks associated with UAC-0006, a financially-motived threat actor that has been active since 2013.
Researchers have raised alarms about sophisticated phishing campaigns leveraging Cloudflare Workers to deploy phishing sites aimed at harvesting credentials from multiple organizations users. These campaigns utilize a method called transparent phishing or adversary-in-the-middle phishing. This technique involves using Cloudflare Workers as a reverse proxy to legitimate login pages, intercepting traffic to capture login credentials, cookies, and tokens.
ShrinkLocker is a newly identified ransomware strain that encrypts corporate systems through Windows BitLocker by creating a new boot partition. Targeting sectors such as government, vaccine, and manufacturing, ShrinkLocker operates by shrinking non-boot partitions to form a new boot volume.
Trellix Research has uncovered a concerning trend in cybersecurity: fake antivirus websites masquerading as legitimate security software while actually harboring malware. These deceptive sites, such as avast-securedownload[.]com and bitdefender-app[.]com, distribute harmful programs like SpyNote trojan, Lumma malware, and StealC malware under the guise of reputable antivirus brands. Instances of brand reputation attacks like these pose a significant threat, exploiting users' trust in reputable antivirus brands to distribute harmful malware.
With US holidays like Memorial Day upcoming, Microsoft is warning up an uptick in activity from Storm-0539, a cybercriminal group operating out of Morocco that is known for targeting gift card portals linked to large retailers, luxury brands, and well-known fast-food restaurants. According to Microsoft, Storm-0539 conducts deep reconnaissance and sophisticated cloud-based techniques to target gift card creators.
Russian hackers, particularly Advanced Persistent Threat (APT) groups, are intensifying their cyberattacks, expanding targets beyond governments and utilizing readily available malware. Flashpoint researchers reveal the evolving tactics, emphasizing the need for organizational protection. Recent reports indicate collaboration among state-sponsored groups in Iran for large-scale attacks, paralleled by activities in Russia.
Security researchers have uncovered a series of criminal campaigns that exploit cloud storage services. These campaigns, orchestrated by unnamed threat actors, aim to deceive users into visiting malicious websites through SMS messages. According to a technical analysis released by Enea today, the attackers have two main objectives.
Researchers have recently made a significant revelation regarding the BLOODALCHEMY malware, which has been employed in targeted attacks against government organizations in Southern and Southeastern Asia. These researchers found that BLOODALCHEMY is an updated iteration of Deed RAT, considered a successor to ShadowPad—a widely recognized tool utilized in APT campaigns.
Researchers have recently made a significant revelation regarding the BLOODALCHEMY malware, which has been employed in targeted attacks against government organizations in Southern and Southeastern Asia. These researchers found that BLOODALCHEMY is an updated iteration of Deed RAT, considered a successor to ShadowPad—a widely recognized tool utilized in APT campaigns.
Courtroom Software Backdoored to Deliver RustDoor Malware in Supply Chain Attack
A comprehensive survey conducted among 1,600 Chief Information Security Officers (CISOs) globally indicates a significant increase in concerns regarding cybersecurity threats. Specifically, 70% of these CISOs express apprehension about the susceptibility of their organizations to material cyber attacks over the upcoming year.
Cisco researchers have discovered various techniques used by cybercriminals to embed and deliver brand logos within emails, targeting users through brand impersonation. This widespread threat leverages the familiarity and trust associated with well-known brand logos to solicit sensitive information, particularly in phishing emails where attackers aim to deceive recipients into revealing credentials or other valuable information.
Politically-motivated hacktivist groups are increasingly using ransomware to disrupt targets and draw attention to their causes. Notably, the Ikaruz Red Team, along with aligned groups like the Turk Hack Team and Anka Underground, have been leveraging leaked ransomware builders in their recent attacks.
A Chinese APT group has been targeting governmental entities in the Middle East, Africa, and Asia since late 2022 as part of a cyber espionage campaign named Operation Diplomatic Specter. According to researchers from Palo Alto Networks Unit 42, this group has conducted long-term espionage against at least seven government entities, employing sophisticated email exfiltration techniques.
According to a post on X (formerly known as Twitter), a threat actor is claiming to have gained access to a handful of API keys for major cloud service providers, including Amazon Web Services (AWS), Microsoft Azure, GitHub, etc. The actor who goes by the alias “carlos_hank,” stated that these keys are “fresh and all working,” with high permissions that can be used to compromise entire cloud infrastructures.
Rockwell Automation is advising its customers to disconnect industrial control systems not meant for public internet access to prevent unauthorized or malicious cyber activity. This urgent advisory is in response to increasing geopolitical tensions and global cyber threats.
Chinese-backed threat actors, including groups like Volt Typhoon, are increasingly using proxy networks known as operational relay boxes for cyber espionage, according to a Mandiant report published on May 22. ORBs, similar to botnets, are mesh networks comprising compromised devices like virtual private servers, Internet of Things devices, smart devices, and routers.
Bitdefender researchers have uncovered a previously unknown threat actor named "Unfading Sea Haze," which has been targeting military and government entities in the South China Sea region since 2018.
The Blackbasta ransomware gang has listed Atlas to its data leak list, one of the largest national distributors of fuel to 49 continental US States with over 1 billion gallons per year. Based on the listing, the actors claimed to have stolen 730GB of data from the oil giant, including corporate, department, user, and employee data.
A critical security vulnerability, CVE-2024-4701, with a CVSS score of 9.9, affects Netflix's Genie open source platform, used for big data applications. It allows remote attackers to potentially execute arbitrary code on affected systems by exploiting a bug in the file upload process.
A new report from Rapid7 states that over a third of widely exploited vulnerabilities have occurred in network perimeter technologies since the start of 2023, nearly double than that of the previous year. Notably, 60% of these vulnerabilities (impacting network and security appliances) were exploited as zero days in 2023.
An Iranian threat actor affiliated with one of the Iranian intelligence agencies has been observed conducting destructive wiping attacks that target Albania and Israel. Cybersecurity firm Check Point is tracking the activity under the moniker Void Manticore, which is also known as Storm-842 (formerly DEV-0842) by Microsoft. The techniques, tactics, and procedures (TTPs) employed by Void Manticore are relatively straightforward and simple, involving hands-on efforts using basic, mostly publicly available tools.
A critical vulnerability in Fluent Bit has been identified, impacting major cloud providers and numerous tech giants by exposing them to denial-of-service and remote code execution attacks. Fluent Bit, a popular logging and metrics solution for Windows, Linux, and macOS, is embedded in major Kubernetes distributions.
The SolarMarker malware, known by various aliases such as Deimos, Jupyter Infostealer, Polazert, and Yellow Cockatoo, is a sophisticated and evolving cyber threat. According to new research from Recorded Future, the threat actors behind SolarMarker have established a multi-tiered infrastructure designed to complicate law enforcement takedown efforts.
The surge in sophisticated cyber-attacks has led to significant financial implications for businesses. Ransomware attacks, in particular, have become increasingly prevalent and costly. These attacks involve encrypting a victim's data and demanding payment, typically in cryptocurrency, for its release.
Threat actors are leveraging a design flaw in Foxit PDF Reader to distribute a range of malware, including Agent Tesla, AsyncRAT, DCRat, NanoCore RAT, NjRAT, Pony, Remcos RAT, and XWorm. According to a technical report from Check Point, the exploit uses security warnings to deceive users into executing harmful commands.
Researchers at Elastic Security Labs have observed an uptick in email campaigns since early March of 2024, delivering Latrodectus malware. Latrodectus is a malware loader that was identified in October of 2023 by Walmart researchers and is believed to be a successor of the IcedID malware.
In August 2023, Singing River Health System suffered a ransomware attack affecting nearly 900,000 individuals. The breach exposed sensitive data including full names, dates of birth, addresses, Social Security Numbers, and medical details.
Top10VPN and cybersecurity researcher Mathy Vanhoef have identified a new vulnerability stemming from a design flaw in the IEEE 802.11 Wi-Fi standard that tricks victims into connecting to a less secure wireless network and eavesdrop on and intercept their network traffic by spoofing a trusted network name (SSID) and utilizing similar-looking credentials.
Cyble Research and Intelligence Labs has uncovered a new banking trojan dubbed “Antidot” targeting Android devices by posing as a Google Play update application. Users who install the application are presented with a counterfeit Google Play update page that contains a “continue” button designed to redirect to the Android device's Accessibility settings. I
A newly discovered social engineering attack employing fictitious Facebook accounts to targets via Messenger has been attributed to the North Korea-linked APT group Kimsuky with the intent to deliver malware to the victim. These fictitious accounts are created with a fake identity disguised as a North Korean human rights public official.
What was described as a "smash and grab" attack has impacted the automotive giant Nissan North America (NNA). On May 15, 2024, NNA disclosed a ransomware breach, revealing the compromise of personal information, including Social Security numbers, of both current and former employees, affecting 53,038 individuals.
Symantec's Threat Hunter Team recently uncovered a new Linux backdoor, Linux.Gomir, developed by the North Korean Springtail espionage group, linked to a recent campaign against South Korean organizations. This group, also known as Kimsuky, has a history of targeting South Korean public sector organizations and was previously identified in attacks dating back to 2014.
Cloud cryptomining has surged in recent years due to the scalability and flexibility of cloud platforms. This trend makes it easier for attackers to exploit vulnerabilities and deploy resources for cryptomining quickly. A significant threat in this landscape is the Kinsing malware, notorious for targeting Linux-based cloud infrastructure.
In September 2020, a detailed investigation into a prolonged xHunt campaign targeting a Kuwaiti organization revealed the presence of a newly discovered webshell named BumbleBee, alongside two other backdoors called TriFive and Snugy. The BumbleBee webshell was notable for its ability to upload/download files and execute commands on the compromised Microsoft Exchange server.
ew Jersey's Cybersecurity and Communications Integration Cell (NJCCIC) disclosed that it uncovered a new LockBit campaign where actors are sending millions of phishing emails with the help of the Phorpiex botnet to infect potential victims with LockBit Black, an encryptor that was likely built using the LockBit 3.0 builder that was leaked by a disgruntled developer on Twitter in September 2022.
An instance involving a MS-SQL honeypot has shed light on the sophisticated tactics employed by cyber-attackers relying on Mallox ransomware. The honeypot, set up by researchers at Sekoia, was targeted by an intrusion set utilizing brute force techniques to deploy the Mallox ransomware via PureCrypter to exploit various MS-SQL vulnerabilities. Upon analyzing Mallox samples, the researchers identified two distinct affiliates using different approaches.
Threat actors are using DNS tunneling to track when targets open phishing emails and click malicious links, as well as to scan networks for vulnerabilities. DNS tunneling involves encoding data or commands within DNS queries, turning DNS into a covert communication channel. The attackers use various encoding methods, such as Base16, Base64, or custom algorithms, to transmit data via DNS records like TXT, MX, CNAME, and Address records.
Cybersecurity researchers at Rapid7 have uncovered an ongoing social engineering campaign that barrages enterprises with spam emails with the goal of obtaining initial access to their environments for follow-on exploitation. The social engineering tactics involve overwhelming a potential victim's email with junk mail, calling the victim user, and offering them assistance with the issue.
The rapid advancement of artificial intelligence and the proliferation of data worldwide, estimated to reach 200 zettabytes, have ushered in an era of unprecedented technological growth. However, despite this data abundance, there exists a crisis in accessing research data, with the government and private sector being identified as primary contributors to the problem.
The North Korean APT group Kimsuky has been observed by Kaspersky deploying a previously undocumented Golang-based malware dubbed Durian in targeted cyberattacks against two South Korean cryptocurrency firms. Kaspersky states that Durian boasts comprehensive backdoor functionality, enabling the execution of delivered commands, additional file downloads, and exfiltration of files.
Careto, also known as "The Mask," resurfaced after a lengthy hiatus, launching a cyber-espionage campaign targeting organizations primarily in Latin America and Central Africa. This APT group was initially active from 2007 to 2013, during which it targeted a diverse range of victims across 31 countries, including prominent entities like government institutions, diplomatic offices, energy companies, research institutions, and private equity firms.
There has been a notable rise in cyber threats exploiting legitimate software platforms to propagate malicious payloads. Among these threats is the Remcos RAT, a sophisticated remote access tool favored by cybercriminals. Cyber attackers have leveraged trusted applications like GoTo Meeting to facilitate the deployment of the Remcos RAT, employing advanced techniques to evade detection and compromise systems.
Cybersecurity researchers have identified a malicious Python package that purports to be an offshoot of the popular requests library and has been found concealing a Golang-version of the Sliver command-and-control (C2) framework within a PNG image of the project's logo.
Security researchers at Kaspersky's ICS CERT division revealed a series of eight vulnerabilities, including CVE-2023-47610 through CVE-2023-47616, in Telit Cinterion cellular modems, prevalent across industrial, healthcare, and telecommunications sectors. The most severe flaw, CVE-2023-47610, enables remote code execution via SMS, granting attackers unauthorized access to the modem's operating system without authentication.
CRIL (Cyble Research and Intelligence Labs) has uncovered a new ransomware variant dubbed Trinity, notable for its utilization of a double extortion tactic. This method involves exfiltrating victim data before initiating encryption and subsequently demanding ransom payments. The threat actors behind Trinity operate victim support and data leak sites, enhancing their coercive capabilities (T1486).
A group of researchers, primarily from Singapore-based universities, has demonstrated the feasibility of attacking autonomous vehicles by exploiting their reliance on camera-based computer vision systems. Dubbed GhostStripe, the attack manipulates the sensors used by brands like Tesla and Baidu Apollo, which rely on complementary metal oxide semiconductor (CMOS) sensors.
A cybercriminal group, known as STORM-0539, has been targeting employees at US retail corporate offices to create fraudulent gift cards, according to a new advisory from the FBI. In the campaigns observed by the FBI, the group is using smishing to target employees and gain unauthorized access to employee accounts and corporate systems.
The Sysdig Threat Research Team recently conducted a study on a new cyber attack termed “LLMjacking”, which specifically targets cloud-hosted large language model services by exploiting stolen cloud credentials. These credentials were obtained from a vulnerable version of Laravel (CVE-2021-3120).
A new version of the malware loader, Hijack Loader, has been spotted by researchers at Zscaler which comes with an updated set of anti-analysis techniques to fly under the radar. In total, the latest variant comes with 7 new modules. Notably, one of these modules is designed to bypass User Account Control (UAC), a security feature on Windows designed to prevent unauthorized changes to the operating system.
BogusBazaar, the vast network of fake online shops, was discovered by Security Research Labs GmbH to have successfully deceived over 850,000 individuals in the United States and Europe. This operation, which has been active for three years since 2021, has aimed to process around $50 million in fraudulent purchases by stealing credit card information and attempting fake transactions. The operations of BogusBazaar involves the creation of over 75,000 fake webshops.
"TunnelVision" is a newly discovered cyber threat that exploits a vulnerability in the Dynamic Host Configuration Protocol to bypass the encryption of VPNs. This attack method, outlined in a report by Leviathan Security, enables malicious actors to intercept and surveil unencrypted data while maintaining the facade of a secure VPN connection.
At the RSA Conference in San Francisco, cybersecurity experts revealed concerns about China-linked espionage groups exploiting zero-day vulnerabilities to infiltrate US critical infrastructure and businesses. Charles Carmakal from Mandiant Consulting highlighted how these attackers target network security devices that lack endpoint detection and response capabilities, such as routers and firewalls.
Over 52,000 out of 90,310 hosts with Tinyproxy services are vulnerable to a severe security flaw CVE-2023-49606, which exposes them to potential remote code execution. This vulnerability, with a CVSS score of 9.8 out of 10, affects Tinyproxy versions 1.10.0 and 1.11.1. The vulnerability arises from a use-after-free bug triggered by a specially crafted HTTP Connection header.
ArcaneDoor, a cyber espionage campaign targeting network devices from multiple vendors, including Cisco, has been linked to China-linked actors based on findings from Censys. The campaign, attributed to a sophisticated state-sponsored actor known as UAT4356 or Storm-1849, began around July 2023 and continued with the first confirmed attack using custom malware named Line Runner and Line Dancer in January 2024.
MITRE Corporation has provided more details regarding the recently disclosed cyber attack on MITRE's Networked Experimentation, Research, and Virtualization Environment (NERVE).
Law enforcement agencies, collaborated in a significant operation named Operation Cronos. This operation successfully dismantled the infrastructure of the LockBit ransomware group on February 19th. It involved seizing 34 servers that hosted the data leak website, along with data stolen from victims, cryptocurrency addresses, 1,000 decryption keys, and the affiliate panel used by LockBit.
The discovery of Cuckoo highlights the ongoing arms race between cybersecurity researchers and malicious actors. This malware's sophistication, from its ability to evade detection to its multifaceted information-gathering capabilities, showcases the level of expertise adversaries have attained in crafting highly effective threats.
A critical security vulnerability in GitLab is currently being actively exploited according to CISA. This vulnerability allows an attacker to send reset password requests for any account to the bad actor's chosen email address to facilitate account takeover.
A recent advisory from US government agencies like the FBI, US Department of State, and NSA highlighted the activities of North Korean threat actors, specifically the Kimsuky group, in exploiting vulnerabilities in email policies for espionage purposes.
Researchers at Trend Micro, report the botnet of hijacked Ubiquiti routers used by Russia-linked APT28 to conduct global espionage operations consists of more than just Ubiquiti devices.
Over the last couple of years, Threat actors have been weaponizing Microsoft Graph API more frequently for malicious activity in an attempt to evade detection more effectively. Bad actors utilize this tool to facilitate their C2 communications on legitimate Microsoft cloud services.
According to metrics collected by network performance management provider Netscout, distributed denial of service attacks (DDoS) targeting Sweden surged in volume between 2023 and 2024 as the country was in the process of joining NATO. Netscout notes that DDoS attacks against Swedish organizations started picking up significantly in late 2023 with 730 Gbps attacks.
The recent report from Picussecurity outlines threats, malware, vulnerabilities, and exploits for the first week of May. Critical vulnerabilities, including CVE-2024-27322 in R Programming Language and three in Judge0, pose significant risks. Malware activities involve Wpeeper Android malware utilizing compromised WordPress sites and the Dev Popper campaign targeting developers with a Python RAT.
During a government hearing on Wednesday, senators strongly criticized UnitedHealth Group CEO Andrew Witty for the organization's inadequate security measures leading up to the February ransomware attack on Change Healthcare, a subsidiary. Witty confirmed a $22 million ransom payment and acknowledged potential data theft affecting one-third of Americans.
A newly discovered botnet named Goldoon has emerged, specifically targeting D-Link routers by exploiting a critical security flaw known as CVE-2015-2051. This flaw, with a high CVSS score of 9.8, impacts D-Link DIR-645 routers, allowing malicious actors to execute arbitrary commands remotely via specially crafted HTTP requests.
Researchers at Veriti recently uncovered a concerning trend: a surge in cyberattacks targeting sensitive data within the US education and government sectors. This campaign is sophisticated, employing a combination of two notorious malware strains: Agent Tesla and Taskun.
Lumen Technologies' Black Lotus Labs has uncovered a new malware dubbed ‘Cuttlefish' that has been observed infecting enterprise-grade and small office/home office routers to monitor data passing through them and steal authentication information. The malware supports various router architectures with builds for ARM, i386, i386_i686, i386_x64, mips32, and mips64.
Threat actors continue to target operational technology as a means to disrupt critical infrastructure networks, or to deliver malware as a just-in-case measure for increasing global conflicts. Earlier this year we reported on IRGC-Affiliated Cyber Actors targeting Israeli produced programmable logic controllers (PLCs) to disrupt the water sector. We also highlighted reports of Chinese (PRC) state-Sponsored actors compromising and maintaining persistent access to U.S. critical infrastructure with strategic and destructive malware.
Cybersecurity researchers have discovered a previously undocumented malware targeting Android devices that utilizes compromised WordPress sites as relays for its actual command-and-control (C2) servers as a defense evasion technique. The malware, Wpeeper, uses an ELF binary that leverages HTTPS to secure communications to the C2 server.
Kapeka, also known as KnuckleTouch, emerged around mid-2022 but gained formal tracking in 2024 due to its involvement in limited-scope attacks, notably in Eastern Europe. It's associated with the Sandstorm Group, operated by Russia's Military Unit 74455, known for disruptive cyber activities, particularly targeting Ukraine's critical infrastructure.
Latrodectus, also known as Unidentified 111 and IceNova, is a Windows malware downloader that acts as a backdoor, allowing threat actors to gain unauthorized access to compromised systems. The malware was initially discovered by Walmart's security team and later analyzed by cybersecurity firms such as ProofPoint and Team Cymru.
Since October 2023, security researchers at Akamai have been investigating USPS-themed phishing following a USPS smishing attempt targeting one of their team members. In this case, the SMS contained a link designed to redirect the employee to a site containing malicious JavaScript.
Operation SideCopy is a sophisticated cyber operation originating from Pakistan and primarily targeting Indian defense forces and personnel. Since its inception in early 2019, the threat group has demonstrated a high level of adaptability, continuously evolving its malware modules to avoid detection and maintain operational effectiveness. Notably, SideCopy closely monitors antivirus detections and promptly updates its modules in response.
A newly discovered cyber threat known as Muddling Meerkat has been actively engaging in sophisticated DNS activities since October 2019. This threat is believed to have affiliations with the People's Republic of China due to its utilization of DNS open resolvers from Chinese IP space and its potential control over the Great Firewall, which is known for censoring internet access and manipulating internet traffic in and out of China.
Last Friday, CrushFTP disclosed details of critical severity server-side template injection vulnerability in its file transfer software that is being actively exploited in attacks in the wild. Tracked as CVE-2024-4040, the flaw could enable actors to perform a virtual file system escape to read any file on the server's file system, gain administrative privileges, and perform remote code execution to effectively compromise unpatched systems.
Palo Alto Networks has issued remediation guidance for a critical security flaw, CVE-2024-3400, impacting PAN-OS, which is actively being exploited. This flaw allows unauthenticated remote shell command execution and has been observed in multiple versions of PAN-OS. Dubbed "Operation MidnightEclipse," the exploit involves dropping a Python-based backdoor named UPSTYLE, enabling execution of commands through crafted requests.
The Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent directive for federal civilian agencies to patch three critical vulnerabilities within a week. These vulnerabilities include two affecting Cisco products (CVE-2024-20353 and CVE-2024-20359) and one impacting CrushFTP, a popular file transfer tool. The exploits are being actively utilized by state-sponsored threat actors, posing significant risks to network security.
Perception Point researchers have identified a new phishing campaign utilizing compromised accounts to target users through an open redirect vulnerability discovered within a Nespresso domain. Nespresso is a coffee manufacturer. This redirect method allows attacks to bypass standard endpoint detection security measures assuming that these measures do not check for hidden or embedded links.
A campaign has been uncovered by researchers at Netcraft, where actors are using compromised email accounts to send phishing emails to existing contacts. These emails contain shortened URL links (generated using the autode[.]sk URL shortener) that lead to malicious PDF documents hosted on Autodesk Drive, a data-sharing platform.
This blog post from MITRE highlights a recent cyber intrusion they experienced, emphasizing the evolving tactics of foreign nation-state cyber adversaries. The breach, discovered in April 2024, involved the exploitation of zero-day vulnerabilities in Ivanti Connect Secure VPNs and subsequent lateral movement into their VMware infrastructure.
Cisco Talos has disclosed details on a campaign that has been ongoing since February 2024 to distribute three information-stealing malware, including Crypbot, LummaC2, and Rhadamanthys. Updated versions of each of the payloads are being deployed in attacks, each equipped with new obfuscation techniques to evade detection and exfiltrate data of interest from targeted systems.
Researchers have uncovered a sophisticated attack campaign leveraging phishing emails to distribute a stealthy malware called SSLoad. This campaign, named FROZEN#SHADOW by Securonix, is notable for its use of multiple tools, including Cobalt Strike and ConnectWise ScreenConnect, to gain unauthorized access to targeted systems.
The US Treasury's Office of Foreign Assets Control (OFAC) sanctioned two firms and 4 persons on Monday for their involvement in Iranian state-sponsored malicious cyber activities conducted for the Iranian Islamic Revolutionary Guard Corps (IRGC-CEC) from 2016 to April 2021.
The National Police Agency in South Korea has issued an urgent warning regarding ongoing cyberattacks targeting defense industry entities by North Korean hacking groups. The police discovered several instances of successful breaches involving the hacking groups Lazarus, Andariel, and Kimsuky, all linked to the North Korean hacking apparatus.
Key takeaways from the Cyble Research & Intelligence Labs (CRIL) report on DragonForce ransomware reveal significant insights. CRIL identified DragonForce ransomware as being based on LOCKBIT Black ransomware, suggesting that the threat actors behind DragonForce utilized a leaked builder of LOCKBIT Black to generate their binary. This discovery was made after an X user shared the download link for the LockBit ransomware builder in September 2022. DragonForce ransomware surfaced in November 2023, employing double extortion tactics and targeting victims worldwide.
GuptiMiner, a malware tool reportedly used by North Korean hackers, has recently come into the spotlight due to its sophisticated capabilities and the manner in which it has been deployed. The attack vector involves exploiting vulnerabilities in the update mechanism of eScan antivirus software, allowing the attackers to plant backdoors and deploy cryptocurrency miners on targeted networks.
While phishing remains a popular method of gaining initial access to victim environments, researchers at Mandiant note that threat actors are increasingly exploiting vulnerabilities in computer systems to breach organizations.
APT28, also known as Strontium or Forest Blizzard, is a Russian cyber-espionage group that has been active for years. They have gained notoriety for their sophisticated tactics and have previously been linked to the Russian General Staff Main Intelligence Directorate.
Security researcher at SafeBreach Or Yair uncovered a technique that exploits vulnerabilities in the DOS-to-NT path conversion process, to achieve rootkit-like capabilities on Windows systems.
CrushFTP users are facing a critical security issue stemming from a vulnerability that is actively being exploited by malicious actors. This vulnerability specifically affects CrushFTP versions prior to 11.1, allowing attackers to circumvent the virtual file system and gain unauthorized access to system files.
Last Friday, MITRE disclosed that it experienced a breach after detecting suspicious activity on its Networked Experimentation, Research, and Virtualization Environment (NERVE), a collaborative network used for research, development, and prototyping.
A group known as GhostR has claimed responsibility for stealing a sensitive database from World-Check, a global database used by various organizations, including financial institutions, regulatory bodies, and law enforcement agencies, for assessing risks associated with individuals and entities regarding financial crime, terrorism, or corruption.
In the realm of cyber extortion, re-victimization often stems from a combination of desperation and strategic maneuvering by threat actors. For instance, repeat attacks against victims may exploit persistent vulnerabilities that were not adequately addressed or leverage new entry points, such as phishing campaigns or compromises in third-party services.
The cybersecurity landscape is evolving rapidly, with AI emerging as a promising tool for chief information security officers (CISOs) to combat increasingly sophisticated threats. However, adopting AI requires careful consideration and a new playbook emphasizing due diligence, data management, and automation.
LastPass has disclosed details of a campaign targeting its customers using the CryptoChameleon phishing kit. CryptoChameleon is a phishing-as-a-service that enables threat actors to easily generate fake SSO or other login sites impersonating the legitimate sites of companies to steal credentials and other information that can be used for authentication.
Quishing attacks, a type of phishing that exploits QR codes, has seen siginificant rise from 0.8% in 2021 to 10.8% in 2024, according to the latest finding from Egress. At the same time, the report notes a substantial decline in attachment-based payloads, which decreased by half from 72.7% to 35,7%. Impersonation attacks continue to be a prevalent threat, with 77% if them masquerading as well-known brands such as DocuSign and Microsoft.
The latest trends in ransomware paint a complex picture of evolving dynamics within the cybercriminal ecosystem. Coverware's report highlights a notable decrease in ransom payments, with only 28% of victims opting to pay in the first quarter of 2024, marking a significant drop from previous periods. This shift is attributed to improved resilience among businesses, allowing them to recover from attacks without succumbing to ransom demands.
In February 2024, Kaspersky discovered a new malware campaign targeting government entities in the Middle East actively employing over 30 DuneQuixote dropper samples. The droppers come in the form of either using a regular malware dropper or abusing a legitimate tool named “Total Commander” which both carry malicious code to download additional malware using a backdoor method Kaspersky has named “CR4T”.
The Sandworm hacking group, associated with Russia military intelligence, has been employing a sophisticated strategy involving the use of multiple personas to conceal its activities. Mandiant, has conducted research revealing the extent of this strategy and its implications.
Researchers at BlackBerry have disclosed details of a spear-phishing campaign identified in late 2023 that targeted a large automotive manufacturer based in the United States. The campaign has been attributed to a financially motived threat actor called FIN7 and initiated with spear-phishing emails targeting highly privileged employees in the IT department of the unnamed U.S. based manufacturer.
Security researchers at Microsoft recently discovered a malware campaign exploiting new critical vulnerabilities in OpenMetadata to compromise Kubernetes environments, gain access to Kubernetes workloads and abuse them for malicious cryptomining activity. OpenMetadata is an open-source platform designed to manage metadata across various data sources. It serves as a central repository for users to discover, understand, and govern their data.
This joint Cybersecurity Advisory (CSA) is part of an ongoing #StopRansomware effort to publish advisories for network defenders that detail various ransomware variants and ransomware threat actors.
Multiple botnet operations are taking advantage of a year-old vulnerability, CVE-2023-1389, specifically targeting TP-Link Archer AX21 (AX1800) routers. This vulnerability allows attackers to execute commands without authentication via the locale API accessible through the router's web interface.
Threat actors are actively targeting unpatched Atlassian servers using a critical security vulnerability known as CVE-2023-22518, which has a CVSS score of 9.1. This vulnerability affects the Atlassian Confluence Data Center and Server, allowing attackers to reset Confluence and create an administrator account without authentication. Once they gain this level of access, threat actors can assume control of the affected systems.
Cisco Duo recently sent out a notice warning that some of their customer's VoIP and SMS logs for multi-factor authentication messages were stolen by hackers in a cyberattack on the vendor's telephony providers. According to Cisco Duo, an unnamed provider who handles the company's SMS and VOIP multi-factor authentication messages was compromised on April 1, 2024. In this case, the actor was able to obtain employee credentials via a phishing attack which were then used to gain access to the telephony provider's systems.
The discovery of CVE-2024-31497 in PuTTY versions 0.68 through 0.80 unveils a critical vulnerability that exposes cryptographic private keys to potential recovery by attackers. This flaw stems from PuTTY's method of generating ECDSA nonces, introducing a bias that weakens the security of private key generation, particularly on the NIST P-521 curve.
The TA558 hacking group has launched a sophisticated new campaign dubbed "SteganoAmor," leveraging steganography techniques to embed malicious code within innocuous images. This technique allows them to evade detection by both users and security products, making their attacks highly stealthy.
The OpenSSF and OpenJS Foundations have issued a warning to open source maintainers regarding a series of social engineering attacks reminiscent of the xz Utils campaign. These attacks involve suspicious emails sent to the OpenJS Foundation Cross Project Council, requesting urgent updates to popular JavaScript projects under the pretext of addressing critical vulnerabilities.
Professionals in the vulnerability management community warned that the lasting issues of the US National Vulnerability Database (NVD) could lead to a major supply chain security crisis. 50 cybersecurity professionals consolidated to sign and send an open letter on April 12th to several members of the US Congress including the Secretary of Commerce which addressed the ongoing issues with NVD.
Cybersecurity researchers have discovered a resurfaced cyber espionage campaign targeting users in South Asia to deliver an Apple iOS spyware implant called LightSpy. L
Muddled Libra, a cybercriminal group with aliases like Starfraud, UNC3944, Scatter Swine, and Scattered Spider, has gained infamy for its sophisticated attacks on software-as-a-service applications and cloud service provider environments.
Nexperia, a prominent chipmaker, disclosed that it was targeted in a cyber-attack where ransomware actors from the Dunghill group accessed sensitive documents and intellectual property.
In recent years, AI, cybersecurity, and digital transformation have emerged as pivotal themes shaping the landscape of IT. Organizations must stay ahead of the curve, understanding the evolving dynamics, reasons behind them, and how to adapt.
AT&T has confirmed a data breach impacting 51 million former and current customers, after previously denying ownership of the leaked data. The breach, initially reported in 2021 by threat actor ShinyHunters and later by 'MajorNelson', exposed personal information including names, email addresses, phone numbers, social security numbers, and AT&T account details. Although AT&T claims no financial data or call history was compromised, the breach still poses significant risks to affected individuals.
The blog delves into how the integration of the MITRE ATT&CK Framework with the Cado Security platform enriches forensic investigations, providing security teams with a structured approach to understanding and mitigating cyber threats.
The impact of Operation Cronos continues to impede the LockBit ransomware group's activities, leading them to post false victim claims on their leak site. According to Trend Micro approximately 80% of the victim entries on LockBIt's new data leak site following Operation Cronos are not genuine.
A new malware variant known as Byakuan is being distributed through fake Adobe Reader installers. This malicious campaign was initially uncovered by AnhLab Security Intelligence researchers and further analyzed by Fortinet Fortiguard Labs. The attack begins with a PDF file written in Portuguese, which, upon opening, displays a blurred image and prompts the user to click on a link to download the Adobe Reader application to view the content.
According to Check Point Software, human errors account for 95% of cybersecurity issues, emphasizing the critical need for companies to prioritize cybersecurity measures. With the average ransomware payout at $4.35 million and 71% of businesses falling victim to such attacks in 2023, employee awareness and training are essential.
Researchers at Sophos have observed a significant rise in Remote Desktop Protocol exploitation within ransomware attacks, based on their analysis of 150 incident response cases from 2023. They found that RDP abuse featured in a staggering 90% of these cases, allowing threat actors to gain unauthorized remote access to Windows environments.
A recent report from Lasso Security, has raised concerns about software developers potentially using nonexistent or hallucinated software packages when relying on chatbots to build applications. The report, based on continued research by Bar Lanyado from Lasso, builds upon previous findings that demonstrated how large language models can inadvertently recommend packages that do not actually exist.
Idan Tarab, a threat analyst at Perception Point, has released details on a massive campaign targeting entities in Latin America with Venom RAT. The campaign has been attributed to a financially motivated cybercriminal threat group dubbed TA558, which in the past has targeted entities in the LATAM region with several malware strains including Loda RAT, Vjw0rm, and Revenge RAT.
The Earth Freybug cyberthreat group, part of APT41, has been using a new malware named UNAPIMON for covert operations. This group, active since 2012, engages in espionage and financially motivated activities, targeting organizations worldwide.
The Indian government has confirmed that it has rescued and repatriated around 250 Indian citizens who were held captive in Cambodia and coerced into executing cyber scams that target people in India. These victims of human trafficking were carefully lured by crime racket agents under the guise of employment opportunities, but these victims were forced into “cyber slavery” instead.
The cybercriminal group INC Ransom has claimed responsibility for the ongoing cybersecurity incident at Leicester City Council, marking the first involvement of an established cybercrime gang in the local authority's IT troubles. According to a post on INC Ransom's leak blog, they assert having stolen 3 TB of council data before deleting it shortly after publication.
Rated at Severity Medium: At this time the Fedora Linux 40 builds have not been shown to be compromised. Current investigation indicates that the packages are only present in Fedora 40 and Fedora Rawhide within the Red Hat community ecosystem.
The latest updates to Vultur introduce several significant changes, including enhanced remote control capabilities and the addition of new features. One notable addition is the malware's utilization of Android's Accessibility Services, allowing for remote interaction with infected devices through commands sent via Firebase Cloud Messaging (FCM).
AT&T has reset passcodes for 7.6 million current customers and 65.4 million former subscribers following a data leak discovered on the dark web. The leaked information, dating back to 2019 and earlier, varies in content, potentially including full names, email addresses, mailing addresses, phone numbers, social security numbers, dates of birth, and AT&T account numbers.
Palo Alto Network's Unit 42 researchers uncovered and disclosed a new Broken Object Level Authorization (BOLA) vulnerability that affects Grafana versions from 9.5.0 to 9.5.18, from 10.0.0 to 10.0.13, from 10.1.0 to 10.1.9, from 10.2.0 to 10.2.6, and from 10.3.0 to 10.3.5. Grafana is an established open-source data visualization and monitoring solution with almost 60,000 stars on GitHub that helps organizations drive business processes.
Kaspersky has disclosed details of a new Linux version of DinodasRAT that it discovered in early October 2023 after a publication from ESET. Also known as XDealer, the trojan is a multi-backdoor written in C++ that enables actors to surveil and harvest sensitive data from targeted systems.
Vice President Kamala Harris announced the White House Office of Management and Budget's (OMB) inaugural government-wide policy to manage the risks of artificial intelligence (AI) while harnessing its benefits, in line with President Biden's AI Executive Order. T
Researchers have noted that cybercriminals are increasingly interested in developing malicious large language models due to the limitations of existing tools like WormGPT. Ransomware and malware operators are also showing interest in this trend. The demand for AI talent has risen as previous tools like WormGPT failed to meet cybercriminals' needs.
Darcula, a Phishing-as-a-service platform first documented by security researcher Oshri Kalfon last summer, is growing in popularity among the cybercriminal community, with Netcraft analysts recently noting in a blog post that they detected 20,0000+ Darcula-related domains across 11,000 IP addresses, targeting more than 100 brands.
Researchers have recently uncovered an active cyberattack campaign targeting a shadow vulnerability in Ray, developed by Anyscale, an open-source AI framework employed by thousands of companies and servers.
SpiderLabs has disclosed details of a new campaign that utilized a novel loader to ultimately deploy Agent Tesla on targeted systems. Researchers note that they identified a phishing email on March 8, 2024, which contained a seemingly harmless archive masquerading as a legitimate payment receipt from a bank.
The parent company of The Big Issue, a renowned street newspaper supporting homeless people, is facing a cybersecurity crisis initiated by the Qilin ransomware gang. The gang has claimed to have stolen 550 GB of sensitive company data, including personal information like driving licenses, salary details of executives, and even passport and bank details of key figures within the organization.
Threat hunters have identified a potentially nefarious package named SqzrFramework480 within the NuGet package manager. This package is suspected to target developers using tools from a Chinese industrial technology firm known for manufacturing industrial and digital equipment. The package, uploaded by a user named "zhaoyushun1999," contains a DLL file named "SqzrFramework480[.]dll" that exhibits several concerning behaviors.
API's are the connective tissue behind digital moderization, helping applications and databases exchange data more effectively. The State of API Security in 2024 Report from Imperva, found that the majority of internet traffic (71%) in 2023 was API calls. What's more, a typical enterprise site saw an average of 1.5 billion API calls in 2023.
Since its discovery in 2022, the Agenda Ransomware group, also known as Qilin, has remained active and continually evolved. Trend Micro, tracking it as Water Galura, reports ongoing global infections with top targets including the US, Argentina, Australia, and Thailand, spanning various industries like finance and law.
Proofpoint has disclosed details of a new phishing campaign launched by Iran-affiliated threat actor TA450 (aka MuddyWater, Mango, Sandstorm, and Static Kitten) that targeted Israeli employees at large multinational organizations spanning global manufacturing,
Researchers at Sentinel Labs, uncovered a new variant of the destructive wiper malware AcidRain, called Acid Pour. AcidRain has been linked to Russian military intelligence and was notably used in a cyber-attack against Viasat's KA-SAT satellites in Ukraine in May 2022, causing widespread disruptions.
A new vulnerability dubbed GoFetch was discovered in Apple M-series chips, allowing attackers to extract secret keys used in cryptographic operations. This vulnerability exploits a feature called data memory-dependent prefetcher to target constant-time cryptographic implementations and access sensitive data from the CPU cache.
The Checkmarx Research team uncovered a sophisticated attack campaign targeting the software supply chain, affecting numerous victims, including the Top[.]gg GitHub organization with over 170k users and individual developers.
The North Korea-linked threat actor known as Kimsuky (aka Black Banshee, Emerald Sleet, or Springtail) has been observed shifting its tactics, leveraging CHM files as attack vectors in the delivery phase to deploy malware for harvesting sensitive data. Kimsuky has been active for over 10 years and is notorious for targeting entities in South Korea, North America, Europe, and Asia, gathering intelligence relative to North Korea's interests.
A new wave of phishing attacks has surfaced that endeavors to deliver a malicious and continually evolving information stealer malware known as StrelaStealer. Palo Alto Network's Unit 42 Researchers have identified multiple instances of StrelaStealer campaigns that have affected over a hundred organizations in Europe and the United States.
Sucuri, a website security firm, has issued a warning about a new malware strain called Sign1, which has infected more than 39,000 websites. The malware operates by redirecting visitors to scam domains and displaying unwanted advertisements.
Financially motivated hackers have been actively using SmokeLoader malware in a series of sophisticated phishing campaigns, with a particular focus on targeting Ukrainian government and administration organizations.
Cisco Talos has provided updated details on a new campaign where the Russian espionage group Turla deployed their custom backdoor dubbed TinyTurla-NG to infect multiple systems in the compromised network of a European non-government organization (NGO). While it's unclear how exactly the group gained initial access, Turla in the past has initiated drive-by compromises and employed phishing lures to obtain a foothold into victim environments.
Mandiant's investigation reveals a sophisticated cyber threat campaign attributed to a Chinese threat actor group named UNC5174, also known by the alias "Uteus." The group employs a combination of novel and known vulnerabilities to target a wide range of organizations globally, including U.S. defense contractors, government entities, research institutions, and NGOs.
Atlassian has released patches for more than two dozen security flaws, including a critical bug impacting Bamboo Data Center and Server that could leave user environments susceptible to exploitation which could have a massive impact on confidentiality, integrity, and availability without needing any user interaction.
Ivanti has revealed a critical remote code execution vulnerability affecting Standalone Sentry and has urged customers to promptly apply the available patches for protection against potential cyber threats. Tracked as CVE-2023-41724 with a CVSS score of 9.6 this flaw allows unauthenticated attackers to execute arbitrary commands on the appliance's operating system within the same network.
Researchers at CIPSPA Helmholtz-Center for Information Security have discovered a new denial-of-service attack known as ‘Loop DoS', which targets application layer protocols and exploits a vulnerability in the UDP. This attack can cause an indefinite communication loop between network services, resulting in a significant increase in traffic.
Juniper Threat Labs has released details on a Python-based tool, dubbed AndroxGh0st, designed to target Laravel applications and steal sensitive data. Laravel is an open-source PHP web application development framework that is used for designing web applications such as e-commerce platforms, APIs, content management systems, etc.
Microsoft has acknowledged a widespread issue affecting Windows domain controllers, attributing it to a memory leak introduced with the March 2024 Windows Server security updates. The problem stems from a Local Security Authority Subsystem Service (LSASS) process memory leak, causing affected servers to freeze and restart unexpectedly.
SentinelLab's security researcher Tom Hegel has spotted a new destructive malware dubbed AcidPour, which seems to be a variant of the AcidRain data wiper that was used to target satellite communications provider Viasat back in 2022. In a series of threads on X (formerly known as Twitter), Juan Andres Guerrero Saade, AVP of Research for SentinelLabs, provided details regarding the new data wiper, noting that it is designed to target Linux x86 IoT and networking devices.
Trend Micro has released details surrounding a campaign that has been ongoing since early 2022. The campaign has been attributed to a Chinese APT group dubbed ‘Earth Krahang,' who according to researchers has breached 70 organizations and targeted at least 116 entities across 45 countries since initiating operations.
Threat actors are exploiting various digital document publishing platforms to conduct phishing, credential theft, and session token hijacking. Cisco Talos researchers highlighted this trend, noting that using DDP sites increases phishing success rates due to their positive reputation, absence from web filters, and familiarity to users.
A novel cyberattack method called "Conversation Overflow" has recently surfaced, showcasing cybercriminals' attempts to bypass AI- and ML-enabled security platforms through sophisticated techniques. This attack tactic, analyzed by SlashNext researchers, is observed in multiple incidents, indicating a deliberate effort to evade advanced cybersecurity defenses.
The report provides an analysis of a njRAT (Remote Access Trojan) sample discovered in October 2023. The malware, written in .NET, allows attackers to remotely control infected machines. Basic static analysis reveals key file information and suspicious strings indicating registry manipulation, network communication, and process control.
A new phishing campaign is targeting U.S. organizations to deploy a remote access trojan called NetSupport RAT. This operation, which introduces a nuanced exploitation method that utilizes OLE template manipulation, is tracked by Israeli cybersecurity company Perception Point as “Operation PhantomBlu”.
A new report from Kaspersky noted that its anti-phishing system was able to deter over 709 million attempts to access phishing and scam websites in 2023, highlighting a 40 percent increase over 2022. A spike in phishing activity was observed between May and June, where actors used travel-related lures including counterfeit airline tickets and fake hotel deals to gain potential victims.
Credential-stealing phishing remains a persistent threat, with threat actors continually evolving their tactics. While various methods for hosting phishing pages exist, including third-party services and email attachments, traditional approaches involving internet-connected servers remain common. A recent trend observed involves an increase in phishing campaigns utilizing IPFS (InterPlanetary File System) and R2 buckets, a Cloudflare object storage service, to host malicious content.
The recent global IT outages experienced by McDonald's restaurants have caused significant disruptions to operations across multiple countries. These outages, which commenced overnight, have led to widespread difficulties in order-taking and payment processing, prompting some stores to close temporarily.