# articles

feed_id: tag:blogger.com,1999:blog-4802841478634147276.post-1694430975214228800
title: New 'FabricScape' Bug in Microsoft Azure Service Fabric Impacts Linux Workloads
uri: New-FabricScape-Bug-in-Microsoft-Azure-Service-Fabric-Impacts-Linux
url: http://www.blogger.com/feeds/4802841478634147276/posts/default/1694430975214228800
content:
Cybersecurity researchers from Palo Alto Networks Unit 42 disclosed details of a new security flaw affecting Microsoft's Service Fabric that could be exploited to obtain elevated permissions and seize control of all nodes in a cluster.
The issue, which has been dubbed FabricScape (CVE-2022-30137), could be exploited on containers that are configured to have runtime access. It has been remediated<div class="feedflare">
<a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=gLjKuffeuA4:gcJ0CXb86BE:yIl2AUoC8zA"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=yIl2AUoC8zA" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=gLjKuffeuA4:gcJ0CXb86BE:qj6IDK7rITs"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=qj6IDK7rITs" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=gLjKuffeuA4:gcJ0CXb86BE:gIN9vFwOqvQ"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=gLjKuffeuA4:gcJ0CXb86BE:gIN9vFwOqvQ" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=gLjKuffeuA4:gcJ0CXb86BE:V_sGLiPBpWU"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=gLjKuffeuA4:gcJ0CXb86BE:V_sGLiPBpWU" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=gLjKuffeuA4:gcJ0CXb86BE:F7zBnMyn0Lo"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=gLjKuffeuA4:gcJ0CXb86BE:F7zBnMyn0Lo" border="0"></img></a>
</div>


feed_id: tag:blogger.com,1999:blog-4802841478634147276.post-8040115933408193453
title: New UnRAR Vulnerability Could Let Attackers Hack Zimbra Webmail Servers
uri: New-UnRAR-Vulnerability-Could-Let-Attackers-Hack-Zimbra-Webmail-Server
url: http://www.blogger.com/feeds/4802841478634147276/posts/default/8040115933408193453
content:
A new security vulnerability has been disclosed in RARlab's UnRAR utility that, if successfully exploited, could permit a remote attacker to execute arbitrary code on a system that relies on the binary.
The flaw, assigned the identifier CVE-2022-30333, relates to a path traversal vulnerability in the Unix versions of UnRAR that can be triggered upon extracting a maliciously crafted RAR archive.
<div class="feedflare">
<a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=rp8kcPtDEw4:zbGETPApmmk:yIl2AUoC8zA"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=yIl2AUoC8zA" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=rp8kcPtDEw4:zbGETPApmmk:qj6IDK7rITs"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=qj6IDK7rITs" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=rp8kcPtDEw4:zbGETPApmmk:gIN9vFwOqvQ"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=rp8kcPtDEw4:zbGETPApmmk:gIN9vFwOqvQ" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=rp8kcPtDEw4:zbGETPApmmk:V_sGLiPBpWU"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=rp8kcPtDEw4:zbGETPApmmk:V_sGLiPBpWU" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=rp8kcPtDEw4:zbGETPApmmk:F7zBnMyn0Lo"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=rp8kcPtDEw4:zbGETPApmmk:F7zBnMyn0Lo" border="0"></img></a>
</div>


feed_id: tag:blogger.com,1999:blog-4802841478634147276.post-6294944795575849738
title: New YTStealer Malware Aims to Hijack Accounts of YouTube Content Creators
uri: New-YTStealer-Malware-Aims-to-Hijack-Accounts-of-YouTube-Content-Creat
url: http://www.blogger.com/feeds/4802841478634147276/posts/default/6294944795575849738
content:
Cybersecurity researchers have documented a new information-stealing malware that targets YouTube content creators by plundering their authentication cookies.
Dubbed "YTStealer" by Intezer, the malicious tool is likely believed to be sold as a service on the dark web, with it distributed using fake installers that also drop RedLine Stealer and Vidar.
"What sets YTStealer aside from other <div class="feedflare">
<a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=iJyLjyAXJkc:ipFfdJyr3IA:yIl2AUoC8zA"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=yIl2AUoC8zA" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=iJyLjyAXJkc:ipFfdJyr3IA:qj6IDK7rITs"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=qj6IDK7rITs" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=iJyLjyAXJkc:ipFfdJyr3IA:gIN9vFwOqvQ"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=iJyLjyAXJkc:ipFfdJyr3IA:gIN9vFwOqvQ" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=iJyLjyAXJkc:ipFfdJyr3IA:V_sGLiPBpWU"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=iJyLjyAXJkc:ipFfdJyr3IA:V_sGLiPBpWU" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=iJyLjyAXJkc:ipFfdJyr3IA:F7zBnMyn0Lo"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=iJyLjyAXJkc:ipFfdJyr3IA:F7zBnMyn0Lo" border="0"></img></a>
</div>


feed_id: tag:blogger.com,1999:blog-4802841478634147276.post-69599443822738147
title: North Korean Hackers Suspected to be Behind $100M Horizon Bridge Hack
uri: North-Korean-Hackers-Suspected-to-be-Behind-100M-Horizon-Bridge-Hack
url: http://www.blogger.com/feeds/4802841478634147276/posts/default/69599443822738147
content:
The notorious North Korea-backed hacking collective Lazarus Group is suspected to be behind the recent $100 million altcoin theft from Harmony Horizon Bridge, citing similarities to the Ronin bridge attack in March 2022.
The finding comes as Harmony confirmed that its Horizon Bridge, a platform that allows users to move cryptocurrency across different blockchains, had been breached last week.
<div class="feedflare">
<a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=SoT9yERdoNo:Zq-1ezJMbLc:yIl2AUoC8zA"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=yIl2AUoC8zA" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=SoT9yERdoNo:Zq-1ezJMbLc:qj6IDK7rITs"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=qj6IDK7rITs" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=SoT9yERdoNo:Zq-1ezJMbLc:gIN9vFwOqvQ"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=SoT9yERdoNo:Zq-1ezJMbLc:gIN9vFwOqvQ" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=SoT9yERdoNo:Zq-1ezJMbLc:V_sGLiPBpWU"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=SoT9yERdoNo:Zq-1ezJMbLc:V_sGLiPBpWU" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=SoT9yERdoNo:Zq-1ezJMbLc:F7zBnMyn0Lo"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=SoT9yERdoNo:Zq-1ezJMbLc:F7zBnMyn0Lo" border="0"></img></a>
</div>


feed_id: tag:blogger.com,1999:blog-4802841478634147276.post-645985563888942246
title: Ex-Canadian Government Employee Pleads Guilty Over NetWalker Ransomware Attacks
uri: Ex-Canadian-Government-Employee-Pleads-Guilty-Over-NetWalker-Ransomwar
url: http://www.blogger.com/feeds/4802841478634147276/posts/default/645985563888942246
content:
A former Canadian government employee this week agreed to plead guilty in the U.S. to charges related to his involvement with the NetWalker ransomware syndicate.
Sebastien Vachon-Desjardins, who was extradited to the U.S. on March 10, 2022, is accused of conspiracy to commit computer fraud and wire fraud, intentional damage to a protected computer, and transmitting a demand in relation to <div class="feedflare">
<a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=lIycTeQbttA:eA2I8uR48Gs:yIl2AUoC8zA"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=yIl2AUoC8zA" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=lIycTeQbttA:eA2I8uR48Gs:qj6IDK7rITs"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=qj6IDK7rITs" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=lIycTeQbttA:eA2I8uR48Gs:gIN9vFwOqvQ"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=lIycTeQbttA:eA2I8uR48Gs:gIN9vFwOqvQ" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=lIycTeQbttA:eA2I8uR48Gs:V_sGLiPBpWU"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=lIycTeQbttA:eA2I8uR48Gs:V_sGLiPBpWU" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=lIycTeQbttA:eA2I8uR48Gs:F7zBnMyn0Lo"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=lIycTeQbttA:eA2I8uR48Gs:F7zBnMyn0Lo" border="0"></img></a>
</div>


feed_id: tag:blogger.com,1999:blog-4802841478634147276.post-3676168717233091111
title: What is Shadow IT and why is it so risky?
uri: What-is-Shadow-IT-and-why-is-it-so-risky
url: http://www.blogger.com/feeds/4802841478634147276/posts/default/3676168717233091111
content:
Shadow IT refers to the practice of users deploying unauthorized technology resources in order to circumvent their IT department. Users may resort to using shadow IT practices when they feel that existing IT policies are too restrictive or get in the way of them being able to do their jobs effectively.
An old school phenomenon 
Shadow IT is not new. There have been countless examples of <div class="feedflare">
<a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=I0Lxdf6kXyg:VDTVrBBQWZU:yIl2AUoC8zA"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=yIl2AUoC8zA" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=I0Lxdf6kXyg:VDTVrBBQWZU:qj6IDK7rITs"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=qj6IDK7rITs" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=I0Lxdf6kXyg:VDTVrBBQWZU:gIN9vFwOqvQ"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=I0Lxdf6kXyg:VDTVrBBQWZU:gIN9vFwOqvQ" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=I0Lxdf6kXyg:VDTVrBBQWZU:V_sGLiPBpWU"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=I0Lxdf6kXyg:VDTVrBBQWZU:V_sGLiPBpWU" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=I0Lxdf6kXyg:VDTVrBBQWZU:F7zBnMyn0Lo"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=I0Lxdf6kXyg:VDTVrBBQWZU:F7zBnMyn0Lo" border="0"></img></a>
</div>


feed_id: tag:blogger.com,1999:blog-4802841478634147276.post-2269159825036798159
title: U.S. FCC Commissioner Asks Apple and Google to Remove TikTok from App Stores
uri: U-S-FCC-Commissioner-Asks-Apple-and-Google-to-Remove-TikTok-from-App
url: http://www.blogger.com/feeds/4802841478634147276/posts/default/2269159825036798159
content:
One of the commissioners of the U.S. Federal Communications Commission (FCC) has renewed calls asking for Apple and Google to boot the popular video-sharing platform TikTok from their app stores citing "its pattern of surreptitious data practices."
"It is clear that TikTok poses an unacceptable national security risk due to its extensive data harvesting being combined with Beijing's apparently <div class="feedflare">
<a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=YHRZpuui2XU:I-_57YGl6ZE:yIl2AUoC8zA"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=yIl2AUoC8zA" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=YHRZpuui2XU:I-_57YGl6ZE:qj6IDK7rITs"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=qj6IDK7rITs" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=YHRZpuui2XU:I-_57YGl6ZE:gIN9vFwOqvQ"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=YHRZpuui2XU:I-_57YGl6ZE:gIN9vFwOqvQ" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=YHRZpuui2XU:I-_57YGl6ZE:V_sGLiPBpWU"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=YHRZpuui2XU:I-_57YGl6ZE:V_sGLiPBpWU" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=YHRZpuui2XU:I-_57YGl6ZE:F7zBnMyn0Lo"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=YHRZpuui2XU:I-_57YGl6ZE:F7zBnMyn0Lo" border="0"></img></a>
</div>


feed_id: tag:blogger.com,1999:blog-4802841478634147276.post-1505685368150714321
title: Google Blocks Dozens of Malicious Domains Operated by Hack-for-Hire Groups
uri: Google-Blocks-Dozens-of-Malicious-Domains-Operated-by-Hack-for-Hire-Gr
url: http://www.blogger.com/feeds/4802841478634147276/posts/default/1505685368150714321
content:
Google's Threat Analysis Group (TAG) on Thursday disclosed it had acted to block as many as 36 malicious domains operated by hack-for-hire groups from India, Russia, and the U.A.E.
In a manner analogous to the surveillanceware ecosystem, hack-for-hire firms equip their clients with capabilities to enable targeted attacks aimed at corporates as well as activists, journalists, politicians, and <div class="feedflare">
<a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=F8OfzojAUQM:GIvwRVeUlus:yIl2AUoC8zA"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=yIl2AUoC8zA" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=F8OfzojAUQM:GIvwRVeUlus:qj6IDK7rITs"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=qj6IDK7rITs" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=F8OfzojAUQM:GIvwRVeUlus:gIN9vFwOqvQ"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=F8OfzojAUQM:GIvwRVeUlus:gIN9vFwOqvQ" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=F8OfzojAUQM:GIvwRVeUlus:V_sGLiPBpWU"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=F8OfzojAUQM:GIvwRVeUlus:V_sGLiPBpWU" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=F8OfzojAUQM:GIvwRVeUlus:F7zBnMyn0Lo"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=F8OfzojAUQM:GIvwRVeUlus:F7zBnMyn0Lo" border="0"></img></a>
</div>


feed_id: tag:blogger.com,1999:blog-4802841478634147276.post-1395205283549252298
title: Microsoft Warns of Cryptomining Malware Campaign Targeting Linux Servers
uri: Microsoft-Warns-of-Cryptomining-Malware-Campaign-Targeting-Linux-Serve
url: http://www.blogger.com/feeds/4802841478634147276/posts/default/1395205283549252298
content:
A cloud threat actor group tracked as 8220 has updated its malware toolset to breach Linux servers with the goal of installing crypto miners as part of a long-running campaign.
"The updates include the deployment of new versions of a crypto miner and an IRC bot," Microsoft Security Intelligence said in a series of tweets on Thursday. "The group has actively updated its techniques and payloads <div class="feedflare">
<a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=OaLOibmcuwU:IpFqnFB6p4s:yIl2AUoC8zA"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=yIl2AUoC8zA" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=OaLOibmcuwU:IpFqnFB6p4s:qj6IDK7rITs"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=qj6IDK7rITs" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=OaLOibmcuwU:IpFqnFB6p4s:gIN9vFwOqvQ"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=OaLOibmcuwU:IpFqnFB6p4s:gIN9vFwOqvQ" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=OaLOibmcuwU:IpFqnFB6p4s:V_sGLiPBpWU"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=OaLOibmcuwU:IpFqnFB6p4s:V_sGLiPBpWU" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=OaLOibmcuwU:IpFqnFB6p4s:F7zBnMyn0Lo"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=OaLOibmcuwU:IpFqnFB6p4s:F7zBnMyn0Lo" border="0"></img></a>
</div>


feed_id: tag:blogger.com,1999:blog-4802841478634147276.post-3512954341836263586
title: Amazon Quietly Patches 'High Severity' Vulnerability in Android Photos App
uri: Amazon-Quietly-Patches-High-Severity-Vulnerability-in-Android-Photos
url: http://www.blogger.com/feeds/4802841478634147276/posts/default/3512954341836263586
content:
Amazon, in December 2021, patched a high severity vulnerability affecting its Photos app for Android that could have been exploited to steal a user's access tokens.
"The Amazon access token is used to authenticate the user across multiple Amazon APIs, some of which contain personal data such as full name, email, and address," Checkmarx researchers João Morais and Pedro Umbelino said. "Others, <div class="feedflare">
<a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=61yv8totZEU:kS7Yzgiq1fI:yIl2AUoC8zA"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=yIl2AUoC8zA" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=61yv8totZEU:kS7Yzgiq1fI:qj6IDK7rITs"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=qj6IDK7rITs" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=61yv8totZEU:kS7Yzgiq1fI:gIN9vFwOqvQ"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=61yv8totZEU:kS7Yzgiq1fI:gIN9vFwOqvQ" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=61yv8totZEU:kS7Yzgiq1fI:V_sGLiPBpWU"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=61yv8totZEU:kS7Yzgiq1fI:V_sGLiPBpWU" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=61yv8totZEU:kS7Yzgiq1fI:F7zBnMyn0Lo"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=61yv8totZEU:kS7Yzgiq1fI:F7zBnMyn0Lo" border="0"></img></a>
</div>


feed_id: tag:blogger.com,1999:blog-4802841478634147276.post-4193986081114219765
title: New 'SessionManager' Backdoor Targeting Microsoft IIS Servers in the Wild
uri: New-SessionManager-Backdoor-Targeting-Microsoft-IIS-Servers-in-the-W
url: http://www.blogger.com/feeds/4802841478634147276/posts/default/4193986081114219765
content:
A newly discovered malware has been put to use in the wild at least since March 2021 to backdoor Microsoft Exchange servers belonging to a wide range of entities worldwide, with infections lingering in 20 organizations as of June 2022.
Dubbed SessionManager, the malicious tool masquerades as a module for Internet Information Services (IIS), a web server software for Windows systems, after <div class="feedflare">
<a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=3jWF3W-mMis:zJAMyFBPkaM:yIl2AUoC8zA"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=yIl2AUoC8zA" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=3jWF3W-mMis:zJAMyFBPkaM:qj6IDK7rITs"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=qj6IDK7rITs" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=3jWF3W-mMis:zJAMyFBPkaM:gIN9vFwOqvQ"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=3jWF3W-mMis:zJAMyFBPkaM:gIN9vFwOqvQ" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=3jWF3W-mMis:zJAMyFBPkaM:V_sGLiPBpWU"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=3jWF3W-mMis:zJAMyFBPkaM:V_sGLiPBpWU" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=3jWF3W-mMis:zJAMyFBPkaM:F7zBnMyn0Lo"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=3jWF3W-mMis:zJAMyFBPkaM:F7zBnMyn0Lo" border="0"></img></a>
</div>


feed_id: tag:blogger.com,1999:blog-4802841478634147276.post-9173608022613728945
uri: Solving-the-indirect-vulnerability-enigma-fixing-indirect-vulnerabil
url: http://www.blogger.com/feeds/4802841478634147276/posts/default/9173608022613728945
title:
Solving the indirect vulnerability enigma - fixing indirect vulnerabilities without breaking your dependency tree

content:
Fixing indirect vulnerabilities is one of those complex, tedious and, quite frankly, boring tasks that no one really wants to touch. No one except for Debricked, it seems. Sure, there are lots of ways to do it manually, but can it be done automatically with minimal risk of breaking changes? The Debricked team decided to find out. 
A forest full of fragile trees
So, where do you even start?
<div class="feedflare">
<a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=8_-DjGjXPSU:utP20uQT53I:yIl2AUoC8zA"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=yIl2AUoC8zA" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=8_-DjGjXPSU:utP20uQT53I:qj6IDK7rITs"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=qj6IDK7rITs" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=8_-DjGjXPSU:utP20uQT53I:gIN9vFwOqvQ"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=8_-DjGjXPSU:utP20uQT53I:gIN9vFwOqvQ" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=8_-DjGjXPSU:utP20uQT53I:V_sGLiPBpWU"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=8_-DjGjXPSU:utP20uQT53I:V_sGLiPBpWU" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=8_-DjGjXPSU:utP20uQT53I:F7zBnMyn0Lo"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=8_-DjGjXPSU:utP20uQT53I:F7zBnMyn0Lo" border="0"></img></a>
</div>


feed_id: tag:blogger.com,1999:blog-4802841478634147276.post-1398813802330085465
title: Microsoft Warns About Evolving Capabilities of Toll Fraud Android Malware Apps
uri: Microsoft-Warns-About-Evolving-Capabilities-of-Toll-Fraud-Android-Malw
url: http://www.blogger.com/feeds/4802841478634147276/posts/default/1398813802330085465
content:
Microsoft has detailed the evolving capabilities of toll fraud malware apps on Android, pointing out its "complex multi-step attack flow" and an improved mechanism to evade security analysis.
Toll fraud belongs to a category of billing fraud wherein malicious mobile applications come with hidden subscription fees, roping in unsuspecting users to premium content without their knowledge or consent<div class="feedflare">
<a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=pWCvFjFg0qo:HjCUdVJPXW4:yIl2AUoC8zA"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=yIl2AUoC8zA" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=pWCvFjFg0qo:HjCUdVJPXW4:qj6IDK7rITs"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=qj6IDK7rITs" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=pWCvFjFg0qo:HjCUdVJPXW4:gIN9vFwOqvQ"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=pWCvFjFg0qo:HjCUdVJPXW4:gIN9vFwOqvQ" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=pWCvFjFg0qo:HjCUdVJPXW4:V_sGLiPBpWU"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=pWCvFjFg0qo:HjCUdVJPXW4:V_sGLiPBpWU" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=pWCvFjFg0qo:HjCUdVJPXW4:F7zBnMyn0Lo"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=pWCvFjFg0qo:HjCUdVJPXW4:F7zBnMyn0Lo" border="0"></img></a>
</div>


feed_id: tag:blogger.com,1999:blog-4802841478634147276.post-8450366086408685409
title: Google Improves Its Password Manager to Boost Security Across All Platforms
uri: Google-Improves-Its-Password-Manager-to-Boost-Security-Across-All-Plat
url: http://www.blogger.com/feeds/4802841478634147276/posts/default/8450366086408685409
content:
Google on Thursday announced a slew of improvements to its password manager service aimed at creating a more consistent look and feel across different platforms.
Central to the changes is a "simplified and unified management experience that's the same in Chrome and Android settings," Ali Sarraf, Google Chrome product manager, said in a blog post.

The updates are also expected to automatically <div class="feedflare">
<a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=oB8s7N7oN-8:Ry6yjCMvURY:yIl2AUoC8zA"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=yIl2AUoC8zA" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=oB8s7N7oN-8:Ry6yjCMvURY:qj6IDK7rITs"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=qj6IDK7rITs" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=oB8s7N7oN-8:Ry6yjCMvURY:gIN9vFwOqvQ"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=oB8s7N7oN-8:Ry6yjCMvURY:gIN9vFwOqvQ" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=oB8s7N7oN-8:Ry6yjCMvURY:V_sGLiPBpWU"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=oB8s7N7oN-8:Ry6yjCMvURY:V_sGLiPBpWU" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=oB8s7N7oN-8:Ry6yjCMvURY:F7zBnMyn0Lo"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=oB8s7N7oN-8:Ry6yjCMvURY:F7zBnMyn0Lo" border="0"></img></a>
</div>


feed_id: tag:blogger.com,1999:blog-4802841478634147276.post-9087452298076336119
title: TikTok Assures U.S. Lawmakers it's Working to Safeguard User Data From Chinese Staff
uri: TikTok-Assures-U-S-Lawmakers-it-s-Working-to-Safeguard-User-Data-From
url: http://www.blogger.com/feeds/4802841478634147276/posts/default/9087452298076336119
content:
Following heightened worries that U.S. users' data had been accessed by TikTok engineers in China between September 2021 and January 2022, the company sought to assuage U.S. lawmakers that it's taking steps to "strengthen data security."
The admission that some China-based employees can access information from U.S. users came in a letter sent to nine senators, which further noted that the <div class="feedflare">
<a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=pc7U9VTjFBw:5F8Crb27TQ8:yIl2AUoC8zA"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=yIl2AUoC8zA" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=pc7U9VTjFBw:5F8Crb27TQ8:qj6IDK7rITs"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=qj6IDK7rITs" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=pc7U9VTjFBw:5F8Crb27TQ8:gIN9vFwOqvQ"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=pc7U9VTjFBw:5F8Crb27TQ8:gIN9vFwOqvQ" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=pc7U9VTjFBw:5F8Crb27TQ8:V_sGLiPBpWU"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=pc7U9VTjFBw:5F8Crb27TQ8:V_sGLiPBpWU" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=pc7U9VTjFBw:5F8Crb27TQ8:F7zBnMyn0Lo"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=pc7U9VTjFBw:5F8Crb27TQ8:F7zBnMyn0Lo" border="0"></img></a>
</div>


feed_id: tag:blogger.com,1999:blog-4802841478634147276.post-7924247395777232389
title: HackerOne Employee Caught Stealing Vulnerability Reports for Personal Gains
uri: HackerOne-Employee-Caught-Stealing-Vulnerability-Reports-for-Personal
url: http://www.blogger.com/feeds/4802841478634147276/posts/default/7924247395777232389
content:
Vulnerability coordination and bug bounty platform HackerOne on Friday disclosed that a former employee at the firm improperly accessed security reports submitted to it for personal gain.
"The person anonymously disclosed this vulnerability information outside the HackerOne platform with the goal of claiming additional bounties," it said. "In under 24 hours, we worked quickly to contain the <div class="feedflare">
<a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=s39ADRIZ9G0:BHOfgJEJ9lE:yIl2AUoC8zA"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=yIl2AUoC8zA" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=s39ADRIZ9G0:BHOfgJEJ9lE:qj6IDK7rITs"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=qj6IDK7rITs" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=s39ADRIZ9G0:BHOfgJEJ9lE:gIN9vFwOqvQ"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=s39ADRIZ9G0:BHOfgJEJ9lE:gIN9vFwOqvQ" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=s39ADRIZ9G0:BHOfgJEJ9lE:V_sGLiPBpWU"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=s39ADRIZ9G0:BHOfgJEJ9lE:V_sGLiPBpWU" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=s39ADRIZ9G0:BHOfgJEJ9lE:F7zBnMyn0Lo"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=s39ADRIZ9G0:BHOfgJEJ9lE:F7zBnMyn0Lo" border="0"></img></a>
</div>


feed_id: tag:blogger.com,1999:blog-4802841478634147276.post-799068568319968772
title: Ukrainian Authorities Arrested Phishing Gang That Stole 100 Million UAH
uri: Ukrainian-Authorities-Arrested-Phishing-Gang-That-Stole-100-Million-UA
url: http://www.blogger.com/feeds/4802841478634147276/posts/default/799068568319968772
content:
The Cyber Police of Ukraine last week disclosed that it apprehended nine members of a criminal gang that embezzled 100 million hryvnias via hundreds of phishing sites that claimed to offer financial assistance to Ukrainian citizens as part of a campaign aimed at capitalizing on the ongoing conflict.
"Criminals created more than 400 phishing links to obtain bank card data of citizens and <div class="feedflare">
<a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=idn1IggGKOg:0WoRGgYAcfE:yIl2AUoC8zA"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=yIl2AUoC8zA" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=idn1IggGKOg:0WoRGgYAcfE:qj6IDK7rITs"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=qj6IDK7rITs" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=idn1IggGKOg:0WoRGgYAcfE:gIN9vFwOqvQ"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=idn1IggGKOg:0WoRGgYAcfE:gIN9vFwOqvQ" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=idn1IggGKOg:0WoRGgYAcfE:V_sGLiPBpWU"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=idn1IggGKOg:0WoRGgYAcfE:V_sGLiPBpWU" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=idn1IggGKOg:0WoRGgYAcfE:F7zBnMyn0Lo"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=idn1IggGKOg:0WoRGgYAcfE:F7zBnMyn0Lo" border="0"></img></a>
</div>


feed_id: tag:blogger.com,1999:blog-4802841478634147276.post-4656316149425876614
title: Some Worms Use Their Powers for Good
uri: Some-Worms-Use-Their-Powers-for-Good
url: http://www.blogger.com/feeds/4802841478634147276/posts/default/4656316149425876614
content:
Gardeners know that worms are good. Cybersecurity professionals know that worms are bad. Very bad. In fact, worms are literally the most devasting force for evil known to the computing world. The MyDoom worm holds the dubious position of most costly computer malware ever – responsible for some $52 billion in damage. In second place… Sobig, another worm.
It turns out, however, that there are <div class="feedflare">
<a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=O-VNtVmb4aY:AnipX4ma4ZQ:yIl2AUoC8zA"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=yIl2AUoC8zA" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=O-VNtVmb4aY:AnipX4ma4ZQ:qj6IDK7rITs"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=qj6IDK7rITs" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=O-VNtVmb4aY:AnipX4ma4ZQ:gIN9vFwOqvQ"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=O-VNtVmb4aY:AnipX4ma4ZQ:gIN9vFwOqvQ" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=O-VNtVmb4aY:AnipX4ma4ZQ:V_sGLiPBpWU"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=O-VNtVmb4aY:AnipX4ma4ZQ:V_sGLiPBpWU" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=O-VNtVmb4aY:AnipX4ma4ZQ:F7zBnMyn0Lo"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=O-VNtVmb4aY:AnipX4ma4ZQ:F7zBnMyn0Lo" border="0"></img></a>
</div>


feed_id: tag:blogger.com,1999:blog-4802841478634147276.post-5436823800733431461
title: Update Google Chrome Browser to Patch New Zero-Day Exploit Detected in the Wild
uri: Update-Google-Chrome-Browser-to-Patch-New-Zero-Day-Exploit-Detected-in
url: http://www.blogger.com/feeds/4802841478634147276/posts/default/5436823800733431461
content:
Google on Monday shipped security updates to address a high-severity zero-day vulnerability in its Chrome web browser that it said is being exploited in the wild.
The shortcoming, tracked as CVE-2022-2294, relates to a heap overflow flaw in the WebRTC component that provides real-time audio and video communication capabilities in browsers without the need to install plugins or download native <div class="feedflare">
<a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=VTsr5Dm2yVw:Aj7tfW5qVYE:yIl2AUoC8zA"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=yIl2AUoC8zA" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=VTsr5Dm2yVw:Aj7tfW5qVYE:qj6IDK7rITs"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=qj6IDK7rITs" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=VTsr5Dm2yVw:Aj7tfW5qVYE:gIN9vFwOqvQ"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=VTsr5Dm2yVw:Aj7tfW5qVYE:gIN9vFwOqvQ" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=VTsr5Dm2yVw:Aj7tfW5qVYE:V_sGLiPBpWU"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=VTsr5Dm2yVw:Aj7tfW5qVYE:V_sGLiPBpWU" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=VTsr5Dm2yVw:Aj7tfW5qVYE:F7zBnMyn0Lo"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=VTsr5Dm2yVw:Aj7tfW5qVYE:F7zBnMyn0Lo" border="0"></img></a>
</div>


feed_id: tag:blogger.com,1999:blog-4802841478634147276.post-2086739092533455977
title: Researchers Share Techniques to Uncover Anonymized Ransomware Sites on Dark Web
uri: Researchers-Share-Techniques-to-Uncover-Anonymized-Ransomware-Sites-on
url: http://www.blogger.com/feeds/4802841478634147276/posts/default/2086739092533455977
content:
Cybersecurity researchers have detailed the various measures ransomware actors have taken to obscure their true identity online as well as the hosting location of their web server infrastructure.
"Most ransomware operators use hosting providers outside their country of origin (such as Sweden, Germany, and Singapore) to host their ransomware operations sites," Cisco Talos researcher Paul Eubanks <div class="feedflare">
<a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=wKs7tenMq6o:-zQHxynzUg8:yIl2AUoC8zA"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=yIl2AUoC8zA" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=wKs7tenMq6o:-zQHxynzUg8:qj6IDK7rITs"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=qj6IDK7rITs" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=wKs7tenMq6o:-zQHxynzUg8:gIN9vFwOqvQ"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=wKs7tenMq6o:-zQHxynzUg8:gIN9vFwOqvQ" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=wKs7tenMq6o:-zQHxynzUg8:V_sGLiPBpWU"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=wKs7tenMq6o:-zQHxynzUg8:V_sGLiPBpWU" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=wKs7tenMq6o:-zQHxynzUg8:F7zBnMyn0Lo"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=wKs7tenMq6o:-zQHxynzUg8:F7zBnMyn0Lo" border="0"></img></a>
</div>


feed_id: tag:blogger.com,1999:blog-4802841478634147276.post-3224521169948057236
title: As New Clues Emerges, Experts Wonder: Is REvil Back?
uri: As-New-Clues-Emerges-Experts-Wonder-Is-REvil-Back
url: http://www.blogger.com/feeds/4802841478634147276/posts/default/3224521169948057236
content:
Change is a part of life, and nothing stays the same for too long, even with hacking groups, which are at their most dangerous when working in complete silence. The notorious REvil ransomware gang, linked to the infamous JBS and Kaseya, has resurfaced three months after the arrest of its members in Russia.
The Russian domestic intelligence service, the FSB, had caught 14 people from the gang. In<div class="feedflare">
<a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=JBMpbAjLKPU:UIxILNytldY:yIl2AUoC8zA"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=yIl2AUoC8zA" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=JBMpbAjLKPU:UIxILNytldY:qj6IDK7rITs"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=qj6IDK7rITs" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=JBMpbAjLKPU:UIxILNytldY:gIN9vFwOqvQ"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=JBMpbAjLKPU:UIxILNytldY:gIN9vFwOqvQ" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=JBMpbAjLKPU:UIxILNytldY:V_sGLiPBpWU"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=JBMpbAjLKPU:UIxILNytldY:V_sGLiPBpWU" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=JBMpbAjLKPU:UIxILNytldY:F7zBnMyn0Lo"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=JBMpbAjLKPU:UIxILNytldY:F7zBnMyn0Lo" border="0"></img></a>
</div>


feed_id: tag:blogger.com,1999:blog-4802841478634147276.post-2730982183407992466
title: Researchers Uncover Malicious NPM Packages Stealing Data from Apps and Web Forms
uri: Researchers-Uncover-Malicious-NPM-Packages-Stealing-Data-from-Apps-and
url: http://www.blogger.com/feeds/4802841478634147276/posts/default/2730982183407992466
content:
A widespread software supply chain attack has targeted the NPM package manager at least since December 2021 with rogue modules designed to steal data entered in forms by users on websites that include them.
The coordinated attack, dubbed IconBurst by ReversingLabs, involves no fewer than two dozen NPM packages that include obfuscated JavaScript, which comes with malicious code to harvest <div class="feedflare">
<a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=UssisBv0luk:KE-cRMW_auI:yIl2AUoC8zA"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=yIl2AUoC8zA" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=UssisBv0luk:KE-cRMW_auI:qj6IDK7rITs"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=qj6IDK7rITs" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=UssisBv0luk:KE-cRMW_auI:gIN9vFwOqvQ"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=UssisBv0luk:KE-cRMW_auI:gIN9vFwOqvQ" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=UssisBv0luk:KE-cRMW_auI:V_sGLiPBpWU"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=UssisBv0luk:KE-cRMW_auI:V_sGLiPBpWU" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=UssisBv0luk:KE-cRMW_auI:F7zBnMyn0Lo"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=UssisBv0luk:KE-cRMW_auI:F7zBnMyn0Lo" border="0"></img></a>
</div>


feed_id: tag:blogger.com,1999:blog-4802841478634147276.post-3199939987779465901
title: Pro-China Group Uses Dragonbridge Campaign to Target Rare Earth Mining Companies
uri: Pro-China-Group-Uses-Dragonbridge-Campaign-to-Target-Rare-Earth-Mining
url: http://www.blogger.com/feeds/4802841478634147276/posts/default/3199939987779465901
content:
A pro-China influence campaign singled out rare earth mining companies in Australia, Canada, and the U.S. with negative messaging in an unsuccessful attempt to manipulate public discourse to China's benefit.
Targeted firms included Australia's Lynas Rare Earths Ltd, Canada's Appia Rare Earths &amp; Uranium Corp, and the American company USA Rare Earth, threat intelligence firm Mandiant said in a <div class="feedflare">
<a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=7wcU3D8iFG8:dLld-6Rj5v4:yIl2AUoC8zA"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=yIl2AUoC8zA" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=7wcU3D8iFG8:dLld-6Rj5v4:qj6IDK7rITs"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=qj6IDK7rITs" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=7wcU3D8iFG8:dLld-6Rj5v4:gIN9vFwOqvQ"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=7wcU3D8iFG8:dLld-6Rj5v4:gIN9vFwOqvQ" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=7wcU3D8iFG8:dLld-6Rj5v4:V_sGLiPBpWU"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=7wcU3D8iFG8:dLld-6Rj5v4:V_sGLiPBpWU" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=7wcU3D8iFG8:dLld-6Rj5v4:F7zBnMyn0Lo"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=7wcU3D8iFG8:dLld-6Rj5v4:F7zBnMyn0Lo" border="0"></img></a>
</div>


feed_id: tag:blogger.com,1999:blog-4802841478634147276.post-4441718188225875253
title: Hive Ransomware Upgrades to Rust for More Sophisticated Encryption Method
uri: Hive-Ransomware-Upgrades-to-Rust-for-More-Sophisticated-Encryption-Met
url: http://www.blogger.com/feeds/4802841478634147276/posts/default/4441718188225875253
content:
The operators of the Hive ransomware-as-a-service (RaaS) scheme have overhauled their file-encrypting software to fully migrate to Rust and adopt a more sophisticated encryption method.
"With its latest variant carrying several major upgrades, Hive also proves it's one of the fastest evolving ransomware families, exemplifying the continuously changing ransomware ecosystem," Microsoft Threat <div class="feedflare">
<a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=fAeuRzJGTek:NsW7RMxRXcU:yIl2AUoC8zA"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=yIl2AUoC8zA" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=fAeuRzJGTek:NsW7RMxRXcU:qj6IDK7rITs"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=qj6IDK7rITs" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=fAeuRzJGTek:NsW7RMxRXcU:gIN9vFwOqvQ"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=fAeuRzJGTek:NsW7RMxRXcU:gIN9vFwOqvQ" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=fAeuRzJGTek:NsW7RMxRXcU:V_sGLiPBpWU"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=fAeuRzJGTek:NsW7RMxRXcU:V_sGLiPBpWU" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=fAeuRzJGTek:NsW7RMxRXcU:F7zBnMyn0Lo"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=fAeuRzJGTek:NsW7RMxRXcU:F7zBnMyn0Lo" border="0"></img></a>
</div>


feed_id: tag:blogger.com,1999:blog-4802841478634147276.post-5171425548772004771
title: Bitter APT Hackers Continue to Target Bangladesh Military Entities
uri: Bitter-APT-Hackers-Continue-to-Target-Bangladesh-Military-Entities
url: http://www.blogger.com/feeds/4802841478634147276/posts/default/5171425548772004771
content:
Military entities located in Bangladesh continue to be at the receiving end of sustained cyberattacks by an advanced persistent threat tracked as Bitter.
"Through malicious document files and intermediate malware stages the threat actors conduct espionage by deploying Remote Access Trojans," cybersecurity firm SECUINFRA said in a new write-up published on July 5.
The findings from the <div class="feedflare">
<a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=9BvrvF5flJM:iqheTNe5wYg:yIl2AUoC8zA"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=yIl2AUoC8zA" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=9BvrvF5flJM:iqheTNe5wYg:qj6IDK7rITs"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=qj6IDK7rITs" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=9BvrvF5flJM:iqheTNe5wYg:gIN9vFwOqvQ"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=9BvrvF5flJM:iqheTNe5wYg:gIN9vFwOqvQ" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=9BvrvF5flJM:iqheTNe5wYg:V_sGLiPBpWU"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=9BvrvF5flJM:iqheTNe5wYg:V_sGLiPBpWU" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=9BvrvF5flJM:iqheTNe5wYg:F7zBnMyn0Lo"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=9BvrvF5flJM:iqheTNe5wYg:F7zBnMyn0Lo" border="0"></img></a>
</div>


feed_id: tag:blogger.com,1999:blog-4802841478634147276.post-3863498642770039365
title: The End of False Positives for Web and API Security Scanning?
uri: The-End-of-False-Positives-for-Web-and-API-Security-Scanning
url: http://www.blogger.com/feeds/4802841478634147276/posts/default/3863498642770039365
content:
July may positively disrupt and adrenalize the old-fashioned Dynamic Application Security Scanning (DAST) market, despite the coming holiday season. The pathbreaking innovation comes from ImmuniWeb, a global application security company, well known for, among other things, its free Community Edition that processes over 100,000 daily security scans of web and mobile apps. 
Today, ImmuniWeb <div class="feedflare">
<a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=q5g5OCnAfsk:xW0KiM_3If0:yIl2AUoC8zA"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=yIl2AUoC8zA" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=q5g5OCnAfsk:xW0KiM_3If0:qj6IDK7rITs"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=qj6IDK7rITs" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=q5g5OCnAfsk:xW0KiM_3If0:gIN9vFwOqvQ"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=q5g5OCnAfsk:xW0KiM_3If0:gIN9vFwOqvQ" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=q5g5OCnAfsk:xW0KiM_3If0:V_sGLiPBpWU"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=q5g5OCnAfsk:xW0KiM_3If0:V_sGLiPBpWU" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=q5g5OCnAfsk:xW0KiM_3If0:F7zBnMyn0Lo"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=q5g5OCnAfsk:xW0KiM_3If0:F7zBnMyn0Lo" border="0"></img></a>
</div>


feed_id: tag:blogger.com,1999:blog-4802841478634147276.post-2382599353339956113
title: OpenSSL Releases Patch for High-Severity Bug that Could Lead to RCE Attacks
uri: OpenSSL-Releases-Patch-for-High-Severity-Bug-that-Could-Lead-to-RCE-At
url: http://www.blogger.com/feeds/4802841478634147276/posts/default/2382599353339956113
content:
The maintainers of the OpenSSL project have released patches to address a high-severity bug in the cryptographic library that could potentially lead to remote code execution under certain scenarios.
The issue, now assigned the identifier CVE-2022-2274, has been described as a case of heap memory corruption with RSA private key operation that was introduced in OpenSSL version 3.0.4 released on <div class="feedflare">
<a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=YzYnshts4N4:cFws4ZHea20:yIl2AUoC8zA"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=yIl2AUoC8zA" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=YzYnshts4N4:cFws4ZHea20:qj6IDK7rITs"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=qj6IDK7rITs" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=YzYnshts4N4:cFws4ZHea20:gIN9vFwOqvQ"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=YzYnshts4N4:cFws4ZHea20:gIN9vFwOqvQ" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=YzYnshts4N4:cFws4ZHea20:V_sGLiPBpWU"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=YzYnshts4N4:cFws4ZHea20:V_sGLiPBpWU" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=YzYnshts4N4:cFws4ZHea20:F7zBnMyn0Lo"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=YzYnshts4N4:cFws4ZHea20:F7zBnMyn0Lo" border="0"></img></a>
</div>


feed_id: tag:blogger.com,1999:blog-4802841478634147276.post-7205283871489159037
title: Hackers Abusing BRc4 Red Team Penetration Tool in Attacks to Evade Detection
uri: Hackers-Abusing-BRc4-Red-Team-Penetration-Tool-in-Attacks-to-Evade-Det
url: http://www.blogger.com/feeds/4802841478634147276/posts/default/7205283871489159037
content:
Malicious actors have been observed abusing legitimate adversary simulation software in their attacks in an attempt to stay under the radar and evade detection.
Palo Alto Networks Unit 42 said a malware sample uploaded to the VirusTotal database on May 19, 2022, contained a payload associated with Brute Ratel C4, a relatively new sophisticated toolkit "designed to avoid detection by endpoint <div class="feedflare">
<a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=lC7vq43ln54:nixjkzUERlM:yIl2AUoC8zA"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=yIl2AUoC8zA" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=lC7vq43ln54:nixjkzUERlM:qj6IDK7rITs"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=qj6IDK7rITs" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=lC7vq43ln54:nixjkzUERlM:gIN9vFwOqvQ"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=lC7vq43ln54:nixjkzUERlM:gIN9vFwOqvQ" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=lC7vq43ln54:nixjkzUERlM:V_sGLiPBpWU"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=lC7vq43ln54:nixjkzUERlM:V_sGLiPBpWU" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=lC7vq43ln54:nixjkzUERlM:F7zBnMyn0Lo"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=lC7vq43ln54:nixjkzUERlM:F7zBnMyn0Lo" border="0"></img></a>
</div>


feed_id: tag:blogger.com,1999:blog-4802841478634147276.post-5337126819312291911
title: NIST Announces First Four Quantum-Resistant Cryptographic Algorithms
uri: NIST-Announces-First-Four-Quantum-Resistant-Cryptographic-Algorithms
url: http://www.blogger.com/feeds/4802841478634147276/posts/default/5337126819312291911
content:
The U.S. Department of Commerce's National Institute of Standards and Technology (NIST) has chosen the first set of quantum-resistant encryption algorithms that are designed to "withstand the assault of a future quantum computer."
The post-quantum cryptography (PQC) technologies include the CRYSTALS-Kyber algorithm for general encryption, and CRYSTALS-Dilithium, FALCON, and SPHINCS+ for digital <div class="feedflare">
<a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=pPQido79RLI:LNUf-_DRrWo:yIl2AUoC8zA"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=yIl2AUoC8zA" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=pPQido79RLI:LNUf-_DRrWo:qj6IDK7rITs"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=qj6IDK7rITs" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=pPQido79RLI:LNUf-_DRrWo:gIN9vFwOqvQ"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=pPQido79RLI:LNUf-_DRrWo:gIN9vFwOqvQ" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=pPQido79RLI:LNUf-_DRrWo:V_sGLiPBpWU"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=pPQido79RLI:LNUf-_DRrWo:V_sGLiPBpWU" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=pPQido79RLI:LNUf-_DRrWo:F7zBnMyn0Lo"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=pPQido79RLI:LNUf-_DRrWo:F7zBnMyn0Lo" border="0"></img></a>
</div>


feed_id: tag:blogger.com,1999:blog-4802841478634147276.post-6228491682967903558
title: Apple's New "Lockdown Mode" Protects iPhone, iPad, and Mac Against Spyware
uri: Apple-s-New-Lockdown-Mode-Protects-iPhone-iPad-and-Mac-Against-Spy
url: http://www.blogger.com/feeds/4802841478634147276/posts/default/6228491682967903558
content:
Apple on Wednesday announced it plans to introduce an enhanced security setting called Lockdown Mode in iOS 16, iPadOS 16, and macOS Ventura to safeguard high-risk users against "highly targeted cyberattacks."
The "extreme, optional protection" feature, now available for preview in beta versions of its upcoming software, is designed to counter a surge in threats posed by private companies <div class="feedflare">
<a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=wvmQpMe7xO8:Ga9pSgGiGzw:yIl2AUoC8zA"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=yIl2AUoC8zA" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=wvmQpMe7xO8:Ga9pSgGiGzw:qj6IDK7rITs"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=qj6IDK7rITs" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=wvmQpMe7xO8:Ga9pSgGiGzw:gIN9vFwOqvQ"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=wvmQpMe7xO8:Ga9pSgGiGzw:gIN9vFwOqvQ" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=wvmQpMe7xO8:Ga9pSgGiGzw:V_sGLiPBpWU"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=wvmQpMe7xO8:Ga9pSgGiGzw:V_sGLiPBpWU" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=wvmQpMe7xO8:Ga9pSgGiGzw:F7zBnMyn0Lo"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=wvmQpMe7xO8:Ga9pSgGiGzw:F7zBnMyn0Lo" border="0"></img></a>
</div>


feed_id: tag:blogger.com,1999:blog-4802841478634147276.post-7761360963746424037
title: Researchers Warn of New OrBit Linux Malware That Hijacks Execution Flow
uri: Researchers-Warn-of-New-OrBit-Linux-Malware-That-Hijacks-Execution-Flo
url: http://www.blogger.com/feeds/4802841478634147276/posts/default/7761360963746424037
content:
Cybersecurity researchers have taken the wraps off a new and entirely undetected Linux threat dubbed OrBit, signally a growing trend of malware attacks geared towards the popular operating system.
The malware gets its name from one of the filenames that's utilized to temporarily store the output of executed commands ("/tmp/.orbit"), according to cybersecurity firm Intezer.
"It can be installed <div class="feedflare">
<a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=wCG7RT70OTY:DGfgwgNMt7g:yIl2AUoC8zA"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=yIl2AUoC8zA" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=wCG7RT70OTY:DGfgwgNMt7g:qj6IDK7rITs"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=qj6IDK7rITs" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=wCG7RT70OTY:DGfgwgNMt7g:gIN9vFwOqvQ"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=wCG7RT70OTY:DGfgwgNMt7g:gIN9vFwOqvQ" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=wCG7RT70OTY:DGfgwgNMt7g:V_sGLiPBpWU"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=wCG7RT70OTY:DGfgwgNMt7g:V_sGLiPBpWU" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=wCG7RT70OTY:DGfgwgNMt7g:F7zBnMyn0Lo"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=wCG7RT70OTY:DGfgwgNMt7g:F7zBnMyn0Lo" border="0"></img></a>
</div>


feed_id: tag:blogger.com,1999:blog-4802841478634147276.post-4085805117317277650
title: Cisco and Fortinet Release Security Patches for Multiple Products
uri: Cisco-and-Fortinet-Release-Security-Patches-for-Multiple-Products
url: http://www.blogger.com/feeds/4802841478634147276/posts/default/4085805117317277650
content:
Cisco on Wednesday rolled out patches for 10 security flaws spanning multiple products, one of which is rated Critical in severity and could be weaponized to conduct absolute path traversal attacks.
The issues, tracked as CVE-2022-20812 and CVE-2022-20813, affect Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) and "could allow a remote attacker to overwrite <div class="feedflare">
<a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=5zicGTXUcvY:5lCZddUaEpo:yIl2AUoC8zA"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=yIl2AUoC8zA" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=5zicGTXUcvY:5lCZddUaEpo:qj6IDK7rITs"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=qj6IDK7rITs" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=5zicGTXUcvY:5lCZddUaEpo:gIN9vFwOqvQ"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=5zicGTXUcvY:5lCZddUaEpo:gIN9vFwOqvQ" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=5zicGTXUcvY:5lCZddUaEpo:V_sGLiPBpWU"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=5zicGTXUcvY:5lCZddUaEpo:V_sGLiPBpWU" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=5zicGTXUcvY:5lCZddUaEpo:F7zBnMyn0Lo"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=5zicGTXUcvY:5lCZddUaEpo:F7zBnMyn0Lo" border="0"></img></a>
</div>


feed_id: tag:blogger.com,1999:blog-4802841478634147276.post-5426548734625301530
title: The Age of Collaborative Security: What Tens of Thousands of Machines Witness
uri: The-Age-of-Collaborative-Security-What-Tens-of-Thousands-of-Machines
url: http://www.blogger.com/feeds/4802841478634147276/posts/default/5426548734625301530
content:
Disclaimer: This article is meant to give insight into cyber threats as seen by the community of users of CrowdSec.
What can tens of thousands of machines tell us about illegal hacker activities?
Do you remember that scene in Batman - The Dark Knight, where Batman uses a system that aggregates active sound data from countless mobile phones to create a meta sonar feed of what is going on at any <div class="feedflare">
<a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=TqEGDU3GGWg:zBLFfcDyPCQ:yIl2AUoC8zA"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=yIl2AUoC8zA" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=TqEGDU3GGWg:zBLFfcDyPCQ:qj6IDK7rITs"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=qj6IDK7rITs" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=TqEGDU3GGWg:zBLFfcDyPCQ:gIN9vFwOqvQ"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=TqEGDU3GGWg:zBLFfcDyPCQ:gIN9vFwOqvQ" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=TqEGDU3GGWg:zBLFfcDyPCQ:V_sGLiPBpWU"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=TqEGDU3GGWg:zBLFfcDyPCQ:V_sGLiPBpWU" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=TqEGDU3GGWg:zBLFfcDyPCQ:F7zBnMyn0Lo"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=TqEGDU3GGWg:zBLFfcDyPCQ:F7zBnMyn0Lo" border="0"></img></a>
</div>


feed_id: tag:blogger.com,1999:blog-4802841478634147276.post-7045101776921368685
title: Over 1200 NPM Packages Found Involved in "CuteBoi" Cryptomining Campaign
uri: Over-1200-NPM-Packages-Found-Involved-in-CuteBoi-Cryptomining-Campai
url: http://www.blogger.com/feeds/4802841478634147276/posts/default/7045101776921368685
content:
Researchers have disclosed a new large-scale cryptocurrency mining campaign targeting the NPM JavaScript package repository.
The malicious activity, attributed to a software supply chain threat actor dubbed CuteBoi, involves an array of 1,283 rogue modules that were published in an automated fashion from over 1,000 different user accounts.
"This was done using automation which includes the <div class="feedflare">
<a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=UuwEQB6OCqI:igpwoIhVtAE:yIl2AUoC8zA"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=yIl2AUoC8zA" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=UuwEQB6OCqI:igpwoIhVtAE:qj6IDK7rITs"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=qj6IDK7rITs" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=UuwEQB6OCqI:igpwoIhVtAE:gIN9vFwOqvQ"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=UuwEQB6OCqI:igpwoIhVtAE:gIN9vFwOqvQ" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=UuwEQB6OCqI:igpwoIhVtAE:V_sGLiPBpWU"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=UuwEQB6OCqI:igpwoIhVtAE:V_sGLiPBpWU" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=UuwEQB6OCqI:igpwoIhVtAE:F7zBnMyn0Lo"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=UuwEQB6OCqI:igpwoIhVtAE:F7zBnMyn0Lo" border="0"></img></a>
</div>


feed_id: tag:blogger.com,1999:blog-4802841478634147276.post-3352770107709567255
title: North Korean Maui Ransomware Actively Targeting U.S. Healthcare Organizations
uri: North-Korean-Maui-Ransomware-Actively-Targeting-U-S-Healthcare-Organi
url: http://www.blogger.com/feeds/4802841478634147276/posts/default/3352770107709567255
content:
In a new joint cybersecurity advisory, U.S. cybersecurity and intelligence agencies have warned about the use of Maui ransomware by North Korean government-backed hackers to target the healthcare sector since at least May 2021.
"North Korean state-sponsored cyber actors used Maui ransomware in these incidents to encrypt servers responsible for healthcare services—including electronic health <div class="feedflare">
<a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=SWAdPG7ro0I:XwlJ3eyHOvw:yIl2AUoC8zA"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=yIl2AUoC8zA" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=SWAdPG7ro0I:XwlJ3eyHOvw:qj6IDK7rITs"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=qj6IDK7rITs" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=SWAdPG7ro0I:XwlJ3eyHOvw:gIN9vFwOqvQ"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=SWAdPG7ro0I:XwlJ3eyHOvw:gIN9vFwOqvQ" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=SWAdPG7ro0I:XwlJ3eyHOvw:V_sGLiPBpWU"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=SWAdPG7ro0I:XwlJ3eyHOvw:V_sGLiPBpWU" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=SWAdPG7ro0I:XwlJ3eyHOvw:F7zBnMyn0Lo"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=SWAdPG7ro0I:XwlJ3eyHOvw:F7zBnMyn0Lo" border="0"></img></a>
</div>


feed_id: tag:blogger.com,1999:blog-4802841478634147276.post-2273663803330864264
title: TrickBot Gang Shifted its Focus on "Systematically" Targeting Ukraine
uri: TrickBot-Gang-Shifted-its-Focus-on-Systematically-Targeting-Ukraine
url: http://www.blogger.com/feeds/4802841478634147276/posts/default/2273663803330864264
content:
In what's being described as an "unprecedented" twist, the operators of the TrickBot malware have resorted to systematically targeting Ukraine since the onset of the war in late February 2022.
The group is believed to have orchestrated at least six phishing campaigns aimed at targets that align with Russian state interests, with the emails acting as lures for delivering malicious software such <div class="feedflare">
<a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=jGH6hG8Ig34:l11DJ5VpfO0:yIl2AUoC8zA"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=yIl2AUoC8zA" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=jGH6hG8Ig34:l11DJ5VpfO0:qj6IDK7rITs"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=qj6IDK7rITs" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=jGH6hG8Ig34:l11DJ5VpfO0:gIN9vFwOqvQ"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=jGH6hG8Ig34:l11DJ5VpfO0:gIN9vFwOqvQ" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=jGH6hG8Ig34:l11DJ5VpfO0:V_sGLiPBpWU"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=jGH6hG8Ig34:l11DJ5VpfO0:V_sGLiPBpWU" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=jGH6hG8Ig34:l11DJ5VpfO0:F7zBnMyn0Lo"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=jGH6hG8Ig34:l11DJ5VpfO0:F7zBnMyn0Lo" border="0"></img></a>
</div>


feed_id: tag:blogger.com,1999:blog-4802841478634147276.post-2143784746949465229
title: Microsoft Quietly Rolls Back Plan to Block Office VBA Macros by Default
uri: Microsoft-Quietly-Rolls-Back-Plan-to-Block-Office-VBA-Macros-by-Defaul
url: http://www.blogger.com/feeds/4802841478634147276/posts/default/2143784746949465229
content:
Five months after announcing plans to disable Visual Basic for Applications (VBA) macros by default in the Office productivity suite, Microsoft appears to have rolled back its plans.
"Based on feedback received, a rollback has started," Microsoft employee Angela Robertson said in a July 6 comment. "An update about the rollback is in progress. I apologize for any inconvenience of the rollback <div class="feedflare">
<a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=FMJYql8vSjw:qGQuK0QywMI:yIl2AUoC8zA"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=yIl2AUoC8zA" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=FMJYql8vSjw:qGQuK0QywMI:qj6IDK7rITs"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=qj6IDK7rITs" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=FMJYql8vSjw:qGQuK0QywMI:gIN9vFwOqvQ"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=FMJYql8vSjw:qGQuK0QywMI:gIN9vFwOqvQ" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=FMJYql8vSjw:qGQuK0QywMI:V_sGLiPBpWU"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=FMJYql8vSjw:qGQuK0QywMI:V_sGLiPBpWU" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=FMJYql8vSjw:qGQuK0QywMI:F7zBnMyn0Lo"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=FMJYql8vSjw:qGQuK0QywMI:F7zBnMyn0Lo" border="0"></img></a>
</div>


feed_id: tag:blogger.com,1999:blog-4802841478634147276.post-8024305594352581986
title: Why Developers Hate Changing Language Versions
uri: Why-Developers-Hate-Changing-Language-Versions
url: http://www.blogger.com/feeds/4802841478634147276/posts/default/8024305594352581986
content:
Progress powers technology forward. But progress also has a cost: by adding new capabilities and features, the developer community is constantly adjusting the building blocks. That includes the fundamental languages used to code technology solutions.
When the building blocks change, the code behind the technology solution must change too. It's a challenging and time-consuming exercise that <div class="feedflare">
<a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=rsAPlQR0Sqo:L_eRdER6wJo:yIl2AUoC8zA"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=yIl2AUoC8zA" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=rsAPlQR0Sqo:L_eRdER6wJo:qj6IDK7rITs"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=qj6IDK7rITs" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=rsAPlQR0Sqo:L_eRdER6wJo:gIN9vFwOqvQ"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=rsAPlQR0Sqo:L_eRdER6wJo:gIN9vFwOqvQ" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=rsAPlQR0Sqo:L_eRdER6wJo:V_sGLiPBpWU"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=rsAPlQR0Sqo:L_eRdER6wJo:V_sGLiPBpWU" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=rsAPlQR0Sqo:L_eRdER6wJo:F7zBnMyn0Lo"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=rsAPlQR0Sqo:L_eRdER6wJo:F7zBnMyn0Lo" border="0"></img></a>
</div>


feed_id: tag:blogger.com,1999:blog-4802841478634147276.post-2766789350727822272
title: Experts Uncover 350 Browser Extension Variants Used in ABCsoup Adware Campaign
uri: Experts-Uncover-350-Browser-Extension-Variants-Used-in-ABCsoup-Adware
url: http://www.blogger.com/feeds/4802841478634147276/posts/default/2766789350727822272
content:
A malicious browser extension with 350 variants is masquerading as a Google Translate add-on as part of an adware campaign targeting Russian users of Google Chrome, Opera, and Mozilla Firefox browsers.
Mobile security firm Zimperium dubbed the malware family ABCsoup, stating the "extensions are installed onto a victim's machine via a Windows-based executable, bypassing most endpoint security <div class="feedflare">
<a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=7obsN3OJuI4:HssHVke4gIo:yIl2AUoC8zA"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=yIl2AUoC8zA" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=7obsN3OJuI4:HssHVke4gIo:qj6IDK7rITs"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=qj6IDK7rITs" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=7obsN3OJuI4:HssHVke4gIo:gIN9vFwOqvQ"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=7obsN3OJuI4:HssHVke4gIo:gIN9vFwOqvQ" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=7obsN3OJuI4:HssHVke4gIo:V_sGLiPBpWU"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=7obsN3OJuI4:HssHVke4gIo:V_sGLiPBpWU" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=7obsN3OJuI4:HssHVke4gIo:F7zBnMyn0Lo"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=7obsN3OJuI4:HssHVke4gIo:F7zBnMyn0Lo" border="0"></img></a>
</div>


feed_id: tag:blogger.com,1999:blog-4802841478634147276.post-3711771579204915907
title: Researchers Detail Techniques LockBit Ransomware Using to Infect its Targets
uri: Researchers-Detail-Techniques-LockBit-Ransomware-Using-to-Infect-its-T
url: http://www.blogger.com/feeds/4802841478634147276/posts/default/3711771579204915907
content:
LockBit ransomware attacks are constantly evolving by making use of a wide range of techniques to infect targets while also taking steps to disable endpoint security solutions.
"The affiliates that use LockBit's services conduct their attacks according to their preference and use different tools and techniques to achieve their goal," Cybereason security analysts Loïc Castel and Gal Romano said. <div class="feedflare">
<a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=dP6AfZCUSf0:fYJgIEKU1LA:yIl2AUoC8zA"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=yIl2AUoC8zA" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=dP6AfZCUSf0:fYJgIEKU1LA:qj6IDK7rITs"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=qj6IDK7rITs" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=dP6AfZCUSf0:fYJgIEKU1LA:gIN9vFwOqvQ"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=dP6AfZCUSf0:fYJgIEKU1LA:gIN9vFwOqvQ" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=dP6AfZCUSf0:fYJgIEKU1LA:V_sGLiPBpWU"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=dP6AfZCUSf0:fYJgIEKU1LA:V_sGLiPBpWU" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=dP6AfZCUSf0:fYJgIEKU1LA:F7zBnMyn0Lo"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=dP6AfZCUSf0:fYJgIEKU1LA:F7zBnMyn0Lo" border="0"></img></a>
</div>


feed_id: tag:blogger.com,1999:blog-4802841478634147276.post-6147883765794186675
title: Researchers Warn of Raspberry Robin's Worm Targeting Windows Users
uri: Researchers-Warn-of-Raspberry-Robin-s-Worm-Targeting-Windows-Users
url: http://www.blogger.com/feeds/4802841478634147276/posts/default/6147883765794186675
content:
Cybersecurity researchers are drawing attention to an ongoing wave of attacks linked to a threat cluster tracked as Raspberry Robin that's behind a Windows malware with worm-like capabilities. 
Describing it as a "persistent" and "spreading" threat, Cybereason said it observed a number of victims in Europe.
The infections involve a worm that propagates over removable USB devices containing <div class="feedflare">
<a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=ELOWTRaymhk:tWbcSo8-7hQ:yIl2AUoC8zA"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=yIl2AUoC8zA" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=ELOWTRaymhk:tWbcSo8-7hQ:qj6IDK7rITs"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=qj6IDK7rITs" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=ELOWTRaymhk:tWbcSo8-7hQ:gIN9vFwOqvQ"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=ELOWTRaymhk:tWbcSo8-7hQ:gIN9vFwOqvQ" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=ELOWTRaymhk:tWbcSo8-7hQ:V_sGLiPBpWU"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=ELOWTRaymhk:tWbcSo8-7hQ:V_sGLiPBpWU" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=ELOWTRaymhk:tWbcSo8-7hQ:F7zBnMyn0Lo"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=ELOWTRaymhk:tWbcSo8-7hQ:F7zBnMyn0Lo" border="0"></img></a>
</div>


feed_id: tag:blogger.com,1999:blog-4802841478634147276.post-1518937336857102078
title: Hackers Exploiting Follina Bug to Deploy Rozena Backdoor
uri: Hackers-Exploiting-Follina-Bug-to-Deploy-Rozena-Backdoor
url: http://www.blogger.com/feeds/4802841478634147276/posts/default/1518937336857102078
content:
A newly observed phishing campaign is leveraging the recently disclosed Follina security vulnerability to distribute a previously undocumented backdoor on Windows systems.
"Rozena is a backdoor malware that is capable of injecting a remote shell connection back to the attacker's machine," Fortinet FortiGuard Labs researcher Cara Lin said in a report this week.
Tracked as CVE-2022-30190, the <div class="feedflare">
<a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=GT-66PEXyg8:hJJ-asYzYoc:yIl2AUoC8zA"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=yIl2AUoC8zA" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=GT-66PEXyg8:hJJ-asYzYoc:qj6IDK7rITs"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=qj6IDK7rITs" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=GT-66PEXyg8:hJJ-asYzYoc:gIN9vFwOqvQ"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=GT-66PEXyg8:hJJ-asYzYoc:gIN9vFwOqvQ" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=GT-66PEXyg8:hJJ-asYzYoc:V_sGLiPBpWU"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=GT-66PEXyg8:hJJ-asYzYoc:V_sGLiPBpWU" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=GT-66PEXyg8:hJJ-asYzYoc:F7zBnMyn0Lo"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=GT-66PEXyg8:hJJ-asYzYoc:F7zBnMyn0Lo" border="0"></img></a>
</div>


feed_id: tag:blogger.com,1999:blog-4802841478634147276.post-7724627061098901559
title: Hackers Used Fake Job Offer to Hack and Steal $540 Million from Axie Infinity
uri: Hackers-Used-Fake-Job-Offer-to-Hack-and-Steal-540-Million-from-Axie-I
url: http://www.blogger.com/feeds/4802841478634147276/posts/default/7724627061098901559
content:
The $540 million hack of Axie Infinity's Ronin Bridge in late March 2022 was the consequence of one of its former employees getting tricked by a fraudulent job offer on LinkedIn, it has emerged. 
According to a report from The Block published last week citing two people familiar with the matter, a senior engineer at the company was duped into applying for a job at a non-existent company, causing<div class="feedflare">
<a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=SsBmVy3MaRI:Gwow1UbBk8U:yIl2AUoC8zA"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=yIl2AUoC8zA" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=SsBmVy3MaRI:Gwow1UbBk8U:qj6IDK7rITs"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=qj6IDK7rITs" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=SsBmVy3MaRI:Gwow1UbBk8U:gIN9vFwOqvQ"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=SsBmVy3MaRI:Gwow1UbBk8U:gIN9vFwOqvQ" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=SsBmVy3MaRI:Gwow1UbBk8U:V_sGLiPBpWU"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=SsBmVy3MaRI:Gwow1UbBk8U:V_sGLiPBpWU" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=SsBmVy3MaRI:Gwow1UbBk8U:F7zBnMyn0Lo"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=SsBmVy3MaRI:Gwow1UbBk8U:F7zBnMyn0Lo" border="0"></img></a>
</div>


feed_id: tag:blogger.com,1999:blog-4802841478634147276.post-1200647622459702811
title: PyPI Repository Makes 2FA Security Mandatory for Critical Python Projects
uri: PyPI-Repository-Makes-2FA-Security-Mandatory-for-Critical-Python-Proje
url: http://www.blogger.com/feeds/4802841478634147276/posts/default/1200647622459702811
content:
The maintainers of the official third-party software repository for Python have begun imposing a new two-factor authentication (2FA) condition for projects deemed "critical."
"We've begun rolling out a 2FA requirement: soon, maintainers of critical projects must have 2FA enabled to publish, update, or modify them," Python Package Index (PyPI) said in a tweet last week.
"Any maintainer of a <div class="feedflare">
<a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=xcs2rHPHlgQ:2KcYENCKkHg:yIl2AUoC8zA"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=yIl2AUoC8zA" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=xcs2rHPHlgQ:2KcYENCKkHg:qj6IDK7rITs"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=qj6IDK7rITs" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=xcs2rHPHlgQ:2KcYENCKkHg:gIN9vFwOqvQ"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=xcs2rHPHlgQ:2KcYENCKkHg:gIN9vFwOqvQ" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=xcs2rHPHlgQ:2KcYENCKkHg:V_sGLiPBpWU"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=xcs2rHPHlgQ:2KcYENCKkHg:V_sGLiPBpWU" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=xcs2rHPHlgQ:2KcYENCKkHg:F7zBnMyn0Lo"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=xcs2rHPHlgQ:2KcYENCKkHg:F7zBnMyn0Lo" border="0"></img></a>
</div>


feed_id: tag:blogger.com,1999:blog-4802841478634147276.post-2088901466501857439
title: What It Takes to Tackle Your SaaS Security
uri: What-It-Takes-to-Tackle-Your-SaaS-Security
url: http://www.blogger.com/feeds/4802841478634147276/posts/default/2088901466501857439
content:
It's not a new concept that Office 365, Salesforce, Slack, Google Workspace or Zoom, etc., are amazing for enabling the hybrid workforce and hyper-productivity in businesses today. However, there are three main challenges that have arisen stemming from this evolution: (1) While SaaS apps include a host of native security settings, they need to be hardened by the security team of the organization<div class="feedflare">
<a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=mAmdVVxru9g:fBfOmU8Ub3c:yIl2AUoC8zA"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=yIl2AUoC8zA" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=mAmdVVxru9g:fBfOmU8Ub3c:qj6IDK7rITs"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=qj6IDK7rITs" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=mAmdVVxru9g:fBfOmU8Ub3c:gIN9vFwOqvQ"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=mAmdVVxru9g:fBfOmU8Ub3c:gIN9vFwOqvQ" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=mAmdVVxru9g:fBfOmU8Ub3c:V_sGLiPBpWU"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=mAmdVVxru9g:fBfOmU8Ub3c:V_sGLiPBpWU" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=mAmdVVxru9g:fBfOmU8Ub3c:F7zBnMyn0Lo"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=mAmdVVxru9g:fBfOmU8Ub3c:F7zBnMyn0Lo" border="0"></img></a>
</div>


feed_id: tag:blogger.com,1999:blog-4802841478634147276.post-2972203185431400100
title: Cloud-based Cryptocurrency Miners Targeting GitHub Actions and Azure VMs
uri: Cloud-based-Cryptocurrency-Miners-Targeting-GitHub-Actions-and-Azure-V
url: http://www.blogger.com/feeds/4802841478634147276/posts/default/2972203185431400100
content:
GitHub Actions and Azure virtual machines (VMs) are being leveraged for cloud-based cryptocurrency mining, indicating sustained attempts on the part of malicious actors to target cloud resources for illicit purposes.
"Attackers can abuse the runners or servers provided by GitHub to run an organization's pipelines and automation by maliciously downloading and installing their own cryptocurrency <div class="feedflare">
<a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=rQajsd7o6Kw:zMh7waPTiM0:yIl2AUoC8zA"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=yIl2AUoC8zA" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=rQajsd7o6Kw:zMh7waPTiM0:qj6IDK7rITs"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=qj6IDK7rITs" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=rQajsd7o6Kw:zMh7waPTiM0:gIN9vFwOqvQ"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=rQajsd7o6Kw:zMh7waPTiM0:gIN9vFwOqvQ" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=rQajsd7o6Kw:zMh7waPTiM0:V_sGLiPBpWU"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=rQajsd7o6Kw:zMh7waPTiM0:V_sGLiPBpWU" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=rQajsd7o6Kw:zMh7waPTiM0:F7zBnMyn0Lo"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=rQajsd7o6Kw:zMh7waPTiM0:F7zBnMyn0Lo" border="0"></img></a>
</div>


feed_id: tag:blogger.com,1999:blog-4802841478634147276.post-5805308517947632800
title: Microsoft Windows Autopatch is Now Generally Available for Enterprise Systems
uri: Microsoft-Windows-Autopatch-is-Now-Generally-Available-for-Enterprise
url: http://www.blogger.com/feeds/4802841478634147276/posts/default/5805308517947632800
content:
Microsoft on Monday announced the general availability of a feature called Autopatch that automatically keeps Windows and Office software up-to-date on enrolled endpoints.
The launch, which comes a day before Microsoft is expected to release its monthly round of security patches, is available for customers with Windows Enterprise E3 and E5 licenses. It, however, doesn't support Windows Education<div class="feedflare">
<a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=QyAMQ_xIDdc:S1pZqYUI55Y:yIl2AUoC8zA"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=yIl2AUoC8zA" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=QyAMQ_xIDdc:S1pZqYUI55Y:qj6IDK7rITs"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=qj6IDK7rITs" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=QyAMQ_xIDdc:S1pZqYUI55Y:gIN9vFwOqvQ"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=QyAMQ_xIDdc:S1pZqYUI55Y:gIN9vFwOqvQ" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=QyAMQ_xIDdc:S1pZqYUI55Y:V_sGLiPBpWU"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=QyAMQ_xIDdc:S1pZqYUI55Y:V_sGLiPBpWU" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=QyAMQ_xIDdc:S1pZqYUI55Y:F7zBnMyn0Lo"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=QyAMQ_xIDdc:S1pZqYUI55Y:F7zBnMyn0Lo" border="0"></img></a>
</div>


feed_id: tag:blogger.com,1999:blog-4802841478634147276.post-7744003115404943095
title: Avoiding Death by a Thousand Scripts: Using Automated Content Security Policies
uri: Avoiding-Death-by-a-Thousand-Scripts-Using-Automated-Content-Security
url: http://www.blogger.com/feeds/4802841478634147276/posts/default/7744003115404943095
content:
Businesses know they need to secure their client-side scripts. Content security policies (CSPs) are a great way to do that. But CSPs are cumbersome. One mistake and you have a potentially significant client-side security gap. Finding those gaps means long and tedious hours (or days) in manual code reviews through thousands of lines of script on your web applications. Automated content security <div class="feedflare">
<a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=UszvSnygxvw:LHIQvBOGC9c:yIl2AUoC8zA"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=yIl2AUoC8zA" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=UszvSnygxvw:LHIQvBOGC9c:qj6IDK7rITs"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=qj6IDK7rITs" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=UszvSnygxvw:LHIQvBOGC9c:gIN9vFwOqvQ"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=UszvSnygxvw:LHIQvBOGC9c:gIN9vFwOqvQ" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=UszvSnygxvw:LHIQvBOGC9c:V_sGLiPBpWU"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=UszvSnygxvw:LHIQvBOGC9c:V_sGLiPBpWU" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=UszvSnygxvw:LHIQvBOGC9c:F7zBnMyn0Lo"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=UszvSnygxvw:LHIQvBOGC9c:F7zBnMyn0Lo" border="0"></img></a>
</div>


feed_id: tag:blogger.com,1999:blog-4802841478634147276.post-3501762425157784547
title: TikTok Postpones Privacy Policy Update in Europe After Italy Warns of GDPR Breach
uri: TikTok-Postpones-Privacy-Policy-Update-in-Europe-After-Italy-Warns-of
url: http://www.blogger.com/feeds/4802841478634147276/posts/default/3501762425157784547
content:
Popular video-sharing platform TikTok on Tuesday agreed to pause a controversial privacy policy update that could have allowed it to serve targeted ads based on users' activity on the social video platform without their permission to do so.
The reversal, reported by TechCrunch, comes a day after the Italian data protection authority — the Garante per la Protezione dei Dati Personali — warned the<div class="feedflare">
<a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=IOxtxVNtFDI:OqFLgZrKHEA:yIl2AUoC8zA"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=yIl2AUoC8zA" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=IOxtxVNtFDI:OqFLgZrKHEA:qj6IDK7rITs"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=qj6IDK7rITs" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=IOxtxVNtFDI:OqFLgZrKHEA:gIN9vFwOqvQ"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=IOxtxVNtFDI:OqFLgZrKHEA:gIN9vFwOqvQ" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=IOxtxVNtFDI:OqFLgZrKHEA:V_sGLiPBpWU"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=IOxtxVNtFDI:OqFLgZrKHEA:V_sGLiPBpWU" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=IOxtxVNtFDI:OqFLgZrKHEA:F7zBnMyn0Lo"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=IOxtxVNtFDI:OqFLgZrKHEA:F7zBnMyn0Lo" border="0"></img></a>
</div>


feed_id: tag:blogger.com,1999:blog-4802841478634147276.post-6454886147284378901
title: Microsoft Releases Fix for Zero-Day Flaw in July 2022 Security Patch Rollout
uri: Microsoft-Releases-Fix-for-Zero-Day-Flaw-in-July-2022-Security-Patch-R
url: http://www.blogger.com/feeds/4802841478634147276/posts/default/6454886147284378901
content:
Microsoft released its monthly round of Patch Tuesday updates to address 84 new security flaws spanning multiple product categories, counting a zero-day vulnerability that's under active attack in the wild.
Of the 84 shortcomings, four are rated Critical, and 80 are rated Important in severity. Also separately resolved by the tech giant are two other bugs in the Chromium-based Edge browser, one <div class="feedflare">
<a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=_t7cd-2AqD8:PJ-EcSnMz80:yIl2AUoC8zA"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=yIl2AUoC8zA" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=_t7cd-2AqD8:PJ-EcSnMz80:qj6IDK7rITs"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=qj6IDK7rITs" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=_t7cd-2AqD8:PJ-EcSnMz80:gIN9vFwOqvQ"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=_t7cd-2AqD8:PJ-EcSnMz80:gIN9vFwOqvQ" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=_t7cd-2AqD8:PJ-EcSnMz80:V_sGLiPBpWU"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=_t7cd-2AqD8:PJ-EcSnMz80:V_sGLiPBpWU" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=_t7cd-2AqD8:PJ-EcSnMz80:F7zBnMyn0Lo"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=_t7cd-2AqD8:PJ-EcSnMz80:F7zBnMyn0Lo" border="0"></img></a>
</div>


feed_id: tag:blogger.com,1999:blog-4802841478634147276.post-611666180046028020
title: Researchers Uncover New Attempts by Qakbot Malware to Evade Detection
uri: Researchers-Uncover-New-Attempts-by-Qakbot-Malware-to-Evade-Detection
url: http://www.blogger.com/feeds/4802841478634147276/posts/default/611666180046028020
content:
The operators behind the Qakbot malware are transforming their delivery vectors in an attempt to sidestep detection.
"Most recently, threat actors have transformed their techniques to evade detection by using ZIP file extensions, enticing file names with common formats, and Excel (XLM) 4.0 to trick victims into downloading malicious attachments that install Qakbot," Zscaler Threatlabz <div class="feedflare">
<a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=ZiKHSsDd6PI:U_IdduhZpCY:yIl2AUoC8zA"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=yIl2AUoC8zA" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=ZiKHSsDd6PI:U_IdduhZpCY:qj6IDK7rITs"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=qj6IDK7rITs" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=ZiKHSsDd6PI:U_IdduhZpCY:gIN9vFwOqvQ"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=ZiKHSsDd6PI:U_IdduhZpCY:gIN9vFwOqvQ" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=ZiKHSsDd6PI:U_IdduhZpCY:V_sGLiPBpWU"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=ZiKHSsDd6PI:U_IdduhZpCY:V_sGLiPBpWU" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=ZiKHSsDd6PI:U_IdduhZpCY:F7zBnMyn0Lo"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=ZiKHSsDd6PI:U_IdduhZpCY:F7zBnMyn0Lo" border="0"></img></a>
</div>


feed_id: tag:blogger.com,1999:blog-4802841478634147276.post-6356248713206281001
title: Researchers Uncover New Variants of the ChromeLoader Browser Hijacking Malware
uri: Researchers-Uncover-New-Variants-of-the-ChromeLoader-Browser-Hijacking
url: http://www.blogger.com/feeds/4802841478634147276/posts/default/6356248713206281001
content:
Cybersecurity researchers have uncovered new variants of the ChromeLoader information-stealing malware, highlighting its evolving feature set in a short span of time.
Primarily used for hijacking victims' browser searches and presenting advertisements, ChromeLoader came to light in January 2022 and has been distributed in the form of ISO or DMG file downloads advertised via QR codes on Twitter <div class="feedflare">
<a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=1oFQCTWR9rs:OzxNlh6Z14g:yIl2AUoC8zA"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=yIl2AUoC8zA" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=1oFQCTWR9rs:OzxNlh6Z14g:qj6IDK7rITs"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=qj6IDK7rITs" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=1oFQCTWR9rs:OzxNlh6Z14g:gIN9vFwOqvQ"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=1oFQCTWR9rs:OzxNlh6Z14g:gIN9vFwOqvQ" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=1oFQCTWR9rs:OzxNlh6Z14g:V_sGLiPBpWU"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=1oFQCTWR9rs:OzxNlh6Z14g:V_sGLiPBpWU" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=1oFQCTWR9rs:OzxNlh6Z14g:F7zBnMyn0Lo"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=1oFQCTWR9rs:OzxNlh6Z14g:F7zBnMyn0Lo" border="0"></img></a>
</div>


feed_id: tag:blogger.com,1999:blog-4802841478634147276.post-5507800709349321939
title: Microsoft Warns of Large-Scale AiTM Phishing Attacks Against Over 10,000 Organizations
uri: Microsoft-Warns-of-Large-Scale-AiTM-Phishing-Attacks-Against-Over-10-0
url: http://www.blogger.com/feeds/4802841478634147276/posts/default/5507800709349321939
content:
Microsoft on Tuesday disclosed that a large-scale phishing campaign targeted over 10,000 organizations since September 2021 by hijacking Office 365's authentication process even on accounts secured with multi-factor authentication (MFA).
"The attackers then used the stolen credentials and session cookies to access affected users' mailboxes and perform follow-on business email compromise (BEC) <div class="feedflare">
<a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=n7FtAGdDFVE:_7y3yxqW8jM:yIl2AUoC8zA"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=yIl2AUoC8zA" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=n7FtAGdDFVE:_7y3yxqW8jM:qj6IDK7rITs"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=qj6IDK7rITs" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=n7FtAGdDFVE:_7y3yxqW8jM:gIN9vFwOqvQ"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=n7FtAGdDFVE:_7y3yxqW8jM:gIN9vFwOqvQ" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=n7FtAGdDFVE:_7y3yxqW8jM:V_sGLiPBpWU"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=n7FtAGdDFVE:_7y3yxqW8jM:V_sGLiPBpWU" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=n7FtAGdDFVE:_7y3yxqW8jM:F7zBnMyn0Lo"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=n7FtAGdDFVE:_7y3yxqW8jM:F7zBnMyn0Lo" border="0"></img></a>
</div>


feed_id: tag:blogger.com,1999:blog-4802841478634147276.post-8775335294896222346
title: 5 Questions You Need to Ask About Your Firewall Security
uri: 5-Questions-You-Need-to-Ask-About-Your-Firewall-Security
url: http://www.blogger.com/feeds/4802841478634147276/posts/default/8775335294896222346
content:
Often, organizations think of firewall security as a one-and-done type of solution. They install firewalls, then assume that they are "good to go" without investigating whether or not these solutions are actually protecting their systems in the best way possible. "Set it and forget it!"
Instead of just relying on firewalls and assuming that they will always protect their businesses from cyber <div class="feedflare">
<a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=A9MJCzziLHI:lxOCVF-7PoY:yIl2AUoC8zA"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=yIl2AUoC8zA" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=A9MJCzziLHI:lxOCVF-7PoY:qj6IDK7rITs"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=qj6IDK7rITs" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=A9MJCzziLHI:lxOCVF-7PoY:gIN9vFwOqvQ"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=A9MJCzziLHI:lxOCVF-7PoY:gIN9vFwOqvQ" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=A9MJCzziLHI:lxOCVF-7PoY:V_sGLiPBpWU"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=A9MJCzziLHI:lxOCVF-7PoY:V_sGLiPBpWU" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=A9MJCzziLHI:lxOCVF-7PoY:F7zBnMyn0Lo"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=A9MJCzziLHI:lxOCVF-7PoY:F7zBnMyn0Lo" border="0"></img></a>
</div>


feed_id: tag:blogger.com,1999:blog-4802841478634147276.post-7416713357059505236
title: U.S. FTC Vows to Crack Down on illegal Use and Sharing of Citizens' Sensitive Data
uri: U-S-FTC-Vows-to-Crack-Down-on-illegal-Use-and-Sharing-of-Citizens-Se
url: http://www.blogger.com/feeds/4802841478634147276/posts/default/7416713357059505236
content:
The U.S. Federal Trade Commission (FTC) warned this week that it will crack down on tech companies' illegal use and sharing of highly sensitive data and false claims about data anonymization.
"While many consumers may happily offer their location data in exchange for real-time crowd-sourced advice on the fastest route home, they likely think differently about having their thinly-disguised online<div class="feedflare">
<a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=Tc8FqHrYe3g:OWUUstEQ26Q:yIl2AUoC8zA"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=yIl2AUoC8zA" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=Tc8FqHrYe3g:OWUUstEQ26Q:qj6IDK7rITs"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=qj6IDK7rITs" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=Tc8FqHrYe3g:OWUUstEQ26Q:gIN9vFwOqvQ"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=Tc8FqHrYe3g:OWUUstEQ26Q:gIN9vFwOqvQ" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=Tc8FqHrYe3g:OWUUstEQ26Q:V_sGLiPBpWU"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=Tc8FqHrYe3g:OWUUstEQ26Q:V_sGLiPBpWU" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=Tc8FqHrYe3g:OWUUstEQ26Q:F7zBnMyn0Lo"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=Tc8FqHrYe3g:OWUUstEQ26Q:F7zBnMyn0Lo" border="0"></img></a>
</div>


feed_id: tag:blogger.com,1999:blog-4802841478634147276.post-3731608006091688525
title: New UEFI Firmware Vulnerabilities Impact Several Lenovo Notebook Models
uri: New-UEFI-Firmware-Vulnerabilities-Impact-Several-Lenovo-Notebook-Model
url: http://www.blogger.com/feeds/4802841478634147276/posts/default/3731608006091688525
content:
Consumer electronics maker Lenovo on Tuesday rolled out fixes to contain three security flaws in its UEFI firmware affecting over 70 product models.
"The vulnerabilities can be exploited to achieve arbitrary code execution in the early phases of the platform boot, possibly allowing the attackers to hijack the OS execution flow and disable some important security features," Slovak cybersecurity <div class="feedflare">
<a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=pgAnbjDZ2Dg:tGlG3auwvzQ:yIl2AUoC8zA"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=yIl2AUoC8zA" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=pgAnbjDZ2Dg:tGlG3auwvzQ:qj6IDK7rITs"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=qj6IDK7rITs" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=pgAnbjDZ2Dg:tGlG3auwvzQ:gIN9vFwOqvQ"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=pgAnbjDZ2Dg:tGlG3auwvzQ:gIN9vFwOqvQ" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=pgAnbjDZ2Dg:tGlG3auwvzQ:V_sGLiPBpWU"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=pgAnbjDZ2Dg:tGlG3auwvzQ:V_sGLiPBpWU" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=pgAnbjDZ2Dg:tGlG3auwvzQ:F7zBnMyn0Lo"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=pgAnbjDZ2Dg:tGlG3auwvzQ:F7zBnMyn0Lo" border="0"></img></a>
</div>


feed_id: tag:blogger.com,1999:blog-4802841478634147276.post-7567273942337889139
title: New 'Retbleed' Speculative Execution Attack Affects AMD and Intel CPUs
uri: New-Retbleed-Speculative-Execution-Attack-Affects-AMD-and-Intel-CPUs
url: http://www.blogger.com/feeds/4802841478634147276/posts/default/7567273942337889139
content:
Security researchers have uncovered yet another vulnerability affecting numerous older AMD and Intel microprocessors that could bypass current defenses and result in Spectre-based speculative-execution attacks.
Dubbed Retbleed by ETH Zurich researchers Johannes Wikner and Kaveh Razavi, the issues are tracked as CVE-2022-29900 (AMD) and CVE-2022-29901 (Intel), with the chipmakers releasing <div class="feedflare">
<a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=kfNIE8hYo2k:iE00ZMKZs_4:yIl2AUoC8zA"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=yIl2AUoC8zA" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=kfNIE8hYo2k:iE00ZMKZs_4:qj6IDK7rITs"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=qj6IDK7rITs" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=kfNIE8hYo2k:iE00ZMKZs_4:gIN9vFwOqvQ"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=kfNIE8hYo2k:iE00ZMKZs_4:gIN9vFwOqvQ" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=kfNIE8hYo2k:iE00ZMKZs_4:V_sGLiPBpWU"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=kfNIE8hYo2k:iE00ZMKZs_4:V_sGLiPBpWU" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=kfNIE8hYo2k:iE00ZMKZs_4:F7zBnMyn0Lo"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=kfNIE8hYo2k:iE00ZMKZs_4:F7zBnMyn0Lo" border="0"></img></a>
</div>


feed_id: tag:blogger.com,1999:blog-4802841478634147276.post-4331487020388959289
title: Pakistani Hackers Targeting Indian Students in Latest Malware Campaign
uri: Pakistani-Hackers-Targeting-Indian-Students-in-Latest-Malware-Campaign
url: http://www.blogger.com/feeds/4802841478634147276/posts/default/4331487020388959289
content:
The advanced persistent threat (APT) group known as Transparent Tribe has been attributed to a new ongoing phishing campaign targeting students at various educational institutions in India at least since December 2021.
"This new campaign also suggests that the APT is actively expanding its network of victims to include civilian users," Cisco Talos said in a report shared with The Hacker News.
<div class="feedflare">
<a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=2xL5hwFcrII:vNbI2q4s2fE:yIl2AUoC8zA"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=yIl2AUoC8zA" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=2xL5hwFcrII:vNbI2q4s2fE:qj6IDK7rITs"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=qj6IDK7rITs" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=2xL5hwFcrII:vNbI2q4s2fE:gIN9vFwOqvQ"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=2xL5hwFcrII:vNbI2q4s2fE:gIN9vFwOqvQ" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=2xL5hwFcrII:vNbI2q4s2fE:V_sGLiPBpWU"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=2xL5hwFcrII:vNbI2q4s2fE:V_sGLiPBpWU" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=2xL5hwFcrII:vNbI2q4s2fE:F7zBnMyn0Lo"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=2xL5hwFcrII:vNbI2q4s2fE:F7zBnMyn0Lo" border="0"></img></a>
</div>


feed_id: tag:blogger.com,1999:blog-4802841478634147276.post-5253933690829835840
title: Former CIA Engineer Convicted of Leaking 'Vault 7' Hacking Secrets to Wikileaks
uri: Former-CIA-Engineer-Convicted-of-Leaking-Vault-7-Hacking-Secrets-to
url: http://www.blogger.com/feeds/4802841478634147276/posts/default/5253933690829835840
content:
Joshua Schulte, a former programmer with the U.S. Central Intelligence Agency (CIA), has been found guilty of leaking a trove of classified hacking tools and exploits dubbed Vault 7 to WikiLeaks.
The 33-year-old engineer had been charged in June 2018 with unauthorized disclosure of classified information and theft of classified material. Schulte also faces a separate trial on charges related to <div class="feedflare">
<a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=b0ZDjll7-hQ:Iz8CagD5vfI:yIl2AUoC8zA"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=yIl2AUoC8zA" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=b0ZDjll7-hQ:Iz8CagD5vfI:qj6IDK7rITs"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=qj6IDK7rITs" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=b0ZDjll7-hQ:Iz8CagD5vfI:gIN9vFwOqvQ"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=b0ZDjll7-hQ:Iz8CagD5vfI:gIN9vFwOqvQ" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=b0ZDjll7-hQ:Iz8CagD5vfI:V_sGLiPBpWU"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=b0ZDjll7-hQ:Iz8CagD5vfI:V_sGLiPBpWU" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=b0ZDjll7-hQ:Iz8CagD5vfI:F7zBnMyn0Lo"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=b0ZDjll7-hQ:Iz8CagD5vfI:F7zBnMyn0Lo" border="0"></img></a>
</div>


feed_id: tag:blogger.com,1999:blog-4802841478634147276.post-7666269484637335302
title: State-Backed Hackers Targeting Journalists in Widespread Espionage Campaigns
uri: State-Backed-Hackers-Targeting-Journalists-in-Widespread-Espionage-Cam
url: http://www.blogger.com/feeds/4802841478634147276/posts/default/7666269484637335302
content:
Nation-state hacking groups aligned with China, Iran, North Korea, and Turkey have been targeting journalists to conduct espionage and spread malware as part of a series of campaigns since early 2021.
"Most commonly, phishing attacks targeting journalists are used for espionage or to gain key insights into the inner workings of another government, company, or other area of state-designated <div class="feedflare">
<a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=gDIounJY2FI:wnj4j3J84lY:yIl2AUoC8zA"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=yIl2AUoC8zA" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=gDIounJY2FI:wnj4j3J84lY:qj6IDK7rITs"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=qj6IDK7rITs" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=gDIounJY2FI:wnj4j3J84lY:gIN9vFwOqvQ"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=gDIounJY2FI:wnj4j3J84lY:gIN9vFwOqvQ" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=gDIounJY2FI:wnj4j3J84lY:V_sGLiPBpWU"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=gDIounJY2FI:wnj4j3J84lY:V_sGLiPBpWU" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=gDIounJY2FI:wnj4j3J84lY:F7zBnMyn0Lo"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=gDIounJY2FI:wnj4j3J84lY:F7zBnMyn0Lo" border="0"></img></a>
</div>


feed_id: tag:blogger.com,1999:blog-4802841478634147276.post-8204376646361912711
title: A Simple Formula for Getting Your IT Security Budget Approved
uri: A-Simple-Formula-for-Getting-Your-IT-Security-Budget-Approved
url: http://www.blogger.com/feeds/4802841478634147276/posts/default/8204376646361912711
content:
Although there is a greater awareness of cybersecurity threats than ever before, it is becoming increasingly difficult for IT departments to get their security budgets approved. Security budgets seem to shrink each year and IT pros are constantly being asked to do more with less. Even so, the situation may not be hopeless. There are some things that IT pros can do to improve the chances of <div class="feedflare">
<a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=sc-Zgz4geuc:L8aNyDKFDOw:yIl2AUoC8zA"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=yIl2AUoC8zA" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=sc-Zgz4geuc:L8aNyDKFDOw:qj6IDK7rITs"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=qj6IDK7rITs" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=sc-Zgz4geuc:L8aNyDKFDOw:gIN9vFwOqvQ"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=sc-Zgz4geuc:L8aNyDKFDOw:gIN9vFwOqvQ" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=sc-Zgz4geuc:L8aNyDKFDOw:V_sGLiPBpWU"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=sc-Zgz4geuc:L8aNyDKFDOw:V_sGLiPBpWU" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=sc-Zgz4geuc:L8aNyDKFDOw:F7zBnMyn0Lo"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=sc-Zgz4geuc:L8aNyDKFDOw:F7zBnMyn0Lo" border="0"></img></a>
</div>


feed_id: tag:blogger.com,1999:blog-4802841478634147276.post-8476595650331289596
title: Microsoft Details App Sandbox Escape Bug Impacting Apple iOS, iPadOS, macOS Devices
uri: Microsoft-Details-App-Sandbox-Escape-Bug-Impacting-Apple-iOS-iPadOS
url: http://www.blogger.com/feeds/4802841478634147276/posts/default/8476595650331289596
content:
Microsoft on Wednesday shed light on a now patched security vulnerability affecting Apple's operating systems that, if successfully exploited, could allow attackers to escalate device privileges and deploy malware.
"An attacker could take advantage of this sandbox escape vulnerability to gain elevated privileges on the affected device or execute malicious commands like installing additional <div class="feedflare">
<a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=EnqgtDPwUF0:t5pCRG7DLgs:yIl2AUoC8zA"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=yIl2AUoC8zA" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=EnqgtDPwUF0:t5pCRG7DLgs:qj6IDK7rITs"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?d=qj6IDK7rITs" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=EnqgtDPwUF0:t5pCRG7DLgs:gIN9vFwOqvQ"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=EnqgtDPwUF0:t5pCRG7DLgs:gIN9vFwOqvQ" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=EnqgtDPwUF0:t5pCRG7DLgs:V_sGLiPBpWU"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=EnqgtDPwUF0:t5pCRG7DLgs:V_sGLiPBpWU" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/theHackerNews_com?a=EnqgtDPwUF0:t5pCRG7DLgs:F7zBnMyn0Lo"><img src="http://feeds.feedburner.com/~ff/theHackerNews_com?i=EnqgtDPwUF0:t5pCRG7DLgs:F7zBnMyn0Lo" border="0"></img></a>
</div>


feed_id: tag:blogger.com,1999:blog-4802841478634147276.post-4014016984274077591
title: Researchers Detail Malicious Tools Used by Cyberespionage Group Earth Aughisky
uri: Researchers-Detail-Malicious-Tools-Used-by-Cyberespionage-Group-Earth
url: https://thehackernews.com/2022/10/researchers-detail-malicious-tools-used.html
content:
A new piece of research has detailed the increasingly sophisticated nature of the malware toolset employed by an advanced persistent threat (APT) group named Earth Aughisky.
"Over the last decade, the group has continued to make adjustments in the tools and malware deployments on specific targets located in Taiwan and, more recently, Japan," Trend Micro disclosed in a technical profile last week


feed_id: tag:blogger.com,1999:blog-4802841478634147276.post-3532090865318642783
title: Experts Warn of Stealthy PowerShell Backdoor Disguising as Windows Update
uri: Experts-Warn-of-Stealthy-PowerShell-Backdoor-Disguising-as-Windows-Upd
url: https://thehackernews.com/2022/10/experts-warn-of-stealthy-powershell.html
content:
Details have emerged about a previously undocumented and fully undetectable (FUD) PowerShell backdoor that gains its stealth by disguising itself as part of a Windows update process.
"The covert self-developed tool and the associated C2 commands seem to be the work of a sophisticated, unknown threat actor who has targeted approximately 100 victims," Tomer Bar, director of security research at 


feed_id: tag:blogger.com,1999:blog-4802841478634147276.post-7632605953144449125
title: New TikTok Privacy Policy Confirms Chinese Staff Can Access European Users' Data
uri: New-TikTok-Privacy-Policy-Confirms-Chinese-Staff-Can-Access-European-U
url: https://thehackernews.com/2022/11/new-tiktok-privacy-policy-confirms.html
content:
Popular short-form video-sharing service TikTok is revising its privacy policy for European users to make it explicitly clear that user data can be accessed by some employees from across the world, including China.
The ByteDance-owned platform, which currently stores European user data in the U.S. and Singapore, said the revision is part of its ongoing data governance efforts to limit employee 


feed_id: tag:blogger.com,1999:blog-4802841478634147276.post-8626500522949885162
title: Google to Roll Out Privacy Sandbox Beta on Android 13 by Early 2023
uri: Google-to-Roll-Out-Privacy-Sandbox-Beta-on-Android-13-by-Early-2023
url: https://thehackernews.com/2022/11/google-to-roll-out-privacy-sandbox-beta.html
content:
Internet behemoth Google on Tuesday said it plans to roll out Privacy Sandbox for Android in beta to mobile devices running Android 13 starting early next year.
"The Privacy Sandbox Beta will be available for ad tech and app developers who wish to test the ads-related APIs as part of their solutions," the company said.
To that end, developers will need to complete an enrollment process in order 


feed_id: https://thehackernews.com/2022/12/google-rolls-out-new-chrome-browser.html
title: Google Rolls Out New Chrome Browser Update to Patch Yet Another Zero-Day Vulnerability
uri: 2022-12-04-Google-Rolls-Out-New-Chrome-Browser-Update-to-Patch-Yet-Another-Zero-D
url: https://thehackernews.com/2022/12/google-rolls-out-new-chrome-browser.html
content:
Search giant Google on Friday released an out-of-band security update to fix a new actively exploited zero-day flaw in its Chrome web browser.
The high-severity flaw, tracked as CVE-2022-4262, concerns a type confusion bug in the V8 JavaScript engine. Clement Lecigne of Google's Threat Analysis Group (TAG) has been credited with reporting the issue on November 29, 2022.
Type confusion


feed_id: https://thehackernews.com/2022/12/hackers-sign-android-malware-apps-with.html
title: Hackers Sign Android Malware Apps with Compromised Platform Certificates
uri: 2022-12-04-Hackers-Sign-Android-Malware-Apps-with-Compromised-Platform-Certificat
url: https://thehackernews.com/2022/12/hackers-sign-android-malware-apps-with.html
content:
Platform certificates used by Android smartphone vendors like Samsung, LG, and MediaTek have been found to be abused to sign malicious apps.
The findings were first discovered and reported by Google reverse engineer Łukasz Siewierski on Thursday.
"A platform certificate is the application signing certificate used to sign the 'android' application on the system image," a report filed through the


feed_id: https://thehackernews.com/2022/12/cisa-warns-of-multiple-critical.html
title: CISA Warns of Multiple Critical Vulnerabilities Affecting Mitsubishi Electric PLCs
uri: 2022-12-04-CISA-Warns-of-Multiple-Critical-Vulnerabilities-Affecting-Mitsubishi-E
url: https://thehackernews.com/2022/12/cisa-warns-of-multiple-critical.html
content:
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) this week released an Industrial Control Systems (ICS) advisory warning of multiple vulnerabilities in Mitsubishi Electric GX Works3 engineering software.
"Successful exploitation of these vulnerabilities could allow unauthorized users to gain access to the MELSEC iQ-R/F/L series CPU modules and the MELSEC iQ-R series OPC UA server


feed_id: https://thehackernews.com/2022/12/the-value-of-old-systems.html
title: The Value of Old Systems
uri: 2022-12-04-The-Value-of-Old-Systems
url: https://thehackernews.com/2022/12/the-value-of-old-systems.html
content:
Old technology solutions – every organization has a few of them tucked away somewhere. 
It could be an old and unsupported storage system or a tape library holding the still-functional backups from over 10 years ago. 
This is a common scenario with software too. For example, consider an accounting software suite that was extremely expensive when it was purchased. If the vendor eventually went


feed_id: https://thehackernews.com/2022/12/researchers-disclose-supply-chain-flaw.html
title: Researchers Disclose Supply-Chain Flaw Affecting IBM Cloud Databases for PostgreSQL
uri: 2022-12-04-Researchers-Disclose-Supply-Chain-Flaw-Affecting-IBM-Cloud-Databases-f
url: https://thehackernews.com/2022/12/researchers-disclose-supply-chain-flaw.html
content:
IBM has fixed a high-severity security vulnerability affecting its Cloud Databases (ICD) for PostgreSQL product that could be potentially exploited to tamper with internal repositories and run unauthorized code.
The privilege escalation flaw (CVSS score: 8.8), dubbed "Hell's Keychain" by cloud security firm Wiz, has been described as a "first-of-its-kind supply-chain attack vector impacting a


feed_id: https://thehackernews.com/2022/12/hackers-exploiting-redis-vulnerability.html
title: Hackers Exploiting Redis Vulnerability to Deploy New Redigo Malware on Servers
uri: 2022-12-04-Hackers-Exploiting-Redis-Vulnerability-to-Deploy-New-Redigo-Malware-on
url: https://thehackernews.com/2022/12/hackers-exploiting-redis-vulnerability.html
content:
A previously undocumented Go-based malware is targeting Redis servers with the goal of taking control of the infected systems and likely building a botnet network.
The attacks involve taking advantage of a critical security vulnerability in the open source, in-memory, key-value store that was disclosed earlier this year to deploy Redigo, according to cloud security firm Aqua.


feed_id: https://thehackernews.com/2022/12/what-cisa-reporting-rule-means-for-your.html
title: What the CISA Reporting Rule Means for Your IT Security Protocol
uri: 2022-12-04-What-the-CISA-Reporting-Rule-Means-for-Your-IT-Security-Protocol
url: https://thehackernews.com/2022/12/what-cisa-reporting-rule-means-for-your.html
content:
The new Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA) requires CISA to create rules regarding cyber incident reporting by critical infrastructure organizations. The RFI and hearings precede a Notice of Proposed Rulemaking (NPRM) that CISA must publish sooner than 24 months from the enactment of CIRCIA, which the President signed into law in March. The sessions and


feed_id: https://thehackernews.com/2022/12/watch-out-these-android-keyboard-apps.html
title: Watch Out! These Android Keyboard Apps With 2 Million Installs Can be Hacked Remotely
uri: 2022-12-04-Watch-Out-These-Android-Keyboard-Apps-With-2-Million-Installs-Can-be
url: https://thehackernews.com/2022/12/watch-out-these-android-keyboard-apps.html
content:
Multiple unpatched vulnerabilities have been discovered in three Android apps that allow a smartphone to be used as a remote keyboard and mouse.
The apps in question are Lazy Mouse, PC Keyboard, and Telepad, which have been cumulatively downloaded over two million times from the Google Play Store. Telepad is no longer available through the app marketplace but can be downloaded from its website.


feed_id: https://thehackernews.com/2022/12/cuba-ransomware-extorted-over-60.html
title: Cuba Ransomware Extorted Over $60 Million in Ransom Fees from More than 100 Entities
uri: 2022-12-04-Cuba-Ransomware-Extorted-Over-60-Million-in-Ransom-Fees-from-More-tha
url: https://thehackernews.com/2022/12/cuba-ransomware-extorted-over-60.html
content:
The threat actors behind Cuba (aka COLDDRAW) ransomware have received more than $60 million in ransom payments and compromised over 100 entities across the world as of August 2022.
In a new advisory shared by the U.S. Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI), the agencies highlighted a "sharp increase in both the number of compromised


feed_id: https://thehackernews.com/2022/12/google-accuses-spanish-spyware-vendor.html
title: Google Accuses Spanish Spyware Vendor of Exploiting Chrome, Firefox, & Windows Zero-Days
uri: Google-Accuses-Spanish-Spyware-Vendor-of-Exploiting-Chrome-Firefox
url: https://thehackernews.com/2022/12/google-accuses-spanish-spyware-vendor.html
content:
A Barcelona-based surveillanceware vendor named Variston IT is said to have surreptitiously planted spyware on targeted devices by exploiting several zero-day flaws in Google Chrome, Mozilla Firefox, and Windows, some of which date back to December 2018.
"Their Heliconia framework exploits n-day vulnerabilities in Chrome, Firefox, and Microsoft Defender, and provides all the tools necessary to


feed_id: https://thehackernews.com/2022/12/hackers-leak-another-set-of-medibank.html
title: Hackers Leak Another Set of Medibank Customer Data on the Dark Web
uri: 2022-12-04-Hackers-Leak-Another-Set-of-Medibank-Customer-Data-on-the-Dark-Web
url: https://thehackernews.com/2022/12/hackers-leak-another-set-of-medibank.html
content:
Medibank on Thursday confirmed that the threat actors behind the devastating cyber attack have posted another dump of data stolen from its systems on the dark web after its refusal to pay a ransom.
"We are in the process of analyzing the data, but the data released appears to be the data we believed the criminal stole," the Australian health insurer said.
"While our investigation continues there


feed_id: https://thehackernews.com/2022/12/researchers-disclose-critical-rce.html
title: Researchers Disclose Critical RCE Vulnerability Affecting Quarkus Java Framework
uri: 2022-12-04-Researchers-Disclose-Critical-RCE-Vulnerability-Affecting-Quarkus-Java
url: https://thehackernews.com/2022/12/researchers-disclose-critical-rce.html
content:
A critical security vulnerability has been disclosed in the Quarkus Java framework that could be potentially exploited to achieve remote code execution on affected systems.
Tracked as CVE-2022-4116 (CVSS score: 9.8), the shortcoming could be trivially abused by a malicious actor without any privileges.
"The vulnerability is found in the Dev UI Config Editor, which is vulnerable to drive-by


feed_id: https://thehackernews.com/2022/12/what-developers-need-to-fight-battle.html
title: What Developers Need to Fight the Battle Against Common Vulnerabilities
uri: 2022-12-04-What-Developers-Need-to-Fight-the-Battle-Against-Common-Vulnerabilitie
url: https://thehackernews.com/2022/12/what-developers-need-to-fight-battle.html
content:
Today's threat landscape is constantly evolving, and now more than ever, organizations and businesses in every sector have a critical need to consistently produce and maintain secure software. While some verticals - like the finance industry, for example - have been subject to regulatory and compliance requirements for some time, we are seeing a steady increase in attention on cybersecurity best


feed_id: https://thehackernews.com/2022/12/schoolyard-bully-trojan-apps-stole.html
title: Schoolyard Bully Trojan Apps Stole Facebook Credentials from Over 300,000 Android Users
uri: 2022-12-04-Schoolyard-Bully-Trojan-Apps-Stole-Facebook-Credentials-from-Over-300
url: https://thehackernews.com/2022/12/schoolyard-bully-trojan-apps-stole.html
content:
More than 300,000 users across 71 countries have been victimized by a new Android threat campaign called the Schoolyard Bully Trojan.
Mainly designed to steal Facebook credentials, the malware is camouflaged as legitimate education-themed applications to lure unsuspecting users into downloading them.
The apps, which were available for download from the official Google Play Store, have now been


feed_id: https://thehackernews.com/2022/12/researchers-accidentally-crashed.html
title: Researchers 'Accidentally’ Crash KmsdBot Cryptocurrency Mining Botnet Network
uri: 2022-12-04-Researchers-Accidentally-Crash-KmsdBot-Cryptocurrency-Mining-Botne
url: https://thehackernews.com/2022/12/researchers-accidentally-crashed.html
content:
An ongoing analysis into an up-and-coming cryptocurrency mining botnet known as KmsdBot has led to it being accidentally taken down.
KmsdBot, as christened by the Akamai Security Intelligence Response Team (SIRT), came to light mid-November 2022 for its ability to brute-force systems with weak SSH credentials.
The botnet strikes both Windows and Linux devices spanning a wide range of


feed_id: https://thehackernews.com/2022/12/lastpass-suffers-another-security.html
title: LastPass Suffers Another Security Breach; Exposed Some Customers Information
uri: 2022-12-04-LastPass-Suffers-Another-Security-Breach-Exposed-Some-Customers-Infor
url: https://thehackernews.com/2022/12/lastpass-suffers-another-security.html
content:
Popular password management service LastPass said it's investigating a second security incident that involved attackers accessing some of its customer information.
"We recently detected unusual activity within a third-party cloud storage service, which is currently shared by both LastPass and its affiliate, GoTo," LastPass CEO Karim Toubba said.
GoTo, formerly called LogMeIn, acquired LastPass


feed_id: https://thehackernews.com/2022/12/north-korea-hackers-using-new-dolphin.html
title: North Korea Hackers Using New "Dolphin" Backdoor to Spy on South Korean Targets
uri: 2022-12-04-North-Korea-Hackers-Using-New-Dolphin-Backdoor-to-Spy-on-South-Korea
url: https://thehackernews.com/2022/12/north-korea-hackers-using-new-dolphin.html
content:
The North Korea-linked ScarCruft group has been attributed to a previously undocumented backdoor called Dolphin that the threat actor has used against targets located in its southern counterpart.
"The backdoor [...] has a wide range of spying capabilities, including monitoring drives and portable devices and exfiltrating files of interest, keylogging and taking screenshots, and stealing


feed_id: https://thehackernews.com/2022/11/researchers-find-way-malicious-npm.html
title: Researchers Find a Way Malicious NPM Libraries Can Evade Vulnerability Detection
uri: 2022-12-04-Researchers-Find-a-Way-Malicious-NPM-Libraries-Can-Evade-Vulnerability
url: https://thehackernews.com/2022/11/researchers-find-way-malicious-npm.html
content:
New findings from cybersecurity firm JFrog show that malware targeting the npm ecosystem can evade security checks by taking advantage of an "unexpected behavior" in the npm command line interface (CLI) tool.
npm CLI's install and audit commands have built-in capabilities to check a package and all of its dependencies for known vulnerabilities, effectively acting as a warning mechanism for


feed_id: https://thehackernews.com/2022/11/this-malicious-app-abused-hacked.html
title: This Malicious App Abused Hacked Devices to Create Fake Accounts on Multiple Platforms
uri: 2022-12-04-This-Malicious-App-Abused-Hacked-Devices-to-Create-Fake-Accounts-on-Mu
url: https://thehackernews.com/2022/11/this-malicious-app-abused-hacked.html
content:
A malicious Android SMS application discovered on the Google Play Store has been found to stealthily harvest text messages with the goal of creating accounts on a wide range of platforms like Facebook, Google, and WhatsApp.
The app, named Symoo (com.vanjan.sms), had over 100,000 downloads and functioned as a relay for transmitting messages to a server, which advertises an account creation


feed_id: https://thehackernews.com/2022/11/french-electricity-provider-fined-for.html
title: French Electricity Provider Fined for Storing Users’ Passwords with Weak MD5 Algorithm
uri: 2022-12-04-French-Electricity-Provider-Fined-for-Storing-Users-Passwords-with
url: https://thehackernews.com/2022/11/french-electricity-provider-fined-for.html
content:
The French data protection watchdog on Tuesday fined electricity provider  Électricité de France (EDF) €600,000 for violating the European Union General Data Protection Regulation (GDPR) requirements.
The Commission nationale de l'informatique et des libertés (CNIL) said the electric utility breached European regulation by storing the passwords for over 25,800 accounts by hashing them using the 


feed_id: https://thehackernews.com/2022/11/australia-passes-bill-to-fine-companies.html
title: Australia Passes Bill to Fine Companies up to $50 Million for Data Breaches
uri: 2022-12-04-Australia-Passes-Bill-to-Fine-Companies-up-to-50-Million-for-Data-Bre
url: https://thehackernews.com/2022/11/australia-passes-bill-to-fine-companies.html
content:
The Australian government has passed a bill that markedly increases the penalty for companies suffering from serious or repeated data breaches.
To that end, the maximum fines have been bumped up from the current AU$2.22 million to AU$50 million, 30% of an entity's adjusted turnover in the relevant period, or three times the value of any benefit obtained through the misuse of information,


feed_id: https://thehackernews.com/2022/11/3-new-vulnerabilities-affect-ot.html
title: 3 New Vulnerabilities Affect OT Products from German Companies Festo and CODESYS
uri: 3-New-Vulnerabilities-Affect-OT-Products-from-German-Companies-Festo-a
url: https://thehackernews.com/2022/11/3-new-vulnerabilities-affect-ot.html
content:
Researchers have disclosed details of three new security vulnerabilities affecting operational technology (OT) products from CODESYS and Festo that could lead to source code tampering and denial-of-service (DoS).
The vulnerabilities, reported by Forescout Vedere Labs, are the latest in a long list of flaws collectively tracked under the name OT:ICEFALL.
"These issues exemplify either an


feed_id: https://thehackernews.com/2022/11/chinese-cyber-espionage-hackers-using.html
title: Chinese Cyber Espionage Hackers Using USB Devices to Target Entities in Philippines
uri: 2022-12-04-Chinese-Cyber-Espionage-Hackers-Using-USB-Devices-to-Target-Entities-i
url: https://thehackernews.com/2022/11/chinese-cyber-espionage-hackers-using.html
content:
A threat actor with a suspected China nexus has been linked to a set of espionage attacks in the Philippines that primarily relies on USB devices as an initial infection vector.
Mandiant, which is part of Google Cloud, is tracking the cluster under its uncategorized moniker UNC4191. An analysis of the artifacts used in the intrusions indicates that the campaign dates as far back as September


feed_id: https://thehackernews.com/2022/11/new-flaw-in-acer-laptops-could-let.html
title: New Flaw in Acer Laptops Could Let Attackers Disable Secure Boot Protection
uri: 2022-12-04-New-Flaw-in-Acer-Laptops-Could-Let-Attackers-Disable-Secure-Boot-Prote
url: https://thehackernews.com/2022/11/new-flaw-in-acer-laptops-could-let.html
content:
Acer has released a firmware update to address a security vulnerability that could be potentially weaponized to turn off UEFI Secure Boot on affected machines.
Tracked as CVE-2022-4020, the high-severity vulnerability affects five different models that consist of Aspire A315-22, A115-21, and A315-22G, and Extensa EX215-21 and EX215-21G.

The PC maker described the vulnerability as


feed_id: https://thehackernews.com/2022/11/hackers-using-trending-invisible.html
title: Hackers Using Trending TikTok 'Invisible Challenge' to Spread Malware
uri: Hackers-Using-Trending-TikTok-Invisible-Challenge-to-Spread-Malware
url: https://thehackernews.com/2022/11/hackers-using-trending-invisible.html
content:
Threat actors are capitalizing on a popular TikTok challenge to trick users into downloading information-stealing malware, according to new research from Checkmarx.
The trend, called Invisible Challenge, involves applying a filter known as Invisible Body that just leaves behind a silhouette of the person's body.
But the fact that individuals filming such videos could be undressed has led to a


feed_id: https://thehackernews.com/2022/11/7-cyber-security-tips-for-smbs.html
title: 7 Cyber Security Tips for SMBs
uri: 2022-12-04-7-Cyber-Security-Tips-for-SMBs
url: https://thehackernews.com/2022/11/7-cyber-security-tips-for-smbs.html
content:
When the headlines focus on breaches of large enterprises like the Optus breach, it’s easy for smaller businesses to think they’re not a target for hackers. Surely, they’re not worth the time or effort? 
Unfortunately, when it comes to cyber security, size doesn’t matter. 
Assuming you’re not a target leads to lax security practices in many SMBs who lack the knowledge or expertise to put simple


feed_id: https://thehackernews.com/2022/11/irish-regulator-fines-facebook-277.html
title: Irish Regulator Fines Facebook $277 Million for Leak of Half a Billion Users' Data
uri: 2022-12-04-Irish-Regulator-Fines-Facebook-277-Million-for-Leak-of-Half-a-Billion
url: https://thehackernews.com/2022/11/irish-regulator-fines-facebook-277.html
content:
Ireland's Data Protection Commission (DPC) has levied fines of €265 million ($277 million) against Meta Platforms for failing to safeguard the personal data of more than half a billion users of its Facebook service, ramping up privacy enforcement against U.S. tech firms.
The fines follow an inquiry initiated by the European regulator on April 14, 2021, close on the heels of a leak of a "collated


feed_id: https://thehackernews.com/2022/11/cisa-warns-of-actively-exploited.html
title: CISA Warns of Actively Exploited Critical Oracle Fusion Middleware Vulnerability
uri: 2022-12-04-CISA-Warns-of-Actively-Exploited-Critical-Oracle-Fusion-Middleware-Vul
url: https://thehackernews.com/2022/11/cisa-warns-of-actively-exploited.html
content:
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a critical flaw impacting Oracle Fusion Middleware to its Known Exploited Vulnerabilities (KEV) Catalog, citing evidence of active exploitation.
The vulnerability, tracked as CVE-2021-35587, carries a CVSS score of 9.8 and impacts Oracle Access Manager (OAM) versions 11.1.2.3.0, 12.2.1.3.0, and 12.2.1.4.0.


feed_id: https://thehackernews.com/2022/11/researchers-detail-appsync-cross-tenant.html
title: Researchers Detail AppSync Cross-Tenant Vulnerability in Amazon Web Services
uri: 2022-12-04-Researchers-Detail-AppSync-Cross-Tenant-Vulnerability-in-Amazon-Web-Se
url: https://thehackernews.com/2022/11/researchers-detail-appsync-cross-tenant.html
content:
Amazon Web Services (AWS) has resolved a cross-tenant vulnerability in its platform that could be weaponized by an attacker to gain unauthorized access to resources.
The issue relates to a confused deputy problem, a type of privilege escalation where a program that doesn't have permission to perform an action can coerce a more-privileged entity to perform the action.
The shortcoming was reported


feed_id: https://thehackernews.com/2022/11/the-5-cornerstones-for-effective-cyber.html
title: The 5 Cornerstones for an Effective Cyber Security Awareness Training
uri: 2022-12-04-The-5-Cornerstones-for-an-Effective-Cyber-Security-Awareness-Training
url: https://thehackernews.com/2022/11/the-5-cornerstones-for-effective-cyber.html
content:
It's not news that phishing attacks are getting more complex and happening more often. This year alone, APWG reported a record-breaking total of 1,097,811 phishing attacks. These attacks continue to target organizations and individuals to gain their sensitive information. 
The hard news: they're often successful, have a long-lasting negative impact on your organization and employees, including:


feed_id: https://thehackernews.com/2022/11/over-dozen-new-bmc-firmware-flaws.html
title: Over a Dozen New BMC Firmware Flaws Expose OT and IoT Devices to Remote Attacks
uri: 2022-12-04-Over-a-Dozen-New-BMC-Firmware-Flaws-Expose-OT-and-IoT-Devices-to-Remot
url: https://thehackernews.com/2022/11/over-dozen-new-bmc-firmware-flaws.html
content:
Over a dozen security flaws have been discovered in baseboard management controller (BMC) firmware from Lanner that could expose operational technology (OT) and internet of things (IoT) networks to remote attacks.
BMC refers to a specialized service processor, a system-on-chip (SoC), that's found in server motherboards and is used for remote monitoring and management of a host system, including


feed_id: https://thehackernews.com/2022/11/elon-musk-confirms-twitter-20-will.html
title: Elon Musk Confirms Twitter 2.0 will Bring End-to-End Encryption to Direct Messages
uri: 2022-12-04-Elon-Musk-Confirms-Twitter-2-0-will-Bring-End-to-End-Encryption-to-Dir
url: https://thehackernews.com/2022/11/elon-musk-confirms-twitter-20-will.html
content:
Twitter chief executive Elon Musk confirmed plans for end-to-end encryption (E2EE) for direct messages on the platform.
The feature is part of Musk's vision for Twitter 2.0, which is expected to be what's called an "everything app." Other functionalities include longform tweets and payments, according to a slide deck shared by Musk over the weekend.

The company's plans for


feed_id: https://thehackernews.com/2022/11/all-you-need-to-know-about-emotet-in.html
title: All You Need to Know About Emotet in 2022
uri: 2022-12-04-All-You-Need-to-Know-About-Emotet-in-2022
url: https://thehackernews.com/2022/11/all-you-need-to-know-about-emotet-in.html
content:
For 6 months, the infamous Emotet botnet has shown almost no activity, and now it's distributing malicious spam. Let's dive into details and discuss all you need to know about the notorious malware to combat it.
Why is everyone scared of Emotet?
Emotet is by far one of the most dangerous trojans ever created. The malware became a very destructive program as it grew in scale and sophistication.


feed_id: https://thehackernews.com/2022/11/us-bans-chinese-telecom-equipment-and.html
title: U.S. Bans Chinese Telecom Equipment and Surveillance Cameras Over National Security Risk
uri: 2022-12-04-U-S-Bans-Chinese-Telecom-Equipment-and-Surveillance-Cameras-Over-Nati
url: https://thehackernews.com/2022/11/us-bans-chinese-telecom-equipment-and.html
content:
The U.S. Federal Communications Commission (FCC) formally announced it will no longer authorize electronic equipment from Huawei, ZTE, Hytera, Hikvision, and Dahua, deeming them an "unacceptable" national security threat.
All these Chinese telecom and video surveillance companies were previously included in the Covered List as of March 12, 2021.
"The FCC is committed to protecting our national


feed_id: https://thehackernews.com/2022/11/russia-based-ransomboggs-ransomware.html
title: Russia-based RansomBoggs Ransomware Targeted Several Ukrainian Organizations
uri: 2022-12-04-Russia-based-RansomBoggs-Ransomware-Targeted-Several-Ukrainian-Organiz
url: https://thehackernews.com/2022/11/russia-based-ransomboggs-ransomware.html
content:
Ukraine has come under a fresh onslaught of ransomware attacks that mirror previous intrusions attributed to the Russia-based Sandworm nation-state group.
Slovak cybersecurity company ESET, which dubbed the new ransomware strain RansomBoggs, said the attacks against several Ukrainian entities were first detected on November 21, 2022.
"While the malware written in .NET is new, its deployment is


feed_id: https://thehackernews.com/2022/11/update-chrome-browser-now-to-patch-new.html
title: Update Chrome Browser Now to Patch New Actively Exploited Zero-Day Flaw
uri: 2022-12-04-Update-Chrome-Browser-Now-to-Patch-New-Actively-Exploited-Zero-Day-Fla
url: https://thehackernews.com/2022/11/update-chrome-browser-now-to-patch-new.html
content:
Google on Thursday released software updates to address yet another zero-day flaw in its Chrome web browser.
Tracked as CVE-2022-4135, the high-severity vulnerability has been described as a heap buffer overflow in the GPU component. Clement Lecigne of Google's Threat Analysis Group (TAG) has been credited with reporting the flaw on November 22, 2022.
Heap-based buffer overflow bugs can be 


feed_id: https://thehackernews.com/2022/11/dell-hp-and-lenovo-devices-found-using.html
title: Dell, HP, and Lenovo Devices Found Using Outdated OpenSSL Versions
uri: 2022-12-04-Dell-HP-and-Lenovo-Devices-Found-Using-Outdated-OpenSSL-Versions
url: https://thehackernews.com/2022/11/dell-hp-and-lenovo-devices-found-using.html
content:
An analysis of firmware images across devices from Dell, HP, and Lenovo has revealed the presence of outdated versions of the OpenSSL cryptographic library, underscoring a supply chain risk.
EFI Development Kit, aka EDK, is an open source implementation of the Unified Extensible Firmware Interface (UEFI), which functions as an interface between the operating system and the firmware embedded in


feed_id: https://thehackernews.com/2022/11/uk-police-arrest-142-in-global.html
title: U.K. Police Arrest 142 in Global Crackdown on 'iSpoof' Phone Spoofing Service
uri: 2022-12-04-U-K-Police-Arrest-142-in-Global-Crackdown-on-iSpoof-Phone-Spoofing
url: https://thehackernews.com/2022/11/uk-police-arrest-142-in-global.html
content:
A coordinated law enforcement effort has dismantled an online phone number spoofing service called iSpoof and arrested 142 individuals linked to the operation.
The websites, ispoof[.]me and ispoof[.]cc, allowed the crooks to "impersonate trusted corporations or contacts to access sensitive information from victims," Europol said in a press statement.
Worldwide losses exceeded €115 million ($


feed_id: https://thehackernews.com/2022/11/interpol-seized-130-million-from.html
title: Interpol Seized $130 Million from Cybercriminals in Global "HAECHI-III" Crackdown Operation
uri: 2022-12-04-Interpol-Seized-130-Million-from-Cybercriminals-in-Global-HAECHI-III
url: https://thehackernews.com/2022/11/interpol-seized-130-million-from.html
content:
Interpol on Thursday announced the seizure of $130 million worth of virtual assets in connection with a global crackdown on cyber-enabled financial crimes and money laundering.
The international police operation, dubbed HAECHI-III, transpired between June 28 and November 23, 2022, resulting in the arrests of 975 individuals and the closure of more than 1,600 cases.
This comprised two fugitives


feed_id: https://thehackernews.com/2022/11/new-ransomexx-ransomware-variant.html
title: New RansomExx Ransomware Variant Rewritten in the Rust Programming Language
uri: 2022-12-04-New-RansomExx-Ransomware-Variant-Rewritten-in-the-Rust-Programming-Lan
url: https://thehackernews.com/2022/11/new-ransomexx-ransomware-variant.html
content:
The operators of the RansomExx ransomware have become the latest to develop a new variant fully rewritten in the Rust programming language, following other strains like BlackCat, Hive, and Luna.
The latest version, dubbed RansomExx2 by the threat actor known as Hive0091 (aka DefrayX), is primarily designed to run on the Linux operating system, although it's expected that a Windows version will


feed_id: https://thehackernews.com/2022/11/million-of-android-devices-still-dont.html
title: Millions of Android Devices Still Don't Have Patches for Mali GPU Flaws
uri: 2022-12-04-Millions-of-Android-Devices-Still-Don-t-Have-Patches-for-Mali-GPU-Flaw
url: https://thehackernews.com/2022/11/million-of-android-devices-still-dont.html
content:
A set of five medium-severity security flaws in Arm's Mali GPU driver has continued to remain unpatched on Android devices for months, despite fixes released by the chipmaker.
Google Project Zero, which discovered and reported the bugs, said Arm addressed the shortcomings in July and August 2022.
"These fixes have not yet made it downstream to affected Android devices (including Pixel, Samsung,


feed_id: https://thehackernews.com/2022/11/boost-your-security-with-europes.html
title: Boost Your Security with Europe's Leading Bug Bounty Platform
uri: 2022-12-04-Boost-Your-Security-with-Europe-s-Leading-Bug-Bounty-Platform
url: https://thehackernews.com/2022/11/boost-your-security-with-europes.html
content:
As 2022 comes to an end, now's the time to level up your bug bounty program with Intigriti.
Are you experiencing slow bug bounty lead times, gaps in security skills, or low-quality reports from researchers? Intigriti's expert triage team and global community of ethical hackers are enabling businesses to protect themselves against every emerging cybersecurity threat.
Join the likes of Intel,


feed_id: https://thehackernews.com/2022/11/bahamut-cyber-espionage-hackers.html
title: Bahamut Cyber Espionage Hackers Targeting Android Users with Fake VPN Apps
uri: 2022-12-04-Bahamut-Cyber-Espionage-Hackers-Targeting-Android-Users-with-Fake-VPN
url: https://thehackernews.com/2022/11/bahamut-cyber-espionage-hackers.html
content:
The cyber espionage group known as Bahamut has been attributed as behind a highly targeted campaign that infects users of Android devices with malicious apps designed to extract sensitive information.
The activity, which has been active since January 2022, entails distributing rogue VPN apps through a fake SecureVPN website set up for this purpose, Slovak cybersecurity firm ESET said in a new


feed_id: https://thehackernews.com/2022/11/this-android-file-manager-app-infected.html
title: This Android File Manager App Infected Thousands of Devices with SharkBot Malware
uri: 2022-12-04-This-Android-File-Manager-App-Infected-Thousands-of-Devices-with-Shark
url: https://thehackernews.com/2022/11/this-android-file-manager-app-infected.html
content:
The Android banking fraud malware known as SharkBot has reared its head once again on the official Google Play Store, posing as file managers to bypass the app marketplace's restrictions.
A majority of the users who downloaded the rogue apps are located in the U.K. and Italy, Romanian cybersecurity company Bitdefender said in an analysis published this week.
SharkBot, first discovered towards


feed_id: https://thehackernews.com/2022/11/black-basta-ransomware-gang-actively.html
title: Black Basta Ransomware Gang Actively Infiltrating U.S. Companies with Qakbot Malware
uri: 2022-12-04-Black-Basta-Ransomware-Gang-Actively-Infiltrating-U-S-Companies-with
url: https://thehackernews.com/2022/11/black-basta-ransomware-gang-actively.html
content:
Companies based in the U.S. have been at the receiving end of an "aggressive" Qakbot malware campaign that leads to Black Basta ransomware infections on compromised networks.
"In this latest campaign, the Black Basta ransomware gang is using QakBot malware to create an initial point of entry and move laterally within an organization's network," Cybereason researchers Joakim Kandefelt and


feed_id: https://thehackernews.com/2022/11/34-russian-hacker-groups-stole-over-50.html
title: 34 Russian Cybercrime Groups Stole Over 50 Million Passwords with Stealer Malware
uri: 2022-12-04-34-Russian-Cybercrime-Groups-Stole-Over-50-Million-Passwords-with-Stea
url: https://thehackernews.com/2022/11/34-russian-hacker-groups-stole-over-50.html
content:
As many as 34 Russian-speaking gangs distributing information-stealing malware under the stealer-as-a-service model stole no fewer than 50 million passwords in the first seven months of 2022.
"The underground market value of stolen logs and compromised card details is estimated around $5.8 million," Singapore-headquartered Group-IB said in a report shared with The Hacker News.
Aside from looting


feed_id: https://thehackernews.com/2022/11/ducktail-malware-operation-evolves-with.html
title: Ducktail Malware Operation Evolves with New Malicious Capabilities
uri: 2022-12-04-Ducktail-Malware-Operation-Evolves-with-New-Malicious-Capabilities
url: https://thehackernews.com/2022/11/ducktail-malware-operation-evolves-with.html
content:
The operators of the Ducktail information stealer have demonstrated a "relentless willingness to persist" and continued to update their malware as part of an ongoing financially driven campaign.
"The malware is designed to steal browser cookies and take advantage of authenticated Facebook sessions to steal information from the victim's Facebook account," WithSecure researcher Mohammad Kazem


feed_id: https://thehackernews.com/2022/11/top-cyber-threats-facing-e-commerce.html
title: Top Cyber Threats Facing E-Commerce Sites This Holiday Season
uri: 2022-12-04-Top-Cyber-Threats-Facing-E-Commerce-Sites-This-Holiday-Season
url: https://thehackernews.com/2022/11/top-cyber-threats-facing-e-commerce.html
content:
Delivering a superior customer experience is essential for any e-commerce business. For those companies, there's a lot at stake this holiday season. According to Digital Commerce 360, nearly $1.00 of every $4.00 spent on retail purchases during the 2022 holiday season will be spent online, resulting in $224 billion in e-commerce sales. To ensure your e-commerce site is ready for the holiday rush


feed_id: https://thehackernews.com/2022/11/hackers-exploiting-abandoned-boa-web.html
title: Hackers Exploiting Abandoned Boa Web Servers to Target Critical Industries
uri: 2022-12-04-Hackers-Exploiting-Abandoned-Boa-Web-Servers-to-Target-Critical-Indust
url: https://thehackernews.com/2022/11/hackers-exploiting-abandoned-boa-web.html
content:
Microsoft on Tuesday disclosed the intrusion activity aimed at Indian power grid entities earlier this year likely involved the exploitation of security flaws in a now-discontinued web server called Boa.
The tech behemoth's cybersecurity division said the vulnerable component poses a "supply chain risk that may affect millions of organizations and devices."
The findings build on a prior report 


feed_id: https://thehackernews.com/2022/11/meta-takes-down-fake-facebook-and.html
title: Meta Takes Down Fake Facebook and Instagram Accounts Linked to Pro-U.S. Influence Operation
uri: 2022-12-04-Meta-Takes-Down-Fake-Facebook-and-Instagram-Accounts-Linked-to-Pro-U-S
url: https://thehackernews.com/2022/11/meta-takes-down-fake-facebook-and.html
content:
Meta Platforms on Tuesday said it took down a network of accounts and pages across Facebook and Instagram that were operated by people associated with the U.S. military to spread narratives that depicted the country in a favorable light in the Middle East and Central Asia.
The network, which originated from the U.S., primarily singled out Afghanistan, Algeria, Iran, Iraq, Kazakhstan, Kyrgyzstan,


feed_id: https://thehackernews.com/2022/12/new-gotrim-botnet-attempting-to-break.html
title: New GoTrim Botnet Attempting to Break into WordPress Sites' Admin Accounts
uri: 2022-12-14-New-GoTrim-Botnet-Attempting-to-Break-into-WordPress-Sites-Admin-Acco
url: https://thehackernews.com/2022/12/new-gotrim-botnet-attempting-to-break.html
content:
A new Go-based botnet has been spotted scanning and brute-forcing self-hosted websites using the WordPress content management system (CMS) to seize control of the targeted systems.
"This new brute forcer is part of a new campaign we have named GoTrim because it was written in Go and uses ':::trim:::' to split data communicated to and from the C2 server," Fortinet FortiGuard Labs researchers


feed_id: https://thehackernews.com/2022/12/ransomware-attackers-use-microsoft.html
title: Ransomware Attackers Use Microsoft-Signed Drivers to Gain Access to Systems
uri: 2022-12-14-Ransomware-Attackers-Use-Microsoft-Signed-Drivers-to-Gain-Access-to-Sy
url: https://thehackernews.com/2022/12/ransomware-attackers-use-microsoft.html
content:
Microsoft on Tuesday disclosed it took steps to suspend accounts that were used to publish malicious drivers that were certified by its Windows Hardware Developer Program were used to sign malware.
The tech giant said its investigation revealed the activity was restricted to a number of developer program accounts and that no further compromise was detected.
Cryptographically signing malware is


feed_id: https://thehackernews.com/2022/12/why-pci-dss-40-should-be-on-your-radar.html
title: Why PCI DSS 4.0 Should Be on Your Radar in 2023
uri: 2022-12-14-Why-PCI-DSS-4-0-Should-Be-on-Your-Radar-in-2023
url: https://thehackernews.com/2022/12/why-pci-dss-40-should-be-on-your-radar.html
content:
Protecting customer data is critical for any business accepting online payment information. The Payment Card Industry Data Security Standard (PCI DSS), created by leading credit card companies, establishes best practices for protecting consumers' information. By adhering to these standards, businesses can ensure that their customer's personal and financial information is secure. 
The PCI DSS


feed_id: https://thehackernews.com/2022/12/december-2022-patch-tuesday-get-latest.html
title: December 2022 Patch Tuesday: Get Latest Security Updates from Microsoft and More
uri: 2022-12-14-December-2022-Patch-Tuesday-Get-Latest-Security-Updates-from-Microsof
url: https://thehackernews.com/2022/12/december-2022-patch-tuesday-get-latest.html
content:
Tech giant Microsoft released its last set of monthly security updates for 2022 with fixes for 49 vulnerabilities across its software products.
Of the 49 bugs, six are rated Critical, 40 are rated Important, and three are rated Moderate in severity. The updates are in addition to 24 vulnerabilities that have been addressed in the Chromium-based Edge browser since the start of the month.


feed_id: https://thehackernews.com/2022/12/hackers-actively-exploiting-citrix-adc.html
title: Hackers Actively Exploiting Citrix ADC and Gateway Zero-Day Vulnerability
uri: 2022-12-14-Hackers-Actively-Exploiting-Citrix-ADC-and-Gateway-Zero-Day-Vulnerabil
url: https://thehackernews.com/2022/12/hackers-actively-exploiting-citrix-adc.html
content:
The U.S. National Security Agency (NSA) on Tuesday said a threat actor tracked as APT5 has been actively exploiting a zero-day flaw in Citrix Application Delivery Controller (ADC) and Gateway to take over affected systems.
The critical remote code execution vulnerability, identified as CVE-2022-27518, could allow an unauthenticated attacker to execute commands remotely on vulnerable devices and


feed_id: https://thehackernews.com/2022/12/new-actively-exploited-zero-day.html
title: New Actively Exploited Zero-Day Vulnerability Discovered in Apple Products
uri: 2022-12-14-New-Actively-Exploited-Zero-Day-Vulnerability-Discovered-in-Apple-Prod
url: https://thehackernews.com/2022/12/new-actively-exploited-zero-day.html
content:
Apple on Tuesday rolled out security updates to iOS, iPadOS, macOS, tvOS, and Safari web browser to address a new zero-day vulnerability that could result in the execution of malicious code.
Tracked as CVE-2022-42856, the issue has been described by the tech giant as a type confusion issue in the WebKit browser engine that could be triggered when processing specially crafted content, leading to


feed_id: https://thehackernews.com/2022/12/google-launches-largest-distributed.html
title: Google Launches OSV-Scanner Tool to Identify Open Source Vulnerabilities
uri: Google-Launches-OSV-Scanner-Tool-to-Identify-Open-Source-Vulnerabiliti
url: https://thehackernews.com/2022/12/google-launches-largest-distributed.html
content:
Google on Tuesday announced the open source availability of OSV-Scanner, a scanner that aims to offer easy access to vulnerability information about various projects.
The Go-based tool, powered by the Open Source Vulnerabilities (OSV) database, is designed to connect "a project's list of dependencies with the vulnerabilities that affect them," Google software engineer Rex Pan in a post shared


feed_id: https://thehackernews.com/2022/12/serious-attacks-could-have-been-staged.html
title: Serious Attacks Could Have Been Staged Through This Amazon ECR Public Gallery Vulnerability
uri: 2022-12-14-Serious-Attacks-Could-Have-Been-Staged-Through-This-Amazon-ECR-Public
url: https://thehackernews.com/2022/12/serious-attacks-could-have-been-staged.html
content:
A critical security flaw has been disclosed in Amazon Elastic Container Registry (ECR) Public Gallery that could have been potentially exploited to stage a multitude of attacks, according to cloud security firm Lightspin.
"By exploiting this vulnerability, a malicious actor could delete all images in the Amazon ECR Public Gallery or update the image contents to inject malicious code," Gafnit


feed_id: https://thehackernews.com/2022/12/cybersecurity-experts-uncover-inner.html
title: Cybersecurity Experts Uncover Inner Workings of Destructive Azov Ransomware
uri: 2022-12-14-Cybersecurity-Experts-Uncover-Inner-Workings-of-Destructive-Azov-Ranso
url: https://thehackernews.com/2022/12/cybersecurity-experts-uncover-inner.html
content:
Cybersecurity researchers have published the inner workings of a new wiper called Azov Ransomware that's deliberately designed to corrupt data and "inflict impeccable damage" to compromised systems.
Distributed through another malware loader known as SmokeLoader, the malware has been described as an "effective, fast, and unfortunately unrecoverable data wiper," by Israeli cybersecurity company


feed_id: https://thehackernews.com/2022/12/malware-strains-targeting-python-and.html
title: Malware Strains Targeting Python and JavaScript Developers Through Official Repositories
uri: 2022-12-14-Malware-Strains-Targeting-Python-and-JavaScript-Developers-Through-Off
url: https://thehackernews.com/2022/12/malware-strains-targeting-python-and.html
content:
An active malware campaign is targeting the Python Package Index (PyPI) and npm repositories for Python and JavaScript with typosquatted and fake modules that deploy a ransomware strain, marking the latest security issue to affect software supply chains.
The typosquatted Python packages all impersonate the popular requests library: dequests, fequests, gequests, rdquests, reauests, reduests,


feed_id: https://thehackernews.com/2022/12/fortinet-warns-of-active-exploitation.html
title: Fortinet Warns of Active Exploitation of New SSL-VPN Pre-auth RCE Vulnerability
uri: 2022-12-14-Fortinet-Warns-of-Active-Exploitation-of-New-SSL-VPN-Pre-auth-RCE-Vuln
url: https://thehackernews.com/2022/12/fortinet-warns-of-active-exploitation.html
content:
Fortinet on Monday issued emergency patches for a severe security flaw affecting its FortiOS SSL-VPN product that it said is being actively exploited in the wild.
Tracked as CVE-2022-42475 (CVSS score: 9.3), the critical bug relates to a heap-based buffer overflow vulnerability that could allow an unauthenticated attacker to execute arbitrary code via specially crafted requests.
The company said


feed_id: https://thehackernews.com/2022/12/researchers-demonstrate-how-edr-and.html
title: Researchers Demonstrate How EDR and Antivirus Can Be Weaponized Against Users
uri: 2022-12-14-Researchers-Demonstrate-How-EDR-and-Antivirus-Can-Be-Weaponized-Agains
url: https://thehackernews.com/2022/12/researchers-demonstrate-how-edr-and.html
content:
High-severity security vulnerabilities have been disclosed in different endpoint detection and response (EDR) and antivirus (AV) products that could be exploited to turn them into data wipers.
"This wiper runs with the permissions of an unprivileged user yet has the ability to wipe almost any file on a system, including system files, and make a computer completely unbootable," SafeBreach Labs


feed_id: https://thehackernews.com/2022/12/top-4-saas-security-threats-for-2023.html
title: Top 4 SaaS Security Threats for 2023
uri: 2022-12-14-Top-4-SaaS-Security-Threats-for-2023
url: https://thehackernews.com/2022/12/top-4-saas-security-threats-for-2023.html
content:
With 2022 coming to a close, there is no better time to buckle down and prepare to face the security challenges in the year to come. This past year has seen its fair share of breaches, attacks, and leaks, forcing organizations to scramble to protect their SaaS stacks. March alone saw three different breaches from Microsoft, Hubspot, and Okta. 
With SaaS sprawl ever growing and becoming more


feed_id: https://thehackernews.com/2022/12/google-adds-passkey-support-to-chrome.html
title: Google Adds Passkey Support to Chrome for Windows, macOS and Android
uri: 2022-12-14-Google-Adds-Passkey-Support-to-Chrome-for-Windows-macOS-and-Android
url: https://thehackernews.com/2022/12/google-adds-passkey-support-to-chrome.html
content:
Google has officially begun rolling out support for passkeys, the next-generation passwordless login standard, to its stable version of Chrome web browser.
"Passkeys are a significantly safer replacement for passwords and other phishable authentication factors," the tech giant's Ali Sarraf said. "They cannot be reused, don't leak in server breaches, and protect users from phishing attacks."
The


feed_id: https://thehackernews.com/2022/12/cryptocurrency-mining-campaign-hits.html
title: Cryptocurrency Mining Campaign Hits Linux Users with Go-based CHAOS Malware
uri: 2022-12-14-Cryptocurrency-Mining-Campaign-Hits-Linux-Users-with-Go-based-CHAOS-Ma
url: https://thehackernews.com/2022/12/cryptocurrency-mining-campaign-hits.html
content:
A cryptocurrency mining attack targeting the Linux operating system also involved the use of an open source remote access trojan (RAT) dubbed CHAOS.
The threat, which was spotted by Trend Micro in November 2022, remains virtually unchanged in all other aspects, including when it comes to terminating competing malware, security software, and deploying the Monero (XMR) cryptocurrency miner.
"The


feed_id: https://thehackernews.com/2022/12/keep-your-grinch-at-bay-heres-how-to.html
title: Keep Your Grinch at Bay: Here's How to Stay Safe Online this Holiday Season
uri: 2022-12-14-Keep-Your-Grinch-at-Bay-Here-s-How-to-Stay-Safe-Online-this-Holiday-S
url: https://thehackernews.com/2022/12/keep-your-grinch-at-bay-heres-how-to.html
content:
As the holiday season approaches, online shopping and gift-giving are at the top of many people's to-do lists. But before you hit the "buy" button, it's important to remember that this time of year is also the peak season for cybercriminals.
In fact, cybercriminals often ramp up their efforts during the holidays, taking advantage of the influx of online shoppers and the general hustle and bustle


feed_id: https://thehackernews.com/2022/12/royal-ransomware-threat-takes-aim-at-us.html
title: Royal Ransomware Threat Takes Aim at U.S. Healthcare System
uri: 2022-12-14-Royal-Ransomware-Threat-Takes-Aim-at-U-S-Healthcare-System
url: https://thehackernews.com/2022/12/royal-ransomware-threat-takes-aim-at-us.html
content:
The U.S. Department of Health and Human Services (HHS) has cautioned of ongoing Royal ransomware attacks targeting healthcare entities in the country.
"While most of the known ransomware operators have performed Ransomware-as-a-Service, Royal appears to be a private group without any affiliates while maintaining financial motivation as their goal," the agency's Health Sector Cybersecurity


feed_id: https://thehackernews.com/2022/12/hack-for-hire-group-targets-travel-and.html
title: Hack-for-Hire Group Targets Travel and Financial Entities with New Janicab Malware Variant
uri: 2022-12-14-Hack-for-Hire-Group-Targets-Travel-and-Financial-Entities-with-New-Jan
url: https://thehackernews.com/2022/12/hack-for-hire-group-targets-travel-and.html
content:
Travel agencies have emerged as the target of a hack-for-hire group dubbed Evilnum as part of a broader campaign aimed at legal and financial investment institutions in the Middle East and Europe.
The attacks, which took place during 2020 and 2021 and likely went as far back as 2015, involved a revamped variant of a malware called Janicab that leverages a number of public services like WordPress


feed_id: https://thehackernews.com/2022/12/researchers-detail-new-attack-method-to.html
title: Researchers Detail New Attack Method to Bypass Popular Web Application Firewalls
uri: 2022-12-14-Researchers-Detail-New-Attack-Method-to-Bypass-Popular-Web-Application
url: https://thehackernews.com/2022/12/researchers-detail-new-attack-method-to.html
content:
A new attack method can be used to circumvent web application firewalls (WAFs) of various vendors and infiltrate systems, potentially enabling attackers to gain access to sensitive business and customer information.
Web application firewalls are a key line of defense to help filter, monitor, and block HTTP(S) traffic to and from a web application, and safeguard against attacks such as cross-site


feed_id: https://thehackernews.com/2022/12/cisco-warns-of-high-severity-unpatched.html
title: Cisco Warns of High-Severity Unpatched Flaw Affecting IP Phones Firmware
uri: 2022-12-14-Cisco-Warns-of-High-Severity-Unpatched-Flaw-Affecting-IP-Phones-Firmwa
url: https://thehackernews.com/2022/12/cisco-warns-of-high-severity-unpatched.html
content:
Cisco has released a new security advisory warning of a high-severity flaw affecting IP Phone 7800 and 8800 Series firmware that could be potentially exploited by an unauthenticated attacker to cause remote code execution or a denial-of-service (DoS) condition.
The networking equipment major said it's working on a patch to address the vulnerability, which is tracked as CVE-2022-20968 (CVSS score


feed_id: https://thehackernews.com/2022/12/using-xdr-to-consolidate-and-optimize.html
title: Using XDR to Consolidate and Optimize Cybersecurity Technology
uri: 2022-12-14-Using-XDR-to-Consolidate-and-Optimize-Cybersecurity-Technology
url: https://thehackernews.com/2022/12/using-xdr-to-consolidate-and-optimize.html
content:
Businesses know they need cybersecurity, but it seems like a new acronym and system is popping up every day. Professionals that aren’t actively researching these technologies can struggle to keep up. As the cybersecurity landscape becomes more complicated, organizations are desperate to simplify it. Frustrated with the inefficiencies that come with using multiple vendors for cybersecurity, often


feed_id: https://thehackernews.com/2022/12/new-truebot-malware-variant-leveraging.html
title: New TrueBot Malware Variant Leveraging Netwrix Auditor Bug and Raspberry Robin Worm
uri: New-TrueBot-Malware-Variant-Leveraging-Netwrix-Auditor-Bug-and-Raspber
url: https://thehackernews.com/2022/12/new-truebot-malware-variant-leveraging.html
content:
Cybersecurity researchers have reported an increase in TrueBot infections, primarily targeting Mexico, Brazil, Pakistan, and the U.S.
Cisco Talos said the attackers behind the operation have moved from using malicious emails to alternative delivery methods such as the exploitation of a now-patched remote code execution (RCE) flaw in Netwrix auditor as well as the Raspberry Robin worm.
"


feed_id: https://thehackernews.com/2022/12/why-is-robust-api-security-crucial-in.html
title: Why is Robust API Security Crucial in eCommerce?
uri: 2022-12-14-Why-is-Robust-API-Security-Crucial-in-eCommerce
url: https://thehackernews.com/2022/12/why-is-robust-api-security-crucial-in.html
content:
API attacks are on the rise. One of their major targets is eCommerce firms like yours. 
APIs are a vital part of how eCommerce businesses are accelerating their growth in the digital world. 
ECommerce platforms use APIs at all customer touchpoints, from displaying products to handling shipping. Owing to their increased use, APIs are attractive targets for hackers, as the following numbers expose


feed_id: https://thehackernews.com/2022/12/researchers-uncover-new-drokbk-malware.html
title: Researchers Uncover New Drokbk Malware that Uses GitHub as a Dead Drop Resolver
uri: 2022-12-14-Researchers-Uncover-New-Drokbk-Malware-that-Uses-GitHub-as-a-Dead-Drop
url: https://thehackernews.com/2022/12/researchers-uncover-new-drokbk-malware.html
content:
The subgroup of an Iranian nation-state group known as Nemesis Kitten has been attributed as behind a previously undocumented custom malware dubbed Drokbk that uses GitHub as a dead drop resolver to exfiltrate data from an infected computer, or to receive commands.
"The use of GitHub as a virtual dead drop helps the malware blend in," Secureworks principal researcher Rafe Pilling said. "All the


feed_id: https://thehackernews.com/2022/12/what-stricter-data-privacy-laws-mean.html
title: What Stricter Data Privacy Laws Mean for Your Cybersecurity Policies
uri: 2022-12-14-What-Stricter-Data-Privacy-Laws-Mean-for-Your-Cybersecurity-Policies
url: https://thehackernews.com/2022/12/what-stricter-data-privacy-laws-mean.html
content:
For today's businesses data privacy is already a big headache, and with modern privacy laws expanding to more of the world's population, regulatory compliance is on track to become a more complicated, high-stakes process touching on every aspect of an organization. In fact, Gartner predicts that by 2024, 75% of the Global Population will have its personal data covered under privacy regulations.


feed_id: https://thehackernews.com/2022/12/muddywater-hackers-target-asian-and.html
title: MuddyWater Hackers Target Asian and Middle East Countries with Updated Tactics
uri: 2022-12-14-MuddyWater-Hackers-Target-Asian-and-Middle-East-Countries-with-Updated
url: https://thehackernews.com/2022/12/muddywater-hackers-target-asian-and.html
content:
The Iran-linked MuddyWater threat actor has been observed targeting several countries in the Middle East as well as Central and West Asia as part of a new spear-phishing activity.
"The campaign has been observed targeting Armenia, Azerbaijan, Egypt, Iraq, Israel, Jordan, Oman, Qatar, Tajikistan, and the United Arab Emirates," Deep Instinct researcher Simon Kenin said in a technical write-up.


feed_id: https://thehackernews.com/2022/12/researchers-uncover-darknet-service.html
title: Researchers Uncover Darknet Service Allowing Hackers to Trojanize Legit Android Apps
uri: Researchers-Uncover-Darknet-Service-Allowing-Hackers-to-Trojanize-Legi
url: https://thehackernews.com/2022/12/researchers-uncover-darknet-service.html
content:
Researchers have shed light on a new hybrid malware campaign targeting both Android and Windows operating systems in a bid to expand its pool of victims.
The attacks entail the use of different malware such as ERMAC, Erbium, Aurora, and Laplas, according to a ThreatFabric report shared with The Hacker News.
"This campaign resulted in thousands of victims," the Dutch cybersecurity company said,


feed_id: https://thehackernews.com/2022/12/covid-bit-new-covert-channel-to.html
title: COVID-bit: New COVert Channel to Exfiltrate Data from Air-Gapped Computers
uri: 2022-12-14-COVID-bit-New-COVert-Channel-to-Exfiltrate-Data-from-Air-Gapped-Compu
url: https://thehackernews.com/2022/12/covid-bit-new-covert-channel-to.html
content:
An unconventional data exfiltration method leverages a previously undocumented covert channel to leak sensitive information from air-gapped systems.
"The information emanates from the air-gapped computer over the air to a distance of 2 m and more and can be picked up by a nearby insider or spy with a mobile phone or laptop," Dr. Mordechai Guri, the head of R&D in the Cyber Security Research


feed_id: https://thehackernews.com/2022/12/apple-boosts-security-with-new-imessage.html
title: Apple Boosts Security With New iMessage, Apple ID, and iCloud Protections
uri: 2022-12-14-Apple-Boosts-Security-With-New-iMessage-Apple-ID-and-iCloud-Protecti
url: https://thehackernews.com/2022/12/apple-boosts-security-with-new-imessage.html
content:
Apple on Wednesday announced a raft of security measures, including an Advanced Data Protection setting that enables end-to-end encrypted (E2EE) data backups in its iCloud service.
The headlining feature, when turned on, is expected to secure 23 data categories using E2EE, including device and message backups, iCloud Drive, Notes, Photos, Reminders, Voice Memos, Safari Bookmarks, Siri Shortcuts,


feed_id: https://thehackernews.com/2022/12/best-year-end-cybersecurity-deals-from.html
title: Best Year-End Cybersecurity Deals from Uptycs, SANS Institute, and Bitdefender
uri: 2022-12-14-Best-Year-End-Cybersecurity-Deals-from-Uptycs-SANS-Institute-and-Bit
url: https://thehackernews.com/2022/12/best-year-end-cybersecurity-deals-from.html
content:
Looking to up your cybersecurity game in the new year? Do not just buy electronics this vacation season, improve your cybersecurity!
The end of the year is a great time to re-evaluate your cybersecurity strategy and make some important investments in protecting your personal and professional data. Cyber threats are constantly evolving and becoming more sophisticated, so it's important to stay on


feed_id: https://thehackernews.com/2022/12/google-warns-of-internet-explorer-zero.html
title: Google Warns of Internet Explorer Zero-Day Vulnerability Exploited by ScarCruft Hackers
uri: 2022-12-14-Google-Warns-of-Internet-Explorer-Zero-Day-Vulnerability-Exploited-by
url: https://thehackernews.com/2022/12/google-warns-of-internet-explorer-zero.html
content:
An Internet Explorer zero-day vulnerability was actively exploited by a North Korean threat actor to target South Korean users by capitalizing on the recent Itaewon Halloween crowd crush to trick users into downloading malware.
The discovery, reported by Google Threat Analysis Group researchers Benoît Sevens and Clément Lecigne, is the latest set of attacks perpetrated by ScarCruft, which is


feed_id: https://thehackernews.com/2022/12/iranian-hackers-strike-diamond-industry.html
title: Iranian Hackers Strike Diamond Industry with Data-Wiping Malware in Supply-Chain Attack
uri: 2022-12-14-Iranian-Hackers-Strike-Diamond-Industry-with-Data-Wiping-Malware-in-Su
url: https://thehackernews.com/2022/12/iranian-hackers-strike-diamond-industry.html
content:
An Iranian advanced persistent threat (APT) actor known as Agrius has been attributed as behind a set of data wiper attacks aimed at diamond industries in South Africa, Israel, and Hong Kong.
The wiper, referred to as Fantasy by ESET, is believed to have been delivered via a supply-chain attack targeting an Israeli software suite developer as part of a campaign that began in February 2022.


feed_id: https://thehackernews.com/2022/12/vice-society-ransomware-attackers.html
title: Vice Society Ransomware Attackers Targeted Dozens of Schools in 2022
uri: 2022-12-14-Vice-Society-Ransomware-Attackers-Targeted-Dozens-of-Schools-in-2022
url: https://thehackernews.com/2022/12/vice-society-ransomware-attackers.html
content:
The Vice Society cybercrime group has disproportionately targeted educational institutions, accounting for 33 victims in 2022 and surpassing other ransomware families like LockBit, BlackCat, BianLian, and Hive.
Other prominent industry verticals targeted include healthcare, governments, manufacturing, retail, and legal services, according to an analysis of leak site data by Palo Alto Networks


feed_id: https://thehackernews.com/2022/12/how-xdr-helps-protect-critical.html
title: How XDR Helps Protect Critical Infrastructure
uri: 2022-12-14-How-XDR-Helps-Protect-Critical-Infrastructure
url: https://thehackernews.com/2022/12/how-xdr-helps-protect-critical.html
content:
Critical infrastructure is important for societal existence, growth, and development. Societies are reliant on the services provided by critical infrastructure sectors like telecommunication, energy, healthcare, transportation, and information technology. Safety and security are necessary for the optimal operation of these critical infrastructures. Critical infrastructure is made up of digital


feed_id: https://thehackernews.com/2022/12/chinese-hackers-using-russo-ukrainian.html
title: Chinese Hackers Using Russo-Ukrainian War Decoys to Target APAC and European Entities
uri: 2022-12-14-Chinese-Hackers-Using-Russo-Ukrainian-War-Decoys-to-Target-APAC-and-Eu
url: https://thehackernews.com/2022/12/chinese-hackers-using-russo-ukrainian.html
content:
The China-linked nation-state hacking group referred to as Mustang Panda is using lures related to the ongoing Russo-Ukrainian War to attack entities in Europe and the Asia Pacific.
That's according to the BlackBerry Research and Intelligence Team, which analyzed a RAR archive file titled "Political Guidance for the new EU approach towards Russia.rar." Some of the targeted countries include


feed_id: https://thehackernews.com/2022/12/russian-hackers-spotted-targeting-us.html
title: Russian Hackers Spotted Targeting U.S. Military Weapons and Hardware Supplier
uri: 2022-12-14-Russian-Hackers-Spotted-Targeting-U-S-Military-Weapons-and-Hardware-S
url: https://thehackernews.com/2022/12/russian-hackers-spotted-targeting-us.html
content:
A state-sponsored hacking group with links to Russia has been linked to attack infrastructure that spoofs the Microsoft login page of Global Ordnance, a legitimate U.S.-based military weapons and hardware supplier.
Recorded Future attributed the new infrastructure to a threat activity group it tracks under the name TAG-53, and is broadly known by the cybersecurity community as Blue Callisto,


feed_id: https://thehackernews.com/2022/12/microsoft-alerts-cryptocurrency.html
title: Microsoft Alerts Cryptocurrency Industry of Targeted Cyberattacks
uri: 2022-12-14-Microsoft-Alerts-Cryptocurrency-Industry-of-Targeted-Cyberattacks
url: https://thehackernews.com/2022/12/microsoft-alerts-cryptocurrency.html
content:
Cryptocurrency investment companies are the target of a developing threat cluster that uses Telegram groups to seek out potential victims.
Microsoft's Security Threat Intelligence Center (MSTIC) is tracking the activity under the name DEV-0139, and builds upon a recent report from Volexity that attributed the same set of attacks to North Korea's Lazarus Group.
"DEV-0139 joined Telegram groups


feed_id: https://thehackernews.com/2022/12/new-go-based-zerobot-botnet-exploiting.html
title: New Go-based Botnet Exploiting Exploiting Dozens of IoT Vulnerabilities to Expand its Network
uri: New-Go-based-Botnet-Exploiting-Exploiting-Dozens-of-IoT-Vulnerabilitie
url: https://thehackernews.com/2022/12/new-go-based-zerobot-botnet-exploiting.html
content:
A novel Go-based botnet called Zerobot has been observed in the wild proliferating by taking advantage of nearly two dozen security vulnerabilities in the internet of things (IoT) devices and other software.
The botnet "contains several modules, including self-replication, attacks for different protocols, and self-propagation," Fortinet FortiGuard Labs researcher Cara Lin said. "It also


feed_id: https://thehackernews.com/2022/12/chinese-hackers-target-middle-east.html
title: Chinese Hackers Target Middle East Telecoms in Latest Cyber Attacks
uri: 2022-12-14-Chinese-Hackers-Target-Middle-East-Telecoms-in-Latest-Cyber-Attacks
url: https://thehackernews.com/2022/12/chinese-hackers-target-middle-east.html
content:
A malicious campaign targeting the Middle East is likely linked to BackdoorDiplomacy, an advanced persistent threat (APT) group with ties to China.
The espionage activity, directed against a telecom company in the region, is said to have commenced on August 19, 2021 through the successful exploitation of ProxyShell flaws in the Microsoft Exchange Server.
Initial compromise leveraged binaries


feed_id: https://thehackernews.com/2022/12/iranian-state-hackers-targeting-key.html
title: Iranian State Hackers Targeting Key Figures in Activism, Journalism, and Politics
uri: 2022-12-14-Iranian-State-Hackers-Targeting-Key-Figures-in-Activism-Journalism-a
url: https://thehackernews.com/2022/12/iranian-state-hackers-targeting-key.html
content:
Hackers with ties to the Iranian government have been linked to an ongoing social engineering and credential phishing campaign directed against human rights activists, journalists, researchers, academics, diplomats, and politicians working in the Middle East.
At least 20 individuals are believed to have been targeted, Human Rights Watch (HRW) said in a report published Monday, attributing the


feed_id: https://thehackernews.com/2022/12/darknets-largest-mobile-malware.html
title: Darknet's Largest Mobile Malware Marketplace Threatens Users Worldwide
uri: 2022-12-14-Darknet-s-Largest-Mobile-Malware-Marketplace-Threatens-Users-Worldwide
url: https://thehackernews.com/2022/12/darknets-largest-mobile-malware.html
content:
Cybersecurity researchers have shed light on a darknet marketplace called InTheBox that's designed to specifically cater to mobile malware operators.
The actor behind the criminal storefront, believed to be available since at least January 2020, has been offering over 400 custom web injects grouped by geography that can be purchased by other adversaries looking to mount attacks of their own.
"


feed_id: https://thehackernews.com/2022/12/understanding-nist-csf-to-assess-your.html
title: Understanding NIST CSF to assess your organization's Ransomware readiness
uri: 2022-12-14-Understanding-NIST-CSF-to-assess-your-organization-s-Ransomware-readin
url: https://thehackernews.com/2022/12/understanding-nist-csf-to-assess-your.html
content:
Ransomware attacks keep increasing in volume and impact largely due to organizations' weak security controls. Mid-market companies are targeted as they possess a significant amount of valuable data but lack the level of protective controls and staffing of larger organizations.
According to a recent RSM survey, 62% of mid-market companies believe they are at risk of ransomware in the next 12


feed_id: https://thehackernews.com/2022/12/telcom-and-bpo-companies-under-attack.html
title: Telcom and BPO Companies Under Attack by SIM Swapping Hackers
uri: 2022-12-14-Telcom-and-BPO-Companies-Under-Attack-by-SIM-Swapping-Hackers
url: https://thehackernews.com/2022/12/telcom-and-bpo-companies-under-attack.html
content:
A persistent intrusion campaign has set its eyes on telecommunications and business process outsourcing (BPO) companies at lease since June 2022.
"The end objective of this campaign appears to be to gain access to mobile carrier networks and, as evidenced in two investigations, perform SIM swapping activity," CrowdStrike researcher Tim Parisi said in an analysis published last week.
The


feed_id: https://thehackernews.com/2022/12/open-source-ransomware-toolkit.html
title: Open Source Ransomware Toolkit Cryptonite Turns Into Accidental Wiper Malware
uri: 2022-12-14-Open-Source-Ransomware-Toolkit-Cryptonite-Turns-Into-Accidental-Wiper
url: https://thehackernews.com/2022/12/open-source-ransomware-toolkit.html
content:
A version of an open source ransomware toolkit called Cryptonite has been observed in the wild with wiper capabilities due to its "weak architecture and programming."
Cryptonite, unlike other ransomware strains, is not available for sale on the cybercriminal underground, and was instead offered for free by an actor named CYBERDEVILZ until recently through a GitHub repository. The source code and


feed_id: https://thehackernews.com/2022/12/new-bmc-supply-chain-vulnerabilities.html
title: New BMC Supply Chain Vulnerabilities Affect Servers from Dozens of Manufacturers
uri: 2022-12-14-New-BMC-Supply-Chain-Vulnerabilities-Affect-Servers-from-Dozens-of-Man
url: https://thehackernews.com/2022/12/new-bmc-supply-chain-vulnerabilities.html
content:
Three different security flaws have been disclosed in American Megatrends (AMI) MegaRAC Baseboard Management Controller (BMC) software that could lead to remote code execution on vulnerable servers.
"The impact of exploiting these vulnerabilities include remote control of compromised servers, remote deployment of malware, ransomware and firmware implants, and server physical damage (bricking),"


feed_id: https://thehackernews.com/2022/12/russian-courts-targeted-by-new-crywiper.html
title: Russian Courts Targeted by New CryWiper Data Wiper Malware Posing as Ransomware
uri: 2022-12-14-Russian-Courts-Targeted-by-New-CryWiper-Data-Wiper-Malware-Posing-as-R
url: https://thehackernews.com/2022/12/russian-courts-targeted-by-new-crywiper.html
content:
A new data wiper malware called CryWiper has been found targeting Russian government agencies, including mayor's offices and courts.
"Although it disguises itself as a ransomware and extorts money from the victim for 'decrypting' data, [it] does not actually encrypt, but purposefully destroys data in the affected system," Kaspersky researchers Fedor Sinitsyn and Janis Zinchenko said in a


feed_id: https://thehackernews.com/2022/12/when-being-attractive-gets-risky-how.html
title: When Being Attractive Gets Risky - How Does Your Attack Surface Look to an Attacker?
uri: 2022-12-14-When-Being-Attractive-Gets-Risky-How-Does-Your-Attack-Surface-Look-t
url: https://thehackernews.com/2022/12/when-being-attractive-gets-risky-how.html
content:
In the era of digitization and ever-changing business needs, the production environment has become a living organism. Multiple functions and teams within an organization can ultimately impact the way an attacker sees the organization's assets, or in other words, the external attack surface. This dramatically increases the need to define an exposure management strategy.
To keep up with business


feed_id: https://thehackernews.com/2022/12/siriusxm-vulnerability-lets-hackers.html
title: SiriusXM Vulnerability Lets Hackers Remotely Unlock and Start Connected Cars
uri: 2022-12-14-SiriusXM-Vulnerability-Lets-Hackers-Remotely-Unlock-and-Start-Connecte
url: https://thehackernews.com/2022/12/siriusxm-vulnerability-lets-hackers.html
content:
Cybersecurity researchers have discovered a security vulnerability that exposes cars from Honda, Nissan, Infiniti, and Acura to remote attacks through a connected vehicle service provided by SiriusXM.
The issue could be exploited to unlock, start, locate, and honk any car in an unauthorized manner just by knowing the vehicle's vehicle identification number (VIN), researcher Sam Curry said in a 


feed_id: https://thehackernews.com/2022/12/north-korean-hackers-spread-applejeus.html
title: North Korean Hackers Spread AppleJeus Malware Disguised as Cryptocurrency Apps
uri: 2022-12-14-North-Korean-Hackers-Spread-AppleJeus-Malware-Disguised-as-Cryptocurre
url: https://thehackernews.com/2022/12/north-korean-hackers-spread-applejeus.html
content:
The Lazarus Group threat actor has been observed leveraging fake cryptocurrency apps as a lure to deliver a previously undocumented version of the AppleJeus malware, according to new findings from Volexity.
"This activity notably involves a campaign likely targeting cryptocurrency users and organizations with a variant of the AppleJeus malware by way of malicious Microsoft Office documents,"


feed_id: https://thehackernews.com/2022/12/critical-ping-vulnerability-allows.html
title: Critical Ping Vulnerability Allows Remote Attackers to Take Over FreeBSD Systems
uri: 2022-12-14-Critical-Ping-Vulnerability-Allows-Remote-Attackers-to-Take-Over-FreeB
url: https://thehackernews.com/2022/12/critical-ping-vulnerability-allows.html
content:
The maintainers of the FreeBSD operating system have released updates to remediate a security vulnerability impacting the ping module that could be potentially exploited to crash the program or trigger remote code execution.
The issue, assigned the identifier CVE-2022-23093, impacts all supported versions of FreeBSD and concerns a stack-based buffer overflow vulnerability in the ping service.
"


feed_id: https://thehackernews.com/2022/12/cisa-alert-veeam-backup-and-replication.html
title: CISA Alert: Veeam Backup and Replication Vulnerabilities Being Exploited in Attacks
uri: CISA-Alert-Veeam-Backup-and-Replication-Vulnerabilities-Being-Exploit
url: https://thehackernews.com/2022/12/cisa-alert-veeam-backup-and-replication.html
content:
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two vulnerabilities impacting Veeam Backup & Replication software to its Known Exploited Vulnerabilities (KEV) Catalog, citing evidence of active exploitation in the wild.
The now-patched critical flaws, tracked as CVE-2022-26500 and CVE-2022-26501, are both rated 9.8 on the CVSS scoring system, and could be leveraged to


feed_id: https://thehackernews.com/2022/12/researchers-uncover-mirrorface-cyber.html
title: Researchers Uncover MirrorFace Cyber Attacks Targeting Japanese Political Entities
uri: 2022-12-16-Researchers-Uncover-MirrorFace-Cyber-Attacks-Targeting-Japanese-Politi
url: https://thehackernews.com/2022/12/researchers-uncover-mirrorface-cyber.html
content:
A Chinese-speaking advanced persistent threat (APT) actor codenamed MirrorFace has been attributed to a spear-phishing campaign targeting Japanese political establishments.
The activity, dubbed Operation LiberalFace by ESET, specifically focused on members of an unnamed political party in the nation with the goal of delivering an implant called LODEINFO and a hitherto unseen credential stealer


feed_id: https://thehackernews.com/2022/12/microsoft-reclassifies-spnego-extended.html
title: Microsoft Reclassifies SPNEGO Extended Negotiation Security Vulnerability as 'Critical'
uri: 2022-12-16-Microsoft-Reclassifies-SPNEGO-Extended-Negotiation-Security-Vulnerabil
url: https://thehackernews.com/2022/12/microsoft-reclassifies-spnego-extended.html
content:
Microsoft has revised the severity of a security vulnerability it originally patched in September 2022, upgrading it to "Critical" after it emerged that it could be exploited to achieve remote code execution.
Tracked as CVE-2022-37958 (CVSS score: 8.1), the flaw was previously described as an information disclosure vulnerability in SPNEGO Extended Negotiation (NEGOEX) Security Mechanism.
SPNEGO,


feed_id: https://thehackernews.com/2022/12/android-malware-campaign-leverages.html
title: Android Malware Campaign Leverages Money-Lending Apps to Blackmail Victims
uri: 2022-12-16-Android-Malware-Campaign-Leverages-Money-Lending-Apps-to-Blackmail-Vic
url: https://thehackernews.com/2022/12/android-malware-campaign-leverages.html
content:
A previously undocumented Android malware campaign has been observed leveraging money-lending apps to blackmail victims into paying up with personal information stolen from their devices.
Mobile security company Zimperium dubbed the activity MoneyMonger, pointing out the use of the cross-platform Flutter framework to develop the apps.
MoneyMonger "takes advantage of Flutter's framework to


feed_id: https://thehackernews.com/2022/12/top-5-web-app-vulnerabilities-and-how.html
title: Top 5 Web App Vulnerabilities and How to Find Them
uri: 2022-12-16-Top-5-Web-App-Vulnerabilities-and-How-to-Find-Them
url: https://thehackernews.com/2022/12/top-5-web-app-vulnerabilities-and-how.html
content:
Web applications, often in the form of Software as a Service (SaaS), are now the cornerstone for businesses all over the world. SaaS solutions have revolutionized the way they operate and deliver services, and are essential tools in nearly every industry, from finance and banking to healthcare and education. 
Most startup CTOs have an excellent understanding of how to build highly functional


feed_id: https://thehackernews.com/2022/12/hackers-bombard-open-source.html
title: Hackers Bombard Open Source Repositories with Over 144,000 Malicious Packages
uri: 2022-12-16-Hackers-Bombard-Open-Source-Repositories-with-Over-144-000-Malicious-P
url: https://thehackernews.com/2022/12/hackers-bombard-open-source.html
content:
NuGet, PyPi, and npm ecosystems are the target of a new campaign that has resulted in over 144,000 packages being published by unknown threat actors.
"The packages were part of a new attack vector, with attackers spamming the open source ecosystem with packages containing links to phishing campaigns," researchers from Checkmarx and Illustria said in a report published Wednesday.
Of the 144,294


feed_id: https://thehackernews.com/2022/12/fbi-charges-6-seizes-48-domains-linked.html
title: FBI Charges 6, Seizes 48 Domains Linked to DDoS-for-Hire Service Platforms
uri: 2022-12-16-FBI-Charges-6-Seizes-48-Domains-Linked-to-DDoS-for-Hire-Service-Platf
url: https://thehackernews.com/2022/12/fbi-charges-6-seizes-48-domains-linked.html
content:
The U.S. Department of Justice (DoJ) on Wednesday announced the seizure of 48 domains that offered services to conduct distributed denial-of-service (DDoS) attacks on behalf of other threat actors, effectively lowering the barrier to entry for malicious activity.
It also charged six suspects – Jeremiah Sam Evans Miller (23), Angel Manuel Colon Jr. (37), Shamar Shattock (19), Cory Anthony Palmer


feed_id: https://thehackernews.com/2022/12/hacking-using-svg-files-to-smuggle-qbot.html
title: Hacking Using SVG Files to Smuggle QBot Malware onto Windows Systems
uri: 2022-12-16-Hacking-Using-SVG-Files-to-Smuggle-QBot-Malware-onto-Windows-Systems
url: https://thehackernews.com/2022/12/hacking-using-svg-files-to-smuggle-qbot.html
content:
Phishing campaigns involving the Qakbot malware are using Scalable Vector Graphics (SVG) images embedded in HTML email attachments.
The new distribution method was spotted by Cisco Talos, which said it identified fraudulent email messages featuring HTML attachments with encoded SVG images that incorporate HTML script tags.
HTML smuggling is a technique that relies on using legitimate features of


feed_id: https://thehackernews.com/2022/12/samba-issues-security-updates-to-patch.html
title: Samba Issues Security Updates to Patch Multiple High-Severity Vulnerabilities
uri: 2022-12-17-Samba-Issues-Security-Updates-to-Patch-Multiple-High-Severity-Vulnerab
url: https://thehackernews.com/2022/12/samba-issues-security-updates-to-patch.html
content:
Samba has released software updates to remediate multiple vulnerabilities that, if successfully exploited, could allow an attacker to take control of affected systems.
The high-severity flaws, tracked as CVE-2022-38023, CVE-2022-37966, CVE-2022-37967, and CVE-2022-45141, have been patched in versions 4.17.4, 4.16.8 and 4.15.13 released on December 15, 2022.
Samba is an open source Windows


feed_id: https://thehackernews.com/2022/12/trojanized-windows-10-installer-used-in.html
title: Trojanized Windows 10 Installer Used in Cyberattacks Against Ukrainian Government Entities
uri: 2022-12-17-Trojanized-Windows-10-Installer-Used-in-Cyberattacks-Against-Ukrainian
url: https://thehackernews.com/2022/12/trojanized-windows-10-installer-used-in.html
content:
Government entities in Ukraine have been breached as part of a new campaign that leveraged trojanized versions of Windows 10 installer files to conduct post-exploitation activities.
Mandiant, which discovered the "socially engineered supply chain" attack around mid-July 2022, said the malicious ISO files were distributed via Ukrainian- and Russian-language Torrent websites. It's tracking the


feed_id: https://thehackernews.com/2022/12/ex-twitter-employee-gets-35-years-jail.html
title: Ex-Twitter employee Gets 3.5 Years Jail for Spying on Behalf of Saudi Arabia
uri: 2022-12-17-Ex-Twitter-employee-Gets-3-5-Years-Jail-for-Spying-on-Behalf-of-Saudi
url: https://thehackernews.com/2022/12/ex-twitter-employee-gets-35-years-jail.html
content:
A former Twitter employee who was found guilty of spying on behalf of Saudi Arabia by sharing data pertaining to specific individuals has been sentenced to three-and-a-half years in prison.
Ahmad Abouammo, 45, was convicted earlier this August on various criminal counts, including money laundering, fraud, falsifying records, and being an illegal agent of a foreign government.
Abouammo was


feed_id: https://thehackernews.com/2022/12/cyber-security-is-not-losing-game-if.html
title: Cyber Security Is Not a Losing Game – If You Start Right Now
uri: 2022-12-17-Cyber-Security-Is-Not-a-Losing-Game-If-You-Start-Right-Now
url: https://thehackernews.com/2022/12/cyber-security-is-not-losing-game-if.html
content:
Reality has a way of asserting itself, irrespective of any personal or commercial choices we make, good or bad. For example, just recently, the city services of Antwerp in Belgium were the victim of a highly disruptive cyberattack. 
As usual, everyone cried "foul play" and suggested that proper cybersecurity measures should have been in place. And again, as usual, it all happens a bit too late.


feed_id: https://thehackernews.com/2022/12/github-announces-free-secret-scanning.html
title: GitHub Announces Free Secret Scanning for All Public Repositories
uri: 2022-12-17-GitHub-Announces-Free-Secret-Scanning-for-All-Public-Repositories
url: https://thehackernews.com/2022/12/github-announces-free-secret-scanning.html
content:
GitHub on Thursday said it is making available its secret scanning service to all public repositories on the code hosting platform for free.
"Secret scanning alerts notify you directly about leaked secrets in your code," the company said, adding it's expected to complete the rollout by the end of January 2023. 
Secret scanning is designed to examine repositories for access tokens, private keys,


feed_id: https://thehackernews.com/2022/12/goodbye-sha-1-nist-retires-27-year-old.html
title: Goodbye SHA-1: NIST Retires 27-Year-Old Widely Used Cryptographic Algorithm
uri: 2022-12-17-Goodbye-SHA-1-NIST-Retires-27-Year-Old-Widely-Used-Cryptographic-Algo
url: https://thehackernews.com/2022/12/goodbye-sha-1-nist-retires-27-year-old.html
content:
The U.S. National Institute of Standards and Technology (NIST), an agency within the Department of Commerce, announced Thursday that it's formally retiring the SHA-1 cryptographic algorithm.
SHA-1, short for Secure Hash Algorithm 1, is a 27-year-old hash function used in cryptography and has since been deemed broken owing to the risk of collision attacks.
While hashes are designed to be


feed_id: https://thehackernews.com/2022/12/minecraft-servers-under-attack.html
title: Minecraft Servers Under Attack: Microsoft Warns About Cross-Platform DDoS Botnet
uri: 2022-12-17-Minecraft-Servers-Under-Attack-Microsoft-Warns-About-Cross-Platform-D
url: https://thehackernews.com/2022/12/minecraft-servers-under-attack.html
content:
Microsoft on Thursday flagged a cross-platform botnet that's primarily designed to launch distributed denial-of-service (DDoS) attacks against private Minecraft servers.
Called MCCrash, the botnet is characterized by a unique spreading mechanism that allows it to propagate to Linux-based devices despite originating from malicious software downloads on Windows hosts.
"The botnet spreads by


feed_id: https://thehackernews.com/2022/12/bluenoroff-apt-hackers-using-new-ways.html
title: BlueNoroff APT Hackers Using New Ways to Bypass Windows MotW Protection
uri: 2022-12-28-BlueNoroff-APT-Hackers-Using-New-Ways-to-Bypass-Windows-MotW-Protectio
url: https://thehackernews.com/2022/12/bluenoroff-apt-hackers-using-new-ways.html
content:
BlueNoroff, a subcluster of the notorious Lazarus Group, has been observed adopting new techniques into its playbook that enable it to bypass Windows Mark of the Web (MotW) protections.
This includes the use of optical disk image (.ISO extension) and virtual hard disk (.VHD extension) file formats as part of a novel infection chain, Kaspersky disclosed in a report published today.
"BlueNoroff


feed_id: https://thehackernews.com/2022/12/facebook-to-pay-725-million-to-settle.html
title: Facebook to Pay $725 Million to settle Lawsuit Over Cambridge Analytica Data Leak
uri: 2022-12-28-Facebook-to-Pay-725-Million-to-settle-Lawsuit-Over-Cambridge-Analytic
url: https://thehackernews.com/2022/12/facebook-to-pay-725-million-to-settle.html
content:
Meta Platforms, the parent company of Facebook, Instagram, and WhatsApp, has agreed to pay $725 million to settle a long-running class-action lawsuit filed in 2018.
The legal dispute sprang up in response to revelations that the social media giant allowed third-party apps such as those used by Cambridge Analytica to access users' personal information without their consent for political


feed_id: https://thehackernews.com/2022/12/guloader-malware-utilizing-new.html
title: GuLoader Malware Utilizing New Techniques to Evade Security Software
uri: 2022-12-28-GuLoader-Malware-Utilizing-New-Techniques-to-Evade-Security-Software
url: https://thehackernews.com/2022/12/guloader-malware-utilizing-new.html
content:
Cybersecurity researchers have exposed a wide variety of techniques adopted by an advanced malware downloader called GuLoader to evade security software.
"New shellcode anti-analysis technique attempts to thwart researchers and hostile environments by scanning entire process memory for any virtual machine (VM)-related strings," CrowdStrike researchers Sarang Sonawane and Donato Onofri said in a


feed_id: https://thehackernews.com/2022/12/2022-top-five-immediate-threats-in.html
title: 2022 Top Five Immediate Threats in Geopolitical Context
uri: 2022-12-28-2022-Top-Five-Immediate-Threats-in-Geopolitical-Context
url: https://thehackernews.com/2022/12/2022-top-five-immediate-threats-in.html
content:
As we are nearing the end of 2022, looking at the most concerning threats of this turbulent year in terms of testing numbers offers a threat-based perspective on what triggers cybersecurity teams to check how vulnerable they are to specific threats. These are the threats that were most tested to validate resilience with the Cymulate security posture management platform between January 1st and


feed_id: https://thehackernews.com/2022/12/privateloader-ppi-service-found.html
title: PrivateLoader PPI Service Found Distributing Info-Stealing RisePro Malware
uri: 2022-12-28-PrivateLoader-PPI-Service-Found-Distributing-Info-Stealing-RisePro-Mal
url: https://thehackernews.com/2022/12/privateloader-ppi-service-found.html
content:
The pay-per-install (PPI) malware downloader service known as PrivateLoader is being used to distribute a previously documented information-stealing malware dubbed RisePro.
Flashpoint spotted the newly identified stealer on December 13, 2022, after it discovered "several sets of logs" exfiltrated using the malware on an illicit cybercrime marketplace called Russian Market.
A C++-based malware,


feed_id: https://thehackernews.com/2022/12/w4sp-stealer-discovered-in-multiple.html
title: W4SP Stealer Discovered in Multiple PyPI Packages Under Various Names
uri: 2022-12-28-W4SP-Stealer-Discovered-in-Multiple-PyPI-Packages-Under-Various-Names
url: https://thehackernews.com/2022/12/w4sp-stealer-discovered-in-multiple.html
content:
Threat actors have published yet another round of malicious packages to Python Package Index (PyPI) with the goal of delivering information-stealing malware on compromised developer machines.
Interestingly, while the malware goes by a variety of names like ANGEL Stealer, Celestial Stealer, Fade Stealer, Leaf $tealer, PURE Stealer, Satan Stealer, and @skid Stealer, cybersecurity company Phylum


feed_id: https://thehackernews.com/2022/12/frodopir-new-privacy-focused-database.html
title: FrodoPIR: New Privacy-Focused Database Querying System
uri: 2022-12-28-FrodoPIR-New-Privacy-Focused-Database-Querying-System
url: https://thehackernews.com/2022/12/frodopir-new-privacy-focused-database.html
content:
The developers behind the Brave open-source web browser have revealed a new privacy-preserving data querying and retrieval system called FrodoPIR.
The idea, the company said, is to use the technology to build out a wide range of use cases such as safe browsing, scanning passwords against breached databases, certificate revocation checks, and streaming, among others.
The scheme is called FrodoPIR


feed_id: https://thehackernews.com/2022/12/researchers-warn-of-kavach-2fa-phishing.html
title: Researchers Warn of Kavach 2FA Phishing Attacks Targeting Indian Govt. Officials
uri: 2022-12-28-Researchers-Warn-of-Kavach-2FA-Phishing-Attacks-Targeting-Indian-Govt
url: https://thehackernews.com/2022/12/researchers-warn-of-kavach-2fa-phishing.html
content:
A new targeted phishing campaign has zoomed in on a two-factor authentication solution called Kavach that's used by Indian government officials.
Cybersecurity firm Securonix dubbed the activity STEPPY#KAVACH, attributing it to a threat actor known as SideCopy based on tactical overlaps with prior attacks.
".LNK files are used to initiate code execution which eventually downloads and runs a


feed_id: https://thehackernews.com/2022/12/accelerate-your-incident-response.html
title: Accelerate Your Incident Response
uri: 2022-12-28-Accelerate-Your-Incident-Response
url: https://thehackernews.com/2022/12/accelerate-your-incident-response.html
content:
Tis the season for security and IT teams to send out that company-wide email: “No, our CEO does NOT want you to buy gift cards.” 
As much of the workforce signs off for the holidays, hackers are stepping up their game. We’ll no doubt see an increase in activity as hackers continue to unleash e-commerce scams and holiday-themed phishing attacks. Hackers love to use these tactics to trick end


feed_id: https://thehackernews.com/2022/12/vice-society-ransomware-attackers-adopt.html
title: Vice Society Ransomware Attackers Adopt Robust Encryption Methods
uri: 2022-12-28-Vice-Society-Ransomware-Attackers-Adopt-Robust-Encryption-Methods
url: https://thehackernews.com/2022/12/vice-society-ransomware-attackers-adopt.html
content:
The Vice Society ransomware actors have switched to yet another custom ransomware payload in their recent attacks aimed at a variety of sectors.
"This ransomware variant, dubbed 'PolyVice,' implements a robust encryption scheme, using NTRUEncrypt and ChaCha20-Poly1305 algorithms," SentinelOne researcher Antonio Cocomazzi said in an analysis.
Vice Society, which is tracked by Microsoft under the


feed_id: https://thehackernews.com/2022/12/france-fines-microsoft-60-million-for.html
title: France Fines Microsoft €60 Million for Using Advertising Cookies Without User Consent
uri: 2022-12-28-France-Fines-Microsoft-60-Million-for-Using-Advertising-Cookies-Wit
url: https://thehackernews.com/2022/12/france-fines-microsoft-60-million-for.html
content:
France's privacy watchdog has imposed a €60 million ($63.88 million) fine against Microsoft's Ireland subsidiary for dropping advertising cookies in users' computers without their explicit consent in violation of data protection laws in the European Union.
The Commission nationale de l'informatique et des libertés (CNIL) noted that users visiting the home page of its Bing search engine did not


feed_id: https://thehackernews.com/2022/12/lastpass-admits-to-severe-data-breach.html
title: LastPass Admits to Severe Data Breach, Encrypted Password Vaults Stolen
uri: 2022-12-28-LastPass-Admits-to-Severe-Data-Breach-Encrypted-Password-Vaults-Stole
url: https://thehackernews.com/2022/12/lastpass-admits-to-severe-data-breach.html
content:
The August 2022 security breach of LastPass may have been more severe than previously disclosed by the company.
The popular password management service on Thursday revealed that malicious actors obtained a trove of personal information belonging to its customers that include their encrypted password vaults by using data siphoned from the earlier break-in.
Also stolen is "basic customer account


feed_id: https://thehackernews.com/2022/12/fin7-cybercrime-syndicate-emerges-as.html
title: FIN7 Cybercrime Syndicate Emerges as a Major Player in Ransomware Landscape
uri: FIN7-Cybercrime-Syndicate-Emerges-as-a-Major-Player-in-Ransomware-Land
url: https://thehackernews.com/2022/12/fin7-cybercrime-syndicate-emerges-as.html
content:
An exhaustive analysis of FIN7 has unmasked the cybercrime syndicate's organizational hierarchy, alongside unraveling its role as an affiliate for mounting ransomware attacks.
It has also exposed deeper associations between the group and the larger threat ecosystem comprising the now-defunct ransomware DarkSide, REvil, and LockBit families.
The highly active threat group, also known as Carbanak,


feed_id: https://thehackernews.com/2022/12/the-era-of-cyber-threat-intelligence.html
title: The Era of Cyber Threat Intelligence Sharing
uri: 2022-12-28-The-Era-of-Cyber-Threat-Intelligence-Sharing
url: https://thehackernews.com/2022/12/the-era-of-cyber-threat-intelligence.html
content:
We spent forty years defending ourselves as individuals. Trying to outsmart cybercriminals, outpower them, and when all our efforts failed, only then we considered banding together with our peers to outnumber them.
Cybercriminals don't reinvent themselves each time. Their resources are limited, and they have a limited budget. Therefore they use playbooks to attack many people. Meaning most of


feed_id: https://thehackernews.com/2022/12/critical-security-flaw-reported-in.html
title: Critical Security Flaw Reported in Passwordstate Enterprise Password Manager
uri: 2022-12-28-Critical-Security-Flaw-Reported-in-Passwordstate-Enterprise-Password-M
url: https://thehackernews.com/2022/12/critical-security-flaw-reported-in.html
content:
Multiple high-severity vulnerabilities have been disclosed in Passwordstate password management solution that could be exploited by an unauthenticated remote adversary to obtain a user's plaintext passwords.
"Successful exploitation allows an unauthenticated attacker to exfiltrate passwords from an instance, overwrite all stored passwords within the database, or elevate their privileges within


feed_id: https://thehackernews.com/2022/12/two-new-security-flaws-reported-in.html
title: Two New Security Flaws Reported in Ghost CMS Blogging Software
uri: 2022-12-28-Two-New-Security-Flaws-Reported-in-Ghost-CMS-Blogging-Software
url: https://thehackernews.com/2022/12/two-new-security-flaws-reported-in.html
content:
Cybersecurity researchers have detailed two security flaws in the JavaScript-based blogging platform known as Ghost, one of which could be abused to elevate privileges via specially crafted HTTP requests.
Ghost is an open source blogging platform that's used in more than 52,600 live websites, most of them located in the U.S., the U.K., German, China, France, Canada, and India.
Tracked as


feed_id: https://thehackernews.com/2022/12/zerobot-botnet-emerges-as-growing.html
title: Zerobot Botnet Emerges as a Growing Threat with New Exploits and Capabilities
uri: 2022-12-28-Zerobot-Botnet-Emerges-as-a-Growing-Threat-with-New-Exploits-and-Capab
url: https://thehackernews.com/2022/12/zerobot-botnet-emerges-as-growing.html
content:
The Zerobot DDoS botnet has received substantial updates that expand on its ability to target more internet-connected devices and scale its network.
Microsoft Threat Intelligence Center (MSTIC) is tracking the ongoing threat under the moniker DEV-1061, its designation for unknown, emerging, or developing activity clusters.
Zerobot, first documented by Fortinet FortiGuard Labs earlier this month,


feed_id: https://thehackernews.com/2022/12/hackers-breach-oktas-github.html
title: Hackers Breach Okta's GitHub Repositories, Steal Source Code
uri: 2022-12-28-Hackers-Breach-Okta-s-GitHub-Repositories-Steal-Source-Code
url: https://thehackernews.com/2022/12/hackers-breach-oktas-github.html
content:
Okta, a company that provides identity and access management services, disclosed on Wednesday that some of its source code repositories were accessed in an unauthorized manner earlier this month.
"There is no impact to any customers, including any HIPAA, FedRAMP, or DoD customers," the company said in a public statement. "No action is required by customers."
The security event, which was first


feed_id: https://thehackernews.com/2022/12/raspberry-robin-worm-strikes-again.html
title: Raspberry Robin Worm Strikes Again, Targeting Telecom and Government Systems
uri: 2022-12-28-Raspberry-Robin-Worm-Strikes-Again-Targeting-Telecom-and-Government-S
url: https://thehackernews.com/2022/12/raspberry-robin-worm-strikes-again.html
content:
The Raspberry Robin worm has been used in attacks against telecommunications and government office systems across Latin America, Australia, and Europe since at least September 2022.
"The main payload itself is packed with more than 10 layers for obfuscation and is capable of delivering a fake payload once it detects sandboxing and security analytics tools," Trend Micro researcher Christopher So 


feed_id: https://thehackernews.com/2022/12/the-rise-of-rookie-hacker-new-trend-to.html
title: The Rise of the Rookie Hacker - A New Trend to Reckon With
uri: 2022-12-28-The-Rise-of-the-Rookie-Hacker-A-New-Trend-to-Reckon-With
url: https://thehackernews.com/2022/12/the-rise-of-rookie-hacker-new-trend-to.html
content:
More zero knowledge attacks, more leaked credentials, more Gen-Z cyber crimes - 2022 trends and 2023 predictions.
Cybercrime remains a major threat to individuals, businesses, and governments around the world. Cybercriminals continue to take advantage of the prevalence of digital devices and the internet to perpetrate their crimes. As the internet of things continues to develop, cybercriminals


feed_id: https://thehackernews.com/2022/12/godfather-android-banking-trojan.html
title: GodFather Android Banking Trojan Targeting Users of Over 400 Banking and Crypto Apps
uri: 2022-12-28-GodFather-Android-Banking-Trojan-Targeting-Users-of-Over-400-Banking-a
url: https://thehackernews.com/2022/12/godfather-android-banking-trojan.html
content:
An Android banking trojan known as GodFather is being used to target users of more than 400 banking and cryptocurrency apps spanning across 16 countries.
This includes 215 banks, 94 crypto wallet providers, and 110 crypto exchange platforms serving users in the U.S., Turkey, Spain, Italy, Canada, and Canada, among others, Singapore-headquartered Group-IB said in a report shared with The Hacker


feed_id: https://thehackernews.com/2022/12/ransomware-hackers-using-new-way-to.html
title: Ransomware Hackers Using New Way to Bypass MS Exchange ProxyNotShell Mitigations
uri: 2022-12-28-Ransomware-Hackers-Using-New-Way-to-Bypass-MS-Exchange-ProxyNotShell-M
url: https://thehackernews.com/2022/12/ransomware-hackers-using-new-way-to.html
content:
Threat actors affiliated with a ransomware strain known as Play are leveraging a never-before-seen exploit chain that bypasses blocking rules for ProxyNotShell flaws in Microsoft Exchange Server to achieve remote code execution (RCE) through Outlook Web Access (OWA).
"The new exploit method bypasses URL rewrite mitigations for the Autodiscover endpoint," CrowdStrike researchers Brian Pitchford,


feed_id: https://thehackernews.com/2022/12/ukraines-delta-military-system-users.html
title: Ukraine's DELTA Military System Users Under Attack from Info Stealing Malware
uri: 2022-12-28-Ukraine-s-DELTA-Military-System-Users-Under-Attack-from-Info-Stealing
url: https://thehackernews.com/2022/12/ukraines-delta-military-system-users.html
content:
The Computer Emergency Response Team of Ukraine (CERT-UA) this week disclosed that users of the Delta situational awareness program received phishing emails from a compromised email account belonging to the Ministry of Defense.
The attacks, which have been attributed to a threat cluster dubbed UAC-0142, aimed to infect systems with two pieces of data-stealing malware referred to as FateGrab and


feed_id: https://thehackernews.com/2022/12/beware-cybercriminals-launch-new.html
title: Beware: Cybercriminals Launch New BrasDex Android Trojan Targeting Brazilian Banking Users
uri: 2022-12-28-Beware-Cybercriminals-Launch-New-BrasDex-Android-Trojan-Targeting-Bra
url: https://thehackernews.com/2022/12/beware-cybercriminals-launch-new.html
content:
The threat actors behind the Windows banking malware known as Casbaneiro has been attributed as behind a novel Android trojan called BrasDex that has been observed targeting Brazilian users as part of an ongoing multi-platform campaign.
BrasDex features a "complex keylogging system designed to abuse Accessibility Services to extract credentials specifically from a set of Brazilian targeted apps,


feed_id: https://thehackernews.com/2022/12/russian-hackers-target-major-petroleum.html
title: Russian Hackers Targeted Petroleum Refinery in NATO Country During Ukraine War
uri: 2022-12-28-Russian-Hackers-Targeted-Petroleum-Refinery-in-NATO-Country-During-Ukr
url: https://thehackernews.com/2022/12/russian-hackers-target-major-petroleum.html
content:
The Russia-linked Gamaredon group attempted to unsuccessfully break into a large petroleum refining company within a NATO member state earlier this year amid the ongoing Russo-Ukrainian war.
The attack, which took place on August 30, 2022, is just one of multiple intrusions orchestrated by the advanced persistent threat (APT) that's attributed to Russia's Federal Security Service (FSB).


feed_id: https://thehackernews.com/2022/12/a-guide-to-efficient-patch-management.html
title: A Guide to Efficient Patch Management with Action1
uri: 2022-12-28-A-Guide-to-Efficient-Patch-Management-with-Action1
url: https://thehackernews.com/2022/12/a-guide-to-efficient-patch-management.html
content:
It's no secret that keeping software up to date is one of the key best practices in cybersecurity. Software vulnerabilities are being discovered almost weekly these days. The longer it takes IT teams to apply updates issued by developers to patch these security flaws, the more time attackers have to exploit the underlying vulnerability. Once threat actors gain access to corporate IT ecosystems,


feed_id: https://thehackernews.com/2022/12/kmsdbot-botnet-suspected-of-being-used.html
title: KmsdBot Botnet Suspected of Being Used as DDoS-for-Hire Service
uri: 2022-12-28-KmsdBot-Botnet-Suspected-of-Being-Used-as-DDoS-for-Hire-Service
url: https://thehackernews.com/2022/12/kmsdbot-botnet-suspected-of-being-used.html
content:
An ongoing analysis of the KmsdBot botnet has raised the possibility that it's a DDoS-for-hire service offered to other threat actors.
This is based on the different industries and geographies that were attacked, web infrastructure company Akamai said. Among the notable targets included FiveM and RedM, which are game modifications for Grand Theft Auto V and Red Dead Redemption 2, as well as


feed_id: https://thehackernews.com/2022/12/ftc-fines-fortnite-maker-epic-games-275.html
title: FTC Fines Fortnite Maker Epic Games $275 Million for Violating Children's Privacy Law
uri: 2022-12-28-FTC-Fines-Fortnite-Maker-Epic-Games-275-Million-for-Violating-Childre
url: https://thehackernews.com/2022/12/ftc-fines-fortnite-maker-epic-games-275.html
content:
Epic Games has reached a $520 million settlement with the U.S. Federal Trade Commission (FTC) over allegations that the Fortnite creator violated online privacy laws for children and tricked users into making unintended purchases in the video game.
To that end, the company will pay a record $275 million monetary penalty for breaching the Children's Online Privacy Protection Act (COPPA) by


feed_id: https://thehackernews.com/2022/12/microsoft-details-gatekeeper-bypass.html
title: Microsoft Details Gatekeeper Bypass Vulnerability in Apple macOS Systems
uri: 2022-12-28-Microsoft-Details-Gatekeeper-Bypass-Vulnerability-in-Apple-macOS-Syste
url: https://thehackernews.com/2022/12/microsoft-details-gatekeeper-bypass.html
content:
Microsoft has disclosed details of a now-patched security flaw in Apple macOS that could be exploited by an attacker to get around security protections imposed to prevent the execution of malicious applications.
The shortcoming, dubbed Achilles (CVE-2022-42821, CVSS score: 5.5), was addressed by the iPhone maker in macOS Ventura 13, Monterey 12.6.2, and Big Sur 11.7.2, describing it as a logic


feed_id: https://thehackernews.com/2022/12/researchers-discover-malicious-pypi.html
title: Researchers Discover Malicious PyPI Package Posing as SentinelOne SDK to Steal Data
uri: 2022-12-28-Researchers-Discover-Malicious-PyPI-Package-Posing-as-SentinelOne-SDK
url: https://thehackernews.com/2022/12/researchers-discover-malicious-pypi.html
content:
Cybersecurity researchers have discovered a new malicious package on the Python Package Index (PyPI) repository that impersonates a software development kit (SDK) for SentinelOne, a major cybersecurity company, as part of a campaign dubbed SentinelSneak.
The package, named SentinelOne and now taken down, is said to have been published between December 8 and 11, 2022, with nearly two dozen


feed_id: https://thehackernews.com/2022/12/glupteba-botnet-continues-to-thrive.html
title: Glupteba Botnet Continues to Thrive Despite Google's Attempts to Disrupt It
uri: 2022-12-28-Glupteba-Botnet-Continues-to-Thrive-Despite-Google-s-Attempts-to-Disru
url: https://thehackernews.com/2022/12/glupteba-botnet-continues-to-thrive.html
content:
The operators of the Glupteba botnet resurfaced in June 2022 as part of a renewed and "upscaled" campaign, months after Google disrupted the malicious activity.
The ongoing attack is suggestive of the malware's resilience in the face of takedowns, cybersecurity company Nozomi Networks said in a write-up. "In addition, there was a tenfold increase in TOR hidden services being used as C2 servers


feed_id: https://thehackernews.com/2022/12/cybercrime-and-security-predictions-for.html
title: Cybercrime (and Security) Predictions for 2023
uri: 2022-12-28-Cybercrime-(and-Security)-Predictions-for-2023
url: https://thehackernews.com/2022/12/cybercrime-and-security-predictions-for.html
content:
Threat actors continue to adapt to the latest technologies, practices, and even data privacy laws—and it's up to organizations to stay one step ahead by implementing strong cybersecurity measures and programs. 
Here's a look at how cybercrime will evolve in 2023 and what you can do to secure and protect your organization in the year ahead. 
Increase in digital supply chain attacks 
With the


feed_id: https://thehackernews.com/2022/12/new-agenda-ransomware-variant-written.html
title: New Agenda Ransomware Variant, Written in Rust, Aiming at Critical Infrastructure
uri: 2022-12-28-New-Agenda-Ransomware-Variant-Written-in-Rust-Aiming-at-Critical-Inf
url: https://thehackernews.com/2022/12/new-agenda-ransomware-variant-written.html
content:
A Rust variant of a ransomware strain known as Agenda has been observed in the wild, making it the latest malware to adopt the cross-platform programming language after BlackCat, Hive, Luna, and RansomExx.
Agenda, attributed to an operator named Qilin, is a ransomware-as-a-service (RaaS) group that has been linked to a spate of attacks primarily targeting manufacturing and IT industries across


feed_id: https://thehackernews.com/2022/12/facebook-cracks-down-on-spyware-vendors.html
title: Facebook Cracks Down on Spyware Vendors from U.S., China, Russia, Israel, and India
uri: 2022-12-28-Facebook-Cracks-Down-on-Spyware-Vendors-from-U-S-China-Russia-Isra
url: https://thehackernews.com/2022/12/facebook-cracks-down-on-spyware-vendors.html
content:
Meta Platforms disclosed that it took down no less than 200 covert influence operations since 2017 spanning roughly 70 countries across 42 languages.
The social media conglomerate also took steps to disable accounts and block infrastructure operated by spyware vendors, including in China, Russia, Israel, the U.S. and India, that targeted individuals in about 200 countries.
"The global


feed_id: https://thehackernews.com/2022/12/gmail-encryption.html
title: Google Takes Gmail Security to the Next Level with Client-Side Encryption
uri: 2022-12-28-Google-Takes-Gmail-Security-to-the-Next-Level-with-Client-Side-Encrypt
url: https://thehackernews.com/2022/12/gmail-encryption.html
content:
Google on Friday announced that its client-side encryption for Gmail is in beta for Workspace and education customers as part of its efforts to secure emails sent using the web version of the platform.
The development comes at a time when concerns about online privacy and data security are at an all-time high, making it a welcome change for users who value the protection of their personal data.


feed_id: https://thehackernews.com/2022/12/researcher-uncovers-potential.html
title: Researcher Uncovers Potential Wiretapping Bugs in Google Home Smart Speakers
uri: 2022-12-31-Researcher-Uncovers-Potential-Wiretapping-Bugs-in-Google-Home-Smart-Sp
url: https://thehackernews.com/2022/12/researcher-uncovers-potential.html
content:
A security researcher was awarded a bug bounty of $107,500 for identifying security issues in Google Home smart speakers that could be exploited to install backdoors and turn them into wiretapping devices.
The flaws "allowed an attacker within wireless proximity to install a 'backdoor' account on the device, enabling them to send commands to it remotely over the internet, access its microphone


feed_id: https://thehackernews.com/2022/12/cisa-warns-of-active-exploitation-of.html
title: CISA Warns of Active exploitation of JasperReports Vulnerabilities
uri: 2022-12-31-CISA-Warns-of-Active-exploitation-of-JasperReports-Vulnerabilities
url: https://thehackernews.com/2022/12/cisa-warns-of-active-exploitation-of.html
content:
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two years-old security flaws impacting TIBCO Software's JasperReports product to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation.
The flaws, tracked as CVE-2018-5430 (CVSS score: 7.7) and CVE-2018-18809 (CVSS score: 9.9), were addressed by TIBCO in April 2018 and March 2019,


feed_id: https://thehackernews.com/2022/12/thousands-of-citrix-servers-still.html
title: Thousands of Citrix Servers Still Unpatched for Critical Vulnerabilities
uri: 2022-12-31-Thousands-of-Citrix-Servers-Still-Unpatched-for-Critical-Vulnerabiliti
url: https://thehackernews.com/2022/12/thousands-of-citrix-servers-still.html
content:
Thousands of Citrix Application Delivery Controller (ADC) and Gateway endpoints remain vulnerable to two critical security flaws disclosed by the company over the last few months.
The issues in question are CVE-2022-27510 and CVE-2022-27518 (CVSS scores: 9.8), which were addressed by the virtualization services provider on November 8 and December 13, 2022, respectively.
While CVE-2022-27510


feed_id: https://thehackernews.com/2022/12/new-malvertising-campaign-via-google.html
title: New Malvertising Campaign via Google Ads Targets Users Searching for Popular Software
uri: 2022-12-31-New-Malvertising-Campaign-via-Google-Ads-Targets-Users-Searching-for-P
url: https://thehackernews.com/2022/12/new-malvertising-campaign-via-google.html
content:
Users searching for popular software are being targeted by a new malvertising campaign that abuses Google Ads to serve trojanized variants that deploy malware, such as Raccoon Stealer and Vidar.
The activity makes use of seemingly credible websites with typosquatted domain names that are surfaced on top of Google search results in the form of malicious ads by hijacking searches for specific


feed_id: https://thehackernews.com/2022/12/bitkeep-confirms-cyber-attack-loses.html
title: BitKeep Confirms Cyber Attack, Loses Over $9 Million in Digital Currencies
uri: 2022-12-31-BitKeep-Confirms-Cyber-Attack-Loses-Over-9-Million-in-Digital-Curren
url: https://thehackernews.com/2022/12/bitkeep-confirms-cyber-attack-loses.html
content:
Decentralized multi-chain crypto wallet BitKeep on Wednesday confirmed a cyberattack that allowed threat actors to distribute fraudulent versions of its Android app with the goal of stealing users' digital currencies.
"With maliciously implanted code, the altered APK led to the leak of user's private keys and enabled the hacker to move funds," BitKeep CEO Kevin Como said, describing it as a "


feed_id: https://thehackernews.com/2022/12/apt-hackers-turn-to-malicious-excel-add.html
title: APT Hackers Turn to Malicious Excel Add-ins as Initial Intrusion Vector
uri: 2022-12-31-APT-Hackers-Turn-to-Malicious-Excel-Add-ins-as-Initial-Intrusion-Vecto
url: https://thehackernews.com/2022/12/apt-hackers-turn-to-malicious-excel-add.html
content:
Microsoft's decision to block Visual Basic for Applications (VBA) macros by default for Office files downloaded from the internet has led many threat actors to improvise their attack chains in recent months.
Now according to Cisco Talos, advanced persistent threat (APT) actors and commodity malware families alike are increasingly using Excel add-in (.XLL) files as an initial intrusion vector.


feed_id: https://thehackernews.com/2023/01/hackers-using-captcha-bypass-tactics-in.html
title: Hackers Using CAPTCHA Bypass Tactics in Freejacking Campaign on GitHub
uri: 2023-01-07-Hackers-Using-CAPTCHA-Bypass-Tactics-in-Freejacking-Campaign-on-GitHub
url: https://thehackernews.com/2023/01/hackers-using-captcha-bypass-tactics-in.html
content:
A South Africa-based threat actor known as Automated Libra has been observed employing CAPTCHA bypass techniques to create GitHub accounts in a programmatic fashion as part of a freejacking campaign dubbed PURPLEURCHIN.
The group "primarily targets cloud platforms offering limited-time trials of cloud resources in order to perform their crypto mining operations," Palo Alto Networks Unit 42


feed_id: https://thehackernews.com/2023/01/microsoft-reveals-tactics-used-by-4.html
title: Microsoft Reveals Tactics Used by 4 Ransomware Families Targeting macOS
uri: 2023-01-07-Microsoft-Reveals-Tactics-Used-by-4-Ransomware-Families-Targeting-macO
url: https://thehackernews.com/2023/01/microsoft-reveals-tactics-used-by-4.html
content:
Microsoft has shed light on four different ransomware families – KeRanger, FileCoder, MacRansom, and EvilQuest – that are known to impact Apple macOS systems.
"While these malware families are old, they exemplify the range of capabilities and malicious behavior possible on the platform," the tech giant's Security Threat Intelligence team said in a Thursday report.
The initial vector for these


feed_id: https://thehackernews.com/2023/01/dridex-malware-now-attacking-macos.html
title: Dridex Malware Now Attacking macOS Systems with Novel Infection Method
uri: 2023-01-07-Dridex-Malware-Now-Attacking-macOS-Systems-with-Novel-Infection-Method
url: https://thehackernews.com/2023/01/dridex-malware-now-attacking-macos.html
content:
A variant of the infamous Dridex banking malware has set its sights on Apple's macOS operating system using a previously undocumented infection method, according to latest research.
It has "adopted a new technique to deliver documents embedded with malicious macros to users without having to pretend to be invoices or other business-related files," Trend Micro researcher Armando Nathaniel


feed_id: https://thehackernews.com/2023/01/rackspace-confirms-play-ransomware-gang.html
title: Rackspace Confirms Play Ransomware Gang Responsible for Recent Breach
uri: 2023-01-07-Rackspace-Confirms-Play-Ransomware-Gang-Responsible-for-Recent-Breach
url: https://thehackernews.com/2023/01/rackspace-confirms-play-ransomware-gang.html
content:
Cloud services provider Rackspace on Thursday confirmed that the ransomware gang known as Play was responsible for last month's breach.
The security incident, which took place on December 2, 2022, leveraged a previously unknown security exploit to gain initial access to the Rackspace Hosted Exchange email environment.
"This zero-day exploit is associated with CVE-2022-41080," the Texas-based


feed_id: https://thehackernews.com/2023/01/whatsapp-introduces-proxy-support-to.html
title: WhatsApp Introduces Proxy Support to Help Users Bypass Internet Censorship
uri: 2023-01-07-WhatsApp-Introduces-Proxy-Support-to-Help-Users-Bypass-Internet-Censor
url: https://thehackernews.com/2023/01/whatsapp-introduces-proxy-support-to.html
content:
Popular instant messaging service WhatsApp has launched support for proxy servers in the latest version of its Android and iOS apps, letting users circumvent government-imposed censorship and internet shutdowns.
"Choosing a proxy enables you to connect to WhatsApp through servers set up by volunteers and organizations around the world dedicated to helping people communicate freely," the


feed_id: https://thehackernews.com/2023/01/blind-eagle-hackers-return-with-refined.html
title: Blind Eagle Hackers Return with Refined Tools and Sophisticated Infection Chain
uri: 2023-01-07-Blind-Eagle-Hackers-Return-with-Refined-Tools-and-Sophisticated-Infect
url: https://thehackernews.com/2023/01/blind-eagle-hackers-return-with-refined.html
content:
A financially motivated threat actor tracked as Blind Eagle has resurfaced with a refined toolset and an elaborate infection chain as part of its attacks targeting organizations in Colombia and Ecuador.
Check Point's latest research offers new insights into the Spanish-speaking group's tactics and techniques, including the use of sophisticated tools and government-themed lures to activate the


feed_id: https://thehackernews.com/2023/01/bluebottle-cybercrime-group-preys-on.html
title: Bluebottle Cybercrime Group Preys on Financial Sector in French-Speaking African Nations
uri: 2023-01-07-Bluebottle-Cybercrime-Group-Preys-on-Financial-Sector-in-French-Speaki
url: https://thehackernews.com/2023/01/bluebottle-cybercrime-group-preys-on.html
content:
A cybercrime group dubbed Bluebottle has been linked to a set of targeted attacks against the financial sector in Francophone countries located in Africa from at least July 2022 to September 2022.
"The group makes extensive use of living-off-the-land, dual use tools, and commodity malware, with no custom malware deployed in this campaign," Symantec, a division of Broadcom Software, said in a


feed_id: https://thehackernews.com/2023/01/spynote-strikes-again-android-spyware.html
title: SpyNote Strikes Again: Android Spyware Targeting Financial Institutions
uri: 2023-01-07-SpyNote-Strikes-Again-Android-Spyware-Targeting-Financial-Institution
url: https://thehackernews.com/2023/01/spynote-strikes-again-android-spyware.html
content:
Financial institutions are being targeted by a new version of Android malware called SpyNote at least since October 2022 that combines both spyware and banking trojan characteristics.
"The reason behind this increase is that the developer of the spyware, who was previously selling it to other actors, made the source code public," ThreatFabric said in a report shared with The Hacker News. "This


feed_id: https://thehackernews.com/2023/01/mitigate-lastpass-attack-surface-in.html
title: Mitigate the LastPass Attack Surface in Your Environment with this Free Tool
uri: 2023-01-07-Mitigate-the-LastPass-Attack-Surface-in-Your-Environment-with-this-Fre
url: https://thehackernews.com/2023/01/mitigate-lastpass-attack-surface-in.html
content:
The latest breach announced by LastPass is a major cause for concern to security stakeholders. As often occurs, we are at a security limbo – on the one hand, as LastPass has noted, users who followed LastPass best practices would be exposed to practically zero to extremely low risk. However, to say that password best practices are not followed is a wild understatement. The reality is that there


feed_id: https://thehackernews.com/2023/01/circleci-urges-customers-to-rotate.html
title: CircleCI Urges Customers to Rotate Secrets Following Security Incident
uri: 2023-01-07-CircleCI-Urges-Customers-to-Rotate-Secrets-Following-Security-Incident
url: https://thehackernews.com/2023/01/circleci-urges-customers-to-rotate.html
content:
DevOps platform CircleCI on Wednesday urged its customers to rotate all their secrets following an unspecified security incident.
The company said an investigation is currently ongoing, but emphasized that "there are no unauthorized actors active in our systems." Additional details are expected to be shared in the coming days.
"Immediately rotate any and all secrets stored in CircleCI,"


feed_id: https://thehackernews.com/2023/01/the-evolving-tactics-of-vidar-stealer.html
title: The Evolving Tactics of Vidar Stealer: From Phishing Emails to Social Media
uri: 2023-01-07-The-Evolving-Tactics-of-Vidar-Stealer-From-Phishing-Emails-to-Social
url: https://thehackernews.com/2023/01/the-evolving-tactics-of-vidar-stealer.html
content:
The notorious information-stealer known as Vidar is continuing to leverage popular social media services such as TikTok, Telegram, Steam, and Mastodon as an intermediate command-and-control (C2) server.
"When a user creates an account on an online platform, a unique account page that can be accessed by anyone is generated," AhnLab Security Emergency Response Center (ASEC) disclosed in a


feed_id: https://thehackernews.com/2023/01/fortinet-and-zoho-urge-customers-to.html
title: Fortinet and Zoho Urge Customers to Patch Enterprise Software Vulnerabilities
uri: 2023-01-07-Fortinet-and-Zoho-Urge-Customers-to-Patch-Enterprise-Software-Vulnerab
url: https://thehackernews.com/2023/01/fortinet-and-zoho-urge-customers-to.html
content:
Fortinet has warned of a high-severity flaw affecting multiple versions of FortiADC application delivery controller that could lead to the execution of arbitrary code.
"An improper neutralization of special elements used in an OS command vulnerability in FortiADC may allow an authenticated attacker with access to the web GUI to execute unauthorized code or commands via specifically crafted HTTP


feed_id: https://thehackernews.com/2023/01/irish-regulators-fine-facebook-414.html
title: Irish Regulators Fine Facebook $414 Million for Forcing Users to Accept Targeted Ads
uri: 2023-01-07-Irish-Regulators-Fine-Facebook-414-Million-for-Forcing-Users-to-Accep
url: https://thehackernews.com/2023/01/irish-regulators-fine-facebook-414.html
content:
The Irish Data Protection Commission (DPC) has fined Meta Platforms €390 million (roughly $414 million) over its handling of user data for serving personalized ads in what could be a major blow to its ad-fueled business model.
To that end, the privacy regulator has ordered Meta Ireland to pay two fines – a €210 million ($222.5 million) fine over violations of the E.U. General Data Protection


feed_id: https://thehackernews.com/2023/01/qualcomm-chipsets-and-lenovo-bios-get.html
title: Qualcomm Chipsets and Lenovo BIOS Get Security Updates to Fix Multiple Flaws
uri: 2023-01-07-Qualcomm-Chipsets-and-Lenovo-BIOS-Get-Security-Updates-to-Fix-Multiple
url: https://thehackernews.com/2023/01/qualcomm-chipsets-and-lenovo-bios-get.html
content:
Qualcomm on Tuesday released patches to address multiple security flaws in its chipsets, some of which could be exploited to cause information disclosure and memory corruption.
The five vulnerabilities -- tracked from CVE-2022-40516 through CVE-2022-40520 -- also impact Lenovo ThinkPad X13s laptops, prompting the Chinese PC maker to issue BIOS updates to plug the security holes.
The list of


feed_id: https://thehackernews.com/2023/01/the-fbis-perspective-on-ransomware.html
title: The FBI's Perspective on Ransomware
uri: 2023-01-07-The-FBI-s-Perspective-on-Ransomware
url: https://thehackernews.com/2023/01/the-fbis-perspective-on-ransomware.html
content:
Ransomware: contemporary threats, how to prevent them and how the FBI can help
In April 2021, Dutch supermarkets faced a food shortage. The cause wasn't a drought or a sudden surge in the demand for avocados. Rather, the reason was a ransomware attack. In the past years, companies, universities, schools, medical facilities and other organizations have been targeted by ransomware threat actors,


feed_id: https://thehackernews.com/2023/01/new-shc-based-linux-malware-targeting.html
title: New shc-based Linux Malware Targeting Systems with Cryptocurrency Miner
uri: 2023-01-07-New-shc-based-Linux-Malware-Targeting-Systems-with-Cryptocurrency-Mine
url: https://thehackernews.com/2023/01/new-shc-based-linux-malware-targeting.html
content:
A new Linux malware developed using the shell script compiler (shc) has been observed deploying a cryptocurrency miner on compromised systems.
"It is presumed that after successful authentication through a dictionary attack on inadequately managed Linux SSH servers, various malware were installed on the target system," AhnLab Security Emergency Response Center (ASEC) said in a report published


feed_id: https://thehackernews.com/2023/01/synology-releases-patch-for-critical.html
title: Synology Releases Patch for Critical RCE Vulnerability Affecting VPN Plus Servers
uri: 2023-01-07-Synology-Releases-Patch-for-Critical-RCE-Vulnerability-Affecting-VPN-P
url: https://thehackernews.com/2023/01/synology-releases-patch-for-critical.html
content:
Synology has released security updates to address a critical flaw impacting VPN Plus Server that could be exploited to take over affected systems.
Tracked as CVE-2022-43931, the vulnerability carries a maximum severity rating of 10 on the CVSS scale and has been described as an out-of-bounds write bug in the remote desktop functionality in Synology VPN Plus Server.
Successful exploitation of the


feed_id: https://thehackernews.com/2023/01/enforcement-vs-enrollment-based.html
title: Enforcement vs. Enrollment-based Security: How to Balance Security and Employee Trust
uri: 2023-01-07-Enforcement-vs-Enrollment-based-Security-How-to-Balance-Security-and
url: https://thehackernews.com/2023/01/enforcement-vs-enrollment-based.html
content:
Challenges with an enforcement-based approach
An enforcement-based approach to security begins with a security policy backed by security controls, often heavy-handed and designed to prevent employees from engaging in risky behavior or inadvertently expanding the potential attack surface of an organization. 
Most organizations exclusively use enforcement-based security controls, usually carried


feed_id: https://thehackernews.com/2023/01/hackers-using-stolen-bank-information.html
title: Hackers Using Stolen Bank Information to Trick Victims into Downloading BitRAT Malware
uri: 2023-01-07-Hackers-Using-Stolen-Bank-Information-to-Trick-Victims-into-Downloadin
url: https://thehackernews.com/2023/01/hackers-using-stolen-bank-information.html
content:
A new malware campaign has been observed using sensitive information stolen from a bank as a lure in phishing emails to drop a remote access trojan called BitRAT.
The unknown adversary is believed to have hijacked the IT infrastructure of a Colombian cooperative bank, using the information to craft convincing decoy messages to lure victims into opening suspicious Excel attachments.
The discovery


feed_id: https://thehackernews.com/2023/01/raspberry-robin-worm-evolves-to-attack.html
title: Raspberry Robin Worm Evolves to Attack Financial and Insurance Sectors in Europe
uri: 2023-01-07-Raspberry-Robin-Worm-Evolves-to-Attack-Financial-and-Insurance-Sectors
url: https://thehackernews.com/2023/01/raspberry-robin-worm-evolves-to-attack.html
content:
Financial and insurance sectors in Europe have been targeted by the Raspberry Robin worm, as the malware continues to evolve its post-exploitation capabilities while remaining under the radar.
"What is unique about the malware is that it is heavily obfuscated and highly complex to statically disassemble," Security Joes said in a new report published Monday.
The intrusions, observed against


feed_id: https://thehackernews.com/2023/01/redzei-chinese-scammers-targeting.html
title: RedZei Chinese Scammers Targeting Chinese Students in the U.K.
uri: 2023-01-07-RedZei-Chinese-Scammers-Targeting-Chinese-Students-in-the-U-K
url: https://thehackernews.com/2023/01/redzei-chinese-scammers-targeting.html
content:
Chinese international students in the U.K. have been targeted by persistent Chinese-speaking scammers for over a year as part of an activity dubbed RedZei (aka RedThief).
"The RedZei fraudsters have chosen their targets carefully, researched them and realized it was a rich victim group that is ripe for exploitation," cybersecurity researcher Will Thomas (@BushidoToken) said in a write-up


feed_id: https://thehackernews.com/2023/01/pytorch-machine-learning-framework.html
title: PyTorch Machine Learning Framework Compromised with Malicious Dependency
uri: 2023-01-07-PyTorch-Machine-Learning-Framework-Compromised-with-Malicious-Dependen
url: https://thehackernews.com/2023/01/pytorch-machine-learning-framework.html
content:
The maintainers of the PyTorch package have warned users who have installed the nightly builds of the library between December 25, 2022, and December 30, 2022, to uninstall and download the latest versions following a dependency confusion attack.
"PyTorch-nightly Linux packages installed via pip during that time installed a dependency, torchtriton, which was compromised on the Python Package


feed_id: https://thehackernews.com/2023/01/wordpress-security-alert-new-linux.html
title: WordPress Security Alert: New Linux Malware Exploiting Over Two Dozen CMS Flaws
uri: 2023-01-07-WordPress-Security-Alert-New-Linux-Malware-Exploiting-Over-Two-Dozen
url: https://thehackernews.com/2023/01/wordpress-security-alert-new-linux.html
content:
WordPress sites are being targeted by a previously unknown strain of Linux malware that exploits flaws in over two dozen plugins and themes to compromise vulnerable systems.
"If sites use outdated versions of such add-ons, lacking crucial fixes, the targeted web pages are injected with malicious JavaScripts," Russian security vendor Doctor Web said in a report published last week. "As a result,


feed_id: https://thehackernews.com/2023/01/google-to-pay-295-million-to-settle.html
title: Google to Pay $29.5 Million to Settle Lawsuits Over User Location Tracking
uri: 2023-01-07-Google-to-Pay-29-5-Million-to-Settle-Lawsuits-Over-User-Location-Trac
url: https://thehackernews.com/2023/01/google-to-pay-295-million-to-settle.html
content:
Google has agreed to pay a total of $29.5 million to settle two different lawsuits brought by Indiana and Washington, D.C., over its "deceptive" location tracking practices.
The search and advertising giant is required to pay $9.5 million to D.C. and $20 million to Indiana after the states sued the company for charges that the company tracked users' locations without their express consent.
The


feed_id: https://thehackernews.com/2023/01/kinsing-cryptojacking-hits-kubernetes.html
title: Kinsing Cryptojacking Hits Kubernetes Clusters via Misconfigured PostgreSQL
uri: 2023-01-09-Kinsing-Cryptojacking-Hits-Kubernetes-Clusters-via-Misconfigured-Postg
url: https://thehackernews.com/2023/01/kinsing-cryptojacking-hits-kubernetes.html
content:
The threat actors behind the Kinsing cryptojacking operation have been spotted exploiting misconfigured and exposed PostgreSQL servers to obtain initial access to Kubernetes environments.
A second initial access vector technique entails the use of vulnerable images, Sunders Bruskin, security researcher at Microsoft Defender for Cloud, said in a report last week.
Kinsing has a storied history of


feed_id: https://thehackernews.com/2023/01/new-study-uncovers-text-to-sql-model.html
title: New Study Uncovers Text-to-SQL Model Vulnerabilities Allowing Data Theft and DoS Attacks
uri: 2023-01-09-New-Study-Uncovers-Text-to-SQL-Model-Vulnerabilities-Allowing-Data-The
url: https://thehackernews.com/2023/01/new-study-uncovers-text-to-sql-model.html
content:
A group of academics has demonstrated novel attacks that leverage Text-to-SQL models to produce malicious code that could enable adversaries to glean sensitive information and stage denial-of-service (DoS) attacks.
"To better interact with users, a wide range of database applications employ AI techniques that can translate human questions into SQL queries (namely Text-to-SQL)," Xutan Peng, a


feed_id: https://thehackernews.com/2023/01/why-do-user-permissions-matter-for-saas.html
title: Why Do User Permissions Matter for SaaS Security?
uri: 2023-01-09-Why-Do-User-Permissions-Matter-for-SaaS-Security
url: https://thehackernews.com/2023/01/why-do-user-permissions-matter-for-saas.html
content:
Earlier this year, threat actors infiltrated Mailchimp, the popular SaaS email marketing platform. They viewed over 300 Mailchimp customer accounts and exported audience data from 102 of them. The breach was preceded by a successful phishing attempt and led to malicious attacks against Mailchimp’s customers’ end users.
Three months later, Mailchimp was hit with another attack. Once again, an


feed_id: https://thehackernews.com/2023/01/millions-of-vehicles-at-risk-api.html
title: Millions of Vehicles at Risk: API Vulnerabilities Uncovered in 16 Major Car Brands
uri: 2023-01-09-Millions-of-Vehicles-at-Risk-API-Vulnerabilities-Uncovered-in-16-Majo
url: https://thehackernews.com/2023/01/millions-of-vehicles-at-risk-api.html
content:
Multiple bugs affecting millions of vehicles from 16 different manufacturers could be abused to unlock, start, and track cars, plus impact the privacy of car owners.
The security vulnerabilities were found in the automotive APIs powering Acura, BMW, Ferrari, Ford, Genesis, Honda, Hyundai, Infiniti, Jaguar, Kia, Land Rover, Mercedes-Benz, Nissan, Porsche, Rolls Royce, Toyota as well as in


feed_id: https://thehackernews.com/2023/01/malicious-pypi-packages-using.html
title: Malicious PyPI Packages Using Cloudflare Tunnels to Sneak Through Firewalls
uri: 2023-01-09-Malicious-PyPI-Packages-Using-Cloudflare-Tunnels-to-Sneak-Through-Fire
url: https://thehackernews.com/2023/01/malicious-pypi-packages-using.html
content:
In yet another campaign targeting the Python Package Index (PyPI) repository, six malicious packages have been found deploying information stealers on developer systems.
The now-removed packages, which were discovered by Phylum between December 22 and December 31, 2022, include pyrologin, easytimestamp, discorder, discord-dev, style.py, and pythonstyles.
The malicious code, as is increasingly


feed_id: https://thehackernews.com/2023/01/top-saas-cybersecurity-threats-in-2023.html
title: Top SaaS Cybersecurity Threats in 2023: Are You Ready?
uri: 2023-01-09-Top-SaaS-Cybersecurity-Threats-in-2023-Are-You-Ready
url: https://thehackernews.com/2023/01/top-saas-cybersecurity-threats-in-2023.html
content:
Cybercriminals will be as busy as ever this year. Stay safe and protect your systems and data by focusing on these 4 key areas to secure your environment and ensure success in 2023, and make sure your business is only in the headlines when you WANT it to be. 1 — Web application weaknesses

Web applications are at the core of what SaaS companies do and how they operate, and they can store some of


feed_id: https://thehackernews.com/2023/01/hackers-distributing-malicious-visual.html
title: Hackers Can Abuse Visual Studio Marketplace to Target Developers with Malicious Extensions
uri: 2023-01-09-Hackers-Can-Abuse-Visual-Studio-Marketplace-to-Target-Developers-with
url: https://thehackernews.com/2023/01/hackers-distributing-malicious-visual.html
content:
A new attack vector targeting the Visual Studio Code extensions marketplace could be leveraged to upload rogue extensions masquerading as their legitimate counterparts with the goal of mounting supply chain attacks.
The technique "could act as an entry point for an attack on many organizations," Aqua security researcher Ilay Goldman said in a report published last week.
VS Code extensions,


feed_id: https://thehackernews.com/2023/01/russian-turla-hackers-hijack-decade-old.html
title: Russian Turla Hackers Hijack Decade-Old Malware Infrastructure to Deploy New Backdoors
uri: 2023-01-09-Russian-Turla-Hackers-Hijack-Decade-Old-Malware-Infrastructure-to-Depl
url: https://thehackernews.com/2023/01/russian-turla-hackers-hijack-decade-old.html
content:
The Russian cyberespionage group known as Turla has been observed piggybacking on attack infrastructure used by a decade-old malware to deliver its own reconnaissance and backdoor tools to targets in Ukraine.
Google-owned Mandiant, which is tracking the operation under the uncategorized cluster moniker UNC4210, said the hijacked servers correspond to a variant of a commodity malware called 


feed_id: https://thehackernews.com/2023/01/cisco-issues-warning-for-unpatched.html
title: Cisco Issues Warning for Unpatched Vulnerabilities in EoL Business Routers
uri: Cisco-Issues-Warning-for-Unpatched-Vulnerabilities-in-EoL-Business-Rou
url: https://thehackernews.com/2023/01/cisco-issues-warning-for-unpatched.html
content:
Cisco has warned of two security vulnerabilities affecting end-of-life (EoL) Small Business RV016, RV042, RV042G, and RV082 routers that it said will not be fixed, even as it acknowledged the public availability of proof-of-concept (PoC) exploit.
The issues are rooted in the router's web-based management interface, enabling a remote adversary to sidestep authentication or execute malicious


feed_id: https://thehackernews.com/2023/01/beware-tainted-vpns-being-used-to.html
title: Beware: Tainted VPNs Being Used to Spread EyeSpy Surveillanceware
uri: 2023-01-14-Beware-Tainted-VPNs-Being-Used-to-Spread-EyeSpy-Surveillanceware
url: https://thehackernews.com/2023/01/beware-tainted-vpns-being-used-to.html
content:
Tainted VPN installers are being used to deliver a piece of surveillanceware dubbed EyeSpy as part of a malware campaign that started in May 2022.
It uses "components of SecondEye – a legitimate monitoring application – to spy on users of 20Speed VPN, an Iranian-based VPN service, via trojanized installers," Bitdefender said in an analysis.
A majority of the infections are said to originate in


feed_id: https://thehackernews.com/2023/01/cybercriminals-using-polyglot-files-in.html
title: Cybercriminals Using Polyglot Files in Malware Distribution to Fly Under the Radar
uri: 2023-01-14-Cybercriminals-Using-Polyglot-Files-in-Malware-Distribution-to-Fly-Und
url: https://thehackernews.com/2023/01/cybercriminals-using-polyglot-files-in.html
content:
Remote access trojans such as StrRAT and Ratty are being distributed as a combination of polyglot and malicious Java archive (JAR) files, once again highlighting how threat actors are continuously finding new ways to fly under the radar.
"Attackers now use the polyglot technique to confuse security solutions that don't properly validate the JAR file format," Deep Instinct security researcher


feed_id: https://thehackernews.com/2023/01/get-unified-cloud-and-endpoint-security.html
title: Get Unified Cloud and Endpoint Security: Only $1 for 1,000 Assets for all of 2023!
uri: 2023-01-14-Get-Unified-Cloud-and-Endpoint-Security-Only-1-for-1-000-Assets-for
url: https://thehackernews.com/2023/01/get-unified-cloud-and-endpoint-security.html
content:
As the new year begins, it's more important than ever to protect your business from the constantly evolving cyber threats that could compromise your valuable assets. 
But who wants to pay an arm and a leg for top-tier security? With this Uptycs introductory offer, you do not have to.
Kickstart the new year by securing your business with Uptycs. Starting now, for just $1, you can get


feed_id: https://thehackernews.com/2023/01/fortios-flaw-exploited-as-zero-day-in.html
title: FortiOS Flaw Exploited as Zero-Day in Attacks on Government and Organizations
uri: 2023-01-14-FortiOS-Flaw-Exploited-as-Zero-Day-in-Attacks-on-Government-and-Organi
url: https://thehackernews.com/2023/01/fortios-flaw-exploited-as-zero-day-in.html
content:
A zero-day vulnerability in FortiOS SSL-VPN that Fortinet addressed last month was exploited by unknown actors in attacks targeting the government and other large organizations.
"The complexity of the exploit suggests an advanced actor and that it is highly targeted at governmental or government-related targets," Fortinet researchers said in a post-mortem analysis published this week.
The


feed_id: https://thehackernews.com/2023/01/icedid-malware-strikes-again-active.html
title: IcedID Malware Strikes Again: Active Directory Domain Compromised in Under 24 Hours
uri: 2023-01-14-IcedID-Malware-Strikes-Again-Active-Directory-Domain-Compromised-in-U
url: https://thehackernews.com/2023/01/icedid-malware-strikes-again-active.html
content:
A recent IcedID malware attack enabled the threat actor to compromise the Active Directory domain of an unnamed target less than 24 hours after gaining initial access, while also borrowing techniques from other groups like Conti to meet its goals.
"Throughout the attack, the attacker followed a routine of recon commands, credential theft, lateral movement by abusing Windows protocols, and


feed_id: https://thehackernews.com/2023/01/over-100-siemens-plc-models-found.html
title: Over 100 Siemens PLC Models Found Vulnerable to Firmware Takeover
uri: 2023-01-14-Over-100-Siemens-PLC-Models-Found-Vulnerable-to-Firmware-Takeover
url: https://thehackernews.com/2023/01/over-100-siemens-plc-models-found.html
content:
Security researchers have disclosed multiple architectural vulnerabilities in Siemens SIMATIC and SIPLUS S7-1500 programmable logic controllers (PLCs) that could be exploited by a malicious actor to stealthily install firmware on affected devices and take control of them.
Discovered by Red Balloon Security, the issues are tracked as CVE-2022-38773 (CVSS score: 4.6), with the low severity


feed_id: https://thehackernews.com/2023/01/experts-detail-chromium-browser.html
title: Experts Detail Chromium Browser Security Flaw Putting Confidential Data at Risk
uri: 2023-01-14-Experts-Detail-Chromium-Browser-Security-Flaw-Putting-Confidential-Dat
url: https://thehackernews.com/2023/01/experts-detail-chromium-browser.html
content:
Details have emerged about a now-patched vulnerability in Google Chrome and Chromium-based browsers that, if successfully exploited, could have made it possible to siphon files containing confidential data.
"The issue arose from the way the browser interacted with symlinks when processing files and directories," Imperva researcher Ron Masas said. "Specifically, the browser did not properly check


feed_id: https://thehackernews.com/2023/01/patch-where-it-hurts-effective.html
title: Patch Where it Hurts: Effective Vulnerability Management in 2023
uri: Patch-Where-it-Hurts-Effective-Vulnerability-Management-in-2023
url: https://thehackernews.com/2023/01/patch-where-it-hurts-effective.html
content:
A recently published Security Navigator report data shows that businesses are still taking 215 days to patch a reported vulnerability. Even for critical vulnerabilities, it generally takes more than 6 months to patch.
Good vulnerability management is not about being fast enough in patching all potential breaches. It's about focusing on the real risk using vulnerability prioritization to correct


feed_id: https://thehackernews.com/2023/01/twitter-denies-hacking-claims-assures.html
title: Twitter Denies Hacking Claims, Assures Leaked User Data Not from its System
uri: 2023-01-14-Twitter-Denies-Hacking-Claims-Assures-Leaked-User-Data-Not-from-its-S
url: https://thehackernews.com/2023/01/twitter-denies-hacking-claims-assures.html
content:
Twitter on Wednesday said that its investigation found "no evidence" that users' data sold online was obtained by exploiting any security vulnerabilities in its systems.
"Based on information and intel analyzed to investigate the issue, there is no evidence that the data being sold online was obtained by exploiting a vulnerability of Twitter systems," the company said in a statement. "The data


feed_id: https://thehackernews.com/2023/01/alert-hackers-actively-exploiting.html
title: Alert: Hackers Actively Exploiting Critical "Control Web Panel" RCE Vulnerability
uri: 2023-01-14-Alert-Hackers-Actively-Exploiting-Critical-Control-Web-Panel-RCE-Vu
url: https://thehackernews.com/2023/01/alert-hackers-actively-exploiting.html
content:
Malicious actors are actively attempting to exploit a recently patched critical vulnerability in Control Web Panel (CWP) that enables elevated privileges and unauthenticated remote code execution (RCE) on susceptible servers.
Tracked as CVE-2022-44877 (CVSS score: 9.8), the bug impacts all versions of the software before 0.9.8.1147 and was patched by its maintainers on October 25, 2022.
Control


feed_id: https://thehackernews.com/2023/01/new-analysis-reveals-raspberry-robin.html
title: New Analysis Reveals Raspberry Robin Can be Repurposed by Other Threat Actors
uri: 2023-01-14-New-Analysis-Reveals-Raspberry-Robin-Can-be-Repurposed-by-Other-Threat
url: https://thehackernews.com/2023/01/new-analysis-reveals-raspberry-robin.html
content:
A new analysis of Raspberry Robin's attack infrastructure has revealed that it's possible for other threat actors to repurpose the infections for their own malicious activities, making it an even more potent threat.
Raspberry Robin (aka QNAP worm), attributed to a threat actor dubbed DEV-0856, is a malware that has increasingly come under the radar for being used in attacks aimed at finance,


feed_id: https://thehackernews.com/2023/01/australian-healthcare-sector-targeted.html
title: Australian Healthcare Sector Targeted in Latest Gootkit Malware Attacks
uri: 2023-01-14-Australian-Healthcare-Sector-Targeted-in-Latest-Gootkit-Malware-Attack
url: https://thehackernews.com/2023/01/australian-healthcare-sector-targeted.html
content:
A recent wave of Gootkit malware loader attacks has targeted the Australian healthcare sector by leveraging legitimate tools like VLC Media Player.
Gootkit, also called Gootloader, is known to employ search engine optimization (SEO) poisoning tactics (aka spamdexing) for initial access. It typically works by compromising and abusing legitimate infrastructure and seeding those sites with common


feed_id: https://thehackernews.com/2023/01/unlock-your-potential-get-9-online.html
title: Unlock Your Potential: Get 9 Online Cyber Security Courses for Just $49.99
uri: 2023-01-14-Unlock-Your-Potential-Get-9-Online-Cyber-Security-Courses-for-Just-4
url: https://thehackernews.com/2023/01/unlock-your-potential-get-9-online.html
content:
Are you looking to take your career in the information security industry to the next level? Look no further than the 2023 Certified Technology Professional Bundle!
This unparalleled offer grants you lifetime access to nine comprehensive courses in information security, hacking, and cybersecurity at a remarkable price of just $49.99.
Yes, you heard me right. Instead of paying the full price of $


feed_id: https://thehackernews.com/2023/01/dark-pink-apt-group-targets-governments.html
title: Dark Pink APT Group Targets Governments and Military in APAC Region
uri: 2023-01-14-Dark-Pink-APT-Group-Targets-Governments-and-Military-in-APAC-Region
url: https://thehackernews.com/2023/01/dark-pink-apt-group-targets-governments.html
content:
Government and military organizations in the Asia-Pacific region are being targeted by a previously unknown advanced persistent threat (APT) actor, per the latest research conducted by Albert Priego of Group-IB
Singapore-headquartered Group-IB, in a report shared with The Hacker News, said it's tracking the ongoing campaign under the name Dark Pink and attributed seven successful attacks to the


feed_id: https://thehackernews.com/2023/01/microsoft-issues-january-2023-patch.html
title: Microsoft Issues January 2023 Patch Tuesday Updates, Warns of Zero-Day Exploit
uri: 2023-01-14-Microsoft-Issues-January-2023-Patch-Tuesday-Updates-Warns-of-Zero-Day
url: https://thehackernews.com/2023/01/microsoft-issues-january-2023-patch.html
content:
The first Patch Tuesday fixes shipped by Microsoft for 2023 have addressed a total of 98 security flaws, including one bug that the company said is being actively exploited in the wild.
11 of the 98 issues are rated Critical and 87 are rated Important in severity, with one of the vulnerabilities also listed as publicly known at the time of release. Separately, the Windows maker is expected to


feed_id: https://thehackernews.com/2023/01/strongpity-hackers-distribute.html
title: StrongPity Hackers Distribute Trojanized Telegram App to Target Android Users
uri: 2023-01-14-StrongPity-Hackers-Distribute-Trojanized-Telegram-App-to-Target-Androi
url: https://thehackernews.com/2023/01/strongpity-hackers-distribute.html
content:
The advanced persistent threat (APT) group known as StrongPity has targeted Android users with a trojanized version of the Telegram app through a fake website that impersonates a video chat service called Shagle.
"A copycat website, mimicking the Shagle service, is used to distribute StrongPity's mobile backdoor app," ESET malware researcher Lukáš Štefanko said in a technical report. "The app is


feed_id: https://thehackernews.com/2023/01/expert-analysis-reveals-cryptographic.html
title: Expert Analysis Reveals Cryptographic Weaknesses in Threema Messaging App
uri: 2023-01-14-Expert-Analysis-Reveals-Cryptographic-Weaknesses-in-Threema-Messaging
url: https://thehackernews.com/2023/01/expert-analysis-reveals-cryptographic.html
content:
A comprehensive analysis of the cryptographic protocols used in the Swiss encrypted messaging application Threema has revealed a number of loopholes that could be exploited to break authentication protections and even recover users' private keys.
The seven attacks span three different threat models, according to ETH Zurich researchers Kenneth G. Paterson, Matteo Scarlata, and Kien Tuong Truong,


feed_id: https://thehackernews.com/2023/01/italian-users-warned-of-malware-attack.html
title: Italian Users Warned of Malware Attack Targeting Sensitive Information
uri: 2023-01-14-Italian-Users-Warned-of-Malware-Attack-Targeting-Sensitive-Information
url: https://thehackernews.com/2023/01/italian-users-warned-of-malware-attack.html
content:
A new malware campaign has been observed targeting Italy with phishing emails designed to deploy an information stealer on compromised Windows systems.
"The info-stealer malware steals sensitive information like system info, crypto wallet and browser histories, cookies, and credentials of crypto wallets from victim machines," Uptycs security researcher Karthickkumar Kathiresan said in a report.


feed_id: https://thehackernews.com/2023/01/critical-security-flaw-found-in.html
title: Severe Security Flaw Found in "jsonwebtoken" Library Used by 22,000+ Projects
uri: Severe-Security-Flaw-Found-in-jsonwebtoken-Library-Used-by-22-000-P
url: https://thehackernews.com/2023/01/critical-security-flaw-found-in.html
content:
A high-severity security flaw has been disclosed in the open source jsonwebtoken (JWT) library that, if successfully exploited, could lead to remote code execution on a target server.
"By exploiting this vulnerability, attackers could achieve remote code execution (RCE) on a server verifying a maliciously crafted JSON web token (JWT) request," Palo Alto Networks Unit 42 researcher Artur Oleyarsh


feed_id: https://thehackernews.com/2023/01/researchers-uncover-3-pypi-packages.html
title: Researchers Uncover 3 PyPI Packages Spreading Malware to Developer Systems
uri: Researchers-Uncover-3-PyPI-Packages-Spreading-Malware-to-Developer-Sys
url: https://thehackernews.com/2023/01/researchers-uncover-3-pypi-packages.html
content:
A threat actor by the name Lolip0p has uploaded three rogue packages to the Python Package Index (PyPI) repository that are designed to drop malware on compromised developer systems.
The packages – named colorslib (versions 4.6.11 and 4.6.12), httpslib (versions 4.6.9 and 4.6.11), and libhttps (version 4.6.12) – by the author between January 7, 2023, and January 12, 2023. They have since been


feed_id: https://thehackernews.com/2023/01/raccoon-and-vidar-stealers-spreading.html
title: Raccoon and Vidar Stealers Spreading via Massive Network of Fake Cracked Software
uri: 2023-01-17-Raccoon-and-Vidar-Stealers-Spreading-via-Massive-Network-of-Fake-Crack
url: https://thehackernews.com/2023/01/raccoon-and-vidar-stealers-spreading.html
content:
A "large and resilient infrastructure" comprising over 250 domains is being used to distribute information-stealing malware such as Raccoon and Vidar since early 2020.
The infection chain "uses about a hundred of fake cracked software catalogue websites that redirect to several links before downloading the payload hosted on file share platforms, such as GitHub," cybersecurity firm SEKOIA said in


feed_id: https://thehackernews.com/2023/01/a-secure-user-authentication-method.html
title: A Secure User Authentication Method – Planning is More Important than Ever
uri: 2023-01-17-A-Secure-User-Authentication-Method-Planning-is-More-Important-tha
url: https://thehackernews.com/2023/01/a-secure-user-authentication-method.html
content:
When considering authentication providers, many organizations consider the ease of configuration, ubiquity of usage, and technical stability. Organizations cannot always be judged on those metrics alone. There is an increasing need to evaluate company ownership, policies and the stability, or instability, that it brings.
How Leadership Change Affects Stability
In recent months, a salient example


feed_id: https://thehackernews.com/2023/01/cisa-warns-for-flaws-affecting.html
title: CISA Warns of Flaws Affecting Industrial Control Systems from Major Manufacturers
uri: CISA-Warns-of-Flaws-Affecting-Industrial-Control-Systems-from-Major-Ma
url: https://thehackernews.com/2023/01/cisa-warns-for-flaws-affecting.html
content:
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has released several Industrial Control Systems (ICS) advisories warning of critical security flaws affecting products from Sewio, InHand Networks, Sauter Controls, and Siemens.
The most severe of the flaws relate to Sewio's RTLS Studio, which could be exploited by an attacker to "obtain unauthorized access to the server, alter


feed_id: https://thehackernews.com/2023/01/new-backdoor-created-using-leaked-cias.html
title: New Backdoor Created Using Leaked CIA's Hive Malware Discovered in the Wild
uri: 2023-01-17-New-Backdoor-Created-Using-Leaked-CIA-s-Hive-Malware-Discovered-in-the
url: https://thehackernews.com/2023/01/new-backdoor-created-using-leaked-cias.html
content:
Unidentified threat actors have deployed a new backdoor that borrows its features from the U.S. Central Intelligence Agency (CIA)'s Hive multi-platform malware suite, the source code of which was released by WikiLeaks in November 2017.
"This is the first time we caught a variant of the CIA Hive attack kit in the wild, and we named it xdr33 based on its embedded Bot-side certificate CN=xdr33,"


feed_id: https://thehackernews.com/2023/01/malware-attack-on-circleci-engineers.html
title: Malware Attack on CircleCI Engineer's Laptop Leads to Recent Security Incident
uri: 2023-01-17-Malware-Attack-on-CircleCI-Engineer-s-Laptop-Leads-to-Recent-Security
url: https://thehackernews.com/2023/01/malware-attack-on-circleci-engineers.html
content:
DevOps platform CircleCI on Friday disclosed that unidentified threat actors compromised an employee's laptop and leveraged malware to steal their two-factor authentication-backed credentials to breach the company's systems and data last month.
The CI/CD service CircleCI said the "sophisticated attack" took place on December 16, 2022, and that the malware went undetected by its antivirus


feed_id: https://thehackernews.com/2023/01/cacti-servers-under-attack-as-majority.html
title: Cacti Servers Under Attack as Majority Fail to Patch Critical Vulnerability
uri: 2023-01-17-Cacti-Servers-Under-Attack-as-Majority-Fail-to-Patch-Critical-Vulnerab
url: https://thehackernews.com/2023/01/cacti-servers-under-attack-as-majority.html
content:
A majority of internet-exposed Cacti servers have not been patched against a recently patched critical security vulnerability that has come under active exploitation in the wild.
That's according to attack surface management platform Censys, which found only 26 out of a total of 6,427 servers to be running a patched version of Cacti (1.2.23 and 1.3.0).
The issue in question relates to 


feed_id: https://thehackernews.com/2023/01/tiktok-fined-54-million-by-french.html
title: TikTok Fined $5.4 Million by French Regulator for Violating Cookie Laws
uri: 2023-01-17-TikTok-Fined-5-4-Million-by-French-Regulator-for-Violating-Cookie-Law
url: https://thehackernews.com/2023/01/tiktok-fined-54-million-by-french.html
content:
Popular short-form video hosting service TikTok has been fined €5 million (about $5.4 million) by the French data protection watchdog for breaking cookie consent rules, making it the latest platform to face similar penalties after Amazon, Google, Meta, and Microsoft since 2020.
"Users of 'tiktok[.]com' could not refuse cookies as easily as accepting them and they were not informed in a


feed_id: tag:blogger.com,1999:blog-4802841478634147276.post-4332710601956602916
uri: Guide-How-MSSPs-and-vCISOs-can-extend-their-services-into-compliance
url: http://www.blogger.com/feeds/4802841478634147276/posts/default/4332710601956602916
title:
Guide: How MSSPs and vCISOs can extend their services into compliance readiness without increasing cost


feed_id: https://thehackernews.com/2023/01/roaming-mantis-spreading-mobile-malware.html
title: Roaming Mantis Spreading Mobile Malware That Hijacks Wi-Fi Routers' DNS Settings
uri: 2023-01-22-Roaming-Mantis-Spreading-Mobile-Malware-That-Hijacks-Wi-Fi-Routers-DN
url: https://thehackernews.com/2023/01/roaming-mantis-spreading-mobile-malware.html
content:
Threat actors associated with the Roaming Mantis attack campaign have been observed delivering an updated variant of their patent mobile malware known as Wroba to infiltrate Wi-Fi routers and undertake Domain Name System (DNS) hijacking.
Kaspersky, which carried out an analysis of the malicious artifact, said the feature is designed to target specific Wi-Fi routers located in South Korea.


feed_id: https://thehackernews.com/2023/01/gamaredon-group-launches-cyberattacks.html
title: Gamaredon Group Launches Cyberattacks Against Ukraine Using Telegram
uri: 2023-01-22-Gamaredon-Group-Launches-Cyberattacks-Against-Ukraine-Using-Telegram
url: https://thehackernews.com/2023/01/gamaredon-group-launches-cyberattacks.html
content:
The Russian state-sponsored cyber espionage group known as Gamaredon has continued its digital onslaught against Ukraine, with recent attacks leveraging the popular messaging app Telegram to strike military and law enforcement sectors in the country.
"The Gamaredon group's network infrastructure relies on multi-stage Telegram accounts for victim profiling and confirmation of geographic location,


feed_id: https://thehackernews.com/2023/01/whatsapp-hit-with-55-million-fine-for.html
title: WhatsApp Hit with €5.5 Million Fine for Violating Data Protection Laws
uri: 2023-01-22-WhatsApp-Hit-with-5-5-Million-Fine-for-Violating-Data-Protection-La
url: https://thehackernews.com/2023/01/whatsapp-hit-with-55-million-fine-for.html
content:
The Irish Data Protection Commission (DPC) on Thursday imposed fresh fines of €5.5 million against Meta's WhatsApp for violating data protection laws when processing users' personal information.
At the heart of the ruling is an update to the messaging platform's Terms of Service that was imposed in the days leading to the enforcement of the General Data Protection Regulation (GDPR) in May 2018,


feed_id: https://thehackernews.com/2023/01/new-chinese-malware-spotted-exploiting.html
title: Chinese Hackers Exploited Recent Fortinet Flaw as 0-Day to Drop Malware
uri: Chinese-Hackers-Exploited-Recent-Fortinet-Flaw-as-0-Day-to-Drop-Malwar
url: https://thehackernews.com/2023/01/new-chinese-malware-spotted-exploiting.html
content:
A suspected China-nexus threat actor exploited a recently patched vulnerability in Fortinet FortiOS SSL-VPN as a zero-day in attacks targeting a European government entity and a managed service provider (MSP) located in Africa.
Telemetry evidence gathered by Google-owned Mandiant indicates that the exploitation occurred as early as October 2022, at least nearly two months before fixes were


feed_id: https://thehackernews.com/2023/01/new-microsoft-azure-vulnerability.html
title: New Microsoft Azure Vulnerability Uncovered — EmojiDeploy for RCE Attacks
uri: New-Microsoft-Azure-Vulnerability-Uncovered-EmojiDeploy-for-RCE-At
url: https://thehackernews.com/2023/01/new-microsoft-azure-vulnerability.html
content:
A new critical remote code execution (RCE) flaw discovered impacting multiple services related to Microsoft Azure could be exploited by a malicious actor to completely take control of a targeted application.
"The vulnerability is achieved through CSRF (cross-site request forgery) on the ubiquitous SCM service Kudu," Ermetic researcher Liv Matan said in a report shared with The Hacker News. "By


feed_id: https://thehackernews.com/2023/01/android-users-beware-new-hook-malware.html
title: Android Users Beware: New Hook Malware with RAT Capabilities Emerges
uri: 2023-01-22-Android-Users-Beware-New-Hook-Malware-with-RAT-Capabilities-Emerges
url: https://thehackernews.com/2023/01/android-users-beware-new-hook-malware.html
content:
The threat actor behind the BlackRock and ERMAC Android banking trojans has unleashed yet another malware for rent called Hook that introduces new capabilities to access files stored in the devices and create a remote interactive session.
ThreatFabric, in a report shared with The Hacker News, characterized Hook as a novel ERMAC fork that's advertised for sale for $7,000 per month while featuring


feed_id: https://thehackernews.com/2023/01/new-research-delves-into-world-of.html
title: New Research Delves into the World of Malicious LNK Files and Hackers Behind Them
uri: 2023-01-22-New-Research-Delves-into-the-World-of-Malicious-LNK-Files-and-Hackers
url: https://thehackernews.com/2023/01/new-research-delves-into-world-of.html
content:
Cybercriminals are increasingly leveraging malicious LNK files as an initial access method to download and execute payloads such as Bumblebee, IcedID, and Qakbot.
A recent study by cybersecurity experts has shown that it is possible to identify relationships between different threat actors by analyzing the metadata of malicious LNK files, uncovering information such as the specific tools and


feed_id: https://thehackernews.com/2023/01/6-types-of-risk-assessment.html
title: 6 Types of Risk Assessment Methodologies + How to Choose
uri: 2023-01-22-6-Types-of-Risk-Assessment-Methodologies-How-to-Choose
url: https://thehackernews.com/2023/01/6-types-of-risk-assessment.html
content:
An organization’s sensitive information is under constant threat. Identifying those security risks is critical to protecting that information. But some risks are bigger than others. Some mitigation options are more expensive than others. How do you make the right decision? Adopting a formal risk assessment process gives you the information you need to set priorities.
There are many ways to


feed_id: https://thehackernews.com/2023/01/bitzlato-crypto-exchange-founder.html
title: Bitzlato Crypto Exchange Founder Arrested for Aiding Cybercriminals
uri: 2023-01-22-Bitzlato-Crypto-Exchange-Founder-Arrested-for-Aiding-Cybercriminals
url: https://thehackernews.com/2023/01/bitzlato-crypto-exchange-founder.html
content:
The U.S. Department of Justice (DoJ) on Wednesday announced the arrest of Anatoly Legkodymov (aka Gandalf and Tolik), the cofounder of Hong Kong-registered cryptocurrency exchange Bitzlato, for allegedly processing $700 million in illicit funds.
The 40-year-old Russian national, who was arrested in Miami, was charged in a U.S. federal court with "conducting a money transmitting business that


feed_id: https://thehackernews.com/2023/01/mailchimp-suffers-another-security.html
title: Mailchimp Suffers Another Security Breach Compromising Some Customers' Information
uri: 2023-01-22-Mailchimp-Suffers-Another-Security-Breach-Compromising-Some-Customers
url: https://thehackernews.com/2023/01/mailchimp-suffers-another-security.html
content:
Popular email marketing and newsletter service Mailchimp has disclosed yet another security breach that enabled threat actors to access an internal support and account admin tool to obtain information about 133 customers.
"The unauthorized actor conducted a social engineering attack on Mailchimp employees and contractors, and obtained access to select Mailchimp accounts using employee


feed_id: https://thehackernews.com/2023/01/earth-bogle-campaign-unleashes-njrat.html
title: Earth Bogle Campaign Unleashes NjRAT Trojan on Middle East and North Africa
uri: 2023-01-22-Earth-Bogle-Campaign-Unleashes-NjRAT-Trojan-on-Middle-East-and-North-A
url: https://thehackernews.com/2023/01/earth-bogle-campaign-unleashes-njrat.html
content:
An ongoing campaign dubbed Earth Bogle is leveraging geopolitical-themed lures to deliver the NjRAT remote access trojan to victims across the Middle East and North Africa.
"The threat actor uses public cloud storage services such as files[.]fm and failiem[.]lv to host malware, while compromised web servers distribute NjRAT," Trend Micro said in a report published Wednesday.
Phishing emails,


feed_id: https://thehackernews.com/2023/01/iranian-government-entities-under.html
title: Iranian Government Entities Under Attack by New Wave of BackdoorDiplomacy Attacks
uri: 2023-01-22-Iranian-Government-Entities-Under-Attack-by-New-Wave-of-BackdoorDiplom
url: https://thehackernews.com/2023/01/iranian-government-entities-under.html
content:
The threat actor known as BackdoorDiplomacy has been linked to a new wave of attacks targeting Iranian government entities between July and late December 2022.
Palo Alto Networks Unit 42, which is tracking the activity under its constellation-themed moniker Playful Taurus, said it observed the government domains attempting to connect to malware infrastructure previously identified as associated


feed_id: https://thehackernews.com/2023/01/guide-how-mssps-and-vcisos-can-extend.html
uri: 2023-01-22-Guide-How-MSSPs-and-vCISOs-can-extend-their-services-into-compliance
url: https://thehackernews.com/2023/01/guide-how-mssps-and-vcisos-can-extend.html
title:
Guide: How MSSPs and vCISOs can extend their services into compliance readiness without increasing cost

content:
Compliance services are emerging as one of the hottest areas of cybersecurity. 
While compliance used to be mainly the province of large enterprises, times have changed, and it is now a day-to-day concern for a growing number of small and medium businesses. 
Even when these organizations are not regulated, SMEs often aim to follow compliance and/or security frameworks either for their own risk


feed_id: https://thehackernews.com/2023/01/critical-security-vulnerabilities.html
title: Critical Security Vulnerabilities Discovered in Netcomm and TP-Link Routers
uri: 2023-01-22-Critical-Security-Vulnerabilities-Discovered-in-Netcomm-and-TP-Link-Ro
url: https://thehackernews.com/2023/01/critical-security-vulnerabilities.html
content:
Security vulnerabilities have been disclosed in Netcomm and TP-Link routers, some of which could be weaponized to achieve remote code execution.
The flaws, tracked as CVE-2022-4873 and CVE-2022-4874, concern a case of stack-based buffer overflow and authentication bypass and impact Netcomm router models NF20MESH, NF20, and NL1902 running firmware versions earlier than R6B035.
"The two


feed_id: https://thehackernews.com/2023/01/git-users-urged-to-update-software-to.html
title: Git Users Urged to Update Software to Prevent Remote Code Execution Attacks
uri: 2023-01-22-Git-Users-Urged-to-Update-Software-to-Prevent-Remote-Code-Execution-At
url: https://thehackernews.com/2023/01/git-users-urged-to-update-software-to.html
content:
The maintainers of the Git source code version control system have released updates to remediate two critical vulnerabilities that could be exploited by a malicious actor to achieve remote code execution.
The flaws, tracked as CVE-2022-23521 and CVE-2022-41903, impacts the following versions of Git: v2.30.6, v2.31.5, v2.32.4, v2.33.5, v2.34.5, v2.35.5, v2.36.3, v2.37.4, v2.38.2, and v2.39.0.


feed_id: https://thehackernews.com/2023/01/cisa-warns-of-flaws-in-siemens-ge.html
title: CISA Warns of Flaws in Siemens, GE Digital, and Contec Industrial Control Systems
uri: 2023-01-22-CISA-Warns-of-Flaws-in-Siemens-GE-Digital-and-Contec-Industrial-Cont
url: https://thehackernews.com/2023/01/cisa-warns-of-flaws-in-siemens-ge.html
content:
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has published four Industrial Control Systems (ICS) advisories, calling out several security flaws affecting products from Siemens, GE Digital, and Contec.
The most critical of the issues have been identified in Siemens SINEC INS that could lead to remote code execution via a path traversal flaw (CVE-2022-45092, CVSS score: 9.9)


feed_id: https://thehackernews.com/2023/01/microsoft-azure-services-flaws-couldve.html
title: Microsoft Azure Services Flaws Could've Exposed Cloud Resources to Unauthorized Access
uri: 2023-01-22-Microsoft-Azure-Services-Flaws-Could-ve-Exposed-Cloud-Resources-to-Una
url: https://thehackernews.com/2023/01/microsoft-azure-services-flaws-couldve.html
content:
Four different Microsoft Azure services have been found vulnerable to server-side request forgery (SSRF) attacks that could be exploited to gain unauthorized access to cloud resources.
The security issues, which were discovered by Orca between October 8, 2022 and December 2, 2022 in Azure API Management, Azure Functions, Azure Machine Learning, and Azure Digital Twins, have since been addressed


feed_id: https://thehackernews.com/2023/01/hackers-can-abuse-legitimate-github.html
title: Hackers Can Abuse Legitimate GitHub Codespaces Feature to Deliver Malware
uri: 2023-01-22-Hackers-Can-Abuse-Legitimate-GitHub-Codespaces-Feature-to-Deliver-Malw
url: https://thehackernews.com/2023/01/hackers-can-abuse-legitimate-github.html
content:
New research has found that it is possible for threat actors to abuse a legitimate feature in GitHub Codespaces to deliver malware to victim systems.
GitHub Codespaces is a cloud-based configurable development environment that allows users to debug, maintain, and commit changes to a given codebase from a web browser or via an integration in Visual Studio Code.
It also comes with a port


feed_id: https://thehackernews.com/2023/01/4-places-to-supercharge-your-soc-with.html
title: 4 Places to Supercharge Your SOC with Automation
uri: 2023-01-22-4-Places-to-Supercharge-Your-SOC-with-Automation
url: https://thehackernews.com/2023/01/4-places-to-supercharge-your-soc-with.html
content:
It's no secret that the job of SOC teams continues to become increasingly difficult. Increased volume and sophistication of attacks are plaguing under-resourced teams with false positives and analyst burnout.
However, like many other industries, cybersecurity is now beginning to lean on and benefit from advancements in automation to not only maintain the status quo, but to attain better security


feed_id: https://thehackernews.com/2023/01/zoho-manageengine-poc-exploit-to-be.html
title: Zoho ManageEngine PoC Exploit to be Released Soon - Patch Before It's Too Late!
uri: 2023-01-22-Zoho-ManageEngine-PoC-Exploit-to-be-Released-Soon-Patch-Before-It-s
url: https://thehackernews.com/2023/01/zoho-manageengine-poc-exploit-to-be.html
content:
Users of Zoho ManageEngine are being urged to patch their instances against a critical security vulnerability ahead of the release of a proof-of-concept (PoC) exploit code.
The issue in question is CVE-2022-47966, an unauthenticated remote code execution vulnerability affecting several products due to the use of an outdated third-party dependency, Apache Santuario.
"This vulnerability allows an


feed_id: https://thehackernews.com/2023/01/facebook-introduces-new-features-for.html
title: Facebook Introduces New Features for End-to-End Encrypted Messenger App
uri: 2023-01-24-Facebook-Introduces-New-Features-for-End-to-End-Encrypted-Messenger-Ap
url: https://thehackernews.com/2023/01/facebook-introduces-new-features-for.html
content:
Meta Platforms on Monday announced that it has started to expand global testing of end-to-end encryption (E2EE) in Messenger chats by default.
"Over the next few months, more people will continue to see some of their chats gradually being upgraded with an extra layer of protection provided by end-to-end encryption," Meta's Melissa Miranda said.
The social media behemoth said it intends to notify


feed_id: https://thehackernews.com/2023/01/samsung-galaxy-store-app-found.html
title: Samsung Galaxy Store App Found Vulnerable to Sneaky App Installs and Fraud
uri: 2023-01-24-Samsung-Galaxy-Store-App-Found-Vulnerable-to-Sneaky-App-Installs-and-F
url: https://thehackernews.com/2023/01/samsung-galaxy-store-app-found.html
content:
Two security flaws have been disclosed in Samsung's Galaxy Store app for Android that could be exploited by a local attacker to stealthily install arbitrary apps or direct prospective victims to fraudulent landing pages on the web.
The issues, tracked as CVE-2023-21433 and CVE-2023-21434, were discovered by NCC Group and notified to the South Korean chaebol in November and December 2022. Samsung


feed_id: https://thehackernews.com/2023/01/saas-security-posture-management-sspm.html
title: SaaS Security Posture Management (SSPM) as a Layer in Your Identity Fabric
uri: 2023-01-24-SaaS-Security-Posture-Management-(SSPM)-as-a-Layer-in-Your-Identity-Fa
url: https://thehackernews.com/2023/01/saas-security-posture-management-sspm.html
content:
The move to SaaS and other cloud tools has put an emphasis on Identity & Access Management (IAM). After all, user identity is one of the only barriers standing between sensitive corporate data and any unauthorized access. 
The tools used to define IAM make up its identity fabric. The stronger the fabric, the more resistant identities are to pressure from threat actors. However, those pressures


feed_id: https://thehackernews.com/2023/01/threat-actors-turn-to-sliver-as-open.html
title: Threat Actors Turn to Sliver as Open Source Alternative to Popular C2 Frameworks
uri: 2023-01-24-Threat-Actors-Turn-to-Sliver-as-Open-Source-Alternative-to-Popular-C2
url: https://thehackernews.com/2023/01/threat-actors-turn-to-sliver-as-open.html
content:
The legitimate command-and-control (C2) framework known as Sliver is gaining more traction from threat actors as it emerges as an open source alternative to Cobalt Strike and Metasploit.
The findings come from Cybereason, which detailed its inner workings in an exhaustive analysis last week.
Sliver, developed by cybersecurity company BishopFox, is a Golang-based cross-platform post-exploitation


feed_id: https://thehackernews.com/2023/01/massive-ad-fraud-scheme-targeted-over.html
title: Massive Ad Fraud Scheme Targeted Over 11 Million Devices with 1,700 Spoofed Apps
uri: 2023-01-24-Massive-Ad-Fraud-Scheme-Targeted-Over-11-Million-Devices-with-1-700-Sp
url: https://thehackernews.com/2023/01/massive-ad-fraud-scheme-targeted-over.html
content:
Researchers have shut down an "expansive" ad fraud scheme that spoofed more than 1,700 applications from 120 publishers and impacted roughly 11 million devices. 
"VASTFLUX was a malvertising attack that injected malicious JavaScript code into digital ad creatives, allowing the fraudsters to stack numerous invisible video ad players behind one another and register ad views," fraud prevention firm


feed_id: https://thehackernews.com/2023/01/us-federal-agencies-fall-victim-to.html
title: U.S. Federal Agencies Fall Victim to Cyber Attack Utilizing Legitimate RMM Software
uri: U-S-Federal-Agencies-Fall-Victim-to-Cyber-Attack-Utilizing-Legitimate
url: https://thehackernews.com/2023/01/us-federal-agencies-fall-victim-to.html
content:
At least two federal agencies in the U.S. fell victim to a "widespread cyber campaign" that involved the use of legitimate remote monitoring and management (RMM) software to perpetuate a phishing scam.
"Specifically, cyber criminal actors sent phishing emails that led to the download of legitimate RMM software – ScreenConnect (now ConnectWise Control) and AnyDesk – which the actors used in a


feed_id: https://thehackernews.com/2023/01/over-4500-wordpress-sites-hacked-to.html
title: Over 4,500 WordPress Sites Hacked to Redirect Visitors to Sketchy Ad Pages
uri: 2023-01-26-Over-4-500-WordPress-Sites-Hacked-to-Redirect-Visitors-to-Sketchy-Ad-P
url: https://thehackernews.com/2023/01/over-4500-wordpress-sites-hacked-to.html
content:
A massive campaign has infected over 4,500 WordPress websites as part of a long-running operation that's been believed to be active since at least 2017.
According to GoDaddy-owned Sucuri, the infections involve the injection of obfuscated JavaScript hosted on a malicious domain named "track[.]violetlovelines[.]com" that's designed to redirect visitors to unwanted sites.
The latest operation is


feed_id: https://thehackernews.com/2023/01/the-definitive-browser-security.html
title: The Definitive Browser Security Checklist
uri: 2023-01-26-The-Definitive-Browser-Security-Checklist
url: https://thehackernews.com/2023/01/the-definitive-browser-security.html
content:
Security stakeholders have come to realize that the prominent role the browser has in the modern corporate environment requires a re-evaluation of how it is managed and protected. While not long-ago web-borne risks were still addressed by a patchwork of endpoint, network, and cloud solutions, it is now clear that the partial protection these solutions provided is no longer sufficient. Therefore,


feed_id: https://thehackernews.com/2023/01/north-korean-hackers-turn-to-credential.html
title: North Korean Hackers Turn to Credential Harvesting in Latest Wave of Cyberattacks
uri: 2023-01-26-North-Korean-Hackers-Turn-to-Credential-Harvesting-in-Latest-Wave-of-C
url: https://thehackernews.com/2023/01/north-korean-hackers-turn-to-credential.html
content:
A North Korean nation-state group notorious for crypto heists has been attributed to a new wave of malicious email attacks as part of a "sprawling" credential harvesting activity targeting a number of industry verticals, marking a significant shift in its strategy.
The state-aligned threat actor is being tracked by Proofpoint under the name TA444, and by the larger cybersecurity community as


feed_id: https://thehackernews.com/2023/01/lastpass-parent-company-goto-suffers.html
title: LastPass Parent Company GoTo Suffers Data Breach, Customers' Backups Compromised
uri: 2023-01-26-LastPass-Parent-Company-GoTo-Suffers-Data-Breach-Customers-Backups-C
url: https://thehackernews.com/2023/01/lastpass-parent-company-goto-suffers.html
content:
LastPass-owner GoTo (formerly LogMeIn) on Tuesday disclosed that unidentified threat actors were able to steal encrypted backups of some customers' data along with an encryption key for some of those backups in a November 2022 incident.
The breach, which targeted a third-party cloud storage service, impacted Central, Pro, join.me, Hamachi, and RemotelyAnywhere products, the company said.
"The


feed_id: https://thehackernews.com/2023/01/vmware-releases-patches-for-critical.html
title: VMware Releases Patches for Critical vRealize Log Insight Software Vulnerabilities
uri: 2023-01-26-VMware-Releases-Patches-for-Critical-vRealize-Log-Insight-Software-Vul
url: https://thehackernews.com/2023/01/vmware-releases-patches-for-critical.html
content:
VMware on Tuesday released software to remediate four security vulnerabilities affecting vRealize Log Insight (aka Aria Operations for Logs) that could expose users to remote code execution attacks.
Two of the flaws are critical, carrying a severity rating of 9.8 out of a maximum of 10, the virtualization services provider noted in its first security bulletin for 2023.
Tracked as CVE-2022-31706


feed_id: https://thehackernews.com/2023/01/chinese-hackers-utilize-golang-malware.html
title: Chinese Hackers Utilize Golang Malware in DragonSpark Attacks to Evade Detection
uri: 2023-01-26-Chinese-Hackers-Utilize-Golang-Malware-in-DragonSpark-Attacks-to-Evade
url: https://thehackernews.com/2023/01/chinese-hackers-utilize-golang-malware.html
content:
Organizations in East Asia are being targeted by a likely Chinese-speaking actor dubbed DragonSpark while employing uncommon tactics to go past security layers.
"The attacks are characterized by the use of the little known open source SparkRAT and malware that attempts to evade detection through Golang source code interpretation," SentinelOne said in an analysis published today.
A striking


feed_id: https://thehackernews.com/2023/01/fbi-says-north-korean-hackers-behind.html
title: FBI Says North Korean Hackers Behind $100 Million Horizon Bridge Crypto Theft
uri: 2023-01-26-FBI-Says-North-Korean-Hackers-Behind-100-Million-Horizon-Bridge-Crypt
url: https://thehackernews.com/2023/01/fbi-says-north-korean-hackers-behind.html
content:
The U.S. Federal Bureau of Investigation (FBI) on Monday confirmed that North Korean threat actors were responsible for the theft of $100 million in cryptocurrency assets from Harmony Horizon Bridge in June 2022.
The law enforcement agency attributed the hack to the Lazarus Group and APT38 (aka BlueNoroff, Copernicium, and Stardust Chollima), the latter of which is a North Korean state-sponsored


feed_id: https://thehackernews.com/2023/01/security-navigator-research-some.html
title: Security Navigator Research: Some Vulnerabilities Date Back to the Last Millennium
uri: 2023-01-26-Security-Navigator-Research-Some-Vulnerabilities-Date-Back-to-the-Las
url: https://thehackernews.com/2023/01/security-navigator-research-some.html
content:
Vulnerability analysis results in Orange Cyberdefenses' Security Navigator show that some vulnerabilities first discovered in 1999 are still found in networks today. This is concerning.
Age of VOC findings
Our Vulnerability Scans are performed on a recurring basis, which provides us the opportunity to examine the difference between when a scan was performed on an Asset, and when a given finding


feed_id: https://thehackernews.com/2023/01/emotet-malware-makes-comeback-with-new.html
title: Emotet Malware Makes a Comeback with New Evasion Techniques
uri: 2023-01-26-Emotet-Malware-Makes-a-Comeback-with-New-Evasion-Techniques
url: https://thehackernews.com/2023/01/emotet-malware-makes-comeback-with-new.html
content:
The Emotet malware operation has continued to refine its tactics in an effort to fly under the radar, while also acting as a conduit for other dangerous malware such as Bumblebee and IcedID.
Emotet, which officially reemerged in late 2021 following a coordinated takedown of its infrastructure by authorities earlier that year, has continued to be a persistent threat that's distributed via


feed_id: https://thehackernews.com/2023/01/apple-issues-updates-for-older-devices.html
title: Apple Issues Updates for Older Devices to Fix Actively Exploited Vulnerability
uri: 2023-01-26-Apple-Issues-Updates-for-Older-Devices-to-Fix-Actively-Exploited-Vulne
url: https://thehackernews.com/2023/01/apple-issues-updates-for-older-devices.html
content:
Apple has backported fixes for a recently disclosed critical security flaw affecting older devices, citing evidence of active exploitation.
The issue, tracked as CVE-2022-42856, is a type confusion vulnerability in the WebKit browser engine that could result in arbitrary code execution when processing maliciously crafted web content.
While it was originally addressed by the company on November


feed_id: https://thehackernews.com/2023/01/experts-uncover-identity-of-mastermind.html
title: Experts Uncover the Identity of Mastermind Behind Golden Chickens Malware Service
uri: 2023-01-28-Experts-Uncover-the-Identity-of-Mastermind-Behind-Golden-Chickens-Malw
url: https://thehackernews.com/2023/01/experts-uncover-identity-of-mastermind.html
content:
Cybersecurity researchers have discovered the real-world identity of the threat actor behind Golden Chickens malware-as-a-service, who goes by the online persona "badbullzvenom."
eSentire's Threat Response Unit (TRU), in an exhaustive report published following a 16-month-long investigation, said it "found multiple mentions of the badbullzvenom account being shared between two people."
The


feed_id: https://thehackernews.com/2023/01/researchers-discover-new-plugx-malware.html
title: Researchers Discover New PlugX Malware Variant Spreading via Removable USB Devices
uri: 2023-01-28-Researchers-Discover-New-PlugX-Malware-Variant-Spreading-via-Removable
url: https://thehackernews.com/2023/01/researchers-discover-new-plugx-malware.html
content:
Cybersecurity researchers have uncovered a PlugX sample that employs sneaky methods to infect attached removable USB media devices in order to propagate the malware to additional systems.
"This PlugX variant is wormable and infects USB devices in such a way that it conceals itself from the Windows operating file system," Palo Alto Networks Unit 42 researchers Mike Harbison and Jen Miller-Osborn 


feed_id: https://thehackernews.com/2023/01/3-lifehacks-while-analyzing-orcus-rat.html
title: 3 Lifehacks While Analyzing Orcus RAT in a Malware Sandbox
uri: 2023-01-28-3-Lifehacks-While-Analyzing-Orcus-RAT-in-a-Malware-Sandbox
url: https://thehackernews.com/2023/01/3-lifehacks-while-analyzing-orcus-rat.html
content:
Orcus is a Remote Access Trojan with some distinctive characteristics. The RAT allows attackers to create plugins and offers a robust core feature set that makes it quite a dangerous malicious program in its class.
RAT is quite a stable type that always makes it to the top.
ANY.RUN’s top malware types in 2022
That's why you'll definitely come across this type in your practice, and the Orcus


feed_id: https://thehackernews.com/2023/01/british-cyber-agency-warns-of-russian.html
title: British Cyber Agency Warns of Russian and Iranian Hackers Targeting Key Industries
uri: 2023-01-28-British-Cyber-Agency-Warns-of-Russian-and-Iranian-Hackers-Targeting-Ke
url: https://thehackernews.com/2023/01/british-cyber-agency-warns-of-russian.html
content:
The U.K. National Cyber Security Centre (NCSC) on Thursday warned of spear-phishing attacks mounted by Russian and Iranian state-sponsored actors for information-gathering operations.
"The attacks are not aimed at the general public but targets in specified sectors, including academia, defense, government organizations, NGOs, think tanks, as well as politicians, journalists and activists," the


feed_id: https://thehackernews.com/2023/01/hive-ransomware-infrastructure-seized.html
title: Hive Ransomware Infrastructure Seized in Joint International Law Enforcement Effort
uri: 2023-01-28-Hive-Ransomware-Infrastructure-Seized-in-Joint-International-Law-Enfor
url: https://thehackernews.com/2023/01/hive-ransomware-infrastructure-seized.html
content:
In what's a case of hacking the hackers, the darknet infrastructure associated with the Hive ransomware-as-a-service (RaaS) operation has been seized as part of a coordinated law enforcement effort involving 13 countries.
"Law enforcement identified the decryption keys and shared them with many of the victims, helping them regain access to their data without paying the cybercriminals," Europol 


feed_id: https://thehackernews.com/2023/01/google-takes-down-50000-instances-of.html
title: Google Takes Down 50,000 Instances of Pro-Chinese DRAGONBRIDGE Influence Operation
uri: 2023-01-28-Google-Takes-Down-50-000-Instances-of-Pro-Chinese-DRAGONBRIDGE-Influen
url: https://thehackernews.com/2023/01/google-takes-down-50000-instances-of.html
content:
Google on Thursday disclosed it took steps to dismantle over 50,000 instances of activity orchestrated by a pro-Chinese influence operation known as DRAGONBRIDGE in 2022.
"Most DRAGONBRIDGE activity is low quality content without a political message, populated across many channels and blogs," the company's Threat Analysis Group (TAG) said in a report shared with The Hacker News. "However, a


feed_id: https://thehackernews.com/2023/01/researchers-release-poc-exploit-for.html
title: Researchers Release PoC Exploit for Windows CryptoAPI Bug Discovered by NSA
uri: 2023-01-28-Researchers-Release-PoC-Exploit-for-Windows-CryptoAPI-Bug-Discovered-b
url: https://thehackernews.com/2023/01/researchers-release-poc-exploit-for.html
content:
Proof-of-concept (Poc) code has been released for a now-patched high-severity security flaw in the Windows CryptoAPI that the U.S. National Security Agency (NSA) and the U.K. National Cyber Security Centre (NCSC) reported to Microsoft last year.
Tracked as CVE-2022-34689 (CVSS score: 7.5), the spoofing vulnerability was addressed by the tech giant as part of Patch Tuesday updates released in


feed_id: https://thehackernews.com/2023/01/researchers-uncover-connection-bw-moses.html
title: Researchers Uncover Connection b/w Moses Staff and Emerging Abraham's Ax Hacktivists Group
uri: 2023-01-28-Researchers-Uncover-Connection-b-w-Moses-Staff-and-Emerging-Abraham-s
url: https://thehackernews.com/2023/01/researchers-uncover-connection-bw-moses.html
content:
New research has linked the operations of a politically motivated hacktivist group known as Moses Staff to another nascent threat actor named Abraham's Ax that emerged in November 2022.
This is based on "several commonalities across the iconography, videography, and leak sites used by the groups, suggesting they are likely operated by the same entity," Secureworks Counter Threat Unit (CTU) said 


feed_id: https://thehackernews.com/2023/01/is-once-yearly-pen-testing-enough-for.html
title: Is Once-Yearly Pen Testing Enough for Your Organization?
uri: 2023-01-28-Is-Once-Yearly-Pen-Testing-Enough-for-Your-Organization
url: https://thehackernews.com/2023/01/is-once-yearly-pen-testing-enough-for.html
content:
Any organization that handles sensitive data must be diligent in its security efforts, which include regular pen testing. Even a small data breach can result in significant damage to an organization's reputation and bottom line.
There are two main reasons why regular pen testing is necessary for secure web application development:

Security: Web applications are constantly evolving, and new


feed_id: https://thehackernews.com/2023/01/pyration-new-python-based-rat-utilizes.html
title: PY#RATION: New Python-based RAT Uses WebSocket for C2 and Data Exfiltration
uri: 2023-01-28-PY-RATION-New-Python-based-RAT-Uses-WebSocket-for-C2-and-Data-Exfiltr
url: https://thehackernews.com/2023/01/pyration-new-python-based-rat-utilizes.html
content:
Cybersecurity researchers have unearthed a new attack campaign that leverages a Python-based remote access trojan (RAT) to gain control over compromised systems since at least August 2022.
"This malware is unique in its utilization of WebSockets to avoid detection and for both command-and-control (C2) communication and exfiltration," Securonix said in a report shared with The Hacker News.
The


feed_id: https://thehackernews.com/2023/02/experts-warn-of-ice-breaker.html
title: Experts Warn of 'Ice Breaker' Cyberattacks Targeting Gaming and Gambling Industry
uri: Experts-Warn-of-Ice-Breaker-Cyberattacks-Targeting-Gaming-and-Gambli
url: https://thehackernews.com/2023/02/experts-warn-of-ice-breaker.html
content:
A new attack campaign has targeted the gaming and gambling sectors since at least September 2022, just months prior to the ICE London 2023 gaming industry trade fair event that's scheduled next week.
Israeli cybersecurity company Security Joes is tracking the activity cluster under the name Ice Breaker, stating the intrusions employ clever social engineering tactics to deploy a JavaScript


feed_id: https://thehackernews.com/2023/02/new-sh1mmer-exploit-for-chromebook.html
title: New SH1MMER Exploit for Chromebook Unenrolls Managed ChromeOS Devices
uri: 2023-02-01-New-SH1MMER-Exploit-for-Chromebook-Unenrolls-Managed-ChromeOS-Devices
url: https://thehackernews.com/2023/02/new-sh1mmer-exploit-for-chromebook.html
content:
A new exploit has been devised to "unenroll" enterprise- or school-managed Chromebooks from administrative control.
Enrolling ChromeOS devices makes it possible to enforce device policies as set by the organization via the Google Admin console, including the features that are available to users.
"Each enrolled device complies with the policies you set until you wipe or deprovision it," Google 


feed_id: https://thehackernews.com/2023/02/auditing-kubernetes-with-open-source.html
title: Auditing Kubernetes with Open Source SIEM and XDR
uri: 2023-02-01-Auditing-Kubernetes-with-Open-Source-SIEM-and-XDR
url: https://thehackernews.com/2023/02/auditing-kubernetes-with-open-source.html
content:
Container technology has gained traction among businesses due to the increased efficiency it provides. In this regard, organizations widely use Kubernetes for deploying, scaling, and managing containerized applications. Organizations should audit Kubernetes to ensure compliance with regulations, find anomalies, and identify security risks. The Wazuh open source platform plays a critical role in


feed_id: https://thehackernews.com/2023/02/prilex-pos-malware-evolves-to-block.html
title: Prilex PoS Malware Evolves to Block Contactless Payments to Steal from NFC Cards
uri: 2023-02-01-Prilex-PoS-Malware-Evolves-to-Block-Contactless-Payments-to-Steal-from
url: https://thehackernews.com/2023/02/prilex-pos-malware-evolves-to-block.html
content:
The Brazilian threat actors behind an advanced and modular point-of-sale (PoS) malware known as Prilex have reared their head once again with new updates that allow it to block contactless payment transactions.
Russian cybersecurity firm Kaspersky said it detected three versions of Prilex (06.03.8080, 06.03.8072, and 06.03.8070) that are capable of targeting NFC-enabled credit cards, taking its


feed_id: https://thehackernews.com/2023/02/hackers-abused-microsofts-verified.html
title: Hackers Abused Microsoft's "Verified Publisher" OAuth Apps to Breach Corporate Email Accounts
uri: Hackers-Abused-Microsoft-s-Verified-Publisher-OAuth-Apps-to-Breach-C
url: https://thehackernews.com/2023/02/hackers-abused-microsofts-verified.html
content:
Microsoft on Tuesday said it took steps to disable fake Microsoft Partner Network (MPN) accounts that were used for creating malicious OAuth applications as part of a phishing campaign designed to breach organizations' cloud environments and steal email.
"The applications created by these fraudulent actors were then used in a consent phishing campaign, which tricked users into granting


feed_id: https://thehackernews.com/2023/02/additional-supply-chain-vulnerabilities.html
title: Additional Supply Chain Vulnerabilities Uncovered in AMI MegaRAC BMC Software
uri: 2023-02-01-Additional-Supply-Chain-Vulnerabilities-Uncovered-in-AMI-MegaRAC-BMC-S
url: https://thehackernews.com/2023/02/additional-supply-chain-vulnerabilities.html
content:
Two more supply chain security flaws have been disclosed in AMI MegaRAC Baseboard Management Controller (BMC) software, nearly two months after three security vulnerabilities were brought to light in the same product.
Firmware security firm Eclypsium said the two shortcomings were held back until now to provide AMI additional time to engineer appropriate mitigations.
The issues, collectively


feed_id: https://thehackernews.com/2023/01/you-dont-know-where-your-secrets-are.html
title: You Don't Know Where Your Secrets Are
uri: 2023-02-01-You-Don-t-Know-Where-Your-Secrets-Are
url: https://thehackernews.com/2023/01/you-dont-know-where-your-secrets-are.html
content:
Do you know where your secrets are? If not, I can tell you: you are not alone.
Hundreds of CISOs, CSOs, and security leaders, whether from small or large companies, don't know either. No matter the organization's size, the certifications, tools, people, and processes: secrets are not visible in 99% of cases.
It might sound ridiculous at first: keeping secrets is an obvious first thought when


feed_id: https://thehackernews.com/2023/01/new-report-reveals-nikowiper-malware.html
title: New Report Reveals NikoWiper Malware That Targeted Ukraine Energy Sector
uri: 2023-02-01-New-Report-Reveals-NikoWiper-Malware-That-Targeted-Ukraine-Energy-Sect
url: https://thehackernews.com/2023/01/new-report-reveals-nikowiper-malware.html
content:
The Russia-affiliated Sandworm used yet another wiper malware strain dubbed NikoWiper as part of an attack that took place in October 2022 targeting an energy sector company in Ukraine.
"The NikoWiper is based on SDelete, a command line utility from Microsoft that is used for securely deleting files," cybersecurity company ESET revealed in its latest APT Activity Report shared with The Hacker


feed_id: https://thehackernews.com/2023/01/researchers-uncover-packer-that-helped.html
title: Researchers Uncover Packer Used by Several Malware to Evade Detection for 6 Years
uri: 2023-02-01-Researchers-Uncover-Packer-Used-by-Several-Malware-to-Evade-Detection
url: https://thehackernews.com/2023/01/researchers-uncover-packer-that-helped.html
content:
A shellcode-based packer dubbed TrickGate has been successfully operating without attracting notice for over six years, while enabling threat actors to deploy a wide range of malware such as TrickBot, Emotet, AZORult, Agent Tesla, FormBook, Cerber, Maze, and REvil over the years.
"TrickGate managed to stay under the radar for years because it is transformative – it undergoes changes periodically


feed_id: https://thehackernews.com/2023/01/qnap-fixes-critical-vulnerability-in.html
title: QNAP Fixes Critical Vulnerability in NAS Devices with Latest Security Updates
uri: 2023-02-01-QNAP-Fixes-Critical-Vulnerability-in-NAS-Devices-with-Latest-Security
url: https://thehackernews.com/2023/01/qnap-fixes-critical-vulnerability-in.html
content:
Taiwanese company QNAP has released updates to remediate a critical security flaw affecting its network-attached storage (NAS) devices that could lead to arbitrary code injection.
Tracked as CVE-2022-27596, the vulnerability is rated 9.8 out of a maximum of 10 on the CVSS scoring scale. It affects QTS 5.0.1 and QuTS hero h5.0.1.
"If exploited, this vulnerability allows remote attackers to inject


feed_id: https://thehackernews.com/2023/01/github-breach-hackers-stole-code.html
title: GitHub Breach: Hackers Stole Code-Signing Certificates for GitHub Desktop and Atom
uri: 2023-02-01-GitHub-Breach-Hackers-Stole-Code-Signing-Certificates-for-GitHub-Desk
url: https://thehackernews.com/2023/01/github-breach-hackers-stole-code.html
content:
GitHub on Monday disclosed that unknown threat actors managed to exfiltrate encrypted code signing certificates pertaining to some versions of GitHub Desktop for Mac and Atom apps.
As a result, the company is taking the step of revoking the exposed certificates out of abundance of caution. The following versions of GitHub Desktop for Mac have been invalidated: 3.0.2, 3.0.3, 3.0.4, 3.0.5, 3.0.6,


feed_id: https://thehackernews.com/2023/01/titan-stealer-new-golang-based.html
title: Titan Stealer: A New Golang-Based Information Stealer Malware Emerges
uri: 2023-02-01-Titan-Stealer-A-New-Golang-Based-Information-Stealer-Malware-Emerges
url: https://thehackernews.com/2023/01/titan-stealer-new-golang-based.html
content:
A new Golang-based information stealer malware dubbed Titan Stealer is being advertised by threat actors through their Telegram channel.
"The stealer is capable of stealing a variety of information from infected Windows machines, including credential data from browsers and crypto wallets, FTP client details, screenshots, system information, and grabbed files," Uptycs security researchers


feed_id: https://thehackernews.com/2023/01/realtek-vulnerability-under-attack-134.html
title: Realtek Vulnerability Under Attack: Over 134 Million Attempts to Hack IoT Devices
uri: Realtek-Vulnerability-Under-Attack-Over-134-Million-Attempts-to-Hack
url: https://thehackernews.com/2023/01/realtek-vulnerability-under-attack-134.html
content:
Researchers are warning about a spike in exploitation attempts weaponizing a now-patched critical remote code execution flaw in Realtek Jungle SDK since the start of August 2022.
According to Palo Alto Networks Unit 42, the ongoing campaign is said to have recorded 134 million exploit attempts as of December 2022, with 97% of the attacks occurring in the past four months.
Close to 50% of the


feed_id: https://thehackernews.com/2023/01/gootkit-malware-continues-to-evolve.html
title: Gootkit Malware Continues to Evolve with New Components and Obfuscations
uri: 2023-02-01-Gootkit-Malware-Continues-to-Evolve-with-New-Components-and-Obfuscatio
url: https://thehackernews.com/2023/01/gootkit-malware-continues-to-evolve.html
content:
The threat actors associated with the Gootkit malware have made "notable changes" to their toolset, adding new components and obfuscations to their infection chains.
Google-owned Mandiant is monitoring the activity cluster under the moniker UNC2565, noting that the usage of the malware is "exclusive to this group."
Gootkit, also called Gootloader, is spread through compromised websites that


feed_id: https://thehackernews.com/2023/01/microsoft-urges-customers-to-secure-on.html
title: Microsoft Urges Customers to Secure On-Premises Exchange Servers
uri: 2023-02-01-Microsoft-Urges-Customers-to-Secure-On-Premises-Exchange-Servers
url: https://thehackernews.com/2023/01/microsoft-urges-customers-to-secure-on.html
content:
Microsoft is urging customers to keep their Exchange servers updated as well as take steps to bolster the environment, such as enabling Windows Extended Protection and configuring certificate-based signing of PowerShell serialization payloads.
"Attackers looking to exploit unpatched Exchange servers are not going to go away," the tech giant's Exchange Team said in a post. "There are too many


feed_id: https://thehackernews.com/2023/01/isc-releases-security-patches-for-new.html
title: ISC Releases Security Patches for New BIND DNS Software Vulnerabilities
uri: 2023-02-01-ISC-Releases-Security-Patches-for-New-BIND-DNS-Software-Vulnerabilitie
url: https://thehackernews.com/2023/01/isc-releases-security-patches-for-new.html
content:
The Internet Systems Consortium (ISC) has released patches to address multiple security vulnerabilities in the Berkeley Internet Name Domain (BIND) 9 Domain Name System (DNS) software suite that could lead to a denial-of-service (DoS) condition.
"A remote attacker could exploit these vulnerabilities to potentially cause denial-of-service conditions and system failures," the U.S. Cybersecurity


feed_id: https://thehackernews.com/2023/01/ukraine-hit-with-new-golang-based.html
title: Ukraine Hit with New Golang-based 'SwiftSlicer' Wiper Malware in Latest Cyber Attack
uri: 2023-02-01-Ukraine-Hit-with-New-Golang-based-SwiftSlicer-Wiper-Malware-in-Lates
url: https://thehackernews.com/2023/01/ukraine-hit-with-new-golang-based.html
content:
Ukraine has come under a fresh cyber onslaught from Russia that involved the deployment of a previously undocumented Golang-based data wiper dubbed SwiftSlicer.
ESET attributed the attack to Sandworm, a nation-state group linked to Military Unit 74455 of the Main Intelligence Directorate of the General Staff of the Armed Forces of the Russian Federation (GRU).
"Once executed it deletes shadow


feed_id: https://thehackernews.com/2023/01/eliminating-saas-shadow-it-is-now.html
title: Eliminating SaaS Shadow IT is Now Available via a Self-Service Product, Free of Charge
uri: 2023-02-01-Eliminating-SaaS-Shadow-IT-is-Now-Available-via-a-Self-Service-Product
url: https://thehackernews.com/2023/01/eliminating-saas-shadow-it-is-now.html
content:
The use of software as a service (SaaS) is experiencing rapid growth and shows no signs of slowing down. Its decentralized and easy-to-use nature is beneficial for increasing employee productivity, but it also poses many security and IT challenges. Keeping track of all the SaaS applications that have been granted access to an organization's data is a difficult task. Understanding the risks that


feed_id: https://thehackernews.com/2023/02/python-developers-beware-clipper.html
title: Python Developers Beware: Clipper Malware Found in 450+ PyPI Packages!
uri: 2023-02-14-Python-Developers-Beware-Clipper-Malware-Found-in-450-PyPI-Packages
url: https://thehackernews.com/2023/02/python-developers-beware-clipper.html
content:
Malicious actors have published more than 451 unique Python packages on the official Python Package Index (PyPI) repository in an attempt to infect developer systems with clipper malware.
Software supply chain security company Phylum, which spotted the libraries, said the ongoing activity is a follow-up to a campaign that was initially disclosed in November 2022.
The initial vector entails using


feed_id: https://thehackernews.com/2023/02/a-cisos-practical-guide-to-storage-and.html
title: A CISOs Practical Guide to Storage and Backup Ransomware Resiliency
uri: 2023-02-14-A-CISOs-Practical-Guide-to-Storage-and-Backup-Ransomware-Resiliency
url: https://thehackernews.com/2023/02/a-cisos-practical-guide-to-storage-and.html
content:
One thing is clear. The "business value" of data continues to grow, making it an organization's primary piece of intellectual property.
From a cyber risk perspective, attacks on data are the most prominent threat to organizations. 
Regulators, cyber insurance firms, and auditors are paying much closer attention to the integrity, resilience, and recoverability of organization data – as well as


feed_id: https://thehackernews.com/2023/02/chinese-hackers-targeting-south.html
title: Chinese Hackers Targeting South American Diplomatic Entities with ShadowPad
uri: 2023-02-14-Chinese-Hackers-Targeting-South-American-Diplomatic-Entities-with-Shad
url: https://thehackernews.com/2023/02/chinese-hackers-targeting-south.html
content:
Microsoft on Monday attributed a China-based cyber espionage actor to a set of attacks targeting diplomatic entities in South America.
The tech giant's Security Intelligence team is tracking the cluster under the emerging moniker DEV-0147, describing the activity as an "expansion of the group's data exfiltration operations that traditionally targeted government agencies and think tanks in Asia


feed_id: https://thehackernews.com/2023/02/massive-http-ddos-attack-hits-record.html
title: Massive HTTP DDoS Attack Hits Record High of 71 Million Requests/Second
uri: 2023-02-14-Massive-HTTP-DDoS-Attack-Hits-Record-High-of-71-Million-Requests-Secon
url: https://thehackernews.com/2023/02/massive-http-ddos-attack-hits-record.html
content:
Web infrastructure company Cloudflare on Monday disclosed that it thwarted a record-breaking distributed denial-of-service (DDoS) attack that peaked at over 71 million requests per second (RPS).
"The majority of attacks peaked in the ballpark of 50-70 million requests per second (RPS) with the largest exceeding 71 million," the company said, calling it a "hyper-volumetric" DDoS attack.
It's also


feed_id: https://thehackernews.com/2023/02/patch-now-apples-ios-ipados-macos-and.html
title: Patch Now: Apple's iOS, iPadOS, macOS, and Safari Under Attack with New Zero-Day Flaw
uri: 2023-02-14-Patch-Now-Apple-s-iOS-iPadOS-macOS-and-Safari-Under-Attack-with-Ne
url: https://thehackernews.com/2023/02/patch-now-apples-ios-ipados-macos-and.html
content:
Apple on Monday rolled out security updates for iOS, iPadOS, macOS, and Safari to address a zero-day flaw that it said has been actively exploited in the wild.
Tracked as CVE-2023-23529, the issue relates to a type confusion bug in the WebKit browser engine that could be activated when processing maliciously crafted web content, culminating in arbitrary code execution.
The iPhone maker said the


feed_id: https://thehackernews.com/2023/02/hackers-create-malicious-dota-2-game.html
title: Hackers Create Malicious Dota 2 Game Modes to Secretly Access Players' Systems
uri: 2023-02-14-Hackers-Create-Malicious-Dota-2-Game-Modes-to-Secretly-Access-Players
url: https://thehackernews.com/2023/02/hackers-create-malicious-dota-2-game.html
content:
An unknown threat actor created malicious game modes for the Dota 2 multiplayer online battle arena (MOBA) video game that could have been exploited to establish backdoor access to players' systems.
The modes exploited a high-severity flaw in the V8 JavaScript engine tracked as CVE-2021-38003 (CVSS score: 8.8), which was exploited as a zero-day and addressed by Google in October 2021.
"Since V8


feed_id: https://thehackernews.com/2023/02/honeypot-factory-use-of-deception-in.html
title: Honeypot-Factory: The Use of Deception in ICS/OT Environments
uri: 2023-02-14-Honeypot-Factory-The-Use-of-Deception-in-ICS-OT-Environments
url: https://thehackernews.com/2023/02/honeypot-factory-use-of-deception-in.html
content:
The recently published Security Navigator report of Orange Cyberdefense shows there has been a  rapid increase of attacks on industrial control systems (ICS) in the past few years. Looking a bit closer, most of the attacks seem to have spilt over from traditional IT. That's to be expected, as production systems are commonly connected to ordinary corporate networks at this point. Though the data


feed_id: https://thehackernews.com/2023/02/chinese-tonto-team-hackers-second.html
title: Chinese Tonto Team Hackers' Second Attempt to Target Cybersecurity Firm Group-IB Fails
uri: 2023-02-14-Chinese-Tonto-Team-Hackers-Second-Attempt-to-Target-Cybersecurity-Fir
url: https://thehackernews.com/2023/02/chinese-tonto-team-hackers-second.html
content:
The advanced persistent threat (APT) actor known as Tonto Team carried out an unsuccessful attack on cybersecurity company Group-IB in June 2022.
The Singapore-headquartered firm said that it detected and blocked malicious phishing emails originating from the group targeting its employees. It's also the second attack aimed at Group-IB, the first of which took place in March 2021.
Tonto Team,


feed_id: https://thehackernews.com/2023/02/hackers-targeting-us-and-german-firms.html
title: Hackers Targeting U.S. and German Firms Monitor Victims' Desktops with Screenshotter
uri: 2023-02-14-Hackers-Targeting-U-S-and-German-Firms-Monitor-Victims-Desktops-with
url: https://thehackernews.com/2023/02/hackers-targeting-us-and-german-firms.html
content:
A previously unknown threat actor has been targeting companies in the U.S. and Germany with bespoke malware designed to steal confidential information.
Enterprise security company Proofpoint, which is tracking the activity cluster under the name Screentime, said the group, dubbed TA866, is likely financially motivated.
"TA866 is an organized actor able to perform well thought-out attacks at


feed_id: https://thehackernews.com/2023/02/new-esxiargs-ransomware-variant-emerges.html
title: New ESXiArgs Ransomware Variant Emerges After CISA Releases Decryptor Tool
uri: 2023-02-14-New-ESXiArgs-Ransomware-Variant-Emerges-After-CISA-Releases-Decryptor
url: https://thehackernews.com/2023/02/new-esxiargs-ransomware-variant-emerges.html
content:
After the U.S. Cybersecurity and Infrastructure Security Agency (CISA) released a decryptor for affected victims to recover from ESXiArgs ransomware attacks, the threat actors have bounced back with an updated version that encrypts more data.
The emergence of the new variant was reported by a system administrator on an online forum, where another participant stated that files larger than 128MB


feed_id: https://thehackernews.com/2023/02/enigma-vector-and-tgtoxic-new-threats.html
title: Enigma, Vector, and TgToxic: The New Threats to Cryptocurrency Users
uri: 2023-02-14-Enigma-Vector-and-TgToxic-The-New-Threats-to-Cryptocurrency-Users
url: https://thehackernews.com/2023/02/enigma-vector-and-tgtoxic-new-threats.html
content:
Suspected Russian threat actors have been targeting Eastern European users in the crypto industry with fake job opportunities as bait to install information-stealing malware on compromised hosts.
The attackers "use several highly obfuscated and under-development custom loaders in order to infect those involved in the cryptocurrency industry with Enigma stealer," Trend Micro researchers Aliakbar


feed_id: https://thehackernews.com/2023/02/cisa-warns-of-active-attacks-exploiting.html
title: CISA Warns of Active Attacks Exploiting Fortra MFT, TerraMaster NAS, and Intel Driver Flaws
uri: 2023-02-14-CISA-Warns-of-Active-Attacks-Exploiting-Fortra-MFT-TerraMaster-NAS-a
url: https://thehackernews.com/2023/02/cisa-warns-of-active-attacks-exploiting.html
content:
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added three flaws to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active abuse in the wild.
Included among the three is CVE-2022-24990, a bug affecting TerraMaster network-attached storage (TNAS) devices that could lead to unauthenticated remote code execution with the highest privileges.
Details


feed_id: https://thehackernews.com/2023/02/researchers-uncover-obfuscated.html
title: Researchers Uncover Obfuscated Malicious Code in PyPI Python Packages
uri: 2023-02-14-Researchers-Uncover-Obfuscated-Malicious-Code-in-PyPI-Python-Packages
url: https://thehackernews.com/2023/02/researchers-uncover-obfuscated.html
content:
Four different rogue packages in the Python Package Index (PyPI) have been found to carry out a number of malicious actions, including dropping malware, deleting the netstat utility, and manipulating the SSH authorized_keys file.
The packages in question are aptx, bingchilling2, httops, and tkint3rs, all of which were collectively downloaded about 450 times before they were taken down. While


feed_id: https://thehackernews.com/2023/02/north-korean-hackers-targeting.html
title: North Korean Hackers Targeting Healthcare with Ransomware to Fund its Operations
uri: 2023-02-14-North-Korean-Hackers-Targeting-Healthcare-with-Ransomware-to-Fund-its
url: https://thehackernews.com/2023/02/north-korean-hackers-targeting.html
content:
State-backed hackers from North Korea are conducting ransomware attacks against healthcare and critical infrastructure facilities to fund illicit activities, U.S. and South Korean cybersecurity and intelligence agencies warned in a joint advisory.
The attacks, which demand cryptocurrency ransoms in exchange for recovering access to encrypted files, are designed to support North Korea's


feed_id: https://thehackernews.com/2023/02/3-overlooked-cybersecurity-breaches.html
title: 3 Overlooked Cybersecurity Breaches
uri: 2023-02-14-3-Overlooked-Cybersecurity-Breaches
url: https://thehackernews.com/2023/02/3-overlooked-cybersecurity-breaches.html
content:
Here are three of the worst breaches, attacker tactics and techniques of 2022, and the security controls that can provide effective, enterprise security protection for them.
#1: 2 RaaS Attacks in 13 Months
Ransomware as a service is a type of attack in which the ransomware software and infrastructure are leased out to the attackers. These ransomware services can be purchased on the dark web from


feed_id: https://thehackernews.com/2023/02/uk-and-us-sanction-7-russians-for.html
title: U.K. and U.S. Sanction 7 Russians for TrickBot, Ryuk, and Conti Ransomware Attacks
uri: 2023-02-14-U-K-and-U-S-Sanction-7-Russians-for-TrickBot-Ryuk-and-Conti-Ransom
url: https://thehackernews.com/2023/02/uk-and-us-sanction-7-russians-for.html
content:
In a first-of-its-kind coordinated action, the U.K. and U.S. governments on Thursday levied sanctions against seven Russian nationals for their affiliation to the TrickBot, Ryuk, and Conti cybercrime operation.
The individuals designated under sanctions are Vitaly Kovalev (aka Alex Konor, Bentley, or Bergen), Maksim Mikhailov (aka Baget), Valentin Karyagin (aka Globus), Mikhail Iskritskiy (aka


feed_id: https://thehackernews.com/2023/02/reddit-suffers-security-breach-exposing.html
title: Reddit Suffers Security Breach Exposing Internal Documents and Source Code
uri: 2023-02-14-Reddit-Suffers-Security-Breach-Exposing-Internal-Documents-and-Source
url: https://thehackernews.com/2023/02/reddit-suffers-security-breach-exposing.html
content:
Popular social news aggregation platform Reddit has disclosed that it was the victim of a security incident that enabled unidentified threat actors to gain unauthorized access to internal documents, code, and some unspecified business systems.
The company blamed it on a "sophisticated and highly-targeted phishing attack" that took place on February 5, 2023, aimed at its employees.
The attack


feed_id: https://thehackernews.com/2023/02/critical-infrastructure-at-risk-from.html
title: Critical Infrastructure at Risk from New Vulnerabilities Found in Wireless IIoT Devices
uri: 2023-02-14-Critical-Infrastructure-at-Risk-from-New-Vulnerabilities-Found-in-Wire
url: https://thehackernews.com/2023/02/critical-infrastructure-at-risk-from.html
content:
A set of 38 security vulnerabilities has been uncovered in wireless industrial internet of things (IIoT) devices from four different vendors that could pose a significant attack surface for threat actors looking to exploit operational technology (OT) environments.
"Threat actors can exploit vulnerabilities in Wireless IIoT devices to gain initial access to internal OT networks," Israeli


feed_id: https://thehackernews.com/2023/02/thn-webinar-learn-how-to-comply-with.html
title: Webinar: Learn How to Comply with New Cyber Insurance Identity Security Requirements
uri: Webinar-Learn-How-to-Comply-with-New-Cyber-Insurance-Identity-Securit
url: https://thehackernews.com/2023/02/thn-webinar-learn-how-to-comply-with.html
content:
Have you ever stopped to think about the potential consequences of a cyberattack on your organization? It's getting more intense and destructive every day, and organizations are feeling the heat.
That's why more and more businesses are turning to cyber insurance to find some much-needed peace of mind. Imagine, in the unfortunate event of a successful security breach or ransomware attack, the


feed_id: https://thehackernews.com/2023/02/newspenguin-threat-actor-emerges-with.html
title: NewsPenguin Threat Actor Emerges with Malicious Campaign Targeting Pakistani Entities
uri: 2023-02-14-NewsPenguin-Threat-Actor-Emerges-with-Malicious-Campaign-Targeting-Pak
url: https://thehackernews.com/2023/02/newspenguin-threat-actor-emerges-with.html
content:
A previously unknown threat actor dubbed NewsPenguin has been linked to a phishing campaign targeting Pakistani entities by leveraging the upcoming international maritime expo as a lure.
"The attacker sent out targeted phishing emails with a weaponized document attached that purports to be an exhibitor manual for PIMEC-23," the BlackBerry Research and Intelligence Team said.
PIMEC, short for


feed_id: https://thehackernews.com/2023/02/a-hackers-pot-of-gold-your-msps-data.html
title: A Hackers Pot of Gold: Your MSP's Data
uri: 2023-02-14-A-Hackers-Pot-of-Gold-Your-MSP-s-Data
url: https://thehackernews.com/2023/02/a-hackers-pot-of-gold-your-msps-data.html
content:
A single ransomware attack on a New Zealand managed service provider (MSP) disrupted several of its clients' business operations overnight, most belonging to the healthcare sector. According to the country's privacy commissioner, "a cyber security incident involving a ransomware attack" in late November upended the daily operations of New Zealand's health ministry when it prevented the staff


feed_id: https://thehackernews.com/2023/02/gootkit-malware-adopts-new-tactics-to.html
title: Gootkit Malware Adopts New Tactics to Attack Healthcare and Finance Firms
uri: 2023-02-14-Gootkit-Malware-Adopts-New-Tactics-to-Attack-Healthcare-and-Finance-Fi
url: https://thehackernews.com/2023/02/gootkit-malware-adopts-new-tactics-to.html
content:
The Gootkit malware is prominently going after healthcare and finance organizations in the U.S., U.K., and Australia, according to new findings from Cybereason.
The cybersecurity firm said it investigated a Gootkit incident in December 2022 that adopted a new method of deployment, with the actors abusing the foothold to deliver Cobalt Strike and SystemBC for post-exploitation.
"The threat actor


feed_id: https://thehackernews.com/2023/02/openssl-fixes-multiple-new-security.html
title: OpenSSL Fixes Multiple New Security Flaws with Latest Update
uri: 2023-02-14-OpenSSL-Fixes-Multiple-New-Security-Flaws-with-Latest-Update
url: https://thehackernews.com/2023/02/openssl-fixes-multiple-new-security.html
content:
The OpenSSL Project has released fixes to address several security flaws, including a high-severity bug in the open source encryption toolkit that could potentially expose users to malicious attacks.
Tracked as CVE-2023-0286, the issue relates to a case of type confusion that may permit an adversary to "read memory contents or enact a denial-of-service," the maintainers said in an advisory.
The


feed_id: https://thehackernews.com/2023/02/nist-standardizes-ascon-cryptographic.html
title: NIST Standardizes Ascon Cryptographic Algorithm for IoT and Other Lightweight Devices
uri: 2023-02-14-NIST-Standardizes-Ascon-Cryptographic-Algorithm-for-IoT-and-Other-Ligh
url: https://thehackernews.com/2023/02/nist-standardizes-ascon-cryptographic.html
content:
The U.S. National Institute of Standards and Technology (NIST) has announced that a family of authenticated encryption and hashing algorithms known as Ascon will be standardized for lightweight cryptography applications.
"The chosen algorithms are designed to protect information created and transmitted by the Internet of Things (IoT), including its myriad tiny sensors and actuators," NIST said.


feed_id: https://thehackernews.com/2023/02/unpatched-security-flaws-disclosed-in.html
title: Unpatched Security Flaws Disclosed in Multiple Document Management Systems
uri: 2023-02-14-Unpatched-Security-Flaws-Disclosed-in-Multiple-Document-Management-Sys
url: https://thehackernews.com/2023/02/unpatched-security-flaws-disclosed-in.html
content:
Multiple unpatched security flaws have been disclosed in open source and freemium Document Management System (DMS) offerings from four vendors LogicalDOC, Mayan, ONLYOFFICE, and OpenKM.
Cybersecurity firm Rapid7 said the eight vulnerabilities offer a mechanism through which "an attacker can convince a human operator to save a malicious document on the platform and, once the document is indexed


feed_id: https://thehackernews.com/2023/02/sydney-man-sentenced-for-blackmailing.html
title: Sydney Man Sentenced for Blackmailing Optus Customers After Data Breach
uri: 2023-02-14-Sydney-Man-Sentenced-for-Blackmailing-Optus-Customers-After-Data-Breac
url: https://thehackernews.com/2023/02/sydney-man-sentenced-for-blackmailing.html
content:
A Sydney man has been sentenced to an 18-month Community Correction Order (CCO) and 100 hours of community service for attempting to take advantage of the Optus data breach last year to blackmail its customers.
The unnamed individual, 19 when arrested in October 2022 and now 20, used the leaked records stolen from the security lapse to orchestrate an SMS-based extortion scheme.
The suspect


feed_id: https://thehackernews.com/2023/02/russian-hackers-using-graphiron-malware.html
title: Russian Hackers Using Graphiron Malware to Steal Data from Ukraine
uri: 2023-02-14-Russian-Hackers-Using-Graphiron-Malware-to-Steal-Data-from-Ukraine
url: https://thehackernews.com/2023/02/russian-hackers-using-graphiron-malware.html
content:
A Russia-linked threat actor has been observed deploying a new information-stealing malware in cyber attacks targeting Ukraine.
Dubbed Graphiron by Broadcom-owned Symantec, the malware is the handiwork of an espionage group known as Nodaria, which is tracked by the Computer Emergency Response Team of Ukraine (CERT-UA) as UAC-0056.
"The malware is written in Go and is designed to harvest a wide


feed_id: https://thehackernews.com/2023/02/how-to-think-like-hacker-and-stay-ahead.html
title: How to Think Like a Hacker and Stay Ahead of Threats
uri: 2023-02-14-How-to-Think-Like-a-Hacker-and-Stay-Ahead-of-Threats
url: https://thehackernews.com/2023/02/how-to-think-like-hacker-and-stay-ahead.html
content:
To succeed as a cybersecurity analyst, you need to understand the traits, values, and thought processes of hackers, along with the tools they use to launch their attacks. 
During a webinar called The Hacker Mindset, a Red Team Researcher shared how you can use some of these tools for your own detection and prevention of breaches. He also demonstrated how an attack takes place using the Follina


feed_id: https://thehackernews.com/2023/02/russian-hacker-pleads-guilty-to-money.html
title: Russian Hacker Pleads Guilty to Money Laundering Linked to Ryuk Ransomware
uri: 2023-02-14-Russian-Hacker-Pleads-Guilty-to-Money-Laundering-Linked-to-Ryuk-Ransom
url: https://thehackernews.com/2023/02/russian-hacker-pleads-guilty-to-money.html
content:
A Russian national on February 7, 2023, pleaded guilty in the U.S. to money laundering charges and for attempting to conceal the source of funds obtained in connection with Ryuk ransomware attacks.
Denis Mihaqlovic Dubnikov, 30, was arrested in Amsterdam in November 2021 before he was extradited from the Netherlands in August 2022. He is awaiting sentencing on April 11, 2023.
"Between at least


feed_id: https://thehackernews.com/2023/02/cert-ua-alerts-ukrainian-state.html
title: CERT-UA Alerts Ukrainian State Authorities of Remcos Software-Fueled Cyber Attacks
uri: 2023-02-14-CERT-UA-Alerts-Ukrainian-State-Authorities-of-Remcos-Software-Fueled-C
url: https://thehackernews.com/2023/02/cert-ua-alerts-ukrainian-state.html
content:
The Computer Emergency Response Team of Ukraine (CERT-UA) has issued an alert warning of cyber attacks against state authorities in the country that deploy a legitimate remote access software named Remcos.
The mass phishing campaign has been attributed to a threat actor it tracks as UAC-0050, with the agency describing the activity as likely motivated by espionage given the toolset employed.
The


feed_id: https://thehackernews.com/2023/02/encrypted-messaging-app-exclu-used-by.html
title: Encrypted Messaging App Exclu Used by Criminal Groups Cracked by Joint Law Enforcement
uri: 2023-02-14-Encrypted-Messaging-App-Exclu-Used-by-Criminal-Groups-Cracked-by-Joint
url: https://thehackernews.com/2023/02/encrypted-messaging-app-exclu-used-by.html
content:
A joint law enforcement operation conducted by Germany, the Netherlands, and Poland has cracked yet another encrypted messaging application named Exclu used by organized crime groups.
Eurojust, in a press statement, said the February 3 exercise resulted in the arrests of 45 individuals across Belgium and the Netherlands, some of whom include users as well as the administrators and owners of the


feed_id: https://thehackernews.com/2023/02/hackers-exploit-vulnerabilities-in.html
title: Hackers Exploit Vulnerabilities in Sunlogin to Deploy Sliver C2 Framework
uri: 2023-02-14-Hackers-Exploit-Vulnerabilities-in-Sunlogin-to-Deploy-Sliver-C2-Framew
url: https://thehackernews.com/2023/02/hackers-exploit-vulnerabilities-in.html
content:
Threat actors are leveraging known flaws in Sunlogin software to deploy the Sliver command-and-control (C2) framework for carrying out post-exploitation activities.
The findings come from AhnLab Security Emergency response Center (ASEC), which discovered that security vulnerabilities in Sunlogin, a remote desktop program developed in China, are being abused to deploy a wide range of payloads.
"


feed_id: https://thehackernews.com/2023/02/tackling-new-cyber-insurance.html
title: Tackling the New Cyber Insurance Requirements: Can Your Organization Comply?
uri: 2023-02-14-Tackling-the-New-Cyber-Insurance-Requirements-Can-Your-Organization-C
url: https://thehackernews.com/2023/02/tackling-new-cyber-insurance.html
content:
With cyberattacks around the world escalating rapidly, insurance companies are ramping up the requirements to qualify for a cyber insurance policy. Ransomware attacks were up 80% last year, prompting underwriters to put in place a number of new provisions designed to prevent ransomware and stem the record number of claims. Among these are a mandate to enforce multi-factor authentication (MFA)


feed_id: https://thehackernews.com/2023/02/linux-variant-of-clop-ransomware.html
title: Linux Variant of Clop Ransomware Spotted, But Uses Faulty Encryption Algorithm
uri: 2023-02-14-Linux-Variant-of-Clop-Ransomware-Spotted-But-Uses-Faulty-Encryption-A
url: https://thehackernews.com/2023/02/linux-variant-of-clop-ransomware.html
content:
The first-ever Linux variant of the Clop ransomware has been detected in the wild, but with a faulty encryption algorithm that has made it possible to reverse engineer the process.
"The ELF executable contains a flawed encryption algorithm making it possible to decrypt locked files without paying the ransom," SentinelOne researcher Antonis Terefos said in a report shared with The Hacker News.


feed_id: https://thehackernews.com/2023/02/vmware-finds-no-evidence-of-0-day-flaw.html
title: VMware Finds No Evidence of 0-Day in Ongoing ESXiArgs Ransomware Spree
uri: 2023-02-14-VMware-Finds-No-Evidence-of-0-Day-in-Ongoing-ESXiArgs-Ransomware-Spree
url: https://thehackernews.com/2023/02/vmware-finds-no-evidence-of-0-day-flaw.html
content:
VMware on Monday said it found no evidence that threat actors are leveraging an unknown security flaw, i.e., a zero-day, in its software as part of an ongoing ransomware attack spree worldwide.
"Most reports state that End of General Support (EoGS) and/or significantly out-of-date products are being targeted with known vulnerabilities which were previously addressed and disclosed in VMware


feed_id: https://thehackernews.com/2023/02/guloader-malware-using-malicious-nsis.html
title: GuLoader Malware Using Malicious NSIS Executables to Target E-Commerce Industry
uri: GuLoader-Malware-Using-Malicious-NSIS-Executables-to-Target-E-Commerce
url: https://thehackernews.com/2023/02/guloader-malware-using-malicious-nsis.html
content:
E-commerce industries in South Korea and the U.S. are at the receiving end of an ongoing GuLoader malware campaign, cybersecurity firm Trellix disclosed late last month.
The malspam activity is notable for transitioning away from malware-laced Microsoft Word documents to NSIS executable files for loading the malware. Other countries targeted as part of the campaign include Germany, Saudi Arabia,


feed_id: https://thehackernews.com/2023/02/microsoft-iranian-nation-state-group.html
title: Microsoft: Iranian Nation-State Group Sanctioned by U.S. Behind Charlie Hebdo Hack
uri: 2023-02-14-Microsoft-Iranian-Nation-State-Group-Sanctioned-by-U-S-Behind-Charli
url: https://thehackernews.com/2023/02/microsoft-iranian-nation-state-group.html
content:
An Iranian nation-state group sanctioned by the U.S. government has been attributed to the hack of the French satirical magazine Charlie Hebdo in early January 2023.
Microsoft, which disclosed details of the incident, is tracking the activity cluster under its chemical element-themed moniker NEPTUNIUM, which is an Iran-based company known as Emennet Pasargad.
In January 2022, the U.S. Federal


feed_id: https://thehackernews.com/2023/02/saas-in-real-world-whos-responsible-to.html
title: SaaS in the Real World: Who's Responsible to Secure this Data?
uri: 2023-02-14-SaaS-in-the-Real-World-Who-s-Responsible-to-Secure-this-Data
url: https://thehackernews.com/2023/02/saas-in-real-world-whos-responsible-to.html
content:
When SaaS applications started growing in popularity, it was unclear who was responsible for securing the data. Today, most security and IT teams understand the shared responsibility model, in which the SaaS vendor is responsible for securing the application, while the organization is responsible for securing their data. 
What’s far murkier, however, is where the data responsibility lies on the


feed_id: https://thehackernews.com/2023/02/openssh-releases-patch-for-new-pre-auth.html
title: OpenSSH Releases Patch for New Pre-Auth Double Free Vulnerability
uri: 2023-02-14-OpenSSH-Releases-Patch-for-New-Pre-Auth-Double-Free-Vulnerability
url: https://thehackernews.com/2023/02/openssh-releases-patch-for-new-pre-auth.html
content:
The maintainers of OpenSSH have released OpenSSH 9.2 to address a number of security bugs, including a memory safety vulnerability in the OpenSSH server (sshd).
Tracked as CVE-2023-25136, the shortcoming has been classified as a pre-authentication double free vulnerability that was introduced in version 9.1.
"This is not believed to be exploitable, and it occurs in the unprivileged pre-auth


feed_id: https://thehackernews.com/2023/02/formbook-malware-spreads-via.html
title: FormBook Malware Spreads via Malvertising Using MalVirt Loader to Evade Detection
uri: 2023-02-14-FormBook-Malware-Spreads-via-Malvertising-Using-MalVirt-Loader-to-Evad
url: https://thehackernews.com/2023/02/formbook-malware-spreads-via.html
content:
An ongoing malvertising campaign is being used to distribute virtualized .NET loaders that are designed to deploy the FormBook information-stealing malware.
"The loaders, dubbed MalVirt, use obfuscated virtualization for anti-analysis and evasion along with the Windows Process Explorer driver for terminating processes," SentinelOne researchers Aleksandar Milenkoski and Tom Hegel said in a


feed_id: https://thehackernews.com/2023/02/pixpirate-new-android-banking-trojan.html
title: PixPirate: New Android Banking Trojan Targeting Brazilian Financial Institutions
uri: 2023-02-14-PixPirate-New-Android-Banking-Trojan-Targeting-Brazilian-Financial-In
url: https://thehackernews.com/2023/02/pixpirate-new-android-banking-trojan.html
content:
A new Android banking trojan has set its eyes on Brazilian financial institutions to commit fraud by leveraging the PIX payments platform.
Italian cybersecurity company Cleafy, which discovered the malware between the end of 2022 and the beginning of 2023, is tracking it under the name PixPirate.
"PixPirate belongs to the newest generation of Android banking trojan, as it can perform ATS (


feed_id: https://thehackernews.com/2023/02/new-wave-of-ransomware-attacks.html
title: New Wave of Ransomware Attacks Exploiting VMware Bug to Target ESXi Servers
uri: 2023-02-14-New-Wave-of-Ransomware-Attacks-Exploiting-VMware-Bug-to-Target-ESXi-Se
url: https://thehackernews.com/2023/02/new-wave-of-ransomware-attacks.html
content:
VMware ESXi hypervisors are the target of a new wave of attacks designed to deploy ransomware on compromised systems.
"These attack campaigns appear to exploit CVE-2021-21974, for which a patch has been available since February 23, 2021," the Computer Emergency Response Team (CERT) of France said in an advisory on Friday.
VMware, in its own alert released at the time, described the issue as an 


feed_id: https://thehackernews.com/2023/02/warning-hackers-actively-exploiting.html
title: Warning: Hackers Actively Exploiting Zero-Day in Fortra's GoAnywhere MFT
uri: 2023-02-14-Warning-Hackers-Actively-Exploiting-Zero-Day-in-Fortra-s-GoAnywhere-M
url: https://thehackernews.com/2023/02/warning-hackers-actively-exploiting.html
content:
A zero-day vulnerability affecting Fortra's GoAnywhere MFT managed file transfer application is being actively exploited in the wild.
Details of the flaw were first publicly shared by security reporter Brian Krebs on Mastodon. No public advisory has been published by Fortra.
The vulnerability is a case of remote code injection that requires access to the administrative console of the application


feed_id: https://thehackernews.com/2023/02/is-your-ev-charging-station-safe-new.html
title: Is Your EV Charging Station Safe? New Security Vulnerabilities Uncovered
uri: 2023-02-14-Is-Your-EV-Charging-Station-Safe-New-Security-Vulnerabilities-Uncover
url: https://thehackernews.com/2023/02/is-your-ev-charging-station-safe-new.html
content:
Two new security weaknesses discovered in several electric vehicle (EV) charging systems could be exploited to remotely shut down charging stations and even expose them to data and energy theft.
The findings, which come from Israel-based SaiFlow, once again demonstrate the potential risks facing the EV charging infrastructure.
The issues have been identified in version 1.6J of the Open Charge


feed_id: https://thehackernews.com/2023/02/post-macro-world-sees-rise-in-microsoft.html
title: Post-Macro World Sees Rise in Microsoft OneNote Documents Delivering Malware
uri: 2023-02-14-Post-Macro-World-Sees-Rise-in-Microsoft-OneNote-Documents-Delivering-M
url: https://thehackernews.com/2023/02/post-macro-world-sees-rise-in-microsoft.html
content:
In a continuing sign that threat actors are adapting well to a post-macro world, it has emerged that the use of Microsoft OneNote documents to deliver malware via phishing attacks is on the rise.
Some of the notable malware families that are being distributed using this method include AsyncRAT, RedLine Stealer, Agent Tesla, DOUBLEBACK, Quasar RAT, XWorm, Qakbot, BATLOADER, and FormBook.


feed_id: https://thehackernews.com/2023/02/iranian-oilrig-hackers-using-new.html
title: Iranian OilRig Hackers Using New Backdoor to Exfiltrate Data from Govt. Organizations
uri: 2023-02-14-Iranian-OilRig-Hackers-Using-New-Backdoor-to-Exfiltrate-Data-from-Govt
url: https://thehackernews.com/2023/02/iranian-oilrig-hackers-using-new.html
content:
The Iranian nation-state hacking group known as OilRig has continued to target government organizations in the Middle East as part of a cyber espionage campaign that leverages a new backdoor to exfiltrate data.
"The campaign abuses legitimate but compromised email accounts to send stolen data to external mail accounts controlled by the attackers," Trend Micro researchers Mohamed Fahmy, Sherif


feed_id: https://thehackernews.com/2023/02/the-pivot-how-msps-can-turn-challenge.html
title: The Pivot: How MSPs Can Turn a Challenge Into a Once-in-a-Decade Opportunity
uri: The-Pivot-How-MSPs-Can-Turn-a-Challenge-Into-a-Once-in-a-Decade-Oppor
url: https://thehackernews.com/2023/02/the-pivot-how-msps-can-turn-challenge.html
content:
Cybersecurity is quickly becoming one of the most significant growth drivers for Managed Service Providers (MSPs). That's the main insight from a recent study from Lumu: in North America, more than 80% of MSPs cite cybersecurity as a primary growth driver of their business. Service providers have a huge opportunity to expand their business and win new customers by developing their cybersecurity


feed_id: https://thehackernews.com/2023/02/atlassians-jira-software-found.html
title: Atlassian's Jira Service Management Found Vulnerable to Critical Vulnerability
uri: Atlassian-s-Jira-Service-Management-Found-Vulnerable-to-Critical-Vulne
url: https://thehackernews.com/2023/02/atlassians-jira-software-found.html
content:
Atlassian has released fixes to resolve a critical security flaw in Jira Service Management Server and Data Center that could be abused by an attacker to pass off as another user and gain unauthorized access to susceptible instances.
The vulnerability is tracked as CVE-2023-22501 (CVSS score: 9.4) and has been described as a case of broken authentication with low attack complexity.
"An


feed_id: https://thehackernews.com/2023/02/new-high-severity-vulnerabilities.html
title: New High-Severity Vulnerabilities Discovered in Cisco IOx and F5 BIG-IP Products
uri: 2023-02-14-New-High-Severity-Vulnerabilities-Discovered-in-Cisco-IOx-and-F5-BIG-I
url: https://thehackernews.com/2023/02/new-high-severity-vulnerabilities.html
content:
F5 has warned of a high-severity flaw impacting BIG-IP appliances that could lead to denial-of-service (DoS) or arbitrary code execution.
The issue is rooted in the iControl Simple Object Access Protocol (SOAP) interface and affects the following versions of BIG-IP -

13.1.5
14.1.4.6 - 14.1.5
15.1.5.1 - 15.1.8
16.1.2.2 - 16.1.3, and
17.0.0

"A format string vulnerability exists in iControl SOAP


feed_id: https://thehackernews.com/2023/02/cisa-alert-oracle-e-business-suite-and.html
title: CISA Alert: Oracle E-Business Suite and SugarCRM Vulnerabilities Under Attack
uri: 2023-02-14-CISA-Alert-Oracle-E-Business-Suite-and-SugarCRM-Vulnerabilities-Under
url: https://thehackernews.com/2023/02/cisa-alert-oracle-e-business-suite-and.html
content:
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on February 2 added two security flaws to its Known Exploited Vulnerabilities (KEV) Catalog, citing evidence of active exploitation.
The first of the two vulnerabilities is CVE-2022-21587 (CVSS score: 9.8), a critical issue impacting versions 12.2.3 to 12.2.11 of the Oracle Web Applications Desktop Integrator product.
"Oracle


feed_id: https://thehackernews.com/2023/02/samsung-introduces-new-feature-to.html
title: Samsung Introduces New Feature to Protect Users from Zero-Click Malware Attacks
uri: 2023-02-20-Samsung-Introduces-New-Feature-to-Protect-Users-from-Zero-Click-Malwar
url: https://thehackernews.com/2023/02/samsung-introduces-new-feature-to.html
content:
Samsung has announced a new feature called Message Guard that comes with safeguards to protect users from malware and spyware via what's referred to as zero-click attacks.
The South Korean chaebol said the solution "preemptively" secures users' devices by "limiting exposure to invisible threats disguised as image attachments."
The security feature, available on Samsung Messages and Google


feed_id: https://thehackernews.com/2023/02/fortinet-issues-patches-for-40-flaws.html
title: Fortinet Issues Patches for 40 Flaws Affecting FortiWeb, FortiOS, FortiNAC, and FortiProxy
uri: 2023-02-20-Fortinet-Issues-Patches-for-40-Flaws-Affecting-FortiWeb-FortiOS-Fort
url: https://thehackernews.com/2023/02/fortinet-issues-patches-for-40-flaws.html
content:
Fortinet has released security updates to address 40 vulnerabilities in its software lineup, including FortiWeb, FortiOS, FortiNAC, and FortiProxy, among others.
Two of the 40 flaws are rated Critical, 15 are rated High, 22 are rated Medium, and one is rated Low in severity.
Top of the list is a severe bug residing in the FortiNAC network access control solution (CVE-2022-39952, CVSS score: 9.8)


feed_id: https://thehackernews.com/2023/02/twitter-limits-sms-based-2-factor.html
title: Twitter Limits SMS-Based 2-Factor Authentication to Blue Subscribers Only
uri: 2023-02-20-Twitter-Limits-SMS-Based-2-Factor-Authentication-to-Blue-Subscribers-O
url: https://thehackernews.com/2023/02/twitter-limits-sms-based-2-factor.html
content:
Twitter has announced that it's limiting the use of SMS-based two-factor authentication (2FA) to its Blue subscribers.
"While historically a popular form of 2FA, unfortunately we have seen phone-number based 2FA be used – and abused – by bad actors," the company said.
"We will no longer allow accounts to enroll in the text message/SMS method of 2FA unless they are Twitter Blue subscribers."


feed_id: https://thehackernews.com/2023/02/godaddy-discloses-multi-year-security.html
title: GoDaddy Discloses Multi-Year Security Breach Causing Malware Installations and Source Code Theft
uri: 2023-02-20-GoDaddy-Discloses-Multi-Year-Security-Breach-Causing-Malware-Installat
url: https://thehackernews.com/2023/02/godaddy-discloses-multi-year-security.html
content:
Web hosting services provider GoDaddy on Friday disclosed a multi-year security breach that enabled unknown threat actors to install malware and siphon source code related to some of its services.
The company attributed the campaign to a "sophisticated and organized group targeting hosting services."
GoDaddy said in December 2022, it received an unspecified number of customer complaints about


feed_id: https://thehackernews.com/2023/02/experts-warn-of-rambleon-android.html
title: Experts Warn of RambleOn Android Malware Targeting South Korean Journalists
uri: 2023-02-20-Experts-Warn-of-RambleOn-Android-Malware-Targeting-South-Korean-Journa
url: https://thehackernews.com/2023/02/experts-warn-of-rambleon-android.html
content:
Suspected North Korean nation-state actors targeted a journalist in South Korea with a malware-laced Android app as part of a social engineering campaign.
The findings come from South Korea-based non-profit Interlab, which coined the new malware RambleOn.
The malicious functionalities include the "ability to read and leak target's contact list, SMS, voice call content, location and others from


feed_id: https://thehackernews.com/2023/02/top-cybersecurity-news-stories-this.html
title: ⚡Top Cybersecurity News Stories This Week — Cybersecurity Newsletter
uri: 2023-02-20-Top-Cybersecurity-News-Stories-This-Week-Cybersecurity-Newslett
url: https://thehackernews.com/2023/02/top-cybersecurity-news-stories-this.html
content:
Hey 👋 there, cyber friends!
Welcome to this week's cybersecurity newsletter, where we aim to keep you informed and empowered in the ever-changing world of cyber threats.
In today's edition, we will cover some interesting developments in the cybersecurity landscape and share some insightful analysis of each to help you protect yourself against potential attacks.
1. Apple 📱 Devices Hacked with


feed_id: https://thehackernews.com/2023/02/armenian-entities-hit-by-new-version-of.html
title: Armenian Entities Hit by New Version of OxtaRAT Spying Tool
uri: 2023-02-20-Armenian-Entities-Hit-by-New-Version-of-OxtaRAT-Spying-Tool
url: https://thehackernews.com/2023/02/armenian-entities-hit-by-new-version-of.html
content:
Entities in Armenia have come under a cyber attack using an updated version of a backdoor called OxtaRAT that allows remote access and desktop surveillance.
"The tool capabilities include searching for and exfiltrating files from the infected machine, recording the video from the web camera and desktop, remotely controlling the compromised machine with TightVNC, installing a web shell,


feed_id: https://thehackernews.com/2023/02/new-mirai-botnet-variant-v3g4.html
title: New Mirai Botnet Variant 'V3G4' Exploiting 13 Flaws to Target Linux and IoT Devices
uri: 2023-02-20-New-Mirai-Botnet-Variant-V3G4-Exploiting-13-Flaws-to-Target-Linux-an
url: https://thehackernews.com/2023/02/new-mirai-botnet-variant-v3g4.html
content:
A new variant of the notorious Mirai botnet has been found leveraging several security vulnerabilities to propagate itself to Linux and IoT devices.
Observed during the second half of 2022, the new version has been dubbed V3G4 by Palo Alto Networks Unit 42, which identified three different campaigns likely conducted by the same threat actor.
"Once the vulnerable devices are compromised, they


feed_id: https://thehackernews.com/2023/02/critical-rce-vulnerability-discovered.html
title: Critical RCE Vulnerability Discovered in ClamAV Open Source Antivirus Software
uri: 2023-02-20-Critical-RCE-Vulnerability-Discovered-in-ClamAV-Open-Source-Antivirus
url: https://thehackernews.com/2023/02/critical-rce-vulnerability-discovered.html
content:
Cisco has rolled out security updates to address a critical flaw reported in the ClamAV open source antivirus engine that could lead to remote code execution on susceptible devices.
Tracked as CVE-2023-20032 (CVSS score: 9.8), the issue relates to a case of remote code execution residing in the HFS+ file parser component.
The flaw affects versions 1.0.0 and earlier, 0.105.1 and earlier, and


feed_id: https://thehackernews.com/2023/02/researchers-hijack-popular-npm-package.html
title: Researchers Hijack Popular NPM Package with Millions of Downloads
uri: 2023-02-20-Researchers-Hijack-Popular-NPM-Package-with-Millions-of-Downloads
url: https://thehackernews.com/2023/02/researchers-hijack-popular-npm-package.html
content:
A popular npm package with more than 3.5 million weekly downloads has been found vulnerable to an account takeover attack.
"The package can be taken over by recovering an expired domain name for one of its maintainers and resetting the password," software supply chain security company Illustria said in a report.
While npm's security protections limit users to have only one active email address


feed_id: https://thehackernews.com/2023/02/researchers-link-sidewinder-group-to.html
title: Researchers Link SideWinder Group to Dozens of Targeted Attacks in Multiple Countries
uri: 2023-02-20-Researchers-Link-SideWinder-Group-to-Dozens-of-Targeted-Attacks-in-Mul
url: https://thehackernews.com/2023/02/researchers-link-sidewinder-group-to.html
content:
The prolific SideWinder group has been attributed as the nation-state actor behind attempted attacks against 61 entities in Afghanistan, Bhutan, Myanmar, Nepal, and Sri Lanka between June and November 2021.
Targets included government, military, law enforcement, banks, and other organizations, according to an exhaustive report published by Group-IB, which also found links between the adversary


feed_id: https://thehackernews.com/2023/02/hackers-using-google-ads-to-spread.html
title: Hackers Using Google Ads to Spread FatalRAT Malware Disguised as Popular Apps
uri: 2023-02-20-Hackers-Using-Google-Ads-to-Spread-FatalRAT-Malware-Disguised-as-Popul
url: https://thehackernews.com/2023/02/hackers-using-google-ads-to-spread.html
content:
Chinese-speaking individuals in Southeast and East Asia are the targets of a new rogue Google Ads campaign that delivers remote access trojans such as FatalRAT to compromised machines.
The attacks involve purchasing ad slots to appear in Google search results and direct users looking for popular applications to rogue websites hosting trojanized installers, ESET said in a report published today.


feed_id: https://thehackernews.com/2023/02/researchers-warn-of-critical-security.html
title: Researchers Warn of Critical Security Bugs in Schneider Electric Modicon PLCs
uri: 2023-02-20-Researchers-Warn-of-Critical-Security-Bugs-in-Schneider-Electric-Modic
url: https://thehackernews.com/2023/02/researchers-warn-of-critical-security.html
content:
Security researchers have disclosed two new vulnerabilities affecting Schneider Electric Modicon programmable logic controllers (PLCs) that could allow for authentication bypass and remote code execution.
The flaws, tracked as CVE-2022-45788 (CVSS score: 7.5) and CVE-2022-45789 (CVSS score: 8.1), are part of a broader collection of security defects tracked by Forescout as OT:ICEFALL.
Successful


feed_id: https://thehackernews.com/2023/02/breaking-security-black-box-in-dbs-data.html
title: Breaking the Security "Black Box" in DBs, Data Warehouses and Data Lakes
uri: 2023-02-20-Breaking-the-Security-Black-Box-in-DBs-Data-Warehouses-and-Data-Lak
url: https://thehackernews.com/2023/02/breaking-security-black-box-in-dbs-data.html
content:
Security teams typically have great visibility over most areas, for example, the corporate network, endpoints, servers, and cloud infrastructure. They use this visibility to enforce the necessary security and compliance requirements. However, this is not the case when it comes to sensitive data sitting in production or analytic databases, data warehouses or data lakes.
Security teams have to


feed_id: https://thehackernews.com/2023/02/new-threat-actor-wip26-targeting.html
title: New Threat Actor WIP26 Targeting Telecom Service Providers in the Middle East
uri: 2023-02-20-New-Threat-Actor-WIP26-Targeting-Telecom-Service-Providers-in-the-Midd
url: https://thehackernews.com/2023/02/new-threat-actor-wip26-targeting.html
content:
Telecommunication service providers in the Middle East are being targeted by a previously undocumented threat actor as part of a suspected intelligence gathering mission.
Cybersecurity firms SentinelOne and QGroup are tracking the activity cluster under the former's work-in-progress moniker WIP26.
"WIP26 relies heavily on public cloud infrastructure in an attempt to evade detection by making


feed_id: https://thehackernews.com/2023/02/esxiargs-ransomware-hits-over-500-new.html
title: ESXiArgs Ransomware Hits Over 500 New Targets in European Countries
uri: 2023-02-20-ESXiArgs-Ransomware-Hits-Over-500-New-Targets-in-European-Countries
url: https://thehackernews.com/2023/02/esxiargs-ransomware-hits-over-500-new.html
content:
More than 500 hosts have been newly compromised en masse by the ESXiArgs ransomware strain, most of which are located in France, Germany, the Netherlands, the U.K., and Ukraine.
The findings come from attack surface management firm Censys, which discovered "two hosts with strikingly similar ransom notes dating back to mid-October 2022, just after ESXi versions 6.5 and 6.7 reached end of life."


feed_id: https://thehackernews.com/2023/02/north-koreas-apt37-targeting-southern.html
title: North Korea's APT37 Targeting Southern Counterpart with New M2RAT Malware
uri: 2023-02-20-North-Korea-s-APT37-Targeting-Southern-Counterpart-with-New-M2RAT-Malw
url: https://thehackernews.com/2023/02/north-koreas-apt37-targeting-southern.html
content:
The North Korea-linked threat actor tracked as APT37 has been linked to a piece of new malware dubbed M2RAT in attacks targeting its southern counterpart, suggesting continued evolution of the group's features and tactics.
APT37, also tracked under the monikers Reaper, RedEyes, Ricochet Chollima, and ScarCruft, is an element within North Korea's Ministry of State Security (MSS) unlike the


feed_id: https://thehackernews.com/2023/02/webinar-mythbusting-special-9-myths.html
title: Webinar — A MythBusting Special: 9 Myths about File-based Threats
uri: 2023-02-20-Webinar-A-MythBusting-Special-9-Myths-about-File-based-Threats
url: https://thehackernews.com/2023/02/webinar-mythbusting-special-9-myths.html
content:
Bad actors love to deliver threats in files. Persistent and persuasive messages convince unsuspecting victims to accept and open files from unknown sources, executing the first step in a cyber attack. 
This continues to happen whether the file is an EXE or a Microsoft Excel document. Far too often, end users have an illusion of security, masked by good faith efforts of other users and (


feed_id: https://thehackernews.com/2023/02/financially-motivated-threat-actor.html
title: Financially Motivated Threat Actor Strikes with New Ransomware and Clipper Malware
uri: 2023-02-20-Financially-Motivated-Threat-Actor-Strikes-with-New-Ransomware-and-Cli
url: https://thehackernews.com/2023/02/financially-motivated-threat-actor.html
content:
A new financially motivated campaign that commenced in December 2022 has seen the unidentified threat actor behind it deploying a novel ransomware strain dubbed MortalKombat and a clipper malware known as Laplas.
Cisco Talos said it "observed the actor scanning the internet for victim machines with an exposed remote desktop protocol (RDP) port 3389."
The attacks, per the cybersecurity company,


feed_id: https://thehackernews.com/2023/02/regular-pen-testing-is-key-to-resolving.html
title: Regular Pen Testing Is Key to Resolving Conflict Between SecOps and DevOps
uri: 2023-02-20-Regular-Pen-Testing-Is-Key-to-Resolving-Conflict-Between-SecOps-and-De
url: https://thehackernews.com/2023/02/regular-pen-testing-is-key-to-resolving.html
content:
In an ideal world, security and development teams would be working together in perfect harmony. But we live in a world of competing priorities, where DevOps and security departments often butt heads with each other.
Agility and security are often at odds with each other— if a new feature is delivered quickly but contains security vulnerabilities, the SecOps team will need to scramble the release


feed_id: https://thehackernews.com/2023/02/experts-warn-of-beep-new-evasive.html
title: Experts Warn of 'Beep' - A New Evasive Malware That Can Fly Under the Radar
uri: 2023-02-20-Experts-Warn-of-Beep-A-New-Evasive-Malware-That-Can-Fly-Under-the
url: https://thehackernews.com/2023/02/experts-warn-of-beep-new-evasive.html
content:
Cybersecurity researchers have unearthed a new piece of evasive malware dubbed Beep that's designed to fly under the radar and drop additional payloads onto a compromised host.
"It seemed as if the authors of this malware were trying to implement as many anti-debugging and anti-VM (anti-sandbox) techniques as they could find," Minerva Labs researcher Natalie Zargarov said.
"One such technique


feed_id: https://thehackernews.com/2023/02/google-rolling-out-privacy-sandbox-beta.html
title: Google Rolling Out Privacy Sandbox Beta on Android 13 Devices
uri: 2023-02-20-Google-Rolling-Out-Privacy-Sandbox-Beta-on-Android-13-Devices
url: https://thehackernews.com/2023/02/google-rolling-out-privacy-sandbox-beta.html
content:
Google announced on Tuesday that it's officially rolling out Privacy Sandbox on Android in beta to eligible mobile devices running Android 13.
"The Privacy Sandbox Beta provides new APIs that are designed with privacy at the core, and don't use identifiers that can track your activity across apps and websites," the search and advertising giant said. "Apps that choose to participate in the Beta


feed_id: https://thehackernews.com/2023/02/update-now-microsoft-releases-patches.html
title: Update Now: Microsoft Releases Patches for 3 Actively Exploited Windows Vulnerabilities
uri: 2023-02-20-Update-Now-Microsoft-Releases-Patches-for-3-Actively-Exploited-Window
url: https://thehackernews.com/2023/02/update-now-microsoft-releases-patches.html
content:
Microsoft on Tuesday released security updates to address 75 flaws spanning its product portfolio, three of which have come under active exploitation in the wild.
The updates are in addition to 22 flaws the Windows maker patched in its Chromium-based Edge browser over the past month.
Of the 75 vulnerabilities, nine are rated Critical and 66 are rated Important in severity. 37 out of 75 bugs are


feed_id: https://thehackernews.com/2023/02/massive-adsense-fraud-campaign.html
title: Massive AdSense Fraud Campaign Uncovered - 10,000+ WordPress Sites Infected
uri: 2023-02-20-Massive-AdSense-Fraud-Campaign-Uncovered-10-000-WordPress-Sites-Inf
url: https://thehackernews.com/2023/02/massive-adsense-fraud-campaign.html
content:
The threat actors behind the black hat redirect malware campaign have scaled up their campaign to use more than 70 bogus domains mimicking URL shorteners and infect over 10,800 websites.
"The main objective is still ad fraud by artificially increasing traffic to pages which contain the AdSense ID which contain Google ads for revenue generation," Sucuri researcher Ben Martin said in a report


feed_id: https://thehackernews.com/2023/02/the-secret-vulnerability-finance-execs.html
title: The Secret Vulnerability Finance Execs are Missing
uri: The-Secret-Vulnerability-Finance-Execs-are-Missing
url: https://thehackernews.com/2023/02/the-secret-vulnerability-finance-execs.html
content:
The (Other) Risk in Finance
A few years ago, a Washington-based real estate developer received a document link from First American – a financial services company in the real estate industry – relating to a deal he was working on. Everything about the document was perfectly fine and normal.
The odd part, he told a reporter, was that if he changed a single digit in the URL, suddenly, he could see


feed_id: https://thehackernews.com/2023/02/new-hacking-cluster-clasiopa-targeting.html
title: New Hacking Cluster 'Clasiopa' Targeting Materials Research Organizations in Asia
uri: New-Hacking-Cluster-Clasiopa-Targeting-Materials-Research-Organizati
url: https://thehackernews.com/2023/02/new-hacking-cluster-clasiopa-targeting.html
content:
Materials research organizations in Asia have been targeted by a previously unknown threat actor using a distinct set of tools.
Symantec, by Broadcom Software, is tracking the cluster under the moniker Clasiopa. The origins of the hacking group and its affiliations are currently unknown, but there are hints that suggest the adversary could have ties to India.
This includes references to "


feed_id: https://thehackernews.com/2023/02/lazarus-group-using-new-winordll64.html
title: Lazarus Group Using New WinorDLL64 Backdoor to Exfiltrate Sensitive Data
uri: 2023-02-23-Lazarus-Group-Using-New-WinorDLL64-Backdoor-to-Exfiltrate-Sensitive-Da
url: https://thehackernews.com/2023/02/lazarus-group-using-new-winordll64.html
content:
A new backdoor associated with a malware downloader named Wslink has been discovered, with the tool likely used by the notorious North Korea-aligned Lazarus Group, new findings reveal.
The payload, dubbed WinorDLL64 by ESET, is a fully-featured implant that can exfiltrate, overwrite, and delete files; execute PowerShell commands; and obtain comprehensive information about the underlying machine.


feed_id: https://thehackernews.com/2023/02/new-s1deload-malware-hijacking-users.html
title: New S1deload Malware Hijacking Users' Social Media Accounts and Mining Cryptocurrency
uri: 2023-02-23-New-S1deload-Malware-Hijacking-Users-Social-Media-Accounts-and-Mining
url: https://thehackernews.com/2023/02/new-s1deload-malware-hijacking-users.html
content:
An active malware campaign has set its sights on Facebook and YouTube users by leveraging a new information stealer to hijack the accounts and abuse the systems' resources to mine cryptocurrency.
Bitdefender is calling the malware S1deload Stealer for its use of DLL side-loading techniques to get past security defenses and execute its malicious components.
"Once infected, S1deload Stealer steals


feed_id: https://thehackernews.com/2023/02/python-developers-warned-of-trojanized.html
title: Python Developers Warned of Trojanized PyPI Packages Mimicking Popular Libraries
uri: 2023-02-23-Python-Developers-Warned-of-Trojanized-PyPI-Packages-Mimicking-Popular
url: https://thehackernews.com/2023/02/python-developers-warned-of-trojanized.html
content:
Cybersecurity researchers are warning of "imposter packages" mimicking popular libraries available on the Python Package Index (PyPI) repository.
The 41 malicious PyPI packages have been found to pose as typosquatted variants of legitimate modules such as HTTP, AIOHTTP, requests, urllib, and urllib3. The names of the packages are as follows:
aio5, aio6, htps1, httiop, httops, httplat, httpscolor


feed_id: https://thehackernews.com/2023/02/apple-warns-of-3-new-vulnerabilities.html
title: Apple Warns of 3 New Vulnerabilities Affecting iPhone, iPad, and Mac Devices
uri: 2023-02-23-Apple-Warns-of-3-New-Vulnerabilities-Affecting-iPhone-iPad-and-Mac-D
url: https://thehackernews.com/2023/02/apple-warns-of-3-new-vulnerabilities.html
content:
Apple has revised the security advisories it released last month to include three new vulnerabilities impacting iOS, iPadOS, and macOS.
The first flaw is a race condition in the Crash Reporter component (CVE-2023-23520) that could enable a malicious actor to read arbitrary files as root. The iPhone maker said it addressed the issue with additional validation.
The two other vulnerabilities,


feed_id: https://thehackernews.com/2023/02/attackers-flood-npm-repository-with.html
title: Attackers Flood NPM Repository with Over 15,000 Spam Packages Containing Phishing Links
uri: 2023-02-23-Attackers-Flood-NPM-Repository-with-Over-15-000-Spam-Packages-Containi
url: https://thehackernews.com/2023/02/attackers-flood-npm-repository-with.html
content:
In what's a continuing assault on the open source ecosystem, over 15,000 spam packages have flooded the npm repository in an attempt to distribute phishing links.
"The packages were created using automated processes, with project descriptions and auto-generated names that closely resembled one another," Checkmarx researcher Yehuda Gelb said in a Tuesday report.
"The attackers referred to retail


feed_id: https://thehackernews.com/2023/02/3-steps-to-automate-your-third-party.html
title: 3 Steps to Automate Your Third-Party Risk Management Program
uri: 2023-02-23-3-Steps-to-Automate-Your-Third-Party-Risk-Management-Program
url: https://thehackernews.com/2023/02/3-steps-to-automate-your-third-party.html
content:
If you Google "third-party data breaches" you will find many recent reports of data breaches that were either caused by an attack at a third party or sensitive information stored at a third-party location was exposed. Third-party data breaches don't discriminate by industry because almost every company is operating with some sort of vendor relationship – whether it be a business partner,


feed_id: https://thehackernews.com/2023/02/hydrochasma-new-threat-actor-targets.html
title: Hydrochasma: New Threat Actor Targets Shipping Companies and Medical Labs in Asia
uri: 2023-02-23-Hydrochasma-New-Threat-Actor-Targets-Shipping-Companies-and-Medical-L
url: https://thehackernews.com/2023/02/hydrochasma-new-threat-actor-targets.html
content:
Shipping companies and medical laboratories in Asia have been the subject of a suspected espionage campaign carried out by a never-before-seen threat actor dubbed Hydrochasma.
The activity, which has been ongoing since October 2022, "relies exclusively on publicly available and living-off-the-land tools," Symantec, by Broadcom Software, said in a report shared with The Hacker News.
There is no


feed_id: https://thehackernews.com/2023/02/threat-actors-adopt-havoc-framework-for.html
title: Threat Actors Adopt Havoc Framework for Post-Exploitation in Targeted Attacks
uri: 2023-02-23-Threat-Actors-Adopt-Havoc-Framework-for-Post-Exploitation-in-Targeted
url: https://thehackernews.com/2023/02/threat-actors-adopt-havoc-framework-for.html
content:
An open source command-and-control (C2) framework known as Havoc is being adopted by threat actors as an alternative to other well-known legitimate toolkits like Cobalt Strike, Sliver, and Brute Ratel.
Cybersecurity firm Zscaler said it observed a new campaign in the beginning of January 2023 targeting an unnamed government organization that utilized Havoc.
"While C2 frameworks are prolific, the


feed_id: https://thehackernews.com/2023/02/gcore-thwarts-massive-650-gbps-ddos.html
title: Gcore Thwarts Massive 650 Gbps DDoS Attack on Free Plan Client
uri: 2023-02-23-Gcore-Thwarts-Massive-650-Gbps-DDoS-Attack-on-Free-Plan-Client
url: https://thehackernews.com/2023/02/gcore-thwarts-massive-650-gbps-ddos.html
content:
At the beginning of January, Gcore faced an incident involving several L3/L4 DDoS attacks with a peak volume of 650 Gbps. Attackers exploited over 2000 servers belonging to one of the top three cloud providers worldwide and targeted a client who was using a free CDN plan. However, due to Gcore’s distribution of infrastructure and a large number of peering partners, the attacks were mitigated,


feed_id: https://thehackernews.com/2023/02/us-cybersecurity-agency-cisa-adds-three.html
title: U.S. Cybersecurity Agency CISA Adds Three New Vulnerabilities in KEV Catalog
uri: 2023-02-23-U-S-Cybersecurity-Agency-CISA-Adds-Three-New-Vulnerabilities-in-KEV-C
url: https://thehackernews.com/2023/02/us-cybersecurity-agency-cisa-adds-three.html
content:
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added three security flaws to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation.
The list of shortcomings is as follows -

CVE-2022-47986 (CVSS score: 9.8) - IBM Aspera Faspex Code Execution Vulnerability
CVE-2022-41223 (CVSS score: 6.8) - Mitel MiVoice Connect Code Injection


feed_id: https://thehackernews.com/2023/02/vmware-patches-critical-vulnerability.html
title: VMware Patches Critical Vulnerability in Carbon Black App Control Product
uri: 2023-02-23-VMware-Patches-Critical-Vulnerability-in-Carbon-Black-App-Control-Prod
url: https://thehackernews.com/2023/02/vmware-patches-critical-vulnerability.html
content:
VMware on Tuesday released patches to address a critical security vulnerability affecting its Carbon Black App Control product.
Tracked as CVE-2023-20858, the shortcoming carries a CVSS score of 9.1 out of a maximum of 10 and impacts App Control versions 8.7.x, 8.8.x, and 8.9.x.
The virtualization services provider describes the issue as an injection vulnerability. Security researcher Jari


feed_id: https://thehackernews.com/2023/02/mylobot-botnet-spreading-rapidly.html
title: MyloBot Botnet Spreading Rapidly Worldwide: Infecting Over 50,000 Devices Daily
uri: 2023-02-23-MyloBot-Botnet-Spreading-Rapidly-Worldwide-Infecting-Over-50-000-Devi
url: https://thehackernews.com/2023/02/mylobot-botnet-spreading-rapidly.html
content:
A sophisticated botnet known as MyloBot has compromised thousands of systems, with most of them located in India, the U.S., Indonesia, and Iran.
That's according to new findings from BitSight, which said it's "currently seeing more than 50,000 unique infected systems every day," down from a high of 250,000 unique hosts in 2020.
Furthermore, an analysis of MyloBot's infrastructure has found


feed_id: https://thehackernews.com/2023/02/the-future-of-network-security.html
title: The Future of Network Security: Predictive Analytics and ML-Driven Solutions
uri: 2023-02-23-The-Future-of-Network-Security-Predictive-Analytics-and-ML-Driven-Sol
url: https://thehackernews.com/2023/02/the-future-of-network-security.html
content:
As the digital age evolves and continues to shape the business landscape, corporate networks have become increasingly complex and distributed. The amount of data a company collects to detect malicious behaviour constantly increases, making it challenging to detect deceptive and unknown attack patterns and the so-called "needle in the haystack". With a growing number of cybersecurity threats,


feed_id: https://thehackernews.com/2023/02/researchers-discover-dozens-samples-of.html
title: Researchers Discover Numerous Samples of Information Stealer 'Stealc' in the Wild
uri: Researchers-Discover-Numerous-Samples-of-Information-Stealer-Stealc
url: https://thehackernews.com/2023/02/researchers-discover-dozens-samples-of.html
content:
A new information stealer called Stealc that's being advertised on the dark web could emerge as a worthy competitor to other malware of its ilk.
"The threat actor presents Stealc as a fully featured and ready-to-use stealer, whose development relied on Vidar, Raccoon, Mars, and RedLine stealers," SEKOIA said in a Monday report.
The French cybersecurity company said it discovered more than 40


feed_id: https://thehackernews.com/2023/02/coinbase-employee-falls-for-sms-scam-in.html
title: Coinbase Employee Falls for SMS Scam in Cyber Attack, Limited Data Exposed
uri: 2023-02-23-Coinbase-Employee-Falls-for-SMS-Scam-in-Cyber-Attack-Limited-Data-Exp
url: https://thehackernews.com/2023/02/coinbase-employee-falls-for-sms-scam-in.html
content:
Popular cryptocurrency exchange platform Coinbase disclosed that it experienced a cybersecurity attack that targeted its employees.
The company said its "cyber controls prevented the attacker from gaining direct system access and prevented any loss of funds or compromise of customer information."
The incident, which took place on February 5, 2023, resulted in the exposure of a "limited amount of


feed_id: https://thehackernews.com/2023/02/researchers-warn-of-reverserat-backdoor.html
title: Researchers Warn of ReverseRAT Backdoor Targeting Indian Government Agencies
uri: 2023-02-23-Researchers-Warn-of-ReverseRAT-Backdoor-Targeting-Indian-Government-Ag
url: https://thehackernews.com/2023/02/researchers-warn-of-reverserat-backdoor.html
content:
A spear-phishing campaign targeting Indian government entities aims to deploy an updated version of a backdoor called ReverseRAT.
Cybersecurity firm ThreatMon attributed the activity to a threat actor tracked as SideCopy.
SideCopy is a threat group of Pakistani origin that shares overlaps with another actor called Transparent Tribe. It is so named for mimicking the infection chains associated


feed_id: https://thehackernews.com/2023/02/norway-seizes-584-million-in.html
title: Norway Seizes $5.84 Million in Cryptocurrency Stolen by Lazarus Hackers
uri: 2023-02-23-Norway-Seizes-5-84-Million-in-Cryptocurrency-Stolen-by-Lazarus-Hacker
url: https://thehackernews.com/2023/02/norway-seizes-584-million-in.html
content:
Norwegian police agency Økokrim has announced the seizure of 60 million NOK (about $5.84 million) worth of cryptocurrency stolen by the Lazarus Group in March 2022 following the Axie Infinity Ronin Bridge hack.
"This case shows that we also have a great capacity to follow the money on the blockchain, even if the criminals use advanced methods," the Oslo-based crime-fighting unit said in a


feed_id: https://thehackernews.com/2023/02/how-to-detect-new-threats-via.html
title: How to Detect New Threats via Suspicious Activities
uri: 2023-02-23-How-to-Detect-New-Threats-via-Suspicious-Activities
url: https://thehackernews.com/2023/02/how-to-detect-new-threats-via.html
content:
Unknown malware presents a significant cybersecurity threat and can cause serious damage to organizations and individuals alike. When left undetected, malicious code can gain access to confidential information, corrupt data, and allow attackers to gain control of systems. Find out how to avoid these circumstances and detect unknown malicious behavior efficiently. 
Challenges of new threats'


feed_id: https://thehackernews.com/2023/02/google-reveals-alarming-surge-in.html
title: Google Reveals Alarming Surge in Russian Cyber Attacks Against Ukraine
uri: 2023-02-23-Google-Reveals-Alarming-Surge-in-Russian-Cyber-Attacks-Against-Ukraine
url: https://thehackernews.com/2023/02/google-reveals-alarming-surge-in.html
content:
Russia's cyber attacks against Ukraine surged by 250% in 2022 when compared to two years ago, Google's Threat Analysis Group (TAG) and Mandiant disclosed in a new joint report.
The targeting, which coincided and has since persisted following the country's military invasion of Ukraine in February 2022, focused heavily on the Ukrainian government and military entities, alongside critical


feed_id: https://thehackernews.com/2023/02/north-korean-cyber-espionage-group.html
title: Cyber Espionage Group Earth Kitsune Deploys WhiskerSpy Backdoor in Latest Attacks
uri: 2023-02-23-Cyber-Espionage-Group-Earth-Kitsune-Deploys-WhiskerSpy-Backdoor-in-Lat
url: https://thehackernews.com/2023/02/north-korean-cyber-espionage-group.html
content:
The cyber espionage threat actor tracked as Earth Kitsune has been observed deploying a new backdoor called WhiskerSpy as part of a social engineering campaign.
Earth Kitsune, active since at least 2019, is known to primarily target individuals interested in North Korea with self-developed malware such as dneSpy and agfSpy. Previously documented intrusions have entailed the use of watering holes


feed_id: https://thehackernews.com/2023/03/security-and-it-teams-no-longer-need-to.html
title: Security and IT Teams No Longer Need To Pay For SaaS-Shadow IT Discovery
uri: 2023-03-06-Security-and-IT-Teams-No-Longer-Need-To-Pay-For-SaaS-Shadow-IT-Discove
url: https://thehackernews.com/2023/03/security-and-it-teams-no-longer-need-to.html
content:
This past January, a SaaS Security Posture Management (SSPM) company named Wing Security (Wing) made waves with the launch of its free SaaS-Shadow IT discovery solution. Cloud-based companies were invited to gain insight into their employees' SaaS usage through a completely free, self-service product that operates on a "freemium" model. If a user is impressed with the solution and wants to gain


feed_id: https://thehackernews.com/2023/03/new-fixs-atm-malware-targeting-mexican.html
title: New FiXS ATM Malware Targeting Mexican Banks
uri: 2023-03-06-New-FiXS-ATM-Malware-Targeting-Mexican-Banks
url: https://thehackernews.com/2023/03/new-fixs-atm-malware-targeting-mexican.html
content:
A new ATM malware strain dubbed FiXS has been observed targeting Mexican banks since the start of February 2023.
"The ATM malware is hidden inside another not-malicious-looking program," Latin American cybersecurity firm Metabase Q said in a report shared with The Hacker News.
Besides requiring interaction via an external keyboard, the Windows-based ATM malware is also vendor-agnostic and is


feed_id: https://thehackernews.com/2023/03/new-flaws-in-tpm-20-library-pose-threat.html
title: New Flaws in TPM 2.0 Library Pose Threat to Billions of IoT and Enterprise Devices
uri: 2023-03-06-New-Flaws-in-TPM-2-0-Library-Pose-Threat-to-Billions-of-IoT-and-Enterp
url: https://thehackernews.com/2023/03/new-flaws-in-tpm-20-library-pose-threat.html
content:
A pair of serious security defects has been disclosed in the Trusted Platform Module (TPM) 2.0 reference library specification that could potentially lead to information disclosure or privilege escalation.
One of the vulnerabilities, CVE-2023-1017, concerns an out-of-bounds write, while the other, CVE-2023-1018, is described as an out-of-bounds read. Credited with discovering and reporting the


feed_id: https://thehackernews.com/2023/03/chinese-hackers-targeting-european.html
title: Chinese Hackers Targeting European Entities with New MQsTTang Backdoor
uri: 2023-03-06-Chinese-Hackers-Targeting-European-Entities-with-New-MQsTTang-Backdoor
url: https://thehackernews.com/2023/03/chinese-hackers-targeting-european.html
content:
The China-aligned Mustang Panda actor has been observed using a hitherto unseen custom backdoor called MQsTTang as part of an ongoing social engineering campaign that commenced in January 2023.
"Unlike most of the group's malware, MQsTTang doesn't seem to be based on existing families or publicly available projects," ESET researcher Alexandre Côté Cyr said in a new report.
Attack chains


feed_id: https://thehackernews.com/2023/03/us-cybersecurity-agency-raises-alarm.html
title: U.S. Cybersecurity Agency Raises Alarm Over Royal Ransomware's Deadly Capabilities
uri: 2023-03-06-U-S-Cybersecurity-Agency-Raises-Alarm-Over-Royal-Ransomware-s-Deadly
url: https://thehackernews.com/2023/03/us-cybersecurity-agency-raises-alarm.html
content:
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has released a new advisory about Royal ransomware, which emerged in the threat landscape last year.
"After gaining access to victims' networks, Royal actors disable antivirus software and exfiltrate large amounts of data before ultimately deploying the ransomware and encrypting the systems," CISA said.
The custom ransomware


feed_id: https://thehackernews.com/2023/03/hackers-exploit-containerized.html
title: Hackers Exploit Containerized Environments to Steal Proprietary Data and Software
uri: Hackers-Exploit-Containerized-Environments-to-Steal-Proprietary-Data-a
url: https://thehackernews.com/2023/03/hackers-exploit-containerized.html
content:
A sophisticated attack campaign dubbed SCARLETEEL is targeting containerized environments to perpetrate theft of proprietary data and software.
"The attacker exploited a containerized workload and then leveraged it to perform privilege escalation into an AWS account in order to steal proprietary software and credentials," Sysdig said in a new report.
The advanced cloud attack also entailed the


feed_id: https://thehackernews.com/2023/03/new-cryptojacking-campaign-leverages.html
title: New Cryptojacking Campaign Leverages Misconfigured Redis Database Servers
uri: 2023-03-06-New-Cryptojacking-Campaign-Leverages-Misconfigured-Redis-Database-Serv
url: https://thehackernews.com/2023/03/new-cryptojacking-campaign-leverages.html
content:
Misconfigured Redis database servers are the target of a novel cryptojacking campaign that leverages a legitimate and open source command-line file transfer service to implement its attack.
"Underpinning this campaign was the use of transfer[.]sh," Cado Security said in a report shared with The Hacker News. "It's possible that it's an attempt at evading detections based on other common code


feed_id: https://thehackernews.com/2023/03/2023-browser-security-report-uncovers.html
title: 2023 Browser Security Report Uncovers Major Browsing Risks and Blind Spots
uri: 2023-03-06-2023-Browser-Security-Report-Uncovers-Major-Browsing-Risks-and-Blind-S
url: https://thehackernews.com/2023/03/2023-browser-security-report-uncovers.html
content:
As a primary working interface, the browser plays a significant role in today's corporate environment. The browser is constantly used by employees to access websites, SaaS applications and internal applications, from both managed and unmanaged devices. A new report published by LayerX, a browser security vendor, finds that attackers are exploiting this reality and are targeting it in increasing


feed_id: https://thehackernews.com/2023/03/experts-identify-fully-featured-info.html
title: Experts Identify Fully-Featured Info Stealer and Trojan in Python Package on PyPI
uri: 2023-03-06-Experts-Identify-Fully-Featured-Info-Stealer-and-Trojan-in-Python-Pack
url: https://thehackernews.com/2023/03/experts-identify-fully-featured-info.html
content:
A malicious Python package uploaded to the Python Package Index (PyPI) has been found to contain a fully-featured information stealer and remote access trojan.
The package, named colourfool, was identified by Kroll's Cyber Threat Intelligence team, with the company calling the malware Colour-Blind.
"The 'Colour-Blind' malware points to the democratization of cybercrime that could lead to an


feed_id: https://thehackernews.com/2023/03/sysupdate-malware-strikes-again-with.html
title: SysUpdate Malware Strikes Again with Linux Version and New Evasion Tactics
uri: 2023-03-06-SysUpdate-Malware-Strikes-Again-with-Linux-Version-and-New-Evasion-Tac
url: https://thehackernews.com/2023/03/sysupdate-malware-strikes-again-with.html
content:
The threat actor known as Lucky Mouse has developed a Linux version of a malware toolkit called SysUpdate, expanding on its ability to target devices running the operating system.
The oldest version of the updated artifact dates back to July 2022, with the malware incorporating new features designed to evade security software and resist reverse engineering.
Cybersecurity company Trend Micro said


feed_id: https://thehackernews.com/2023/03/critical-flaw-in-cisco-ip-phone-series.html
title: Critical Flaw in Cisco IP Phone Series Exposes Users to Command Injection Attack
uri: 2023-03-06-Critical-Flaw-in-Cisco-IP-Phone-Series-Exposes-Users-to-Command-Inject
url: https://thehackernews.com/2023/03/critical-flaw-in-cisco-ip-phone-series.html
content:
Cisco on Wednesday rolled out security updates to address a critical flaw impacting its IP Phone 6800, 7800, 7900, and 8800 Series products.
The vulnerability, tracked as CVE-2023-20078, is rated 9.8 out of 10 on the CVSS scoring system and is described as a command injection bug in the web-based management interface arising due to insufficient validation of user-supplied input.
Successful


