# articles

feed_id: https://thehackernews.com/2023/03/cybercriminals-targeting-law-firms-with.html
title: Cybercriminals Targeting Law Firms with GootLoader and FakeUpdates Malware
uri: 2023-03-06-Cybercriminals-Targeting-Law-Firms-with-GootLoader-and-FakeUpdates-Mal
url: https://thehackernews.com/2023/03/cybercriminals-targeting-law-firms-with.html
content:
Six different law firms were targeted in January and February 2023 as part of two disparate threat campaigns distributing GootLoader and FakeUpdates (aka SocGholish) malware strains.
GootLoader, active since late 2020, is a first-stage downloader that's capable of delivering a wide range of secondary payloads such as Cobalt Strike and ransomware.
It notably employs search engine optimization (


feed_id: https://thehackernews.com/2023/03/blacklotus-becomes-first-uefi-bootkit.html
title: BlackLotus Becomes First UEFI Bootkit Malware to Bypass Secure Boot on Windows 11
uri: 2023-03-06-BlackLotus-Becomes-First-UEFI-Bootkit-Malware-to-Bypass-Secure-Boot-on
url: https://thehackernews.com/2023/03/blacklotus-becomes-first-uefi-bootkit.html
content:
A stealthy Unified Extensible Firmware Interface (UEFI) bootkit called BlackLotus has become the first publicly known malware capable of bypassing Secure Boot defenses, making it a potent threat in the cyber landscape.
"This bootkit can run even on fully up-to-date Windows 11 systems with UEFI Secure Boot enabled," Slovak cybersecurity company ESET said in a report shared with The Hacker News.


feed_id: https://thehackernews.com/2023/03/cisos-are-stressed-out-and-its-putting.html
title: CISOs Are Stressed Out and It's Putting Companies at Risk
uri: 2023-03-06-CISOs-Are-Stressed-Out-and-It-s-Putting-Companies-at-Risk
url: https://thehackernews.com/2023/03/cisos-are-stressed-out-and-its-putting.html
content:
Employee well-being has become a primary focus for many businesses. Even before the pandemic, the C-suite was acutely aware of how employee mental health impacts business outcomes. 
But for cybersecurity professionals, stress has always been a part of the job.
A new survey revealed that one of the most concerning aspects of employee mental health is how it impacts cybersecurity programs and,


feed_id: https://thehackernews.com/2023/03/gmail-and-google-calendar-now-support.html
title: Gmail and Google Calendar Now Support Client-Side Encryption (CSE) to Boost Data Privacy
uri: 2023-03-06-Gmail-and-Google-Calendar-Now-Support-Client-Side-Encryption-(CSE)-to
url: https://thehackernews.com/2023/03/gmail-and-google-calendar-now-support.html
content:
Google has announced the general availability of client-side encryption (CSE) for Gmail and Calendar, months after piloting the feature in late 2022.
The data privacy controls enable "even more organizations to become arbiters of their own data and the sole party deciding who has access to it," Google's Ganesh Chilakapati and Andy Wen said.
To that end, users can send and receive emails or


feed_id: https://thehackernews.com/2023/03/parallax-rat-targeting-cryptocurrency.html
title: Parallax RAT Targeting Cryptocurrency Firms with Sophisticated Injection Techniques
uri: 2023-03-06-Parallax-RAT-Targeting-Cryptocurrency-Firms-with-Sophisticated-Injecti
url: https://thehackernews.com/2023/03/parallax-rat-targeting-cryptocurrency.html
content:
Cryptocurrency companies are being targeted as part of a new campaign that delivers a remote access trojan called Parallax RAT.
The malware "uses injection techniques to hide within legitimate processes, making it difficult to detect," Uptycs said in a new report. "Once it has been successfully injected, attackers can interact with their victim via Windows Notepad that likely serves as a


feed_id: https://thehackernews.com/2023/02/bitdefender-releases-free-decryptor-for.html
title: Bitdefender Releases Free Decryptor for MortalKombat Ransomware Strain
uri: 2023-03-06-Bitdefender-Releases-Free-Decryptor-for-MortalKombat-Ransomware-Strain
url: https://thehackernews.com/2023/02/bitdefender-releases-free-decryptor-for.html
content:
Romanian cybersecurity company Bitdefender has released a free universal decryptor for a nascent file-encrypting malware known as MortalKombat.
MortalKombat is a new ransomware strain that emerged in January 2023. It's based on a commodity ransomware dubbed Xorist and has been observed in attacks targeting entities in the U.S., the Philippines, the U.K., and Turkey.
Xorist, detected since 2010,


feed_id: https://thehackernews.com/2023/02/new-ex-22-tool-empowers-hackers-with.html
title: New EX-22 Tool Empowers Hackers with Stealthy Ransomware Attacks on Enterprises
uri: 2023-03-06-New-EX-22-Tool-Empowers-Hackers-with-Stealthy-Ransomware-Attacks-on-En
url: https://thehackernews.com/2023/02/new-ex-22-tool-empowers-hackers-with.html
content:
A new post-exploitation framework called EXFILTRATOR-22 (aka EX-22) has emerged in the wild with the goal of deploying ransomware within enterprise networks while flying under the radar.
"It comes with a wide range of capabilities, making post-exploitation a cakewalk for anyone purchasing the tool," CYFIRMA said in a new report.
Some of the notable features include establishing a reverse shell


feed_id: https://thehackernews.com/2023/02/application-security-vs-api-security.html
title: Application Security vs. API Security: What is the difference?
uri: 2023-03-06-Application-Security-vs-API-Security-What-is-the-difference
url: https://thehackernews.com/2023/02/application-security-vs-api-security.html
content:
As digital transformation takes hold and businesses become increasingly reliant on digital services, it has become more important than ever to secure applications and APIs (Application Programming Interfaces). With that said, application security and API security are two critical components of a comprehensive security strategy. By utilizing these practices, organizations can protect themselves


feed_id: https://thehackernews.com/2023/02/apt-c-36-strikes-again-blind-eagle.html
title: APT-C-36 Strikes Again: Blind Eagle Hackers Target Key Industries in Colombia
uri: 2023-03-06-APT-C-36-Strikes-Again-Blind-Eagle-Hackers-Target-Key-Industries-in-C
url: https://thehackernews.com/2023/02/apt-c-36-strikes-again-blind-eagle.html
content:
The threat actor known as Blind Eagle has been linked to a new campaign targeting various key industries in Colombia.
The activity, which was detected by the BlackBerry Research and Intelligence Team on February 20, 2023, is also said to encompass Ecuador, Chile, and Spain, suggesting a slow expansion of the hacking group's victimology footprint.
Targeted entities include health, financial, law


feed_id: https://thehackernews.com/2023/02/cisa-issues-warning-on-active.html
title: CISA Issues Warning on Active Exploitation of ZK Java Web Framework Vulnerability
uri: 2023-03-06-CISA-Issues-Warning-on-Active-Exploitation-of-ZK-Java-Web-Framework-Vu
url: https://thehackernews.com/2023/02/cisa-issues-warning-on-active.html
content:
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a high-severity flaw affecting the ZK Framework to its Known Exploited Vulnerabilities (KEV) catalog based on evidence of active exploitation.
Tracked as CVE-2022-36537 (CVSS score: 7.5), the issue impacts ZK Framework versions 9.6.1, 9.6.0.1, 9.5.1.3, 9.0.1.2, and 8.6.4.1, and allows threat actors to retrieve sensitive


feed_id: https://thehackernews.com/2023/02/lastpass-reveals-second-attack.html
title: LastPass Reveals Second Attack Resulting in Breach of Encrypted Password Vaults
uri: 2023-03-06-LastPass-Reveals-Second-Attack-Resulting-in-Breach-of-Encrypted-Passwo
url: https://thehackernews.com/2023/02/lastpass-reveals-second-attack.html
content:
LastPass, which in December 2022 disclosed a severe data breach that allowed threat actors to access encrypted password vaults, said it happened as a result of the same adversary launching a second attack on its systems.
The company said one of its DevOps engineers had their personal home computer hacked and infected with a keylogger as part of a sustained cyber attack that exfiltrated sensitive


feed_id: https://thehackernews.com/2023/02/researchers-share-new-insights-into-rig.html
title: Researchers Share New Insights Into RIG Exploit Kit Malware's Operations
uri: 2023-03-06-Researchers-Share-New-Insights-Into-RIG-Exploit-Kit-Malware-s-Operatio
url: https://thehackernews.com/2023/02/researchers-share-new-insights-into-rig.html
content:
The RIG exploit kit (EK) touched an all-time high successful exploitation rate of nearly 30% in 2022, new findings reveal.
"RIG EK is a financially-motivated program that has been active since 2014," Swiss cybersecurity company PRODAFT said in an exhaustive report shared with The Hacker News.
"Although it has yet to substantially change its exploits in its more recent activity, the type and


feed_id: https://thehackernews.com/2023/02/shocking-findings-from-2023-third-party.html
title: Shocking Findings from the 2023 Third-Party App Access Report
uri: 2023-03-06-Shocking-Findings-from-the-2023-Third-Party-App-Access-Report
url: https://thehackernews.com/2023/02/shocking-findings-from-2023-third-party.html
content:
Spoiler Alert: Organizations with 10,000 SaaS users that use M365 and Google Workspace average over 4,371 additional connected apps.
SaaS-to-SaaS (third-party) app installations are growing nonstop at organizations around the world. When an employee needs an additional app to increase their efficiency or productivity, they rarely think twice before installing. Most employees don’t even realize


feed_id: https://thehackernews.com/2023/02/chromeloader-malware-targeting-gamers.html
title: ChromeLoader Malware Targeting Gamers via Fake Nintendo and Steam Game Hacks
uri: 2023-03-06-ChromeLoader-Malware-Targeting-Gamers-via-Fake-Nintendo-and-Steam-Game
url: https://thehackernews.com/2023/02/chromeloader-malware-targeting-gamers.html
content:
A new ChromeLoader malware campaign has been observed being distributed via virtual hard disk (VHD) files, marking a deviation from the ISO optical disc image format.
"These VHD files are being distributed with filenames that make them appear like either hacks or cracks for Nintendo and Steam games," AhnLab Security Emergency response Center (ASEC) said in a report last week.
ChromeLoader (aka


feed_id: https://thehackernews.com/2023/02/purecrypter-malware-targets-government.html
title: PureCrypter Malware Targets Government Entities in Asia-Pacific and North America
uri: 2023-03-06-PureCrypter-Malware-Targets-Government-Entities-in-Asia-Pacific-and-No
url: https://thehackernews.com/2023/02/purecrypter-malware-targets-government.html
content:
Government entities in Asia-Pacific and North America are being targeted by an unknown threat actor with an off-the-shelf malware downloader known as PureCrypter to deliver an array of information stealers and ransomware.
"The PureCrypter campaign uses the domain of a compromised non-profit organization as a command-and-control (C2) to deliver a secondary payload," Menlo Security researcher


feed_id: https://thehackernews.com/2023/02/plugx-trojan-disguised-as-legitimate.html
title: PlugX Trojan Disguised as Legitimate Windows Debugger Tool in Latest Attacks
uri: 2023-03-06-PlugX-Trojan-Disguised-as-Legitimate-Windows-Debugger-Tool-in-Latest-A
url: https://thehackernews.com/2023/02/plugx-trojan-disguised-as-legitimate.html
content:
The PlugX remote access trojan has been observed masquerading as an open source Windows debugger tool called x64dbg in an attempt to circumvent security protections and gain control of a target system.
"This file is a legitimate open-source debugger tool for Windows that is generally used to examine kernel-mode and user-mode code, crash dumps, or CPU registers," Trend Micro researchers Buddy


feed_id: https://thehackernews.com/2023/02/dutch-police-arrest-3-hackers-involved.html
title: Dutch Police Arrest 3 Hackers Involved in Massive Data Theft and Extortion Scheme
uri: 2023-03-06-Dutch-Police-Arrest-3-Hackers-Involved-in-Massive-Data-Theft-and-Extor
url: https://thehackernews.com/2023/02/dutch-police-arrest-3-hackers-involved.html
content:
The Dutch police announced the arrest of three individuals in connection with a "large-scale" criminal operation involving data theft, extortion, and money laundering.
The suspects include two 21-year-old men from Zandvoort and Rotterdam and an 18-year-old man without a permanent residence. The arrests were made on January 23, 2023.
It's estimated that the hackers stole personal data belonging


feed_id: https://thehackernews.com/2023/02/google-teams-up-with-ecosystem-partners.html
title: Google Teams Up with Ecosystem Partners to Enhance Security of SoC Processors
uri: 2023-03-06-Google-Teams-Up-with-Ecosystem-Partners-to-Enhance-Security-of-SoC-Pro
url: https://thehackernews.com/2023/02/google-teams-up-with-ecosystem-partners.html
content:
Google said it's working with ecosystem partners to harden the security of firmware that interacts with Android.
While the Android operating system runs on what's called the application processor (AP), it's just one of the many processors of a system-on-chip (SoC) that cater to various tasks like cellular communications and multimedia processing.
"Securing the Android Platform requires going


feed_id: https://thehackernews.com/2023/02/how-to-tackle-top-saas-challenges-of.html
title: How to Tackle the Top SaaS Challenges of 2023
uri: 2023-03-06-How-to-Tackle-the-Top-SaaS-Challenges-of-2023
url: https://thehackernews.com/2023/02/how-to-tackle-top-saas-challenges-of.html
content:
Are you prepared to tackle the top SaaS challenges of 2023? With high-profile data breaches affecting major companies like Nissan and Slack, it's clear that SaaS apps are a prime target for cyberattacks.
The vast amounts of valuable information stored in these apps make them a goldmine for hackers. But don't panic just yet. With the right knowledge and tools, you can protect your company's


feed_id: https://thehackernews.com/2023/02/how-to-use-ai-in-cybersecurity-and.html
title: How to Use AI in Cybersecurity and Avoid Being Trapped
uri: 2023-03-06-How-to-Use-AI-in-Cybersecurity-and-Avoid-Being-Trapped
url: https://thehackernews.com/2023/02/how-to-use-ai-in-cybersecurity-and.html
content:
The use of AI in cybersecurity is growing rapidly and is having a significant impact on threat detection, incident response, fraud detection, and vulnerability management. According to a report by Juniper Research, the use of AI for fraud detection and prevention is expected to save businesses $11 billion annually by 2023. But how to integrate AI into business cybersecurity infrastructure


feed_id: https://thehackernews.com/2023/02/cisa-sounds-alarm-on-cybersecurity.html
title: CISA Sounds Alarm on Cybersecurity Threats Amid Russia's Invasion Anniversary
uri: 2023-03-06-CISA-Sounds-Alarm-on-Cybersecurity-Threats-Amid-Russia-s-Invasion-Anni
url: https://thehackernews.com/2023/02/cisa-sounds-alarm-on-cybersecurity.html
content:
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is urging organizations and individuals to increase their cyber vigilance, as Russia's military invasion of Ukraine officially enters one year.
"CISA assesses that the United States and European nations may experience disruptive and defacement attacks against websites in an attempt to sow chaos and societal discord on February 24,


feed_id: https://thehackernews.com/2023/02/majority-of-android-apps-on-google-play.html
title: Even Top-Ranked Android Apps in Google Play Store Provide Misleading Data Safety Labels
uri: 2023-03-06-Even-Top-Ranked-Android-Apps-in-Google-Play-Store-Provide-Misleading-D
url: https://thehackernews.com/2023/02/majority-of-android-apps-on-google-play.html
content:
An investigation into data safety labels for Android apps available on the Google Play Store has uncovered "serious loopholes" that allow apps to provide misleading or outright false information.
The study, conducted by the Mozilla Foundation as part of its *Privacy Not Included initiative, compared the privacy policies and labels of the 20 most popular paid apps and the 20 most popular free


feed_id: https://thehackernews.com/2023/02/hackers-using-trojanized-macos-apps-to.html
title: Hackers Using Trojanized macOS Apps to Deploy Evasive Cryptocurrency Mining Malware
uri: 2023-03-06-Hackers-Using-Trojanized-macOS-Apps-to-Deploy-Evasive-Cryptocurrency-M
url: https://thehackernews.com/2023/02/hackers-using-trojanized-macos-apps-to.html
content:
Trojanized versions of legitimate applications are being used to deploy evasive cryptocurrency mining malware on macOS systems.
Jamf Threat Labs, which made the discovery, said the XMRig coin miner was executed by means of an unauthorized modification in Final Cut Pro, a video editing software from Apple.
"This malware makes use of the Invisible Internet Project (i2p) [...] to download malicious


feed_id: https://thehackernews.com/2023/02/experts-sound-alarm-over-growing.html
title: Experts Sound Alarm Over Growing Attacks Exploiting Zoho ManageEngine Products
uri: 2023-03-06-Experts-Sound-Alarm-Over-Growing-Attacks-Exploiting-Zoho-ManageEngine
url: https://thehackernews.com/2023/02/experts-sound-alarm-over-growing.html
content:
Multiple threat actors have been observed opportunistically weaponizing a now-patched critical security vulnerability impacting several Zoho ManageEngine products since January 20, 2023.
Tracked as CVE-2022-47966 (CVSS score: 9.8), the remote code execution flaw allows a complete takeover of the susceptible systems by unauthenticated attackers.
As many as 24 different products, including Access


feed_id: https://thehackernews.com/2023/03/new-hiatusrat-malware-targets-business.html
title: New HiatusRAT Malware Targets Business-Grade Routers to Covertly Spy on Victims
uri: 2023-03-07-New-HiatusRAT-Malware-Targets-Business-Grade-Routers-to-Covertly-Spy-o
url: https://thehackernews.com/2023/03/new-hiatusrat-malware-targets-business.html
content:
A never-before-seen complex malware is targeting business-grade routers to covertly spy on victims in Latin America, Europe, and North America at least since July 2022.
The elusive campaign, dubbed Hiatus by Lumen Black Lotus Labs, has been found to deploy two malicious binaries, a remote access trojan dubbed HiatusRAT and a variant of tcpdump that makes it possible to capture packet capture on


feed_id: https://thehackernews.com/2023/03/from-disinformation-to-deep-fakes-how.html
title: From Disinformation to Deep Fakes: How Threat Actors Manipulate Reality
uri: 2023-03-07-From-Disinformation-to-Deep-Fakes-How-Threat-Actors-Manipulate-Realit
url: https://thehackernews.com/2023/03/from-disinformation-to-deep-fakes-how.html
content:
Deep fakes are expected to become a more prominent attack vector. Here's how to identify them.
What are Deep Fakes?
A deep fake is the act of maliciously replacing real images and videos with fabricated ones to perform information manipulation. To create images, video and audio that are high quality enough to be used in deep fakes, AI and ML are required. Such use of AI, ML and image replacement


feed_id: https://thehackernews.com/2023/03/core-members-of-doppelpaymer-ransomware.html
title: Core Members of DoppelPaymer Ransomware Gang Targeted in Germany and Ukraine
uri: 2023-03-07-Core-Members-of-DoppelPaymer-Ransomware-Gang-Targeted-in-Germany-and-U
url: https://thehackernews.com/2023/03/core-members-of-doppelpaymer-ransomware.html
content:
Law enforcement authorities from Germany and Ukraine have targeted suspected core members of a cybercrime group that has been behind large-scale attacks using DoppelPaymer ransomware.
The operation, which took place on February 28, 2023, was carried out with support from the Dutch National Police (Politie) and the U.S. Federal Bureau of Investigation (FBI), according to Europol.
This encompassed


feed_id: https://thehackernews.com/2023/03/experts-reveal-google-cloud-platforms.html
title: Experts Reveal Google Cloud Platform's Blind Spot for Data Exfiltration Attacks
uri: 2023-03-07-Experts-Reveal-Google-Cloud-Platform-s-Blind-Spot-for-Data-Exfiltratio
url: https://thehackernews.com/2023/03/experts-reveal-google-cloud-platforms.html
content:
Malicious actors can take advantage of "insufficient" forensic visibility into Google Cloud Platform (GCP) to exfiltrate sensitive data, a new research has found.
"Unfortunately, GCP does not provide the level of visibility in its storage logs that is needed to allow any effective forensic investigation, making organizations blind to potential data exfiltration attacks," cloud incident response


feed_id: https://thehackernews.com/2023/03/experts-discover-flaw-in-us-govts.html
title: Experts Discover Flaw in U.S. Govt's Chosen Quantum-Resistant Encryption Algorithm
uri: 2023-03-07-Experts-Discover-Flaw-in-U-S-Govt-s-Chosen-Quantum-Resistant-Encrypti
url: https://thehackernews.com/2023/03/experts-discover-flaw-in-us-govts.html
content:
A group of researchers has revealed what it says is a vulnerability in a specific implementation of CRYSTALS-Kyber, one of the encryption algorithms chosen by the U.S. government as quantum-resistant last year.
The exploit relates to "side-channel attacks on up to the fifth-order masked implementations of CRYSTALS-Kyber in ARM Cortex-M4 CPU," Elena Dubrova, Kalle Ngo, and Joel Gärtner of KTH


feed_id: https://thehackernews.com/2023/03/batloader-malware-uses-google-ads-to.html
title: BATLOADER Malware Uses Google Ads to Deliver Vidar Stealer and Ursnif Payloads
uri: 2023-03-13-BATLOADER-Malware-Uses-Google-Ads-to-Deliver-Vidar-Stealer-and-Ursnif
url: https://thehackernews.com/2023/03/batloader-malware-uses-google-ads-to.html
content:
The malware downloader known as BATLOADER has been observed abusing Google Ads to deliver secondary payloads like Vidar Stealer and Ursnif.
According to cybersecurity company eSentire, malicious ads are used to spoof a wide range of legitimate apps and services such as Adobe, OpenAPI's ChatGPT, Spotify, Tableau, and Zoom.
BATLOADER, as the name suggests, is a loader that's responsible for


feed_id: https://thehackernews.com/2023/03/new-version-of-prometei-botnet-infects.html
title: New Version of Prometei Botnet Infects Over 10,000 Systems Worldwide
uri: 2023-03-13-New-Version-of-Prometei-Botnet-Infects-Over-10-000-Systems-Worldwide
url: https://thehackernews.com/2023/03/new-version-of-prometei-botnet-infects.html
content:
An updated version of a botnet malware called Prometei has infected more than 10,000 systems worldwide since November 2022.
The infections are both geographically indiscriminate and opportunistic, with a majority of the victims reported in Brazil, Indonesia, and Turkey.
Prometei, first observed in 2016, is a modular botnet that features a large repertoire of components and several proliferation


feed_id: https://thehackernews.com/2023/03/china-linked-hackers-targeting.html
title: China-linked Hackers Targeting Unpatched SonicWall SMA Devices with Malware
uri: 2023-03-13-China-linked-Hackers-Targeting-Unpatched-SonicWall-SMA-Devices-with-Ma
url: https://thehackernews.com/2023/03/china-linked-hackers-targeting.html
content:
A suspecting China-linked hacking campaign has been observed targeting unpatched SonicWall Secure Mobile Access (SMA) 100 appliances to drop malware and establish long-term persistence.
"The malware has functionality to steal user credentials, provide shell access, and persist through firmware upgrades," cybersecurity company Mandiant said in a technical report published this week.
The


feed_id: https://thehackernews.com/2023/03/international-law-enforcement-takes.html
title: International Law Enforcement Takes Down Infamous NetWire Cross-Platform RAT
uri: 2023-03-13-International-Law-Enforcement-Takes-Down-Infamous-NetWire-Cross-Platfo
url: https://thehackernews.com/2023/03/international-law-enforcement-takes.html
content:
A coordinated international law enforcement exercise has taken down the online infrastructure associated with a cross-platform remote access trojan (RAT) known as NetWire.
Coinciding with the seizure of the sales website www.worldwiredlabs[.]com, a Croatian national who is suspected to be the website's administrator has been arrested. While the suspect's name was not released, investigative


feed_id: https://thehackernews.com/2023/03/when-partial-protection-is-zero.html
title: When Partial Protection is Zero Protection: The MFA Blind Spots No One Talks About
uri: 2023-03-13-When-Partial-Protection-is-Zero-Protection-The-MFA-Blind-Spots-No-One
url: https://thehackernews.com/2023/03/when-partial-protection-is-zero.html
content:
Multi-factor Authentication (MFA) has long ago become a standard security practice. With a wide consensus on its ability to fend off more than 99% percent of account takeover attacks, it's no wonder why security architects regard it as a must-have in their environments. However, what seems to be less known are the inherent coverage limitations of traditional MFA solutions. While compatible with


feed_id: https://thehackernews.com/2023/03/xenomorph-android-banking-trojan.html
title: Xenomorph Android Banking Trojan Returns with a New and More Powerful Variant
uri: 2023-03-13-Xenomorph-Android-Banking-Trojan-Returns-with-a-New-and-More-Powerful
url: https://thehackernews.com/2023/03/xenomorph-android-banking-trojan.html
content:
A new variant of the Android banking trojan named Xenomorph has surfaced in the wild, latest findings from ThreatFabric reveal.
Named "Xenomorph 3rd generation" by the Hadoken Security Group, the threat actor behind the operation, the updated version comes with new features that allow it to perform financial fraud in a seamless manner.
"This new version of the malware adds many new capabilities


feed_id: https://thehackernews.com/2023/03/north-korean-unc2970-hackers-expands.html
title: North Korean UNC2970 Hackers Expands Operations with New Malware Families
uri: 2023-03-13-North-Korean-UNC2970-Hackers-Expands-Operations-with-New-Malware-Famil
url: https://thehackernews.com/2023/03/north-korean-unc2970-hackers-expands.html
content:
A North Korean espionage group tracked as UNC2970 has been observed employing previously undocumented malware families as part of a spear-phishing campaign targeting U.S. and European media and technology organizations since June 2022.
Google-owned Mandiant said the threat cluster shares "multiple overlaps" with a long-running operation dubbed "Dream Job" that employs job recruitment lures in


feed_id: https://thehackernews.com/2023/03/hackers-exploiting-remote-desktop.html
title: Hackers Exploiting Remote Desktop Software Flaws to Deploy PlugX Malware
uri: 2023-03-13-Hackers-Exploiting-Remote-Desktop-Software-Flaws-to-Deploy-PlugX-Malwa
url: https://thehackernews.com/2023/03/hackers-exploiting-remote-desktop.html
content:
Security vulnerabilities in remote desktop programs such as Sunlogin and AweSun are being exploited by threat actors to deploy the PlugX malware.
AhnLab Security Emergency Response Center (ASEC), in a new analysis, said it marks the continued abuse of the flaws to deliver a variety of payloads on compromised systems.
This includes the Sliver post-exploitation framework, XMRig cryptocurrency


feed_id: https://thehackernews.com/2023/03/icefire-linux-ransomware.html
title: IceFire Ransomware Exploits IBM Aspera Faspex to Attack Linux-Powered Enterprise Networks
uri: 2023-03-13-IceFire-Ransomware-Exploits-IBM-Aspera-Faspex-to-Attack-Linux-Powered
url: https://thehackernews.com/2023/03/icefire-linux-ransomware.html
content:
A previously known Windows-based ransomware strain known as IceFire has expanded its focus to target Linux enterprise networks belonging to several media and entertainment sector organizations across the world.
The intrusions entail the exploitation of a recently disclosed deserialization vulnerability in IBM Aspera Faspex file-sharing software (CVE-2022-47986, CVSS score: 9.8), according to


feed_id: https://thehackernews.com/2023/03/does-your-help-desk-know-whos-calling.html
title: Does Your Help Desk Know Who's Calling?
uri: 2023-03-13-Does-Your-Help-Desk-Know-Who-s-Calling
url: https://thehackernews.com/2023/03/does-your-help-desk-know-whos-calling.html
content:
Phishing, the theft of users' credentials or sensitive data using social engineering, has been a significant threat since the early days of the internet – and continues to plague organizations today, accounting for more than 30% of all known breaches. And with the mass migration to remote working during the pandemic, hackers have ramped up their efforts to steal login credentials as they take


feed_id: https://thehackernews.com/2023/03/iranian-hackers-target-women-involved.html
title: Iranian Hackers Target Women Involved in Human Rights and Middle East Politics
uri: 2023-03-13-Iranian-Hackers-Target-Women-Involved-in-Human-Rights-and-Middle-East
url: https://thehackernews.com/2023/03/iranian-hackers-target-women-involved.html
content:
Iranian state-sponsored actors are continuing to engage in social engineering campaigns targeting researchers by impersonating a U.S. think tank.
"Notably the targets in this instance were all women who are actively involved in political affairs and human rights in the Middle East region," Secureworks Counter Threat Unit (CTU) said in a report shared with The Hacker News.
The cybersecurity


feed_id: https://thehackernews.com/2023/03/new-scrubcrypt-crypter-used-in.html
title: New ScrubCrypt Crypter Used in Cryptojacking Attacks Targeting Oracle WebLogic
uri: 2023-03-13-New-ScrubCrypt-Crypter-Used-in-Cryptojacking-Attacks-Targeting-Oracle
url: https://thehackernews.com/2023/03/new-scrubcrypt-crypter-used-in.html
content:
The infamous cryptocurrency miner group called 8220 Gang has been observed using a new crypter called ScrubCrypt to carry out cryptojacking operations.
According to Fortinet FortiGuard Labs, the attack chain commences with the successful exploitation of susceptible Oracle WebLogic servers to download a PowerShell script that contains ScrubCrypt.
Crypters are a type of software that can encrypt,


feed_id: https://thehackernews.com/2023/03/new-critical-flaw-in-fortios-and.html
title: New Critical Flaw in FortiOS and FortiProxy Could Give Hackers Remote Access
uri: 2023-03-13-New-Critical-Flaw-in-FortiOS-and-FortiProxy-Could-Give-Hackers-Remote
url: https://thehackernews.com/2023/03/new-critical-flaw-in-fortios-and.html
content:
Fortinet has released fixes to address 15 security flaws, including one critical vulnerability impacting FortiOS and FortiProxy that could enable a threat actor to take control of affected systems.
The issue, tracked as CVE-2023-25610, is rated 9.3 out of 10 for severity and was internally discovered and reported by its security teams.
"A buffer underwrite ('buffer underflow') vulnerability in


feed_id: https://thehackernews.com/2023/03/jenkins-security-alert-new-security.html
title: Jenkins Security Alert: New Security Flaws Could Allow Code Execution Attacks
uri: 2023-03-13-Jenkins-Security-Alert-New-Security-Flaws-Could-Allow-Code-Execution
url: https://thehackernews.com/2023/03/jenkins-security-alert-new-security.html
content:
A pair of severe security vulnerabilities have been disclosed in the Jenkins open source automation server that could lead to code execution on targeted systems.
The flaws, tracked as CVE-2023-27898 and CVE-2023-27905, impact the Jenkins server and Update Center, and have been collectively christened CorePlague by cloud security firm Aqua. All versions of Jenkins versions prior to 2.319.2 are


feed_id: https://thehackernews.com/2023/03/syxsense-platform-unified-security-and.html
title: Syxsense Platform: Unified Security and Endpoint Management
uri: 2023-03-13-Syxsense-Platform-Unified-Security-and-Endpoint-Management
url: https://thehackernews.com/2023/03/syxsense-platform-unified-security-and.html
content:
As threats grow and attack surfaces get more complex, companies continue to struggle with the multitude of tools they utilize to handle endpoint security and management. This can leave gaps in an enterprise's ability to identify devices that are accessing the network and in ensuring that those devices are compliant with security policies. These gaps are often seen in outdated spreadsheets that


feed_id: https://thehackernews.com/2023/03/lazarus-group-exploits-zero-day.html
title: Lazarus Group Exploits Zero-Day Vulnerability to Hack South Korean Financial Entity
uri: 2023-03-13-Lazarus-Group-Exploits-Zero-Day-Vulnerability-to-Hack-South-Korean-Fin
url: https://thehackernews.com/2023/03/lazarus-group-exploits-zero-day.html
content:
The North Korea-linked Lazarus Group has been observed weaponizing flaws in an undisclosed software to breach a financial business entity in South Korea twice within a span of a year.
While the first attack in May 2022 entailed the use of a vulnerable version of a certificate software that's widely used by public institutions and universities, the re-infiltration in October 2022 involved the


feed_id: https://thehackernews.com/2023/03/sharp-panda-using-new-soul-framework.html
title: Sharp Panda Using New Soul Framework Version to Target Southeast Asian Governments
uri: 2023-03-13-Sharp-Panda-Using-New-Soul-Framework-Version-to-Target-Southeast-Asian
url: https://thehackernews.com/2023/03/sharp-panda-using-new-soul-framework.html
content:
High-profile government entities in Southeast Asia are the target of a cyber espionage campaign undertaken by a Chinese threat actor known as Sharp Panda since late last year.
The intrusions are characterized by the use of a new version of the Soul modular framework, marking a departure from the group's attack chains observed in 2021.
Israeli cybersecurity company Check Point said the "


feed_id: https://thehackernews.com/2023/03/cisas-kev-catalog-updated-with-3-new.html
title: CISA's KEV Catalog Updated with 3 New Flaws Threatening IT Management Systems
uri: 2023-03-13-CISA-s-KEV-Catalog-Updated-with-3-New-Flaws-Threatening-IT-Management
url: https://thehackernews.com/2023/03/cisas-kev-catalog-updated-with-3-new.html
content:
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added three security flaws to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation.
The list of vulnerabilities is below -

CVE-2022-35914 (CVSS score: 9.8) - Teclib GLPI Remote Code Execution Vulnerability
CVE-2022-33891 (CVSS score: 8.8) - Apache Spark Command Injection Vulnerability


feed_id: https://thehackernews.com/2023/03/sys01stealer-new-threat-using-facebook.html
title: SYS01stealer: New Threat Using Facebook Ads to Target Critical Infrastructure Firms
uri: 2023-03-13-SYS01stealer-New-Threat-Using-Facebook-Ads-to-Target-Critical-Infrast
url: https://thehackernews.com/2023/03/sys01stealer-new-threat-using-facebook.html
content:
Cybersecurity researchers have discovered a new information stealer dubbed SYS01stealer targeting critical government infrastructure employees, manufacturing companies, and other sectors since November 2022.
"The threat actors behind the campaign are targeting Facebook business accounts by using Google ads and fake Facebook profiles that promote things like games, adult content, and cracked


feed_id: https://thehackernews.com/2023/03/transparent-tribe-hackers-distribute.html
title: Transparent Tribe Hackers Distribute CapraRAT via Trojanized Messaging Apps
uri: 2023-03-13-Transparent-Tribe-Hackers-Distribute-CapraRAT-via-Trojanized-Messaging
url: https://thehackernews.com/2023/03/transparent-tribe-hackers-distribute.html
content:
A suspected Pakistan-aligned advanced persistent threat (APT) group known as Transparent Tribe has been linked to an ongoing cyber espionage campaign targeting Indian and Pakistani Android users with a backdoor called CapraRAT.
"Transparent Tribe distributed the Android CapraRAT backdoor via trojanized secure messaging and calling apps branded as MeetsApp and MeetUp," ESET said in a report


feed_id: https://thehackernews.com/2023/03/why-healthcare-cant-afford-to-ignore.html
title: Why Healthcare Can't Afford to Ignore Digital Identity
uri: 2023-03-13-Why-Healthcare-Can-t-Afford-to-Ignore-Digital-Identity
url: https://thehackernews.com/2023/03/why-healthcare-cant-afford-to-ignore.html
content:
Investing in digital identity can improve security, increase clinical productivity, and boost healthcare's bottom line. — by Gus Malezis, CEO of Imprivata
Digitalization has created immeasurable opportunities for businesses over the past two decades. But the growth of hybrid work and expansion of Internet of Things (IoT) has outpaced traditional 'castle and moat' cybersecurity, introducing


feed_id: https://thehackernews.com/2023/03/sheins-android-app-caught-transmitting.html
title: Shein's Android App Caught Transmitting Clipboard Data to Remote Servers
uri: 2023-03-13-Shein-s-Android-App-Caught-Transmitting-Clipboard-Data-to-Remote-Serve
url: https://thehackernews.com/2023/03/sheins-android-app-caught-transmitting.html
content:
An older version of Shein's Android application suffered from a bug that periodically captured and transmitted clipboard contents to a remote server.
The Microsoft 365 Defender Research Team said it discovered the problem in version 7.9.2 of the app that was released on December 16, 2021. The issue has since been addressed as of May 2022.
Shein, originally named ZZKKO, is a Chinese online fast


feed_id: https://thehackernews.com/2023/03/lastpass-hack-engineers-failure-to.html
title: LastPass Hack: Engineer's Failure to Update Plex Software Led to Massive Data Breach
uri: 2023-03-13-LastPass-Hack-Engineer-s-Failure-to-Update-Plex-Software-Led-to-Massi
url: https://thehackernews.com/2023/03/lastpass-hack-engineers-failure-to.html
content:
The massive breach at LastPass was the result of one of its engineers failing to update Plex on their home computer, in what's a sobering reminder of the dangers of failing to keep software up-to-date.
The embattled password management service last week revealed how unidentified actors leveraged information stolen from an earlier incident that took place prior to August 12, 2022, along with


feed_id: https://thehackernews.com/2023/03/microsoft-rolls-out-patches-for-80-new.html
title: Microsoft Rolls Out Patches for 80 New Security Flaws — Two Under Active Attack
uri: 2023-03-15-Microsoft-Rolls-Out-Patches-for-80-New-Security-Flaws-Two-Under-Ac
url: https://thehackernews.com/2023/03/microsoft-rolls-out-patches-for-80-new.html
content:
Microsoft's Patch Tuesday update for March 2023 is rolling out with remediations for a set of 80 security flaws, two of which have come under active exploitation in the wild.
Eight of the 80 bugs are rated Critical, 71 are rated Important, and one is rated Moderate in severity. The updates are in addition to 29 flaws the tech giant fixed in its Chromium-based Edge browser in recent weeks.
The


feed_id: https://thehackernews.com/2023/03/gobruteforcer-new-golang-based-malware.html
title: GoBruteforcer: New Golang-Based Malware Breaches Web Servers Via Brute-Force Attacks
uri: 2023-03-15-GoBruteforcer-New-Golang-Based-Malware-Breaches-Web-Servers-Via-Brute
url: https://thehackernews.com/2023/03/gobruteforcer-new-golang-based-malware.html
content:
A new Golang-based malware dubbed GoBruteforcer has been found targeting web servers running phpMyAdmin, MySQL, FTP, and Postgres to corral the devices into a botnet.
"GoBruteforcer chose a Classless Inter-Domain Routing (CIDR) block for scanning the network during the attack, and it targeted all IP addresses within that CIDR range," Palo Alto Networks Unit 42 researchers said.
"The threat actor


feed_id: https://thehackernews.com/2023/03/the-prolificacy-of-lockbit-ransomware.html
title: The Prolificacy of LockBit Ransomware
uri: 2023-03-15-The-Prolificacy-of-LockBit-Ransomware
url: https://thehackernews.com/2023/03/the-prolificacy-of-lockbit-ransomware.html
content:
Today, the LockBit ransomware is the most active and successful cybercrime organization in the world. Attributed to a Russian Threat Actor, LockBit has stepped out from the shadows of the Conti ransomware group, who were disbanded in early 2022.
LockBit ransomware was first discovered in September 2019 and was previously known as ABCD ransomware because of the ".abcd virus" extension first


feed_id: https://thehackernews.com/2023/03/microsoft-warns-of-large-scale-use-of.html
title: Microsoft Warns of Large-Scale Use of Phishing Kits to Send Millions of Emails Daily
uri: 2023-03-15-Microsoft-Warns-of-Large-Scale-Use-of-Phishing-Kits-to-Send-Millions-o
url: https://thehackernews.com/2023/03/microsoft-warns-of-large-scale-use-of.html
content:
An open source adversary-in-the-middle (AiTM) phishing kit has found a number of takers in the cybercrime world for its ability to orchestrate attacks at scale.
The Microsoft Threat Intelligence team is tracking the threat actor behind the development of the kit under its emerging moniker DEV-1101.
An AiTM phishing attack typically involves a threat actor attempting to steal and intercept a


feed_id: https://thehackernews.com/2023/03/fortinet-fortios-flaw-exploited-in.html
title: Fortinet FortiOS Flaw Exploited in Targeted Cyberattacks on Government Entities
uri: 2023-03-15-Fortinet-FortiOS-Flaw-Exploited-in-Targeted-Cyberattacks-on-Government
url: https://thehackernews.com/2023/03/fortinet-fortios-flaw-exploited-in.html
content:
Government entities and large organizations have been targeted by an unknown threat actor by exploiting a security flaw in Fortinet FortiOS software to result in data loss and OS and file corruption.
"The complexity of the exploit suggests an advanced actor and that it is highly targeted at governmental or government-related targets," Fortinet researchers Guillaume Lovet and Alex Kong said in an


feed_id: https://thehackernews.com/2023/03/large-scale-cyber-attack-hijacks-east.html
title: Large-scale Cyber Attack Hijacks East Asian Websites for Adult Content Redirects
uri: 2023-03-15-Large-scale-Cyber-Attack-Hijacks-East-Asian-Websites-for-Adult-Content
url: https://thehackernews.com/2023/03/large-scale-cyber-attack-hijacks-east.html
content:
A widespread malicious cyber operation has hijacked thousands of websites aimed at East Asian audiences to redirect visitors to adult-themed content since early September 2022.
The ongoing campaign entails injecting malicious JavaScript code to the hacked websites, often connecting to the target web server using legitimate FTP credentials the threat actor previously obtained via an unknown


feed_id: https://thehackernews.com/2023/03/fake-chatgpt-chrome-extension-hijacking.html
title: Fake ChatGPT Chrome Extension Hijacking Facebook Accounts for Malicious Advertising
uri: 2023-03-15-Fake-ChatGPT-Chrome-Extension-Hijacking-Facebook-Accounts-for-Maliciou
url: https://thehackernews.com/2023/03/fake-chatgpt-chrome-extension-hijacking.html
content:
A fake ChatGPT-branded Chrome browser extension has been found to come with capabilities to hijack Facebook accounts and create rogue admin accounts, highlighting one of the different methods cyber criminals are using to distribute malware.
"By hijacking high-profile Facebook business accounts, the threat actor creates an elite army of Facebook bots and a malicious paid media apparatus," Guardio


feed_id: https://thehackernews.com/2023/03/how-to-apply-nist-principles-to-saas-in.html
title: How to Apply NIST Principles to SaaS in 2023
uri: 2023-03-15-How-to-Apply-NIST-Principles-to-SaaS-in-2023
url: https://thehackernews.com/2023/03/how-to-apply-nist-principles-to-saas-in.html
content:
The National Institute of Standards and Technology (NIST) is one of the standard-bearers in global cybersecurity. The U.S.-based institute’s cybersecurity framework helps organizations of all sizes understand, manage, and reduce their cyber-risk levels and better protect their data. Its importance in the fight against cyberattacks can’t be overstated.
While NIST hasn’t directly developed


feed_id: https://thehackernews.com/2023/03/warning-ai-generated-youtube-video.html
title: Warning: AI-generated YouTube Video Tutorials Spreading Infostealer Malware
uri: 2023-03-15-Warning-AI-generated-YouTube-Video-Tutorials-Spreading-Infostealer-Ma
url: https://thehackernews.com/2023/03/warning-ai-generated-youtube-video.html
content:
Threat actors have been increasingly observed using AI-generated YouTube Videos to spread a variety of stealer malware such as Raccoon, RedLine, and Vidar.
"The videos lure users by pretending to be tutorials on how to download cracked versions of software such as Photoshop, Premiere Pro, Autodesk 3ds Max, AutoCAD, and other products that are licensed products available only to paid users,"


feed_id: https://thehackernews.com/2023/03/researchers-uncover-over-dozen-security.html
title: Researchers Uncover Over a Dozen Security Flaws in Akuvox E11 Smart Intercom
uri: 2023-03-15-Researchers-Uncover-Over-a-Dozen-Security-Flaws-in-Akuvox-E11-Smart-In
url: https://thehackernews.com/2023/03/researchers-uncover-over-dozen-security.html
content:
More than a dozen security flaws have been disclosed in E11, a smart intercom product made by Chinese company Akuvox.
"The vulnerabilities could allow attackers to execute code remotely in order to activate and control the device's camera and microphone, steal video and images, or gain a network foothold," Claroty security researcher Vera Mens said in a technical write-up.
Akuvox E11 is


feed_id: https://thehackernews.com/2023/03/kamikakabot-malware-used-in-latest-dark.html
title: KamiKakaBot Malware Used in Latest Dark Pink APT Attacks on Southeast Asian Targets
uri: 2023-03-15-KamiKakaBot-Malware-Used-in-Latest-Dark-Pink-APT-Attacks-on-Southeast
url: https://thehackernews.com/2023/03/kamikakabot-malware-used-in-latest-dark.html
content:
The Dark Pink advanced persistent threat (APT) actor has been linked to a fresh set of attacks targeting government and military entities in Southeast Asian countries with a malware called KamiKakaBot.
Dark Pink, also called Saaiwc, was extensively profiled by Group-IB earlier this year, describing its use of custom tools such as TelePowerBot and KamiKakaBot to run arbitrary commands and


feed_id: https://thehackernews.com/2023/03/uk-national-crime-agency-sets-up-fake.html
title: U.K. National Crime Agency Sets Up Fake DDoS-For-Hire Sites to Catch Cybercriminals
uri: 2023-03-27-U-K-National-Crime-Agency-Sets-Up-Fake-DDoS-For-Hire-Sites-to-Catch-C
url: https://thehackernews.com/2023/03/uk-national-crime-agency-sets-up-fake.html
content:
In what's a case of setting a thief to catch a thief, the U.K. National Crime Agency (NCA) revealed that it has created a network of fake DDoS-for-hire websites to infiltrate the online criminal underground.
"All of the NCA-run sites, which have so far been accessed by around several thousand people, have been created to look like they offer the tools and services that enable cyber criminals to


feed_id: https://thehackernews.com/2023/03/microsoft-warns-of-stealthy-outlook.html
title: Microsoft Warns of Stealthy Outlook Vulnerability Exploited by Russian Hackers
uri: 2023-03-27-Microsoft-Warns-of-Stealthy-Outlook-Vulnerability-Exploited-by-Russian
url: https://thehackernews.com/2023/03/microsoft-warns-of-stealthy-outlook.html
content:
Microsoft on Friday shared guidance to help customers discover indicators of compromise (IoCs) associated with a recently patched Outlook vulnerability.
Tracked as CVE-2023-23397 (CVSS score: 9.8), the critical flaw relates to a case of privilege escalation that could be exploited to steal NT Lan Manager (NTLM) hashes and stage a relay attack without requiring any user interaction.
"External


feed_id: https://thehackernews.com/2023/03/openai-reveals-redis-bug-behind-chatgpt.html
title: OpenAI Reveals Redis Bug Behind ChatGPT User Data Exposure Incident
uri: 2023-03-27-OpenAI-Reveals-Redis-Bug-Behind-ChatGPT-User-Data-Exposure-Incident
url: https://thehackernews.com/2023/03/openai-reveals-redis-bug-behind-chatgpt.html
content:
OpenAI on Friday disclosed that a bug in the Redis open source library was responsible for the exposure of other users' personal information and chat titles in the upstart's ChatGPT service earlier this week.
The glitch, which came to light on March 20, 2023, enabled certain users to view brief descriptions of other users' conversations from the chat history sidebar, prompting the company to


feed_id: https://thehackernews.com/2023/03/malicious-python-package-uses-unicode.html
title: Malicious Python Package Uses Unicode Trickery to Evade Detection and Steal Data
uri: 2023-03-27-Malicious-Python-Package-Uses-Unicode-Trickery-to-Evade-Detection-and
url: https://thehackernews.com/2023/03/malicious-python-package-uses-unicode.html
content:
A malicious Python package on the Python Package Index (PyPI) repository has been found to use Unicode as a trick to evade detection and deploy an info-stealing malware.
The package in question, named onyxproxy, was uploaded to PyPI on March 15, 2023, and comes with capabilities to harvest and exfiltrate credentials and other valuable data. It has since been taken down, but not before attracting


feed_id: https://thehackernews.com/2023/03/thn-webinar-inside-high-risk-of-3rd.html
title: THN Webinar: Inside the High Risk of 3rd-Party SaaS Apps
uri: 2023-03-27-THN-Webinar-Inside-the-High-Risk-of-3rd-Party-SaaS-Apps
url: https://thehackernews.com/2023/03/thn-webinar-inside-high-risk-of-3rd.html
content:
Any app that can improve business operations is quickly added to the SaaS stack. However, employees don't realize that this SaaS-to-SaaS connectivity, which typically takes place outside the view of the security team, significantly increases risk.
Whether employees connect through Microsoft 365, Google Workspace, Slack, Salesforce, or any other app, security teams have no way to quantify their


feed_id: https://thehackernews.com/2023/03/github-swiftly-replaces-exposed-rsa-ssh.html
title: GitHub Swiftly Replaces Exposed RSA SSH Key to Protect Git Operations
uri: 2023-03-27-GitHub-Swiftly-Replaces-Exposed-RSA-SSH-Key-to-Protect-Git-Operations
url: https://thehackernews.com/2023/03/github-swiftly-replaces-exposed-rsa-ssh.html
content:
Cloud-based repository hosting service GitHub said it took the step of replacing its RSA SSH host key used to secure Git operations "out of an abundance of caution" after it was briefly exposed in a public repository.
The activity, which was carried out at 05:00 UTC on March 24, 2023, is said to have been undertaken as a measure to prevent any bad actor from impersonating the service or


feed_id: https://thehackernews.com/2023/03/researchers-uncover-chinese-nation.html
title: Researchers Uncover Chinese Nation State Hackers' Deceptive Attack Strategies
uri: 2023-03-27-Researchers-Uncover-Chinese-Nation-State-Hackers-Deceptive-Attack-Str
url: https://thehackernews.com/2023/03/researchers-uncover-chinese-nation.html
content:
A recent campaign undertaken by Earth Preta indicates that nation-state groups aligned with China are getting increasingly proficient at bypassing security solutions.
The threat actor, active since at least 2012, is tracked by the broader cybersecurity community under Bronze President, HoneyMyte, Mustang Panda, RedDelta, and Red Lich.
Attack chains mounted by the group commence with a


feed_id: https://thehackernews.com/2023/03/critical-woocommerce-payments-plugin.html
title: Critical WooCommerce Payments Plugin Flaw Patched for 500,000+ WordPress Sites
uri: 2023-03-27-Critical-WooCommerce-Payments-Plugin-Flaw-Patched-for-500-000-WordPre
url: https://thehackernews.com/2023/03/critical-woocommerce-payments-plugin.html
content:
Patches have been released for a critical security flaw impacting the WooCommerce Payments plugin for WordPress, which is installed on over 500,000 websites.
The flaw, if left unresolved, could enable a bad actor to gain unauthorized admin access to impacted stores, the company said in an advisory on March 23, 2023. It impacts versions 4.8.0 through 5.6.1.
Put differently, the issue could permit


feed_id: https://thehackernews.com/2023/03/fake-chatgpt-chrome-browser-extension.html
title: Fake ChatGPT Chrome Browser Extension Caught Hijacking Facebook Accounts
uri: 2023-03-27-Fake-ChatGPT-Chrome-Browser-Extension-Caught-Hijacking-Facebook-Accoun
url: https://thehackernews.com/2023/03/fake-chatgpt-chrome-browser-extension.html
content:
Google has stepped in to remove a bogus Chrome browser extension from the official Web Store that masqueraded as OpenAI's ChatGPT service to harvest Facebook session cookies and hijack the accounts.
The "ChatGPT For Google" extension, a trojanized version of a legitimate open source browser add-on, attracted over 9,000 installations since March 14, 2023, prior to its removal. It was originally


feed_id: https://thehackernews.com/2023/03/nexus-new-rising-android-banking-trojan.html
title: Nexus: A New Rising Android Banking Trojan Targeting 450 Financial Apps
uri: 2023-03-27-Nexus-A-New-Rising-Android-Banking-Trojan-Targeting-450-Financial-App
url: https://thehackernews.com/2023/03/nexus-new-rising-android-banking-trojan.html
content:
An emerging Android banking trojan dubbed Nexus has already been adopted by several threat actors to target 450 financial applications and conduct fraud.
"Nexus appears to be in its early stages of development," Italian cybersecurity firm Cleafy said in a report published this week.
"Nexus provides all the main features to perform ATO attacks (Account Takeover) against banking portals and


feed_id: https://thehackernews.com/2023/03/2023-cybersecurity-maturity-report.html
title: 2023 Cybersecurity Maturity Report Reveals Organizational Unpreparedness for Cyberattacks
uri: 2023-03-27-2023-Cybersecurity-Maturity-Report-Reveals-Organizational-Unpreparedne
url: https://thehackernews.com/2023/03/2023-cybersecurity-maturity-report.html
content:
In 2022 alone, global cyberattacks increased by 38%, resulting in substantial business loss, including financial and reputational damage. Meanwhile, corporate security budgets have risen significantly because of the growing sophistication of attacks and the number of cybersecurity solutions introduced into the market. With this rise in threats, budgets, and solutions, how prepared are industries


feed_id: https://thehackernews.com/2023/03/operation-soft-cell-chinese-hackers.html
title: Operation Soft Cell: Chinese Hackers Breach Middle East Telecom Providers
uri: 2023-03-27-Operation-Soft-Cell-Chinese-Hackers-Breach-Middle-East-Telecom-Provid
url: https://thehackernews.com/2023/03/operation-soft-cell-chinese-hackers.html
content:
Telecommunication providers in the Middle East are the subject of new cyber attacks that commenced in the first quarter of 2023.
The intrusion set has been attributed to a Chinese cyber espionage actor associated with a long-running campaign dubbed Operation Soft Cell based on tooling overlaps.
"The initial attack phase involves infiltrating Internet-facing Microsoft Exchange servers to deploy


feed_id: https://thehackernews.com/2023/03/german-and-south-korean-agencies-warn.html
title: German and South Korean Agencies Warn of Kimsuky's Expanding Cyber Attack Tactics
uri: 2023-03-27-German-and-South-Korean-Agencies-Warn-of-Kimsuky-s-Expanding-Cyber-Att
url: https://thehackernews.com/2023/03/german-and-south-korean-agencies-warn.html
content:
German and South Korean government agencies have warned about cyber attacks mounted by a threat actor tracked as Kimsuky using rogue browser extensions to steal users' Gmail inboxes.
The joint advisory comes from Germany's domestic intelligence apparatus, the Federal Office for the Protection of the Constitution (BfV), and South Korea's National Intelligence Service (NIS).
The intrusions are


feed_id: https://thehackernews.com/2023/03/cisa-alerts-on-critical-security.html
title: CISA Alerts on Critical Security Vulnerabilities in Industrial Control Systems
uri: 2023-03-27-CISA-Alerts-on-Critical-Security-Vulnerabilities-in-Industrial-Control
url: https://thehackernews.com/2023/03/cisa-alerts-on-critical-security.html
content:
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has released eight Industrial Control Systems (ICS) advisories on Tuesday, warning of critical flaws affecting equipment from Delta Electronics and Rockwell Automation.
This includes 13 security vulnerabilities in Delta Electronics' InfraSuite Device Master, a real-time device monitoring software. All versions prior to 1.0.5 are


feed_id: https://thehackernews.com/2023/03/scarcrufts-evolving-arsenal-researchers.html
title: ScarCruft's Evolving Arsenal: Researchers Reveal New Malware Distribution Techniques
uri: 2023-03-27-ScarCruft-s-Evolving-Arsenal-Researchers-Reveal-New-Malware-Distribut
url: https://thehackernews.com/2023/03/scarcrufts-evolving-arsenal-researchers.html
content:
The North Korean advanced persistent threat (APT) actor dubbed ScarCruft is using weaponized Microsoft Compiled HTML Help (CHM) files to download additional malware onto targeted machines.
According to multiple reports from AhnLab Security Emergency response Center (ASEC), SEKOIA.IO, and Zscaler, the development is illustrative of the group's continuous efforts to refine and retool its tactics


feed_id: https://thehackernews.com/2023/03/preventing-insider-threats-in-your.html
title: Preventing Insider Threats in Your Active Directory
uri: 2023-03-27-Preventing-Insider-Threats-in-Your-Active-Directory
url: https://thehackernews.com/2023/03/preventing-insider-threats-in-your.html
content:
Active Directory (AD) is a powerful authentication and directory service used by organizations worldwide. With this ubiquity and power comes the potential for abuse. Insider threats offer some of the most potentials for destruction. Many internal users have over-provisioned access and visibility into the internal network.
Insiders' level of access and trust in a network leads to unique


feed_id: https://thehackernews.com/2023/03/rogue-nuget-packages-infect-net.html
title: Rogue NuGet Packages Infect .NET Developers with Crypto-Stealing Malware
uri: 2023-03-27-Rogue-NuGet-Packages-Infect-NET-Developers-with-Crypto-Stealing-Malwa
url: https://thehackernews.com/2023/03/rogue-nuget-packages-infect-net.html
content:
The NuGet repository is the target of a new "sophisticated and highly-malicious attack" aiming to infect .NET developer systems with cryptocurrency stealer malware.
The 13 rogue packages, which were downloaded more than 160,000 times over the past month, have since been taken down.
"The packages contained a PowerShell script that would execute upon installation and trigger a download of a '


feed_id: https://thehackernews.com/2023/03/new-naplistener-malware-used-by-ref2924.html
title: NAPLISTENER: New Malware in REF2924 Group's Arsenal for Bypassing Detection
uri: 2023-03-27-NAPLISTENER-New-Malware-in-REF2924-Group-s-Arsenal-for-Bypassing-Dete
url: https://thehackernews.com/2023/03/new-naplistener-malware-used-by-ref2924.html
content:
The threat group tracked as REF2924 has been observed deploying previously unseen malware in its attacks aimed at entities in South and Southeast Asia.
The malware, dubbed NAPLISTENER by Elastic Security Labs, is an HTTP listener programmed in C# and is designed to evade "network-based forms of detection."
REF2924 is the moniker assigned to an activity cluster linked to attacks against an entity


feed_id: https://thehackernews.com/2023/03/breachforums-administrator-baphomet.html
title: BreachForums Administrator Baphomet Shuts Down Infamous Hacking Forum
uri: 2023-03-27-BreachForums-Administrator-Baphomet-Shuts-Down-Infamous-Hacking-Forum
url: https://thehackernews.com/2023/03/breachforums-administrator-baphomet.html
content:
In a sudden turn of events, Baphomet, the current administrator of BreachForums, said in an update on March 21, 2023, that the hacking forum has been officially taken down but emphasized that "it's not the end."
"You are allowed to hate me, and disagree with my decision but I promise what is to come will be better for us all," Baphomet noted in a message posted on the BreachForums Telegram


feed_id: https://thehackernews.com/2023/03/new-bad-magic-cyber-threat-disrupt.html
title: New 'Bad Magic' Cyber Threat Disrupts Ukraine's Key Sectors Amid War
uri: New-Bad-Magic-Cyber-Threat-Disrupts-Ukraine-s-Key-Sectors-Amid-War
url: https://thehackernews.com/2023/03/new-bad-magic-cyber-threat-disrupt.html
content:
Amid the ongoing war between Russia and Ukraine, government, agriculture, and transportation organizations located in Donetsk, Lugansk, and Crimea have been attacked as part of an active campaign that drops a previously unseen, modular framework dubbed CommonMagic.
"Although the initial vector of compromise is unclear, the details of the next stage imply the use of spear phishing or similar


feed_id: https://thehackernews.com/2023/03/new-shellbot-ddos-malware-targeting.html
title: New ShellBot DDoS Malware Variants Targeting Poorly Managed Linux Servers
uri: 2023-03-27-New-ShellBot-DDoS-Malware-Variants-Targeting-Poorly-Managed-Linux-Serv
url: https://thehackernews.com/2023/03/new-shellbot-ddos-malware-targeting.html
content:
Poorly managed Linux SSH servers are being targeted as part of a new campaign that deploys different variants of a malware called ShellBot.
"ShellBot, also known as PerlBot, is a DDoS Bot malware developed in Perl and characteristically uses IRC protocol to communicate with the C&C server," AhnLab Security Emergency response Center (ASEC) said in a report.
ShellBot is installed on servers that


feed_id: https://thehackernews.com/2023/03/the-best-defense-against-cyber-threats.html
title: The Best Defense Against Cyber Threats for Lean Security Teams
uri: 2023-03-27-The-Best-Defense-Against-Cyber-Threats-for-Lean-Security-Teams
url: https://thehackernews.com/2023/03/the-best-defense-against-cyber-threats.html
content:
H0lyGh0st, Magecart, and a slew of state-sponsored hacker groups are diversifying their tactics and shifting their focus to…
You.
That is, if you're in charge of cybersecurity for a small-to-midsize enterprise (SME).
Why? Bad actors know that SMEs typically have a smaller security budget, less infosec manpower, and possibly weak or missing security controls to protect their data and


feed_id: https://thehackernews.com/2023/03/from-ransomware-to-cyber-espionage-55.html
title: From Ransomware to Cyber Espionage: 55 Zero-Day Vulnerabilities Weaponized in 2022
uri: 2023-03-27-From-Ransomware-to-Cyber-Espionage-55-Zero-Day-Vulnerabilities-Weapon
url: https://thehackernews.com/2023/03/from-ransomware-to-cyber-espionage-55.html
content:
As many as 55 zero-day vulnerabilities were exploited in the wild in 2022, with most of the flaws discovered in software from Microsoft, Google, and Apple.
While this figure represents a decrease from the year before, when a staggering 81 zero-days were weaponized, it still represents a significant uptick in recent years of threat actors leveraging unknown security flaws to their advantage.
The 


feed_id: https://thehackernews.com/2023/03/hackers-steal-over-16-million-in-crypto.html
title: Hackers Steal Over $1.6 Million in Crypto from General Bytes Bitcoin ATMs Using Zero-Day Flaw
uri: 2023-03-27-Hackers-Steal-Over-1-6-Million-in-Crypto-from-General-Bytes-Bitcoin-A
url: https://thehackernews.com/2023/03/hackers-steal-over-16-million-in-crypto.html
content:
Bitcoin ATM maker General Bytes disclosed that unidentified threat actors stole cryptocurrency from hot wallets by exploiting a zero-day security flaw in its software.
"The attacker was able to upload his own java application remotely via the master service interface used by terminals to upload videos and run it using 'batm' user privileges," the company said in an advisory published over the


feed_id: https://thehackernews.com/2023/03/new-dotrunpex-malware-delivers-multiple.html
title: New DotRunpeX Malware Delivers Multiple Malware Families via Malicious Ads
uri: 2023-03-27-New-DotRunpeX-Malware-Delivers-Multiple-Malware-Families-via-Malicious
url: https://thehackernews.com/2023/03/new-dotrunpex-malware-delivers-multiple.html
content:
A new piece of malware dubbed dotRunpeX is being used to distribute numerous known malware families such as Agent Tesla, Ave Maria, BitRAT, FormBook, LokiBot, NetWire, Raccoon Stealer, RedLine Stealer, Remcos, Rhadamanthys, and Vidar.
"DotRunpeX is a new injector written in .NET using the Process Hollowing technique and used to infect systems with a variety of known malware families," Check


feed_id: https://thehackernews.com/2023/03/mispadu-banking-trojan-targets-latin.html
title: Mispadu Banking Trojan Targets Latin America: 90,000+ Credentials Stolen
uri: 2023-03-27-Mispadu-Banking-Trojan-Targets-Latin-America-90-000-Credentials-Stol
url: https://thehackernews.com/2023/03/mispadu-banking-trojan-targets-latin.html
content:
A banking trojan dubbed Mispadu has been linked to multiple spam campaigns targeting countries like Bolivia, Chile, Mexico, Peru, and Portugal with the goal of stealing credentials and delivering other payloads.
The activity, which commenced in August 2022, is currently ongoing, Ocelot Team from Latin American cybersecurity firm Metabase Q said in a report shared with The Hacker News.
Mispadu (


feed_id: https://thehackernews.com/2023/03/new-cyber-platform-lab-1-decodes-dark.html
title: New Cyber Platform Lab 1 Decodes Dark Web Data to Uncover Hidden Supply Chain Breaches
uri: 2023-03-27-New-Cyber-Platform-Lab-1-Decodes-Dark-Web-Data-to-Uncover-Hidden-Suppl
url: https://thehackernews.com/2023/03/new-cyber-platform-lab-1-decodes-dark.html
content:
2022 was the year when inflation hit world economies, except in one corner of the global marketplace – stolen data. Ransomware payments fell by over 40% in 2022 compared to 2021. More organisations chose not to pay ransom demands, according to findings by blockchain firm Chainalysis.
Nonetheless, stolen data has value beyond a price tag, and in risky ways you may not expect. Evaluating stolen


feed_id: https://thehackernews.com/2023/03/researchers-shed-light-on-catb.html
title: Researchers Shed Light on CatB Ransomware's Evasion Techniques
uri: 2023-03-27-Researchers-Shed-Light-on-CatB-Ransomware-s-Evasion-Techniques
url: https://thehackernews.com/2023/03/researchers-shed-light-on-catb.html
content:
The threat actors behind the CatB ransomware operation have been observed using a technique called DLL search order hijacking to evade detection and launch the payload.
CatB, also referred to as CatB99 and Baxtoy, emerged late last year and is said to be an "evolution or direct rebrand" of another ransomware strain known as Pandora based on code-level similarities.
It's worth noting that the use


feed_id: https://thehackernews.com/2023/03/emotet-rises-again-evades-macro.html
title: Emotet Rises Again: Evades Macro Security via OneNote Attachments
uri: 2023-03-27-Emotet-Rises-Again-Evades-Macro-Security-via-OneNote-Attachments
url: https://thehackernews.com/2023/03/emotet-rises-again-evades-macro.html
content:
The notorious Emotet malware, in its return after a short hiatus, is now being distributed via Microsoft OneNote email attachments in an attempt to bypass macro-based security restrictions and compromise systems.
Emotet, linked to a threat actor tracked as Gold Crestwood, Mummy Spider, or TA542, continues to be a potent and resilient threat despite attempts by law enforcement to take it down.
A 


feed_id: https://thehackernews.com/2023/03/chinese-hackers-exploit-fortinet-zero.html
title: Chinese Hackers Exploit Fortinet Zero-Day Flaw for Cyber Espionage Attack
uri: 2023-03-27-Chinese-Hackers-Exploit-Fortinet-Zero-Day-Flaw-for-Cyber-Espionage-Att
url: https://thehackernews.com/2023/03/chinese-hackers-exploit-fortinet-zero.html
content:
The zero-day exploitation of a now-patched medium-severity security flaw in the Fortinet FortiOS operating system has been linked to a suspected Chinese hacking group.
American cybersecurity company Mandiant, which made the attribution, said the activity cluster is part of a broader campaign designed to deploy backdoors onto Fortinet and VMware solutions and maintain persistent access to victim


feed_id: https://thehackernews.com/2023/03/pompompurin-unmasked-infamous.html
title: Pompompurin Unmasked: Infamous BreachForums Mastermind Arrested in New York
uri: 2023-03-27-Pompompurin-Unmasked-Infamous-BreachForums-Mastermind-Arrested-in-New
url: https://thehackernews.com/2023/03/pompompurin-unmasked-infamous.html
content:
U.S. law enforcement authorities have arrested a 21-year-old New York man in connection with running the infamous BreachForums hacking forum under the online alias "Pompompurin."
The development, first reported by Bloomberg Law, comes after News 12 Westchester, earlier this week, said that federal investigators "spent hours inside and outside of a home in Peekskill."
"At one point, investigators


feed_id: https://thehackernews.com/2023/03/thn-webinar-3-research-backed-ways-to.html
title: THN Webinar: 3 Research-Backed Ways to Secure Your Identity Perimeter
uri: 2023-03-27-THN-Webinar-3-Research-Backed-Ways-to-Secure-Your-Identity-Perimeter
url: https://thehackernews.com/2023/03/thn-webinar-3-research-backed-ways-to.html
content:
Think of the typical portrayal of a cyberattack. Bad guy pounding furiously on a keyboard, his eyes peeking out from under a dark hoodie. At long last, his efforts pay off and he hits the right combination of keys. "I'm in!" he shouts in triumph.
Clearly, there are many problems with this scenario – and it's not just the hoodie. What's even more inaccurate is that most cyber attackers today do


feed_id: https://thehackernews.com/2023/03/lockbit-30-ransomware-inside.html
title: LockBit 3.0 Ransomware: Inside the Cyberthreat That's Costing Millions
uri: 2023-03-27-LockBit-3-0-Ransomware-Inside-the-Cyberthreat-That-s-Costing-Millions
url: https://thehackernews.com/2023/03/lockbit-30-ransomware-inside.html
content:
U.S. government agencies have released a joint cybersecurity advisory detailing the indicators of compromise (IoCs) and tactics, techniques, and procedures (TTPs) associated with the notorious LockBit 3.0 ransomware.
"The LockBit 3.0 ransomware operations function as a Ransomware-as-a-Service (RaaS) model and is a continuation of previous versions of the ransomware, LockBit 2.0, and LockBit,"


feed_id: https://thehackernews.com/2023/03/fakecalls-vishing-malware-targets-south.html
title: FakeCalls Vishing Malware Targets South Korean Users via Popular Financial Apps
uri: 2023-03-27-FakeCalls-Vishing-Malware-Targets-South-Korean-Users-via-Popular-Finan
url: https://thehackernews.com/2023/03/fakecalls-vishing-malware-targets-south.html
content:
An Android voice phishing (aka vishing) malware campaign known as FakeCalls has reared its head once again to target South Korean users under the guise of over 20 popular financial apps.
"FakeCalls malware possesses the functionality of a Swiss army knife, able not only to conduct its primary aim but also to extract private data from the victim's device," cybersecurity firm Check Point said.


feed_id: https://thehackernews.com/2023/03/new-golang-based-hinatabot-exploiting.html
title: New GoLang-Based HinataBot Exploiting Router and Server Flaws for DDoS Attacks
uri: 2023-03-27-New-GoLang-Based-HinataBot-Exploiting-Router-and-Server-Flaws-for-DDoS
url: https://thehackernews.com/2023/03/new-golang-based-hinatabot-exploiting.html
content:
A new Golang-based botnet dubbed HinataBot has been observed to leverage known flaws to compromise routers and servers and use them to stage distributed denial-of-service (DDoS) attacks.
"The malware binaries appear to have been named by the malware author after a character from the popular anime series, Naruto, with file name structures such as 'Hinata--,'" Akamai said in a


feed_id: https://thehackernews.com/2023/03/a-new-security-category-addresses-web.html
title: A New Security Category Addresses Web-borne Threats
uri: 2023-03-27-A-New-Security-Category-Addresses-Web-borne-Threats
url: https://thehackernews.com/2023/03/a-new-security-category-addresses-web.html
content:
In the modern corporate IT environment, which relies on cloud connectivity, global connections and large volumes of data, the browser is now the most important work interface. The browser connects employees to managed resources, devices to the web, and the on-prem environment to the cloud one.
Yet, and probably unsurprisingly, this browser prominence has significantly increased the number of


feed_id: https://thehackernews.com/2023/03/lookalike-telegram-and-whatsapp.html
title: Lookalike Telegram and WhatsApp Websites Distributing Cryptocurrency Stealing Malware
uri: 2023-03-27-Lookalike-Telegram-and-WhatsApp-Websites-Distributing-Cryptocurrency-S
url: https://thehackernews.com/2023/03/lookalike-telegram-and-whatsapp.html
content:
Copycat websites for instant messaging apps like Telegram and WhatApp are being used to distribute trojanized versions and infect Android and Windows users with cryptocurrency clipper malware.
"All of them are after victims' cryptocurrency funds, with several targeting cryptocurrency wallets," ESET researchers Lukáš Štefanko and Peter Strýček said in a new analysis.
While the first instance of


feed_id: https://thehackernews.com/2023/03/winter-vivern-apt-group-targeting.html
title: Winter Vivern APT Group Targeting Indian, Lithuanian, Slovakian, and Vatican Officials
uri: 2023-03-27-Winter-Vivern-APT-Group-Targeting-Indian-Lithuanian-Slovakian-and-V
url: https://thehackernews.com/2023/03/winter-vivern-apt-group-targeting.html
content:
The advanced persistent threat known as Winter Vivern has been linked to campaigns targeting government officials in India, Lithuania, Slovakia, and the Vatican since 2021.
The activity targeted Polish government agencies, the Ukraine Ministry of Foreign Affairs, the Italy Ministry of Foreign Affairs, and individuals within the Indian government, SentinelOne said in a report shared with The


feed_id: https://thehackernews.com/2023/03/google-uncovers-18-severe-security.html
title: Google Uncovers 18 Severe Security Vulnerabilities in Samsung Exynos Chips
uri: 2023-03-27-Google-Uncovers-18-Severe-Security-Vulnerabilities-in-Samsung-Exynos-C
url: https://thehackernews.com/2023/03/google-uncovers-18-severe-security.html
content:
Google is calling attention to a set of severe security flaws in Samsung's Exynos chips, some of which could be exploited remotely to completely compromise a phone without requiring any user interaction.
The 18 zero-day vulnerabilities affect a wide range of Android smartphones from Samsung, Vivo, Google, wearables using the Exynos W920 chipset, and vehicles equipped with the Exynos Auto T5123


feed_id: https://thehackernews.com/2023/03/chinese-and-russian-hackers-using.html
title: Chinese and Russian Hackers Using SILKLOADER Malware to Evade Detection
uri: 2023-03-27-Chinese-and-Russian-Hackers-Using-SILKLOADER-Malware-to-Evade-Detectio
url: https://thehackernews.com/2023/03/chinese-and-russian-hackers-using.html
content:
Threat activity clusters affiliated with the Chinese and Russian cybercriminal ecosystems have been observed using a new piece of malware that's designed to load Cobalt Strike onto infected machines.
Dubbed SILKLOADER by Finnish cybersecurity company WithSecure, the malware leverages DLL side-loading techniques to deliver the commercial adversary simulation software.
The development comes as 


feed_id: https://thehackernews.com/2023/03/cryptojacking-group-teamtnt-suspected.html
title: Cryptojacking Group TeamTNT Suspected of Using Decoy Miner to Conceal Data Exfiltration
uri: 2023-03-27-Cryptojacking-Group-TeamTNT-Suspected-of-Using-Decoy-Miner-to-Conceal
url: https://thehackernews.com/2023/03/cryptojacking-group-teamtnt-suspected.html
content:
The cryptojacking group known as TeamTNT is suspected to be behind a previously undiscovered strain of malware used to mine Monero cryptocurrency on compromised systems.
That's according to Cado Security, which found the sample after Sysdig detailed a sophisticated attack known as SCARLETEEL aimed at containerized environments to ultimately steal proprietary data and software.
Specifically, the


feed_id: https://thehackernews.com/2023/03/authorities-shut-down-chipmixer.html
title: Authorities Shut Down ChipMixer Platform Tied to Crypto Laundering Scheme
uri: 2023-03-27-Authorities-Shut-Down-ChipMixer-Platform-Tied-to-Crypto-Laundering-Sch
url: https://thehackernews.com/2023/03/authorities-shut-down-chipmixer.html
content:
A coalition of law enforcement agencies across Europe and the U.S. announced the takedown of ChipMixer, an unlicensed cryptocurrency mixer that began its operations in August 2017.
"The ChipMixer software blocked the blockchain trail of the funds, making it attractive for cybercriminals looking to launder illegal proceeds from criminal activities such as drug trafficking, weapons trafficking,


feed_id: https://thehackernews.com/2023/03/whats-wrong-with-manufacturing.html
title: What's Wrong with Manufacturing?
uri: 2023-03-27-What-s-Wrong-with-Manufacturing
url: https://thehackernews.com/2023/03/whats-wrong-with-manufacturing.html
content:
In last year's edition of the Security Navigator we noted that the Manufacturing Industry appeared to be totally over-represented in our dataset of Cyber Extortion victims. Neither the number of businesses nor their average revenue particularly stood out to explain this.
Manufacturing was also the most represented Industry in our CyberSOC dataset – contributing more Incidents than any other


feed_id: https://thehackernews.com/2023/03/multiple-hacker-groups-exploit-3-year.html
title: Multiple Hacker Groups Exploit 3-Year-Old Vulnerability to Breach U.S. Federal Agency
uri: 2023-03-27-Multiple-Hacker-Groups-Exploit-3-Year-Old-Vulnerability-to-Breach-U-S
url: https://thehackernews.com/2023/03/multiple-hacker-groups-exploit-3-year.html
content:
Multiple threat actors, including a nation-state group, exploited a critical three-year-old security flaw in Progress Telerik to break into an unnamed federal entity in the U.S.
The disclosure comes from a joint advisory issued by the Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), and Multi-State Information Sharing and Analysis Center (MS-ISAC).


feed_id: https://thehackernews.com/2023/03/cisa-issues-urgent-warning-adobe.html
title: CISA Issues Urgent Warning: Adobe ColdFusion Vulnerability Exploited in the Wild
uri: 2023-03-27-CISA-Issues-Urgent-Warning-Adobe-ColdFusion-Vulnerability-Exploited-i
url: https://thehackernews.com/2023/03/cisa-issues-urgent-warning-adobe.html
content:
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on March 15 added a security vulnerability impacting Adobe ColdFusion to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation.
The critical flaw in question is CVE-2023-26360 (CVSS score: 8.6), which could be exploited by a threat actor to achieve arbitrary code execution.
"Adobe ColdFusion


feed_id: https://thehackernews.com/2023/03/yorotrooper-stealing-credentials-and.html
title: YoroTrooper Stealing Credentials and Information from Government and Energy Organizations
uri: 2023-03-27-YoroTrooper-Stealing-Credentials-and-Information-from-Government-and-E
url: https://thehackernews.com/2023/03/yorotrooper-stealing-credentials-and.html
content:
A previously undocumented threat actor dubbed YoroTrooper has been targeting government, energy, and international organizations across Europe as part of a cyber espionage campaign that has been active since at least June 2022.
"Information stolen from successful compromises include credentials from multiple applications, browser histories and cookies, system information and screenshots," Cisco


feed_id: https://thehackernews.com/2023/03/new-cryptojacking-operation-targeting.html
title: New Cryptojacking Operation Targeting Kubernetes Clusters for Dero Mining
uri: 2023-03-27-New-Cryptojacking-Operation-Targeting-Kubernetes-Clusters-for-Dero-Min
url: https://thehackernews.com/2023/03/new-cryptojacking-operation-targeting.html
content:
Cybersecurity researchers have discovered the first-ever illicit cryptocurrency mining campaign used to mint Dero since the start of February 2023.
"The novel Dero cryptojacking operation concentrates on locating Kubernetes clusters with anonymous access enabled on a Kubernetes API and listening on non-standard ports accessible from the internet," CrowdStrike said in a new report shared with The


feed_id: https://thehackernews.com/2023/03/the-different-methods-and-stages-of.html
title: The Different Methods and Stages of Penetration Testing
uri: 2023-03-27-The-Different-Methods-and-Stages-of-Penetration-Testing
url: https://thehackernews.com/2023/03/the-different-methods-and-stages-of.html
content:
The stakes could not be higher for cyber defenders. With the vast amounts of sensitive information, intellectual property, and financial data at risk, the consequences of a data breach can be devastating. According to a report released by Ponemon institute, the cost of data breaches has reached an all-time high, averaging $4.35 million in 2022.
Vulnerabilities in web applications are often the


feed_id: https://thehackernews.com/2023/03/tick-apt-targeted-high-value-customers.html
title: Tick APT Targeted High-Value Customers of East Asian Data-Loss Prevention Company
uri: 2023-03-27-Tick-APT-Targeted-High-Value-Customers-of-East-Asian-Data-Loss-Prevent
url: https://thehackernews.com/2023/03/tick-apt-targeted-high-value-customers.html
content:
A cyberespionage actor known as Tick has been attributed with high confidence to a compromise of an East Asian data-loss prevention (DLP) company that caters to government and military entities.
"The attackers compromised the DLP company's internal update servers to deliver malware inside the software developer's network, and trojanized installers of legitimate tools used by the company, which


feed_id: https://thehackernews.com/2023/03/3cx-supply-chain-attack-heres-what-we.html
title: 3CX Supply Chain Attack — Here's What We Know So Far
uri: 3CX-Supply-Chain-Attack-Here-s-What-We-Know-So-Far
url: https://thehackernews.com/2023/03/3cx-supply-chain-attack-heres-what-we.html
content:
Enterprise communications software maker 3CX on Thursday confirmed that multiple versions of its desktop app for Windows and macOS are affected by a supply chain attack.
The version numbers include 18.12.407 and 18.12.416 for Windows and 18.11.1213, 18.12.402, 18.12.407, and 18.12.416 for macOS.
The company said it's engaging the services of Google-owned Mandiant to review the incident. In the


feed_id: https://thehackernews.com/2023/03/researchers-detail-severe-super.html
title: Researchers Detail Severe "Super FabriXss" Vulnerability in Microsoft Azure SFX
uri: 2023-03-31-Researchers-Detail-Severe-Super-FabriXss-Vulnerability-in-Microsoft
url: https://thehackernews.com/2023/03/researchers-detail-severe-super.html
content:
Details have emerged about a now-patched vulnerability in Azure Service Fabric Explorer (SFX) that could lead to unauthenticated remote code execution.
Tracked as CVE-2023-23383 (CVSS score: 8.2), the issue has been dubbed "Super FabriXss" by Orca Security, a nod to the FabriXss flaw (CVE-2022-35829, CVSS score: 6.2) that was fixed by Microsoft in October 2022.
"The Super FabriXss vulnerability


feed_id: https://thehackernews.com/2023/03/chinese-redgolf-group-targeting-windows.html
title: Chinese RedGolf Group Targeting Windows and Linux Systems with KEYPLUG Backdoor
uri: 2023-03-31-Chinese-RedGolf-Group-Targeting-Windows-and-Linux-Systems-with-KEYPLUG
url: https://thehackernews.com/2023/03/chinese-redgolf-group-targeting-windows.html
content:
A Chinese state-sponsored threat activity group tracked as RedGolf has been attributed to the use of a custom Windows and Linux backdoor called KEYPLUG.
"RedGolf is a particularly prolific Chinese state-sponsored threat actor group that has likely been active for many years against a wide range of industries globally," Recorded Future told The Hacker News.
"The group has shown the ability to


feed_id: https://thehackernews.com/2023/03/new-wi-fi-protocol-security-flaw.html
title: New Wi-Fi Protocol Security Flaw Affecting Linux, Android and iOS Devices
uri: 2023-03-31-New-Wi-Fi-Protocol-Security-Flaw-Affecting-Linux-Android-and-iOS-Devi
url: https://thehackernews.com/2023/03/new-wi-fi-protocol-security-flaw.html
content:
A group of academics from Northeastern University and KU Leuven has disclosed a fundamental design flaw in the IEEE 802.11 Wi-Fi protocol standard, impacting a wide range of devices running Linux, FreeBSD, Android, and iOS.
Successful exploitation of the shortcoming could be abused to hijack TCP connections or intercept client and web traffic, researchers Domien Schepers, Aanjhan Ranganathan,


feed_id: https://thehackernews.com/2023/03/cyberstorage-leveraging-multi-cloud-to.html
title: Cyberstorage: Leveraging the Multi-Cloud to Combat Data Exfiltration
uri: 2023-03-31-Cyberstorage-Leveraging-the-Multi-Cloud-to-Combat-Data-Exfiltration
url: https://thehackernews.com/2023/03/cyberstorage-leveraging-multi-cloud-to.html
content:
Multi-cloud data storage, once merely a byproduct of the great cloud migration, has now become a strategy for data management. "Multi-cloud by design," and its companion the supercloud, is an ecosystem in which several cloud systems work together to provide many organizational benefits, including increased scale and overall resiliency.And now, even security teams who have long been the holdout


feed_id: https://thehackernews.com/2023/03/alienfox-malware-targets-api-keys-and.html
title: AlienFox Malware Targets API Keys and Secrets from AWS, Google, and Microsoft Cloud Services
uri: 2023-03-31-AlienFox-Malware-Targets-API-Keys-and-Secrets-from-AWS-Google-and-Mi
url: https://thehackernews.com/2023/03/alienfox-malware-targets-api-keys-and.html
content:
A new "comprehensive toolset" called AlienFox is being distributed on Telegram as a way for threat actors to harvest credentials from API keys and secrets from popular cloud service providers.
"The spread of AlienFox represents an unreported trend towards attacking more minimal cloud services, unsuitable for crypto mining, in order to enable and expand subsequent campaigns," SentinelOne security


feed_id: https://thehackernews.com/2023/03/3cx-desktop-app-targeted-in-supply.html
title: 3CX Desktop App Supply Chain Attack Leaves Millions at Risk - Urgent Update on the Way!
uri: 3CX-Desktop-App-Supply-Chain-Attack-Leaves-Millions-at-Risk-Urgent-U
url: https://thehackernews.com/2023/03/3cx-desktop-app-targeted-in-supply.html
content:
3CX said it's working on a software update for its desktop app after multiple cybersecurity vendors sounded the alarm on what appears to be an active supply chain attack that's using digitally signed and rigged installers of the popular voice and video conferencing software to target downstream customers.
"The trojanized 3CX desktop app is the first stage in a multi-stage attack chain that pulls


feed_id: https://thehackernews.com/2023/03/spyware-vendors-caught-exploiting-zero.html
title: Spyware Vendors Caught Exploiting Zero-Day Vulnerabilities on Android and iOS Devices
uri: 2023-03-31-Spyware-Vendors-Caught-Exploiting-Zero-Day-Vulnerabilities-on-Android
url: https://thehackernews.com/2023/03/spyware-vendors-caught-exploiting-zero.html
content:
A number of zero-day vulnerabilities that were addressed last year were exploited by commercial spyware vendors to target Android and iOS devices, Google's Threat Analysis Group (TAG) has revealed.
The two distinct campaigns were both limited and highly targeted, taking advantage of the patch gap between the release of a fix and when it was actually deployed on the targeted devices. The scale of


feed_id: https://thehackernews.com/2023/03/melofee-researchers-uncover-new-linux.html
title: Mélofée: Researchers Uncover New Linux Malware Linked to Chinese APT Groups
uri: 2023-03-31-Mélofée-Researchers-Uncover-New-Linux-Malware-Linked-to-Chinese-APT
url: https://thehackernews.com/2023/03/melofee-researchers-uncover-new-linux.html
content:
An unknown Chinese state-sponsored hacking group has been linked to a novel piece of malware aimed at Linux servers.
French cybersecurity firm ExaTrack, which found three samples of the previously documented malicious software that date back to early 2022, dubbed it Mélofée.
The newest of the three artifacts is designed to drop a kernel-mode rootkit that's based on an open source project


feed_id: https://thehackernews.com/2023/03/how-to-build-research-lab-for-reverse.html
title: How to Build a Research Lab for Reverse Engineering — 4 Ways
uri: 2023-03-31-How-to-Build-a-Research-Lab-for-Reverse-Engineering-4-Ways
url: https://thehackernews.com/2023/03/how-to-build-research-lab-for-reverse.html
content:
Malware analysis is an essential part of security researcher's work. But working with malicious samples can be dangerous — it requires specialized tools to record their activity, and a secure environment to prevent unintended damage.
However, manual lab setup and configuration can prove to be a laborious and time-consuming process.
In this article, we'll look at 4 ways to create a reverse


feed_id: https://thehackernews.com/2023/03/smart-mobility-has-blindspot-when-it.html
title: Smart Mobility has a Blindspot When it Comes to API Security
uri: 2023-03-31-Smart-Mobility-has-a-Blindspot-When-it-Comes-to-API-Security
url: https://thehackernews.com/2023/03/smart-mobility-has-blindspot-when-it.html
content:
The emergence of smart mobility services and applications has led to a sharp increase in the use of APIs in the automotive industry. However, this increased reliance on APIs has also made them one of the most common attack vectors. According to Gartner, APIs account for 90% of the web application attack surface areas. 
With no surprise, similar trends are emerging also in the smart mobility


feed_id: https://thehackernews.com/2023/03/trojanized-tor-browser-installers.html
title: Trojanized TOR Browser Installers Spreading Crypto-Stealing Clipper Malware
uri: 2023-03-31-Trojanized-TOR-Browser-Installers-Spreading-Crypto-Stealing-Clipper-Ma
url: https://thehackernews.com/2023/03/trojanized-tor-browser-installers.html
content:
Trojanized installers for the TOR anonymity browser are being used to target users in Russia and Eastern Europe with clipper malware designed to siphon cryptocurrencies since September 2022.
"Clipboard injectors [...] can be silent for years, show no network activity or any other signs of presence until the disastrous day when they replace a crypto wallet address," Vitaly Kamluk, director of


feed_id: https://thehackernews.com/2023/03/north-korean-apt43-group-uses.html
title: North Korean APT43 Group Uses Cybercrime to Fund Espionage Operations
uri: 2023-03-31-North-Korean-APT43-Group-Uses-Cybercrime-to-Fund-Espionage-Operations
url: https://thehackernews.com/2023/03/north-korean-apt43-group-uses.html
content:
A new North Korean nation-state cyber operator has been attributed to a series of campaigns orchestrated to gather strategic intelligence that aligns with Pyongyang's geopolitical interests since 2018.
Google-owned Mandiant, which is tracking the activity cluster under the moniker APT43, said the group's motives are both espionage- and financially-motivated, leveraging techniques like credential


feed_id: https://thehackernews.com/2023/03/microsoft-introduces-gpt-4-ai-powered.html
title: Microsoft Introduces GPT-4 AI-Powered Security Copilot Tool to Empower Defenders
uri: 2023-03-31-Microsoft-Introduces-GPT-4-AI-Powered-Security-Copilot-Tool-to-Empower
url: https://thehackernews.com/2023/03/microsoft-introduces-gpt-4-ai-powered.html
content:
Microsoft on Tuesday unveiled Security Copilot in limited preview, marking its continued quest to embed AI-oriented features in an attempt to offer "end-to-end defense at machine speed and scale."
Powered by OpenAI's GPT-4 generative AI and its own security-specific model, it's billed as a security analysis tool that enables cybersecurity analysts to quickly respond to threats, process signals,


feed_id: https://thehackernews.com/2023/03/pakistan-origin-sidecopy-linked-to-new.html
title: Pakistan-Origin SideCopy Linked to New Cyberattack on India's Ministry of Defence
uri: 2023-03-31-Pakistan-Origin-SideCopy-Linked-to-New-Cyberattack-on-India-s-Ministry
url: https://thehackernews.com/2023/03/pakistan-origin-sidecopy-linked-to-new.html
content:
An advanced persistent threat (APT) group that has a track record of targeting India and Afghanistan has been linked to a new phishing campaign that delivers Action RAT.
According to Cyble, which attributed the operation to SideCopy, the activity cluster is designed to target the Defence Research and Development Organization (DRDO), the research and development wing of India's Ministry of


feed_id: https://thehackernews.com/2023/03/icedid-malware-shifts-focus-from.html
title: IcedID Malware Shifts Focus from Banking Fraud to Ransomware Delivery
uri: 2023-03-31-IcedID-Malware-Shifts-Focus-from-Banking-Fraud-to-Ransomware-Delivery
url: https://thehackernews.com/2023/03/icedid-malware-shifts-focus-from.html
content:
Multiple threat actors have been observed using two new variants of the IcedID malware in the wild with more limited functionality that removes functionality related to online banking fraud.
IcedID, also known as BokBot, started off as a banking trojan in 2017. It's also capable of delivering additional malware, including ransomware.
"The well-known IcedID version consists of an initial loader


feed_id: https://thehackernews.com/2023/03/breaking-mold-pen-testing-solutions.html
title: Breaking the Mold: Pen Testing Solutions That Challenge the Status Quo
uri: 2023-03-31-Breaking-the-Mold-Pen-Testing-Solutions-That-Challenge-the-Status-Quo
url: https://thehackernews.com/2023/03/breaking-mold-pen-testing-solutions.html
content:
Malicious actors are constantly adapting their tactics, techniques, and procedures (TTPs) to adapt to political, technological, and regulatory changes quickly. A few emerging threats that organizations of all sizes should be aware of include the following:

Increased use of Artificial Intelligence and Machine Learning: Malicious actors are increasingly leveraging AI and machine learning to


feed_id: https://thehackernews.com/2023/03/stealthy-dbatloader-malware-loader.html
title: Stealthy DBatLoader Malware Loader Spreading Remcos RAT and Formbook in Europe
uri: 2023-03-31-Stealthy-DBatLoader-Malware-Loader-Spreading-Remcos-RAT-and-Formbook-i
url: https://thehackernews.com/2023/03/stealthy-dbatloader-malware-loader.html
content:
A new phishing campaign has set its sights on European entities to distribute Remcos RAT and Formbook via a malware loader dubbed DBatLoader.
"The malware payload is distributed through WordPress websites that have authorized SSL certificates, which is a common tactic used by threat actors to evade detection engines," Zscaler researchers Meghraj Nandanwar and Satyam Singh said in a report


feed_id: https://thehackernews.com/2023/03/president-biden-signs-executive-order.html
title: President Biden Signs Executive Order Restricting Use of Commercial Spyware
uri: 2023-03-31-President-Biden-Signs-Executive-Order-Restricting-Use-of-Commercial-Sp
url: https://thehackernews.com/2023/03/president-biden-signs-executive-order.html
content:
U.S. President Joe Biden on Monday signed an executive order that restricts the use of commercial spyware by federal government agencies.
The order said the spyware ecosystem "poses significant counterintelligence or security risks to the United States Government or significant risks of improper use by a foreign government or foreign person."
It also seeks to ensure that the government's use of


feed_id: https://thehackernews.com/2023/03/apple-issues-urgent-security-update-for.html
title: Apple Issues Urgent Security Update for Older iOS and iPadOS Models
uri: 2023-03-31-Apple-Issues-Urgent-Security-Update-for-Older-iOS-and-iPadOS-Models
url: https://thehackernews.com/2023/03/apple-issues-urgent-security-update-for.html
content:
Apple on Monday backported fixes for an actively exploited security flaw to older iPhone and iPad models.
The issue, tracked as CVE-2023-23529, concerns a type confusion bug in the WebKit browser engine that could lead to arbitrary code execution.
It was originally addressed by the tech giant with improved checks as part of updates released on February 13, 2023. An anonymous researcher has been


feed_id: https://thehackernews.com/2023/03/20-year-old-breachforums-founder-faces.html
title: 20-Year-Old BreachForums Founder Faces Up to 5 Years in Prison
uri: 2023-03-31-20-Year-Old-BreachForums-Founder-Faces-Up-to-5-Years-in-Prison
url: https://thehackernews.com/2023/03/20-year-old-breachforums-founder-faces.html
content:
Conor Brian Fitzpatrick, the 20-year-old founder and the administrator of the now-defunct BreachForums has been formally charged in the U.S. with conspiracy to commit access device fraud.
If proven guilty, Fitzpatrick, who went by the online moniker "pompompurin," faces a maximum penalty of up to five years in prison. He was arrested on March 15, 2023.
"Cybercrime victimizes and steals financial


feed_id: https://thehackernews.com/2023/03/where-sso-falls-short-in-protecting-saas.html
title: Where SSO Falls Short in Protecting SaaS
uri: 2023-03-31-Where-SSO-Falls-Short-in-Protecting-SaaS
url: https://thehackernews.com/2023/03/where-sso-falls-short-in-protecting-saas.html
content:
Single sign-on (SSO) is an authentication method that allows users to authenticate their identity for multiple applications with just one set of credentials. From a security standpoint, SSO is the gold standard. It ensures access without forcing users to remember multiple passwords and can be further secured with MFA. Furthermore, an estimated 61% of attacks stem from stolen credentials. By


feed_id: https://thehackernews.com/2023/03/new-macstealer-macos-malware-steals.html
title: New MacStealer macOS Malware Steals iCloud Keychain Data and Passwords
uri: 2023-03-31-New-MacStealer-macOS-Malware-Steals-iCloud-Keychain-Data-and-Passwords
url: https://thehackernews.com/2023/03/new-macstealer-macos-malware-steals.html
content:
A new information-stealing malware has set its sights on Apple's macOS operating system to siphon sensitive information from compromised devices.
Dubbed MacStealer, it's the latest example of a threat that uses Telegram as a command-and-control (C2) platform to exfiltrate data. It primarily affects devices running macOS versions Catalina and later running on M1 and M2 CPUs.
"MacStealer has the


feed_id: https://thehackernews.com/2023/03/microsoft-issues-patch-for-acropalypse.html
title: Microsoft Issues Patch for aCropalypse Privacy Flaw in Windows Screenshot Tools
uri: 2023-03-31-Microsoft-Issues-Patch-for-aCropalypse-Privacy-Flaw-in-Windows-Screens
url: https://thehackernews.com/2023/03/microsoft-issues-patch-for-acropalypse.html
content:
Microsoft has released an out-of-band update to address a privacy-defeating flaw in its screenshot editing tool for Windows 10 and Windows 11.
The issue, dubbed aCropalypse, could enable malicious actors to recover edited portions of screenshots, potentially revealing sensitive information that may have been cropped out.
Tracked as CVE-2023-28303, the vulnerability is rated 3.3 on the CVSS


feed_id: https://thehackernews.com/2023/04/lazarus-xtrader-hack-impacts-critical.html
title: Lazarus X_TRADER Hack Impacts Critical Infrastructure Beyond 3CX Breach
uri: 2023-04-23-Lazarus-X_TRADER-Hack-Impacts-Critical-Infrastructure-Beyond-3CX-Breac
url: https://thehackernews.com/2023/04/lazarus-xtrader-hack-impacts-critical.html
content:
Lazarus, the prolific North Korean hacking group behind the cascading supply chain attack targeting 3CX, also breached two critical infrastructure organizations in the power and energy sector and two other businesses involved in financial trading using the trojanized X_TRADER application.
The new findings, which come courtesy of Symantec's Threat Hunter Team, confirm earlier suspicions that the


feed_id: https://thehackernews.com/2023/04/cisa-adds-3-actively-exploited-flaws-to.html
title: CISA Adds 3 Actively Exploited Flaws to KEV Catalog, including Critical PaperCut Bug
uri: 2023-04-23-CISA-Adds-3-Actively-Exploited-Flaws-to-KEV-Catalog-including-Critica
url: https://thehackernews.com/2023/04/cisa-adds-3-actively-exploited-flaws-to.html
content:
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added three security flaws to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation.
The three vulnerabilities are as follows -

CVE-2023-28432 (CVSS score - 7.5) - MinIO Information Disclosure Vulnerability 
CVE-2023-27350 (CVSS score - 9.8) - PaperCut MF/NG Improper Access Control


feed_id: https://thehackernews.com/2023/04/kubernetes-rbac-exploited-in-large.html
title: Kubernetes RBAC Exploited in Large-Scale Campaign for Cryptocurrency Mining
uri: 2023-04-23-Kubernetes-RBAC-Exploited-in-Large-Scale-Campaign-for-Cryptocurrency-M
url: https://thehackernews.com/2023/04/kubernetes-rbac-exploited-in-large.html
content:
A large-scale attack campaign discovered in the wild has been exploiting Kubernetes (K8s) Role-Based Access Control (RBAC) to create backdoors and run cryptocurrency miners.
"The attackers also deployed DaemonSets to take over and hijack resources of the K8s clusters they attack," cloud security firm Aqua said in a report shared with The Hacker News. The Israeli company, which dubbed the attack 


feed_id: https://thehackernews.com/2023/04/ghosttoken-flaw-could-let-attackers.html
title: GhostToken Flaw Could Let Attackers Hide Malicious Apps in Google Cloud Platform
uri: 2023-04-23-GhostToken-Flaw-Could-Let-Attackers-Hide-Malicious-Apps-in-Google-Clou
url: https://thehackernews.com/2023/04/ghosttoken-flaw-could-let-attackers.html
content:
Cybersecurity researchers have disclosed details of a now-patched zero-day flaw in Google Cloud Platform (GCP) that could have enabled threat actors to conceal an unremovable, malicious application inside a victim's Google account.
Dubbed GhostToken by Israeli cybersecurity startup Astrix Security, the shortcoming impacts all Google accounts, including enterprise-focused Workspace accounts. It


feed_id: https://thehackernews.com/2023/04/14-kubernetes-and-cloud-security.html
title: 14 Kubernetes and Cloud Security Challenges and How to Solve Them
uri: 2023-04-23-14-Kubernetes-and-Cloud-Security-Challenges-and-How-to-Solve-Them
url: https://thehackernews.com/2023/04/14-kubernetes-and-cloud-security.html
content:
Recently, Andrew Martin, founder and CEO of ControlPlane, released a report entitled Cloud Native and Kubernetes Security Predictions 2023. These predictions underscore the rapidly evolving landscape of Kubernetes and cloud security, emphasizing the need for organizations to stay informed and adopt comprehensive security solutions to protect their digital assets.
In response, Uptycs, the first


feed_id: https://thehackernews.com/2023/04/nk-hackers-employ-matryoshka-doll-style.html
title: N.K. Hackers Employ Matryoshka Doll-Style Cascading Supply Chain Attack on 3CX
uri: 2023-04-23-N-K-Hackers-Employ-Matryoshka-Doll-Style-Cascading-Supply-Chain-Attac
url: https://thehackernews.com/2023/04/nk-hackers-employ-matryoshka-doll-style.html
content:
The supply chain attack targeting 3CX was the result of a prior supply chain compromise associated with a different company, demonstrating a new level of sophistication with North Korean threat actors.
Google-owned Mandiant, which is tracking the attack event under the moniker UNC4736, said the incident marks the first time it has seen a "software supply chain attack lead to another software


feed_id: https://thehackernews.com/2023/04/cisco-and-vmware-release-security.html
title: Cisco and VMware Release Security Updates to Patch Critical Flaws in their Products
uri: 2023-04-23-Cisco-and-VMware-Release-Security-Updates-to-Patch-Critical-Flaws-in-t
url: https://thehackernews.com/2023/04/cisco-and-vmware-release-security.html
content:
Cisco and VMware have released security updates to address critical security flaws in their products that could be exploited by malicious actors to execute arbitrary code on affected systems.
The most severe of the vulnerabilities is a command injection flaw in Cisco Industrial Network Director (CVE-2023-20036, CVSS score: 9.9), which resides in the web UI component and arises as a result of


feed_id: https://thehackernews.com/2023/04/two-critical-flaws-found-in-alibaba.html
title: Two Critical Flaws Found in Alibaba Cloud's PostgreSQL Databases
uri: 2023-04-23-Two-Critical-Flaws-Found-in-Alibaba-Cloud-s-PostgreSQL-Databases
url: https://thehackernews.com/2023/04/two-critical-flaws-found-in-alibaba.html
content:
A chain of two critical flaws has been disclosed in Alibaba Cloud's ApsaraDB RDS for PostgreSQL and AnalyticDB for PostgreSQL that could be exploited to breach tenant isolation protections and access sensitive data belonging to other customers.
"The vulnerabilities potentially allowed unauthorized access to Alibaba Cloud customers' PostgreSQL databases and the ability to perform a supply chain


feed_id: https://thehackernews.com/2023/04/beyond-traditional-security-ndrs.html
title: Beyond Traditional Security: NDR's Pivotal Role in Safeguarding OT Networks
uri: 2023-04-23-Beyond-Traditional-Security-NDR-s-Pivotal-Role-in-Safeguarding-OT-Net
url: https://thehackernews.com/2023/04/beyond-traditional-security-ndrs.html
content:
Why is Visibility into OT Environments Crucial?
The significance of Operational Technology (OT) for businesses is undeniable as the OT sector flourishes alongside the already thriving IT sector. OT includes industrial control systems, manufacturing equipment, and devices that oversee and manage industrial environments and critical infrastructures. In recent years, adversaries have recognized the


feed_id: https://thehackernews.com/2023/04/lazarus-group-adds-linux-malware-to.html
title: Lazarus Group Adds Linux Malware to Arsenal in Operation Dream Job
uri: 2023-04-23-Lazarus-Group-Adds-Linux-Malware-to-Arsenal-in-Operation-Dream-Job
url: https://thehackernews.com/2023/04/lazarus-group-adds-linux-malware-to.html
content:
The notorious North Korea-aligned state-sponsored actor known as the Lazarus Group has been attributed to a new campaign aimed at Linux users.
The attacks are part of a persistent and long-running activity tracked under the name Operation Dream Job, ESET said in a new report published today.
The findings are crucial, not least because it marks the first publicly documented example of the


feed_id: https://thehackernews.com/2023/04/fortra-sheds-light-on-goanywhere-mft.html
title: Fortra Sheds Light on GoAnywhere MFT Zero-Day Exploit Used in Ransomware Attacks
uri: 2023-04-23-Fortra-Sheds-Light-on-GoAnywhere-MFT-Zero-Day-Exploit-Used-in-Ransomwa
url: https://thehackernews.com/2023/04/fortra-sheds-light-on-goanywhere-mft.html
content:
Fortra, the company behind Cobalt Strike, shed light on a zero-day remote code execution (RCE) vulnerability in its GoAnywhere MFT tool that has come under active exploitation by ransomware actors to steal sensitive data.
The high-severity flaw, tracked as CVE-2023-0669 (CVSS score: 7.2), concerns a case of pre-authenticated command injection that could be abused to achieve code execution. The


feed_id: https://thehackernews.com/2023/04/chatgpts-data-protection-blind-spots.html
title: ChatGPT's Data Protection Blind Spots and How Security Teams Can Solve Them
uri: 2023-04-23-ChatGPT-s-Data-Protection-Blind-Spots-and-How-Security-Teams-Can-Solve
url: https://thehackernews.com/2023/04/chatgpts-data-protection-blind-spots.html
content:
In the short time since their inception, ChatGPT and other generative AI platforms have rightfully gained the reputation of ultimate productivity boosters. However, the very same technology that enables rapid production of high-quality text on demand, can at the same time expose sensitive corporate data. A recent incident, in which Samsung software engineers pasted proprietary code into ChatGPT,


feed_id: https://thehackernews.com/2023/04/daggerfly-cyberattack-campaign-hits.html
title: Daggerfly Cyberattack Campaign Hits African Telecom Services Providers
uri: 2023-04-23-Daggerfly-Cyberattack-Campaign-Hits-African-Telecom-Services-Providers
url: https://thehackernews.com/2023/04/daggerfly-cyberattack-campaign-hits.html
content:
Telecommunication services providers in Africa are the target of a new campaign orchestrated by a China-linked threat actor at least since November 2022.
The intrusions have been pinned on a hacking crew tracked by Symantec as Daggerfly, and which is also monitored by the broader cybersecurity community as Bronze Highland and Evasive Panda.
The campaign makes use of "previously unseen plugins


feed_id: https://thehackernews.com/2023/04/nso-group-used-3-zero-click-iphone.html
title: NSO Group Used 3 Zero-Click iPhone Exploits Against Human Rights Defenders
uri: 2023-04-23-NSO-Group-Used-3-Zero-Click-iPhone-Exploits-Against-Human-Rights-Defen
url: https://thehackernews.com/2023/04/nso-group-used-3-zero-click-iphone.html
content:
Israeli spyware maker NSO Group deployed at least three novel "zero-click" exploits against iPhones in 2022 to infiltrate defenses erected by Apple and deploy Pegasus, according to the latest findings from Citizen Lab.
"NSO Group customers widely deployed at least three iOS 15 and iOS 16 zero-click exploit chains against civil society targets around the world," the interdisciplinary laboratory


feed_id: https://thehackernews.com/2023/04/google-tag-warns-of-russian-hackers.html
title: Google TAG Warns of Russian Hackers Conducting Phishing Attacks in Ukraine
uri: 2023-04-23-Google-TAG-Warns-of-Russian-Hackers-Conducting-Phishing-Attacks-in-Ukr
url: https://thehackernews.com/2023/04/google-tag-warns-of-russian-hackers.html
content:
Elite hackers associated with Russia's military intelligence service have been linked to large-volume phishing campaigns aimed at hundreds of users in Ukraine to extract intelligence and influence public discourse related to the war.
Google's Threat Analysis Group (TAG), which is monitoring the activities of the actor under the name FROZENLAKE, said the attacks continue the "group's 2022 focus


feed_id: https://thehackernews.com/2023/04/blind-eagle-cyber-espionage-group.html
title: Blind Eagle Cyber Espionage Group Strikes Again: New Attack Chain Uncovered
uri: 2023-04-23-Blind-Eagle-Cyber-Espionage-Group-Strikes-Again-New-Attack-Chain-Unco
url: https://thehackernews.com/2023/04/blind-eagle-cyber-espionage-group.html
content:
The cyber espionage actor tracked as Blind Eagle has been linked to a new multi-stage attack chain that leads to the deployment of the NjRAT remote access trojan on compromised systems.
"The group is known for using a variety of sophisticated attack techniques, including custom malware, social engineering tactics, and spear-phishing attacks," ThreatMon said in a Tuesday report.
Blind Eagle, also


feed_id: https://thehackernews.com/2023/04/google-chrome-hit-by-second-zero-day.html
title: Google Chrome Hit by Second Zero-Day Attack - Urgent Patch Update Released
uri: 2023-04-23-Google-Chrome-Hit-by-Second-Zero-Day-Attack-Urgent-Patch-Update-Rele
url: https://thehackernews.com/2023/04/google-chrome-hit-by-second-zero-day.html
content:
Google on Tuesday rolled out emergency fixes to address another actively exploited high-severity zero-day flaw in its Chrome web browser.
The flaw, tracked as CVE-2023-2136, is described as a case of integer overflow in Skia, an open source 2D graphics library. Clément Lecigne of Google's Threat Analysis Group (TAG) has been credited with discovering and reporting the flaw on April 12, 2023.
"


feed_id: https://thehackernews.com/2023/04/uncovering-and-understanding-hidden.html
title: Uncovering (and Understanding) the Hidden Risks of SaaS Apps
uri: 2023-04-23-Uncovering-(and-Understanding)-the-Hidden-Risks-of-SaaS-Apps
url: https://thehackernews.com/2023/04/uncovering-and-understanding-hidden.html
content:
Recent data breaches across CircleCI, LastPass, and Okta underscore a common theme: The enterprise SaaS stacks connected to these industry-leading apps can be at serious risk for compromise.
CircleCI, for example, plays an integral, SaaS-to-SaaS role for SaaS app development. Similarly, tens of thousands of organizations rely on Okta and LastPass security roles for SaaS identity and access


feed_id: https://thehackernews.com/2023/04/pakistani-hackers-use-linux-malware.html
title: Pakistani Hackers Use Linux Malware Poseidon to Target Indian Government Agencies
uri: 2023-04-23-Pakistani-Hackers-Use-Linux-Malware-Poseidon-to-Target-Indian-Governme
url: https://thehackernews.com/2023/04/pakistani-hackers-use-linux-malware.html
content:
The Pakistan-based advanced persistent threat (APT) actor known as Transparent Tribe used a two-factor authentication (2FA) tool used by Indian government agencies as a ruse to deliver a new Linux backdoor called Poseidon.
"Poseidon is a second-stage payload malware associated with Transparent Tribe," Uptycs security researcher Tejaswini Sandapolla said in a technical report published this week.


feed_id: https://thehackernews.com/2023/04/us-and-uk-warn-of-russian-hackers.html
title: U.S. and U.K. Warn of Russian Hackers Exploiting Cisco Router Flaws for Espionage
uri: 2023-04-23-U-S-and-U-K-Warn-of-Russian-Hackers-Exploiting-Cisco-Router-Flaws-fo
url: https://thehackernews.com/2023/04/us-and-uk-warn-of-russian-hackers.html
content:
U.K. and U.S. cybersecurity and intelligence agencies have warned of Russian nation-state actors exploiting now-patched flaws in networking equipment from Cisco to conduct reconnaissance and deploy malware against select targets.
The intrusions, per the authorities, took place in 2021 and targeted a small number of entities in Europe, U.S. government institutions, and about 250 Ukrainian victims


feed_id: https://thehackernews.com/2023/04/iranian-government-backed-hackers.html
title: Iranian Government-Backed Hackers Targeting U.S. Energy and Transit Systems
uri: 2023-04-23-Iranian-Government-Backed-Hackers-Targeting-U-S-Energy-and-Transit-Sy
url: https://thehackernews.com/2023/04/iranian-government-backed-hackers.html
content:
An Iranian government-backed actor known as Mint Sandstorm has been linked to attacks aimed at critical infrastructure in the U.S. between late 2021 to mid-2022.
"This Mint Sandstorm subgroup is technically and operationally mature, capable of developing bespoke tooling and quickly weaponizing N-day vulnerabilities, and has demonstrated agility in its operational focus, which appears to align


feed_id: https://thehackernews.com/2023/04/critical-flaws-in-vm2-javascript.html
title: Critical Flaws in vm2 JavaScript Library Can Lead to Remote Code Execution
uri: 2023-04-23-Critical-Flaws-in-vm2-JavaScript-Library-Can-Lead-to-Remote-Code-Execu
url: https://thehackernews.com/2023/04/critical-flaws-in-vm2-javascript.html
content:
A fresh round of patches has been made available for the vm2 JavaScript library to address two critical flaws that could be exploited to break out of sandbox protections and achieve code execution.
Both the flaws – CVE-2023-29199 and CVE-2023-30547 – are rated 9.8 out of 10 on the CVSS scoring system and have been addressed in versions 3.9.16 and 3.9.17, respectively.
Successful exploitation of


feed_id: https://thehackernews.com/2023/04/youtube-videos-distributing-aurora.html
title: YouTube Videos Distributing Aurora Stealer Malware via Highly Evasive Loader
uri: 2023-04-23-YouTube-Videos-Distributing-Aurora-Stealer-Malware-via-Highly-Evasive
url: https://thehackernews.com/2023/04/youtube-videos-distributing-aurora.html
content:
Cybersecurity researchers have detailed the inner workings of a highly evasive loader named "in2al5d p3in4er" (read: invalid printer) that's used to deliver the Aurora information stealer malware.
"The in2al5d p3in4er loader is compiled with Embarcadero RAD Studio and targets endpoint workstations using advanced anti-VM (virtual machine) technique," cybersecurity firm Morphisec said in a report


feed_id: https://thehackernews.com/2023/04/goldoson-android-malware-infects-over.html
title: Goldoson Android Malware Infects Over 100 Million Google Play Store Downloads
uri: 2023-04-23-Goldoson-Android-Malware-Infects-Over-100-Million-Google-Play-Store-Do
url: https://thehackernews.com/2023/04/goldoson-android-malware-infects-over.html
content:
h
A new Android malware strain named Goldoson has been detected in the official Google Play Store spanning more than 60 legitimate apps that collectively have over 100 million downloads.
An additional eight million installations have been tracked through ONE store, a leading third-party app storefront in South Korea.
The rogue component is part of a third-party software library used by the apps


feed_id: https://thehackernews.com/2023/04/dfir-via-xdr-how-to-expedite-your.html
title: DFIR via XDR: How to expedite your investigations with a DFIRent approach
uri: 2023-04-23-DFIR-via-XDR-How-to-expedite-your-investigations-with-a-DFIRent-appro
url: https://thehackernews.com/2023/04/dfir-via-xdr-how-to-expedite-your.html
content:
Rapid technological evolution requires security that is resilient, up to date and adaptable.
In this article, we will cover the transformation in the field of DFIR (digital forensics and incident response) in the last couple years, focusing on the digital forensics' aspect and how XDR fits into the picture.
Before we dive into the details, let's first break down the main components of DFIR and


feed_id: https://thehackernews.com/2023/04/iranian-hackers-using-simplehelp-remote.html
title: Iranian Hackers Using SimpleHelp Remote Support Software for Persistent Access
uri: 2023-04-23-Iranian-Hackers-Using-SimpleHelp-Remote-Support-Software-for-Persisten
url: https://thehackernews.com/2023/04/iranian-hackers-using-simplehelp-remote.html
content:
The Iranian threat actor known as MuddyWater is continuing its time-tested tradition of relying on legitimate remote administration tools to commandeer targeted systems.
While the nation-state group has previously employed ScreenConnect, RemoteUtilities, and Syncro, a new analysis from Group-IB has revealed the adversary's use of the SimpleHelp remote support software in June 2022.
MuddyWater,


feed_id: https://thehackernews.com/2023/04/lockbit-ransomware-now-targeting-apple.html
title: LockBit Ransomware Now Targeting Apple macOS Devices
uri: 2023-04-23-LockBit-Ransomware-Now-Targeting-Apple-macOS-Devices
url: https://thehackernews.com/2023/04/lockbit-ransomware-now-targeting-apple.html
content:
Threat actors behind the LockBit ransomware operation have developed new artifacts that can encrypt files on devices running Apple's macOS operating system.
The development, which was reported by the MalwareHunterTeam over the weekend, appears to be the first time a big-game ransomware crew has created a macOS-based payload.
Additional samples identified by vx-underground show that the macOS


feed_id: https://thehackernews.com/2023/04/israeli-spyware-vendor-quadream-to-shut.html
title: Israeli Spyware Vendor QuaDream to Shut Down Following Citizen Lab and Microsoft Expose
uri: 2023-04-23-Israeli-Spyware-Vendor-QuaDream-to-Shut-Down-Following-Citizen-Lab-and
url: https://thehackernews.com/2023/04/israeli-spyware-vendor-quadream-to-shut.html
content:
Israeli spyware vendor QuaDream is allegedly shutting down its operations in the coming days, less than a week after its hacking toolset was exposed by Citizen Lab and Microsoft.
The development was reported by the Israeli business newspaper Calcalist, citing unnamed sources, adding the company "hasn't been fully active for a while" and that it "has been in a difficult situation for several


feed_id: https://thehackernews.com/2023/04/new-qbot-banking-trojan-campaign.html
title: New QBot Banking Trojan Campaign Hijacks Business Emails to Spread Malware
uri: 2023-04-23-New-QBot-Banking-Trojan-Campaign-Hijacks-Business-Emails-to-Spread-Mal
url: https://thehackernews.com/2023/04/new-qbot-banking-trojan-campaign.html
content:
A new QBot malware campaign is leveraging hijacked business correspondence to trick unsuspecting victims into installing the malware, new findings from Kaspersky reveal.
The latest activity, which commenced on April 4, 2023, has primarily targeted users in Germany, Argentina, Italy, Algeria, Spain, the U.S., Russia, France, the U.K., and Morocco.
QBot (aka Qakbot or Pinkslipbot) is a banking


feed_id: https://thehackernews.com/2023/04/fin7-and-ex-conti-cybercrime-gangs-join.html
title: FIN7 and Ex-Conti Cybercrime Gangs Join Forces in Domino Malware Attacks
uri: 2023-04-23-FIN7-and-Ex-Conti-Cybercrime-Gangs-Join-Forces-in-Domino-Malware-Attac
url: https://thehackernews.com/2023/04/fin7-and-ex-conti-cybercrime-gangs-join.html
content:
A new strain of malware developed by threat actors likely affiliated with the FIN7 cybercrime group has been put to use by the members of the now-defunct Conti ransomware gang, indicating collaboration between the two crews.
The malware, dubbed Domino, is primarily designed to facilitate follow-on exploitation on compromised systems, including delivering a lesser-known information stealer that


feed_id: https://thehackernews.com/2023/04/whats-difference-between-cspm-sspm.html
title: What's the Difference Between CSPM & SSPM?
uri: 2023-04-23-What-s-the-Difference-Between-CSPM-SSPM
url: https://thehackernews.com/2023/04/whats-difference-between-cspm-sspm.html
content:
Cloud Security Posture Management (CSPM) and SaaS Security Posture Management (SSPM) are frequently confused. The similarity of the acronyms notwithstanding, both security solutions focus on securing data in the cloud. In a world where the terms cloud and SaaS are used interchangeably, this confusion is understandable.
This confusion, though, is dangerous to organizations that need to secure


feed_id: https://thehackernews.com/2023/04/google-uncovers-apt41s-use-of-open.html
title: Google Uncovers APT41's Use of Open Source GC2 Tool to Target Media and Job Sites
uri: 2023-04-23-Google-Uncovers-APT41-s-Use-of-Open-Source-GC2-Tool-to-Target-Media-an
url: https://thehackernews.com/2023/04/google-uncovers-apt41s-use-of-open.html
content:
A Chinese nation-state group targeted an unnamed Taiwanese media organization to deliver an open source red teaming tool known as Google Command and Control (GC2) amid broader abuse of Google's infrastructure for malicious ends.
The tech giant's Threat Analysis Group (TAG) attributed the campaign to a threat actor it tracks under the geological and geographical-themed moniker HOODOO, which is


feed_id: https://thehackernews.com/2023/04/tour-of-underground-master-art-of-dark.html
title: Tour of the Underground: Master the Art of Dark Web Intelligence Gathering
uri: 2023-04-23-Tour-of-the-Underground-Master-the-Art-of-Dark-Web-Intelligence-Gathe
url: https://thehackernews.com/2023/04/tour-of-underground-master-art-of-dark.html
content:
The Deep, Dark Web – The Underground – is a haven for cybercriminals, teeming with tools and resources to launch attacks for financial gain, political motives, and other causes.
But did you know that the underground also offers a goldmine of threat intelligence and information that can be harnessed to bolster your cyber defense strategies? The challenge lies in continuously monitoring the right


feed_id: https://thehackernews.com/2023/04/vice-society-ransomware-using-stealthy.html
title: Vice Society Ransomware Using Stealthy PowerShell Tool for Data Exfiltration
uri: 2023-04-23-Vice-Society-Ransomware-Using-Stealthy-PowerShell-Tool-for-Data-Exfilt
url: https://thehackernews.com/2023/04/vice-society-ransomware-using-stealthy.html
content:
Threat actors associated with the Vice Society ransomware gang have been observed using a bespoke PowerShell-based tool to fly under the radar and automate the process of exfiltrating data from compromised networks.
"Threat actors (TAs) using built-in data exfiltration methods like [living off the land binaries and scripts] negate the need to bring in external tools that might be flagged by


feed_id: https://thehackernews.com/2023/04/new-zaraza-bot-credential-stealer-sold.html
title: New Zaraza Bot Credential-Stealer Sold on Telegram Targeting 38 Web Browsers
uri: 2023-04-23-New-Zaraza-Bot-Credential-Stealer-Sold-on-Telegram-Targeting-38-Web-Br
url: https://thehackernews.com/2023/04/new-zaraza-bot-credential-stealer-sold.html
content:
A novel credential-stealing malware called Zaraza bot is being offered for sale on Telegram while also using the popular messaging service as a command-and-control (C2).
"Zaraza bot targets a large number of web browsers and is being actively distributed on a Russian Telegram hacker channel popular with threat actors," cybersecurity company Uptycs said in a report published last week.
"Once the


feed_id: https://thehackernews.com/2023/04/google-releases-urgent-chrome-update-to.html
title: Google Releases Urgent Chrome Update to Fix Actively Exploited Zero-Day Vulnerability
uri: 2023-04-23-Google-Releases-Urgent-Chrome-Update-to-Fix-Actively-Exploited-Zero-Da
url: https://thehackernews.com/2023/04/google-releases-urgent-chrome-update-to.html
content:
Google on Friday released out-of-band updates to resolve an actively exploited zero-day flaw in its Chrome web browser, making it the first such bug to be addressed since the start of the year.
Tracked as CVE-2023-2033, the high-severity vulnerability has been described as a type confusion issue in the V8 JavaScript engine. Clement Lecigne of Google's Threat Analysis Group (TAG) has been


feed_id: https://thehackernews.com/2023/04/russia-linked-hackers-launches.html
title: Russia-Linked Hackers Launches Espionage Attacks on Foreign Diplomatic Entities
uri: 2023-04-23-Russia-Linked-Hackers-Launches-Espionage-Attacks-on-Foreign-Diplomatic
url: https://thehackernews.com/2023/04/russia-linked-hackers-launches.html
content:
The Russia-linked APT29 (aka Cozy Bear) threat actor has been attributed to an ongoing cyber espionage campaign targeting foreign ministries and diplomatic entities located in NATO member states, the European Union, and Africa.
According to Poland's Military Counterintelligence Service and the CERT Polska team, the observed activity shares tactical overlaps with a cluster tracked by Microsoft as


feed_id: https://thehackernews.com/2023/04/kodi-confirms-data-breach-400k-user.html
title: Kodi Confirms Data Breach: 400K User Records and Private Messages Stolen
uri: 2023-04-23-Kodi-Confirms-Data-Breach-400K-User-Records-and-Private-Messages-Stol
url: https://thehackernews.com/2023/04/kodi-confirms-data-breach-400k-user.html
content:
Open source media player software provider Kodi has confirmed a data breach after threat actors stole the company's MyBB forum database containing user data and private messages.
What's more, the unknown threat actors attempted to sell the data dump comprising 400,635 Kodi users on the now-defunct BreachForums cybercrime marketplace.
"MyBB admin logs show the account of a trusted but currently


feed_id: https://thehackernews.com/2023/04/severe-android-and-novi-survey.html
title: Severe Android and Novi Survey Vulnerabilities Under Active Exploitation
uri: 2023-04-23-Severe-Android-and-Novi-Survey-Vulnerabilities-Under-Active-Exploitati
url: https://thehackernews.com/2023/04/severe-android-and-novi-survey.html
content:
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation.
The two flaws are listed below -

CVE-2023-20963 (CVSS score: 7.8) - Android Framework Privilege Escalation Vulnerability
CVE-2023-29492 (CVSS score: TBD) - Novi Survey Insecure Deserialization Vulnerability


feed_id: https://thehackernews.com/2023/04/webinar-tips-from-mssps-to-mssps.html
title: Webinar: Tips from MSSPs to MSSPs – Building a Profitable vCISO Practice
uri: 2023-04-23-Webinar-Tips-from-MSSPs-to-MSSPs-Building-a-Profitable-vCISO-Prac
url: https://thehackernews.com/2023/04/webinar-tips-from-mssps-to-mssps.html
content:
In today's fast-paced and ever-changing digital landscape, businesses of all sizes face a myriad of cybersecurity threats. Putting in place the right people, technological tools and services, MSSPs are in a great position to ensure their customers' cyber resilience. 
The growing need of SMEs and SMBs for structured cybersecurity services can be leveraged by MSPs and MSSPs to provide strategic


feed_id: https://thehackernews.com/2023/04/google-launches-new-cybersecurity.html
title: Google Launches New Cybersecurity Initiatives to Strengthen Vulnerability Management
uri: 2023-04-23-Google-Launches-New-Cybersecurity-Initiatives-to-Strengthen-Vulnerabil
url: https://thehackernews.com/2023/04/google-launches-new-cybersecurity.html
content:
Google on Thursday outlined a set of initiatives aimed at improving the vulnerability management ecosystem and establishing greater transparency measures around exploitation.
"While the notoriety of zero-day vulnerabilities typically makes headlines, risks remain even after they're known and fixed, which is the real story," the company said in an announcement. "Those risks span everything from


feed_id: https://thehackernews.com/2023/04/rtm-locker-emerging-cybercrime-group.html
title: RTM Locker: Emerging Cybercrime Group Targeting Businesses with Ransomware
uri: 2023-04-23-RTM-Locker-Emerging-Cybercrime-Group-Targeting-Businesses-with-Ransom
url: https://thehackernews.com/2023/04/rtm-locker-emerging-cybercrime-group.html
content:
Cybersecurity researchers have detailed the tactics of a "rising" cybercriminal gang called "Read The Manual" (RTM) Locker that functions as a private ransomware-as-a-service (RaaS) provider and carries out opportunistic attacks to generate illicit profit.
"The 'Read The Manual' Locker gang uses affiliates to ransom victims, all of whom are forced to abide by the gang's strict rules,"


feed_id: https://thehackernews.com/2023/04/whatsapp-introduces-new-device.html
title: WhatsApp Introduces New Device Verification Feature to Prevent Account Takeover Attacks
uri: 2023-04-23-WhatsApp-Introduces-New-Device-Verification-Feature-to-Prevent-Account
url: https://thehackernews.com/2023/04/whatsapp-introduces-new-device.html
content:
Popular instant messaging app WhatsApp on Thursday announced a new account verification feature that ensures that malware running on a user's mobile device doesn't impact their account.
"Mobile device malware is one of the biggest threats to people's privacy and security today because it can take advantage of your phone without your permission and use your WhatsApp to send unwanted messages,"


feed_id: https://thehackernews.com/2023/04/new-python-based-legion-hacking-tool.html
title: New Python-Based "Legion" Hacking Tool Emerges on Telegram
uri: 2023-04-23-New-Python-Based-Legion-Hacking-Tool-Emerges-on-Telegram
url: https://thehackernews.com/2023/04/new-python-based-legion-hacking-tool.html
content:
An emerging Python-based credential harvester and a hacking tool named Legion is being marketed via Telegram as a way for threat actors to break into various online services for further exploitation.
Legion, according to Cado Labs, includes modules to enumerate vulnerable SMTP servers, conduct remote code execution (RCE) attacks, exploit unpatched versions of Apache, and brute-force cPanel and


feed_id: https://thehackernews.com/2023/04/pakistan-based-transparent-tribe.html
title: Pakistan-based Transparent Tribe Hackers Targeting Indian Educational Institutions
uri: 2023-04-23-Pakistan-based-Transparent-Tribe-Hackers-Targeting-Indian-Educational
url: https://thehackernews.com/2023/04/pakistan-based-transparent-tribe.html
content:
The Transparent Tribe threat actor has been linked to a set of weaponized Microsoft Office documents in intrusions directed against the Indian education sector to deploy a continuously maintained piece of malware called Crimson RAT.
While the suspected Pakistan-based threat group is known to target military and government entities in the country, the activities have since expanded to include the


feed_id: https://thehackernews.com/2023/04/why-shadow-apis-are-more-dangerous-than.html
title: Why Shadow APIs are More Dangerous than You Think
uri: 2023-04-23-Why-Shadow-APIs-are-More-Dangerous-than-You-Think
url: https://thehackernews.com/2023/04/why-shadow-apis-are-more-dangerous-than.html
content:
Shadow APIs are a growing risk for organizations of all sizes as they can mask malicious behavior and induce substantial data loss. For those that aren't familiar with the term, shadow APIs are a type of application programming interface (API) that isn't officially documented or supported. 
Contrary to popular belief, it's unfortunately all too common to have APIs in production that no one on


feed_id: https://thehackernews.com/2023/04/lazarus-hacker-group-evolves-tactics.html
title: Lazarus Hacker Group Evolves Tactics, Tools, and Targets in DeathNote Campaign
uri: 2023-04-23-Lazarus-Hacker-Group-Evolves-Tactics-Tools-and-Targets-in-DeathNote
url: https://thehackernews.com/2023/04/lazarus-hacker-group-evolves-tactics.html
content:
The North Korean threat actor known as the Lazarus Group has been observed shifting its focus and rapidly evolving its tools and tactics as part of a long-running campaign called DeathNote.
While the nation-state adversary is known for persistently singling out the cryptocurrency sector, recent attacks have also targeted automotive, academic, and defense sectors in Eastern Europe and other parts


feed_id: https://thehackernews.com/2023/04/chatgpt-security-openais-bug-bounty.html
title: ChatGPT Security: OpenAI's Bug Bounty Program Offers Up to $20,000 Prizes
uri: 2023-04-23-ChatGPT-Security-OpenAI-s-Bug-Bounty-Program-Offers-Up-to-20-000-Pri
url: https://thehackernews.com/2023/04/chatgpt-security-openais-bug-bounty.html
content:
OpenAI, the company behind the massively popular ChatGPT AI chatbot, has launched a bug bounty program in an attempt to ensure its systems are "safe and secure."
To that end, it has partnered with the crowdsourced security platform Bugcrowd for independent researchers to report vulnerabilities discovered in its product in exchange for rewards ranging from "$200 for low-severity findings to up to


feed_id: https://thehackernews.com/2023/04/israel-based-spyware-firm-quadream.html
title: Israel-based Spyware Firm QuaDream Targets High-Risk iPhones with Zero-Click Exploit
uri: 2023-04-23-Israel-based-Spyware-Firm-QuaDream-Targets-High-Risk-iPhones-with-Zero
url: https://thehackernews.com/2023/04/israel-based-spyware-firm-quadream.html
content:
Threat actors using hacking tools from an Israeli surveillanceware vendor named QuaDream targeted at least five members of civil society in North America, Central Asia, Southeast Asia, Europe, and the Middle East.
According to findings from a group of researchers from the Citizen Lab, the spyware campaign was directed against journalists, political opposition figures, and an NGO worker in 2021.


feed_id: https://thehackernews.com/2023/04/the-service-accounts-challenge-cant-see.html
title: The Service Accounts Challenge: Can't See or Secure Them Until It's Too Late
uri: 2023-04-23-The-Service-Accounts-Challenge-Can-t-See-or-Secure-Them-Until-It-s-To
url: https://thehackernews.com/2023/04/the-service-accounts-challenge-cant-see.html
content:
Here's a hard question to answer: 'How many service accounts do you have in your environment?'. A harder one is: 'Do you know what these accounts are doing?'. And the hardest is probably: 'If any of your service account was compromised and used to access resources would you be able to detect and stop that in real-time?'. 
Since most identity and security teams would provide a negative reply,


feed_id: https://thehackernews.com/2023/05/bouldspy-android-spyware-iranian.html
title: BouldSpy Android Spyware: Iranian Government's Alleged Tool for Spying on Minority Groups
uri: 2023-05-02-BouldSpy-Android-Spyware-Iranian-Government-s-Alleged-Tool-for-Spying
url: https://thehackernews.com/2023/05/bouldspy-android-spyware-iranian.html
content:
A new Android surveillanceware possibly used by the Iranian government has been used to spy on over 300 individuals belonging to minority groups.
The malware, dubbed BouldSpy, has been attributed with moderate confidence to the Law Enforcement Command of the Islamic Republic of Iran (FARAJA). Targeted victims include Iranian Kurds, Baluchis, Azeris, and Armenian Christian groups.
"The spyware


feed_id: https://thehackernews.com/2023/05/why-telecoms-struggle-with-saas-security.html
title: Why Telecoms Struggle with SaaS Security
uri: 2023-05-02-Why-Telecoms-Struggle-with-SaaS-Security
url: https://thehackernews.com/2023/05/why-telecoms-struggle-with-saas-security.html
content:
The telecom industry has always been a tantalizing target for cybercriminals. The combination of interconnected networks, customer data, and sensitive information allows cybercriminals to inflict maximum damage through minimal effort.
It’s the breaches in telecom companies that tend to have a seismic impact and far-reaching implications — in addition to reputational damage, which can be


feed_id: https://thehackernews.com/2023/05/lobshot-stealthy-financial-trojan-and.html
title: LOBSHOT: A Stealthy, Financial Trojan and Info Stealer Delivered through Google Ads
uri: 2023-05-02-LOBSHOT-A-Stealthy-Financial-Trojan-and-Info-Stealer-Delivered-throu
url: https://thehackernews.com/2023/05/lobshot-stealthy-financial-trojan-and.html
content:
In yet another instance of how threat actors are abusing Google Ads to serve malware, a threat actor has been observed leveraging the technique to deliver a new Windows-based financial trojan and information stealer called LOBSHOT.
"LOBSHOT continues to collect victims while staying under the radar," Elastic Security Labs researcher Daniel Stepanic said in an analysis published last week.
"One


feed_id: https://thehackernews.com/2023/05/north-koreas-scarcruft-deploys-rokrat.html
title: North Korea's ScarCruft Deploys RokRAT Malware via LNK File Infection Chains
uri: 2023-05-02-North-Korea-s-ScarCruft-Deploys-RokRAT-Malware-via-LNK-File-Infection
url: https://thehackernews.com/2023/05/north-koreas-scarcruft-deploys-rokrat.html
content:
The North Korean threat actor known as ScarCruft started experimenting with oversized LNK files as a delivery route for RokRAT malware as early as July 2022, the same month Microsoft began blocking macros across Office documents by default.
"RokRAT has not changed significantly over the years, but its deployment methods have evolved, now utilizing archives containing LNK files that initiate


feed_id: https://thehackernews.com/2023/05/active-exploitation-of-tp-link-apache.html
title: Alert: Active Exploitation of TP-Link, Apache, and Oracle Vulnerabilities Detected
uri: 2023-05-02-Alert-Active-Exploitation-of-TP-Link-Apache-and-Oracle-Vulnerabilit
url: https://thehackernews.com/2023/05/active-exploitation-of-tp-link-apache.html
content:
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added three flaws to the Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation.
The security vulnerabilities are as follows -

CVE-2023-1389 (CVSS score: 8.8) - TP-Link Archer AX-21 Command Injection Vulnerability
CVE-2021-45046 (CVSS score: 9.0) - Apache Log4j2 Deserialization of Untrusted


feed_id: https://thehackernews.com/2023/05/new-decoy-dog-malware-toolkit-uncovered.html
title: New Decoy Dog Malware Toolkit Uncovered: Targeting Enterprise Networks
uri: 2023-05-02-New-Decoy-Dog-Malware-Toolkit-Uncovered-Targeting-Enterprise-Networks
url: https://thehackernews.com/2023/05/new-decoy-dog-malware-toolkit-uncovered.html
content:
An analysis of over 70 billion DNS records has led to the discovery of a new sophisticated malware toolkit dubbed Decoy Dog targeting enterprise networks.
Decoy Dog, as the name implies, is evasive and employs techniques like strategic domain aging and DNS query dribbling, wherein a series of queries are transmitted to the command-and-control (C2) domains so as to not arouse any suspicion.
"


feed_id: https://thehackernews.com/2023/05/wanted-dead-or-alive-real-time.html
title: Wanted Dead or Alive: Real-Time Protection Against Lateral Movement
uri: 2023-05-02-Wanted-Dead-or-Alive-Real-Time-Protection-Against-Lateral-Movement
url: https://thehackernews.com/2023/05/wanted-dead-or-alive-real-time.html
content:
Just a few short years ago, lateral movement was a tactic confined to top APT cybercrime organizations and nation-state operators. Today, however, it has become a commoditized tool, well within the skillset of any ransomware threat actor. This makes real-time detection and prevention of lateral movement a necessity to organizations of all sizes and across all industries. But the disturbing truth


feed_id: https://thehackernews.com/2023/05/vietnamese-threat-actor-infects-500000.html
title: Vietnamese Threat Actor Infects 500,000 Devices Using 'Malverposting' Tactics
uri: 2023-05-02-Vietnamese-Threat-Actor-Infects-500-000-Devices-Using-Malverposting
url: https://thehackernews.com/2023/05/vietnamese-threat-actor-infects-500000.html
content:
A Vietnamese threat actor has been attributed as behind a "malverposting" campaign on social media platforms to infect over 500,000 devices worldwide over the past three months to deliver variants of information stealers such as S1deload Stealer and SYS01stealer.
Malverposting refers to the use of promoted social media posts on services like Facebook and Twitter to mass propagate malicious


feed_id: https://thehackernews.com/2023/05/apt28-targets-ukrainian-government.html
title: APT28 Targets Ukrainian Government Entities with Fake "Windows Update" Emails
uri: 2023-05-02-APT28-Targets-Ukrainian-Government-Entities-with-Fake-Windows-Update
url: https://thehackernews.com/2023/05/apt28-targets-ukrainian-government.html
content:
The Computer Emergency Response Team of Ukraine (CERT-UA) has warned of cyber attacks perpetrated by Russian nation-state hackers targeting various government bodies in the country.
The agency attributed the phishing campaign to APT28, which is also known by the names Fancy Bear, Forest Blizzard, FROZENLAKE, Iron Twilight, Sednit, and Sofacy.
The email messages come with the subject line "


feed_id: https://thehackernews.com/2023/05/google-blocks-143-million-malicious.html
title: Google Blocks 1.43 Million Malicious Apps, Bans 173,000 Bad Accounts in 2022
uri: Google-Blocks-1-43-Million-Malicious-Apps-Bans-173-000-Bad-Accounts-i
url: https://thehackernews.com/2023/05/google-blocks-143-million-malicious.html
content:
Google disclosed that its improved security features and app review processes helped it block 1.43 million bad apps from being published to the Play Store in 2022.
In addition, the company said it banned 173,000 bad accounts and fended off over $2 billion in fraudulent and abusive transactions through developer-facing features like Voided Purchases API, Obfuscated Account ID, and Play Integrity


feed_id: https://thehackernews.com/2023/04/cisa-warns-of-critical-flaws-in.html
title: CISA Warns of Critical Flaws in Illumina's DNA Sequencing Instruments
uri: 2023-05-02-CISA-Warns-of-Critical-Flaws-in-Illumina-s-DNA-Sequencing-Instruments
url: https://thehackernews.com/2023/04/cisa-warns-of-critical-flaws-in.html
content:
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has released an Industrial Control Systems (ICS) medical advisory warning of a critical flaw impacting Illumina medical devices.
The issues impact the Universal Copy Service (UCS) software in the Illumina MiSeqDx, NextSeq 550Dx, iScan, iSeq 100, MiniSeq, MiSeq, NextSeq 500, NextSeq 550, NextSeq 1000/2000, and NovaSeq 6000 DNA


feed_id: https://thehackernews.com/2023/04/chatgpt-is-back-in-italy-after.html
title: ChatGPT is Back in Italy After Addressing Data Privacy Concerns
uri: 2023-05-02-ChatGPT-is-Back-in-Italy-After-Addressing-Data-Privacy-Concerns
url: https://thehackernews.com/2023/04/chatgpt-is-back-in-italy-after.html
content:
OpenAI, the company behind ChatGPT, has officially made a return to Italy after the company met the data protection authority's demands ahead of April 30, 2023, deadline.
The development was first reported by the Associated Press. OpenAI's CEO, Sam Altman, tweeted, "we're excited ChatGPT is available in [Italy] again!"
The reinstatement comes following Garante's decision to temporarily block 


feed_id: https://thehackernews.com/2023/04/new-atomic-macos-stealer-can-steal-your.html
title: New Atomic macOS Malware Steals Keychain Passwords and Crypto Wallets
uri: 2023-05-02-New-Atomic-macOS-Malware-Steals-Keychain-Passwords-and-Crypto-Wallets
url: https://thehackernews.com/2023/04/new-atomic-macos-stealer-can-steal-your.html
content:
Threat actors are advertising a new information stealer for the Apple macOS operating system called Atomic macOS Stealer (or AMOS) on Telegram for $1,000 per month, joining the likes of MacStealer.
"The Atomic macOS Stealer can steal various types of information from the victim's machine, including Keychain passwords, complete system information, files from the desktop and documents folder, and


feed_id: https://thehackernews.com/2023/04/why-your-detection-first-security.html
title: Why Your Detection-First Security Approach Isn't Working
uri: 2023-05-02-Why-Your-Detection-First-Security-Approach-Isn-t-Working
url: https://thehackernews.com/2023/04/why-your-detection-first-security.html
content:
Stopping new and evasive threats is one of the greatest challenges in cybersecurity. This is among the biggest reasons why attacks increased dramatically in the past year yet again, despite the estimated $172 billion spent on global cybersecurity in 2022.
Armed with cloud-based tools and backed by sophisticated affiliate networks, threat actors can develop new and evasive malware more quickly


feed_id: https://thehackernews.com/2023/04/zyxel-firewall-devices-vulnerable-to.html
title: Zyxel Firewall Devices Vulnerable to Remote Code Execution Attacks — Patch Now
uri: 2023-05-02-Zyxel-Firewall-Devices-Vulnerable-to-Remote-Code-Execution-Attacks
url: https://thehackernews.com/2023/04/zyxel-firewall-devices-vulnerable-to.html
content:
Networking equipment maker Zyxel has released patches for a critical security flaw in its firewall devices that could be exploited to achieve remote code execution on affected systems.
The issue, tracked as CVE-2023-28771, is rated 9.8 on the CVSS scoring system. Researchers from TRAPA Security have been credited with reporting the flaw.
"Improper error message handling in some firewall versions


feed_id: https://thehackernews.com/2023/04/vipersoftx-infostealer-adopts.html
title: ViperSoftX InfoStealer Adopts Sophisticated Techniques to Avoid Detection
uri: 2023-05-02-ViperSoftX-InfoStealer-Adopts-Sophisticated-Techniques-to-Avoid-Detect
url: https://thehackernews.com/2023/04/vipersoftx-infostealer-adopts.html
content:
A significant number of victims in the consumer and enterprise sectors located across Australia, Japan, the U.S., and India have been affected by an evasive information-stealing malware called ViperSoftX.
ViperSoftX was first documented by Fortinet in 2020, with cybersecurity company Avast detailing a campaign in November 2022 that leveraged the malware to distribute a malicious Google Chrome


feed_id: https://thehackernews.com/2023/04/attention-online-shoppers-dont-be.html
title: Attention Online Shoppers: Don't Be Fooled by Their Sleek, Modern Looks — It's Magecart!
uri: 2023-05-02-Attention-Online-Shoppers-Don-t-Be-Fooled-by-Their-Sleek-Modern-Look
url: https://thehackernews.com/2023/04/attention-online-shoppers-dont-be.html
content:
An ongoing Magecart campaign has attracted the attention of cybersecurity researchers for leveraging realistic-looking fake payment screens to capture sensitive data entered by unsuspecting users.
"The threat actor used original logos from the compromised store and customized a web element known as a modal to perfectly hijack the checkout page," Jérôme Segura, director of threat intelligence at


feed_id: https://thehackernews.com/2023/04/tonto-team-uses-anti-malware-file-to.html
title: Tonto Team Uses Anti-Malware File to Launch Attacks on South Korean Institutions
uri: 2023-05-02-Tonto-Team-Uses-Anti-Malware-File-to-Launch-Attacks-on-South-Korean-In
url: https://thehackernews.com/2023/04/tonto-team-uses-anti-malware-file-to.html
content:
South Korean education, construction, diplomatic, and political institutions are at the receiving end of new attacks perpetrated by a China-aligned threat actor known as the Tonto Team.
"Recent cases have revealed that the group is using a file related to anti-malware products to ultimately execute their malicious attacks," the AhnLab Security Emergency Response Center (ASEC) said in a report


feed_id: https://thehackernews.com/2023/04/google-gets-court-order-to-take-down.html
title: Google Gets Court Order to Take Down CryptBot That Infected Over 670,000 Computers
uri: 2023-05-02-Google-Gets-Court-Order-to-Take-Down-CryptBot-That-Infected-Over-670-0
url: https://thehackernews.com/2023/04/google-gets-court-order-to-take-down.html
content:
Google on Wednesday said it obtained a temporary court order in the U.S. to disrupt the distribution of a Windows-based information-stealing malware called CryptBot and "decelerate" its growth.
The tech giant's Mike Trinh and Pierre-Marc Bureau said the efforts are part of steps it takes to "not only hold criminal operators of malware accountable, but also those who profit from its distribution.


feed_id: https://thehackernews.com/2023/04/paperbug-attack-new-politically.html
title: Paperbug Attack: New Politically-Motivated Surveillance Campaign in Tajikistan
uri: 2023-05-02-Paperbug-Attack-New-Politically-Motivated-Surveillance-Campaign-in-Ta
url: https://thehackernews.com/2023/04/paperbug-attack-new-politically.html
content:
A little-known Russian-speaking cyber-espionage group has been linked to a new politically-motivated surveillance campaign targeting high-ranking government officials, telecom services, and public service infrastructures in Tajikistan.
The intrusion set, dubbed Paperbug by Swiss cybersecurity company PRODAFT, has been attributed to a threat actor known as Nomadic Octopus (aka DustSquad).
"The


feed_id: https://thehackernews.com/2023/04/limerat-malware-analysis-extracting.html
title: LimeRAT Malware Analysis: Extracting the Config
uri: 2023-05-02-LimeRAT-Malware-Analysis-Extracting-the-Config
url: https://thehackernews.com/2023/04/limerat-malware-analysis-extracting.html
content:
Remote Access Trojans (RATs) have taken the third leading position in ANY. RUN's Q1 2023 report on the most prevalent malware types, making it highly probable that your organization may face this threat.
Though LimeRAT might not be the most well-known RAT family, its versatility is what sets it apart. Capable of carrying out a broad spectrum of malicious activities, it excels not only in data


feed_id: https://thehackernews.com/2023/04/rtm-lockers-first-linux-ransomware.html
title: RTM Locker's First Linux Ransomware Strain Targeting NAS and ESXi Hosts
uri: 2023-05-02-RTM-Locker-s-First-Linux-Ransomware-Strain-Targeting-NAS-and-ESXi-Host
url: https://thehackernews.com/2023/04/rtm-lockers-first-linux-ransomware.html
content:
The threat actors behind RTM Locker have developed a ransomware strain that's capable of targeting Linux machines, marking the group's first foray into the open source operating system.
"Its locker ransomware infects Linux, NAS, and ESXi hosts and appears to be inspired by Babuk ransomware's leaked source code," Uptycs said in a new report published Wednesday. "It uses a combination of ECDH on


feed_id: https://thehackernews.com/2023/04/microsoft-confirms-papercut-servers.html
title: Microsoft Confirms PaperCut Servers Used to Deliver LockBit and Cl0p Ransomware
uri: 2023-05-02-Microsoft-Confirms-PaperCut-Servers-Used-to-Deliver-LockBit-and-Cl0p-R
url: https://thehackernews.com/2023/04/microsoft-confirms-papercut-servers.html
content:
Microsoft has confirmed that the active exploitation of PaperCut servers is linked to attacks that are designed to deliver Cl0p and LockBit ransomware families.
The tech giant's threat intelligence team is attributing a subset of the intrusions to a financially motivated actor it tracks under the name Lace Tempest (formerly DEV-0950), which overlaps with other hacking groups like FIN11, TA505,


feed_id: https://thehackernews.com/2023/04/chinese-hackers-using-pingpull-linux.html
title: Chinese Hackers Spotted Using Linux Variant of PingPull in Targeted Cyberattacks
uri: 2023-05-02-Chinese-Hackers-Spotted-Using-Linux-Variant-of-PingPull-in-Targeted-Cy
url: https://thehackernews.com/2023/04/chinese-hackers-using-pingpull-linux.html
content:
The Chinese nation-state group dubbed Alloy Taurus is using a Linux variant of a backdoor called PingPull as well as a new undocumented tool codenamed Sword2033.
That's according to findings from Palo Alto Networks Unit 42, which discovered recent malicious cyber activity carried out by the group targeting South Africa and Nepal.
Alloy Taurus is the constellation-themed moniker assigned to a


feed_id: https://thehackernews.com/2023/04/charming-kittens-new-bellaciao-malware.html
title: Charming Kitten's New BellaCiao Malware Discovered in Multi-Country Attacks
uri: 2023-05-02-Charming-Kitten-s-New-BellaCiao-Malware-Discovered-in-Multi-Country-At
url: https://thehackernews.com/2023/04/charming-kittens-new-bellaciao-malware.html
content:
The prolific Iranian nation-state group known as Charming Kitten is actively targeting multiple victims in the U.S., Europe, the Middle East and India with a novel malware dubbed BellaCiao, adding to its ever-expanding list of custom tools.
Discovered by Bitdefender Labs, BellaCiao is a "personalized dropper" that's capable of delivering other malware payloads onto a victim machine based on


feed_id: https://thehackernews.com/2023/04/chinese-hackers-using-mgbot-malware-to.html
title: Chinese Hackers Using MgBot Malware to Target International NGOs in Mainland China
uri: 2023-05-02-Chinese-Hackers-Using-MgBot-Malware-to-Target-International-NGOs-in-Ma
url: https://thehackernews.com/2023/04/chinese-hackers-using-mgbot-malware-to.html
content:
The advanced persistent threat (APT) group referred to as Evasive Panda has been observed targeting an international non-governmental organization (NGO) in Mainland China with malware delivered via update channels of legitimate applications like Tencent QQ.
The attack chains are designed to distribute a Windows installer for MgBot malware, ESET security researcher Facundo Muñoz said in a new


feed_id: https://thehackernews.com/2023/04/browser-security-survey-87-of-saas.html
title: Browser Security Survey: 87% of SaaS Adopters Exposed to Browser-borne Attacks
uri: 2023-05-02-Browser-Security-Survey-87-of-SaaS-Adopters-Exposed-to-Browser-borne
url: https://thehackernews.com/2023/04/browser-security-survey-87-of-saas.html
content:
The browser serves as the primary interface between the on-premises environment, the cloud, and the web in the modern enterprise. Therefore, the browser is also exposed to multiple types of cyber threats and operational risks. 
In light of this significant challenge, how are CISOs responding?
LayerX, Browser Security platform provider, has polled more than 150 CISOs across multiple verticals and


feed_id: https://thehackernews.com/2023/04/apache-superset-vulnerability-insecure.html
title: Apache Superset Vulnerability: Insecure Default Configuration Exposes Servers to RCE Attacks
uri: 2023-05-02-Apache-Superset-Vulnerability-Insecure-Default-Configuration-Exposes
url: https://thehackernews.com/2023/04/apache-superset-vulnerability-insecure.html
content:
The maintainers of the Apache Superset open source data visualization software have released fixes to plug an insecure default configuration that could lead to remote code execution.
The vulnerability, tracked as CVE-2023-27524 (CVSS score: 8.9), impacts versions up to and including 2.0.1 and relates to the use of a default SECRET_KEY that could be abused by attackers to authenticate and access


feed_id: https://thehackernews.com/2023/04/vmware-releases-critical-patches-for.html
title: VMware Releases Critical Patches for Workstation and Fusion Software
uri: 2023-05-02-VMware-Releases-Critical-Patches-for-Workstation-and-Fusion-Software
url: https://thehackernews.com/2023/04/vmware-releases-critical-patches-for.html
content:
VMware has released updates to resolve multiple security flaws impacting its Workstation and Fusion software, the most critical of which could allow a local attacker to achieve code execution.
The vulnerability, tracked as CVE-2023-20869 (CVSS score: 9.3), is described as a stack-based buffer-overflow vulnerability that resides in the functionality for sharing host Bluetooth devices with the


feed_id: https://thehackernews.com/2023/04/new-slp-vulnerability-could-let.html
title: New SLP Vulnerability Could Let Attackers Launch 2200x Powerful DDoS Attacks
uri: 2023-05-02-New-SLP-Vulnerability-Could-Let-Attackers-Launch-2200x-Powerful-DDoS-A
url: https://thehackernews.com/2023/04/new-slp-vulnerability-could-let.html
content:
Details have emerged about a high-severity security vulnerability impacting Service Location Protocol (SLP) that could be weaponized to launch volumetric denial-of-service attacks against targets.
"Attackers exploiting this vulnerability could leverage vulnerable instances to launch massive Denial-of-Service (DoS) amplification attacks with a factor as high as 2,200 times, potentially making it


feed_id: https://thehackernews.com/2023/04/iranian-hackers-launch-sophisticated.html
title: Iranian Hackers Launch Sophisticated Attacks Targeting Israel with PowerLess Backdoor
uri: 2023-05-02-Iranian-Hackers-Launch-Sophisticated-Attacks-Targeting-Israel-with-Pow
url: https://thehackernews.com/2023/04/iranian-hackers-launch-sophisticated.html
content:
An Iranian nation-state threat actor has been linked to a new wave of phishing attacks targeting Israel that's designed to deploy an updated version of a Windows backdoor called PowerLess.
Cybersecurity firm Check Point is tracking the activity cluster under its mythical creature handle Educated Manticore, which exhibits "strong overlaps" with a hacking crew known as APT35, Charming Kitten,


feed_id: https://thehackernews.com/2023/04/modernizing-vulnerability-management.html
title: Modernizing Vulnerability Management: The Move Toward Exposure Management
uri: 2023-05-02-Modernizing-Vulnerability-Management-The-Move-Toward-Exposure-Managem
url: https://thehackernews.com/2023/04/modernizing-vulnerability-management.html
content:
Managing vulnerabilities in the constantly evolving technological landscape is a difficult task. Although vulnerabilities emerge regularly, not all vulnerabilities present the same level of risk. Traditional metrics such as CVSS score or the number of vulnerabilities are insufficient for effective vulnerability management as they lack business context, prioritization, and understanding of


feed_id: https://thehackernews.com/2023/04/lazarus-subgroup-targeting-apple.html
title: Lazarus Subgroup Targeting Apple Devices with New RustBucket macOS Malware
uri: 2023-05-02-Lazarus-Subgroup-Targeting-Apple-Devices-with-New-RustBucket-macOS-Mal
url: https://thehackernews.com/2023/04/lazarus-subgroup-targeting-apple.html
content:
A financially-motivated North Korean threat actor is suspected to be behind a new Apple macOS malware strain called RustBucket.
"[RustBucket] communicates with command and control (C2) servers to download and execute various payloads," Jamf Threat Labs researchers Ferdous Saljooki and Jaron Bradley said in a technical report published last week. 
The Apple device management company attributed it


feed_id: https://thehackernews.com/2023/04/google-cloud-introduces-security-ai.html
title: Google Cloud Introduces Security AI Workbench for Faster Threat Detection and Analysis
uri: 2023-05-02-Google-Cloud-Introduces-Security-AI-Workbench-for-Faster-Threat-Detect
url: https://thehackernews.com/2023/04/google-cloud-introduces-security-ai.html
content:
Google's cloud division is following in the footsteps of Microsoft with the launch of Security AI Workbench that leverages generative AI models to gain better visibility into the threat landscape. 
Powering the cybersecurity suite is Sec-PaLM, a specialized large language model (LLM) that's "fine-tuned for security use cases."
The idea is to take advantage of the latest advances in AI to augment


feed_id: https://thehackernews.com/2023/04/google-authenticator-app-gets-cloud.html
title: Google Authenticator App Gets Cloud Backup Feature for TOTP Codes
uri: 2023-05-02-Google-Authenticator-App-Gets-Cloud-Backup-Feature-for-TOTP-Codes
url: https://thehackernews.com/2023/04/google-authenticator-app-gets-cloud.html
content:
Search giant Google on Monday unveiled a major update to its 12-year-old Authenticator app for Android and iOS with an account synchronization option that allows users to back up their time-based one-time passwords (TOTPs) to the cloud.
"This change means users are better protected from lockout and that services can rely on users retaining access, increasing both convenience and security,"


feed_id: https://thehackernews.com/2023/04/russian-hackers-tomiris-targeting.html
title: Russian Hackers Tomiris Targeting Central Asia for Intelligence Gathering
uri: 2023-05-02-Russian-Hackers-Tomiris-Targeting-Central-Asia-for-Intelligence-Gather
url: https://thehackernews.com/2023/04/russian-hackers-tomiris-targeting.html
content:
The Russian-speaking threat actor behind a backdoor known as Tomiris is primarily focused on gathering intelligence in Central Asia, fresh findings from Kaspersky reveal.
"Tomiris's endgame consistently appears to be the regular theft of internal documents," security researchers Pierre Delcher and Ivan Kwiatkowski said in an analysis published today. "The threat actor targets government and


feed_id: https://thehackernews.com/2023/04/ransomware-hackers-using-aukill-tool-to.html
title: Ransomware Hackers Using AuKill Tool to Disable EDR Software Using BYOVD Attack
uri: 2023-05-02-Ransomware-Hackers-Using-AuKill-Tool-to-Disable-EDR-Software-Using-BYO
url: https://thehackernews.com/2023/04/ransomware-hackers-using-aukill-tool-to.html
content:
Threat actors are employing a previously undocumented "defense evasion tool" dubbed AuKill that's designed to disable endpoint detection and response (EDR) software by means of a Bring Your Own Vulnerable Driver (BYOVD) attack.
"The AuKill tool abuses an outdated version of the driver used by version 16.32 of the Microsoft utility, Process Explorer, to disable EDR processes before deploying


feed_id: https://thehackernews.com/2023/04/study-84-of-companies-use-breached-saas.html
title: Study: 84% of Companies Use Breached SaaS Applications - Here's How to Fix it for Free!
uri: 2023-05-02-Study-84-of-Companies-Use-Breached-SaaS-Applications-Here-s-How-to
url: https://thehackernews.com/2023/04/study-84-of-companies-use-breached-saas.html
content:
A recent review by Wing Security, a SaaS security company that analyzed the data of over 500 companies, revealed some worrisome information. According to this review, 84% of the companies had employees using an average of 3.5 SaaS applications that were breached in the previous 3 months. While this is concerning, it isn't much of a surprise. The exponential growth in SaaS usage has security and


feed_id: https://thehackernews.com/2023/04/hackers-exploit-outdated-wordpress.html
title: Hackers Exploit Outdated WordPress Plugin to Backdoor Thousands of WordPress Sites
uri: 2023-05-02-Hackers-Exploit-Outdated-WordPress-Plugin-to-Backdoor-Thousands-of-Wor
url: https://thehackernews.com/2023/04/hackers-exploit-outdated-wordpress.html
content:
Threat actors have been observed leveraging a legitimate but outdated WordPress plugin to surreptitiously backdoor websites as part of an ongoing campaign, Sucuri revealed in a report published last week.
The plugin in question is Eval PHP, released by a developer named flashpixx. It allows users to insert PHP code pages and posts of WordPress sites that's then executed every time the posts are


feed_id: https://thehackernews.com/2023/04/new-all-in-one-evilextractor-stealer.html
title: New All-in-One "EvilExtractor" Stealer for Windows Systems Surfaces on the Dark Web
uri: 2023-05-02-New-All-in-One-EvilExtractor-Stealer-for-Windows-Systems-Surfaces-on
url: https://thehackernews.com/2023/04/new-all-in-one-evilextractor-stealer.html
content:
A new "all-in-one" stealer malware named EvilExtractor (also spelled Evil Extractor) is being marketed for sale for other threat actors to steal data and files from Windows systems.
"It includes several modules that all work via an FTP service," Fortinet FortiGuard Labs researcher Cara Lin said. "It also contains environment checking and Anti-VM functions. Its primary purpose seems to be to


feed_id: https://thehackernews.com/2023/04/russian-hackers-suspected-in-ongoing.html
title: Russian Hackers Suspected in Ongoing Exploitation of Unpatched PaperCut Servers
uri: 2023-05-02-Russian-Hackers-Suspected-in-Ongoing-Exploitation-of-Unpatched-PaperCu
url: https://thehackernews.com/2023/04/russian-hackers-suspected-in-ongoing.html
content:
Print management software provider PaperCut said that it has "evidence to suggest that unpatched servers are being exploited in the wild," citing two vulnerability reports from cybersecurity company Trend Micro.
"PaperCut has conducted analysis on all customer reports, and the earliest signature of suspicious activity on a customer server potentially linked to this vulnerability is 14th April 01


feed_id: https://thehackernews.com/2023/05/google-introduces-passwordless-secure.html
title: Google Introduces Passwordless Secure Sign-In with Passkeys for Google Accounts
uri: 2023-05-04-Google-Introduces-Passwordless-Secure-Sign-In-with-Passkeys-for-Google
url: https://thehackernews.com/2023/05/google-introduces-passwordless-secure.html
content:
Almost five months after Google added support for passkeys to its Chrome browser, the tech giant has begun rolling out the passwordless solution across Google Accounts on all platforms.
Passkeys, backed by the FIDO Alliance, are a more secure way to sign in to apps and websites without having to use a traditional password. This, in turn, can be achieved by simply unlocking their computer or


feed_id: https://thehackernews.com/2023/05/chinese-hacker-group-earth-longzhi.html
title: Chinese Hacker Group Earth Longzhi Resurfaces with Advanced Malware Tactics
uri: 2023-05-04-Chinese-Hacker-Group-Earth-Longzhi-Resurfaces-with-Advanced-Malware-Ta
url: https://thehackernews.com/2023/05/chinese-hacker-group-earth-longzhi.html
content:
A Chinese state-sponsored hacking outfit has resurfaced with a new campaign targeting government, healthcare, technology, and manufacturing entities based in Taiwan, Thailand, the Philippines, and Fiji after more than six months of no activity.
Trend Micro attributed the intrusion set to a cyber espionage group it tracks under the name Earth Longzhi, which is a subgroup within APT41 (aka HOODOO


feed_id: https://thehackernews.com/2023/05/operation-spector-534-million-seized.html
title: Operation SpecTor: $53.4 Million Seized, 288 Vendors Arrested in Dark Web Drug Bust
uri: 2023-05-04-Operation-SpecTor-53-4-Million-Seized-288-Vendors-Arrested-in-Dark
url: https://thehackernews.com/2023/05/operation-spector-534-million-seized.html
content:
An international law enforcement operation has resulted in the arrest of 288 vendors who are believed to be involved in drug trafficking on the dark web, adding to a long list of criminal enterprises that have been shuttered in recent years.
The effort, codenamed Operation SpecTor, also saw the authorities confiscating more than $53.4 million in cash and virtual currencies, 850 kg of drugs, and


feed_id: https://thehackernews.com/2023/05/download-ebook-what-does-it-take-to-be.html
title: Download the eBook: What Does it Take to be a Full-Fledged Virtual CISO?
uri: 2023-05-04-Download-the-eBook-What-Does-it-Take-to-be-a-Full-Fledged-Virtual-CIS
url: https://thehackernews.com/2023/05/download-ebook-what-does-it-take-to-be.html
content:
Almost half of MSP clients fell victim to a cyberattack within the last 12 months. In the SMB world, the danger is especially acute as only 50% of SMBs have a dedicated internal IT person to take care of cybersecurity. No wonder cybercriminals are targeting SMBs so heavily. No wonder SMBs are increasingly willing to pay a subscription or retainer to gain access to expert C-level cyber-assistance


feed_id: https://thehackernews.com/2023/05/apple-and-google-join-forces-to-stop.html
title: Apple and Google Join Forces to Stop Unauthorized Location-Tracking Devices
uri: Apple-and-Google-Join-Forces-to-Stop-Unauthorized-Location-Tracking-De
url: https://thehackernews.com/2023/05/apple-and-google-join-forces-to-stop.html
content:
Apple and Google have teamed up to work on a draft industry-wide specification that's designed to tackle safety risks and alert users when they are being tracked without their knowledge or permission using devices like AirTags.
"The first-of-its-kind specification will allow Bluetooth location-tracking devices to be compatible with unauthorized tracking detection and alerts across Android and


feed_id: https://thehackernews.com/2023/05/hackers-exploiting-5-year-old-unpatched.html
title: Hackers Exploiting 5-year-old Unpatched Vulnerability in TBK DVR Devices
uri: 2023-05-04-Hackers-Exploiting-5-year-old-Unpatched-Vulnerability-in-TBK-DVR-Devic
url: https://thehackernews.com/2023/05/hackers-exploiting-5-year-old-unpatched.html
content:
Threat actors are actively exploiting an unpatched five-year-old flaw impacting TBK digital video recording (DVR) devices, according to an advisory issued by Fortinet FortiGuard Labs.
The vulnerability in question is CVE-2018-9995 (CVSS score: 9.8), a critical authentication bypass issue that could be exploited by remote actors to gain elevated permissions.
"The 5-year-old vulnerability (


feed_id: https://thehackernews.com/2023/05/cisa-issues-advisory-on-critical-rce.html
title: CISA Issues Advisory on Critical RCE Affecting ME RTU Remote Terminal Units
uri: 2023-05-04-CISA-Issues-Advisory-on-Critical-RCE-Affecting-ME-RTU-Remote-Terminal
url: https://thehackernews.com/2023/05/cisa-issues-advisory-on-critical-rce.html
content:
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday released an Industrial Control Systems (ICS) advisory about a critical flaw affecting ME RTU remote terminal units.
The security vulnerability, tracked as CVE-2023-2131, has received the highest severity rating of 10.0 on the CVSS scoring system for its low attack complexity.
"Successful exploitation of this


feed_id: https://thehackernews.com/2023/05/researchers-uncover-new-bgp-flaws-in.html
title: Researchers Uncover New BGP Flaws in Popular Internet Routing Protocol Software
uri: 2023-05-04-Researchers-Uncover-New-BGP-Flaws-in-Popular-Internet-Routing-Protocol
url: https://thehackernews.com/2023/05/researchers-uncover-new-bgp-flaws-in.html
content:
Cybersecurity researchers have uncovered weaknesses in a software implementation of the Border Gateway Protocol (BGP) that could be weaponized to achieve a denial-of-service (DoS) condition on vulnerable BGP peers.
The three vulnerabilities reside in version 8.4 of FRRouting, a popular open source internet routing protocol suite for Linux and Unix platforms. It's currently used by several


feed_id: tag:blogger.com,1999:blog-4802841478634147276.post-1372087541193074076
uri: Strengthening-Product-Security-Harnessing-the-Collective-Experience-a
url: http://www.blogger.com/feeds/4802841478634147276/posts/default/1372087541193074076
title:
Strengthening Product Security: Harnessing the Collective Experience and Collaborative Tools in DevSecOps


feed_id: https://thehackernews.com/2023/05/new-phishing-as-service-platform-lets.html
title: New Phishing-as-a-Service Platform Lets Cybercriminals Generate Convincing Phishing Pages
uri: 2023-05-14-New-Phishing-as-a-Service-Platform-Lets-Cybercriminals-Generate-Convin
url: https://thehackernews.com/2023/05/new-phishing-as-service-platform-lets.html
content:
A new phishing-as-a-service (PhaaS or PaaS) platform named Greatness has been leveraged by cybercriminals to target business users of the Microsoft 365 cloud service since at least mid-2022, effectively lowering the bar to entry for phishing attacks.
"Greatness, for now, is only focused on Microsoft 365 phishing pages, providing its affiliates with an attachment and link builder that creates


feed_id: https://thehackernews.com/2023/05/xworm-malware-exploits-follina.html
title: XWorm Malware Exploits Follina Vulnerability in New Wave of Attacks
uri: 2023-05-14-XWorm-Malware-Exploits-Follina-Vulnerability-in-New-Wave-of-Attacks
url: https://thehackernews.com/2023/05/xworm-malware-exploits-follina.html
content:
Cybersecurity researchers have discovered an ongoing phishing campaign that makes use of a unique attack chain to deliver the XWorm malware on targeted systems.
Securonix, which is tracking the activity cluster under the name MEME#4CHAN, said some of the attacks have primarily targeted manufacturing firms and healthcare clinics located in Germany.
"The attack campaign has been leveraging rather


feed_id: https://thehackernews.com/2023/05/netgear-routers-flaws-expose-users-to.html
title: Netgear Routers' Flaws Expose Users to Malware, Remote Attacks, and Surveillance
uri: 2023-05-14-Netgear-Routers-Flaws-Expose-Users-to-Malware-Remote-Attacks-and-Su
url: https://thehackernews.com/2023/05/netgear-routers-flaws-expose-users-to.html
content:
As many as five security flaws have been disclosed in Netgear RAX30 routers that could be chained to bypass authentication and achieve remote code execution.
"Successful exploits could allow attackers to monitor users' internet activity, hijack internet connections, and redirect traffic to malicious websites or inject malware into network traffic," Claroty security researcher Uri Katz said in a


feed_id: https://thehackernews.com/2023/05/new-variant-of-linux-backdoor-bpfdoor.html
title: New Stealthy Variant of Linux Backdoor BPFDoor Emerges from the Shadows
uri: 2023-05-14-New-Stealthy-Variant-of-Linux-Backdoor-BPFDoor-Emerges-from-the-Shadow
url: https://thehackernews.com/2023/05/new-variant-of-linux-backdoor-bpfdoor.html
content:
A previously undocumented and mostly undetected variant of a Linux backdoor called BPFDoor has been spotted in the wild, cybersecurity firm Deep Instinct said in a technical report published this week.
"BPFDoor retains its reputation as an extremely stealthy and difficult-to-detect malware with this latest iteration," security researchers Shaul Vilkomir-Preisman and Eliran Nissan said.
BPFDoor (


feed_id: https://thehackernews.com/2023/05/solving-your-teams-secure-collaboration.html
title: Solving Your Teams Secure Collaboration Challenges
uri: 2023-05-14-Solving-Your-Teams-Secure-Collaboration-Challenges
url: https://thehackernews.com/2023/05/solving-your-teams-secure-collaboration.html
content:
In today's interconnected world, where organisations regularly exchange sensitive information with customers, partners and employees, secure collaboration has become increasingly vital. However, collaboration can pose a security risk if not managed properly. To ensure that collaboration remains secure, organisations need to take steps to protect their data.
Since collaborating is essential for


feed_id: https://thehackernews.com/2023/05/bl00dy-ransomware-gang-strikes.html
title: Bl00dy Ransomware Gang Strikes Education Sector with Critical PaperCut Vulnerability
uri: 2023-05-14-Bl00dy-Ransomware-Gang-Strikes-Education-Sector-with-Critical-PaperCut
url: https://thehackernews.com/2023/05/bl00dy-ransomware-gang-strikes.html
content:
U.S. cybersecurity and intelligence agencies have warned of attacks carried out by a threat actor known as the Bl00dy Ransomware Gang that attempt to exploit vulnerable PaperCut servers against the education facilities sector in the country.
The attacks took place in early May 2023, the Federal Bureau of Investigation (FBI) and Cybersecurity and Infrastructure Security Agency (CISA) said in a


feed_id: https://thehackernews.com/2023/05/severe-security-flaw-exposes-over.html
title: New Flaw in WordPress Plugin Used by Over a Million Sites Under Active Exploitation
uri: New-Flaw-in-WordPress-Plugin-Used-by-Over-a-Million-Sites-Under-Active
url: https://thehackernews.com/2023/05/severe-security-flaw-exposes-over.html
content:
A security vulnerability has been disclosed in the popular WordPress plugin Essential Addons for Elementor that could be potentially exploited to achieve elevated privileges on affected sites.
The issue, tracked as CVE-2023-32243, has been addressed by the plugin maintainers in version 5.7.2 that was shipped on May 11, 2023. Essential Addons for Elementor has over one million active


feed_id: https://thehackernews.com/2023/05/new-apt-group-red-stinger-targets.html
title: New APT Group Red Stinger Targets Military and Critical Infrastructure in Eastern Europe
uri: 2023-05-14-New-APT-Group-Red-Stinger-Targets-Military-and-Critical-Infrastructure
url: https://thehackernews.com/2023/05/new-apt-group-red-stinger-targets.html
content:
A previously undetected advanced persistent threat (APT) actor dubbed Red Stinger has been linked to attacks targeting Eastern Europe since 2020.
"Military, transportation, and critical infrastructure were some of the entities being targeted, as well as some involved in the September East Ukraine referendums," Malwarebytes disclosed in a report published today.
"Depending on the campaign,


feed_id: https://thehackernews.com/2023/05/how-attack-surface-management-supports.html
title: How Attack Surface Management Supports Continuous Threat Exposure Management
uri: 2023-05-14-How-Attack-Surface-Management-Supports-Continuous-Threat-Exposure-Mana
url: https://thehackernews.com/2023/05/how-attack-surface-management-supports.html
content:
According to Forrester, External Attack Surface Management (EASM) emerged as a market category in 2021 and gained popularity in 2022. In a different report, Gartner concluded that vulnerability management vendors are expanding their offerings to include Attack Surface Management (ASM) for a suite of comprehensive offensive security solutions.
Recognition from global analysts has officially put


feed_id: https://thehackernews.com/2023/05/spanish-police-takes-down-massive.html
title: Spanish Police Takes Down Massive Cybercrime Ring, 40 Arrested
uri: 2023-05-14-Spanish-Police-Takes-Down-Massive-Cybercrime-Ring-40-Arrested
url: https://thehackernews.com/2023/05/spanish-police-takes-down-massive.html
content:
The National Police of Spain said it arrested 40 individuals for their alleged involvement in an organized crime gang called Trinitarians.
Among those apprehended include two hackers who carried out bank scams through phishing and smishing techniques and 15 other members of the crime syndicate, who have all been charged with a number of offenses such as bank fraud, document forgery, identity


feed_id: https://thehackernews.com/2023/05/babuk-source-code-sparks-9-new.html
title: Babuk Source Code Sparks 9 Different Ransomware Strains Targeting VMware ESXi Systems
uri: 2023-05-14-Babuk-Source-Code-Sparks-9-Different-Ransomware-Strains-Targeting-VMwa
url: https://thehackernews.com/2023/05/babuk-source-code-sparks-9-new.html
content:
Multiple threat actors have capitalized on the leak of Babuk (aka Babak or Babyk) ransomware code in September 2021 to build as many as nine different ransomware families capable of targeting VMware ESXi systems.
"These variants emerged through H2 2022 and H1 2023, which shows an increasing trend of Babuk source code adoption," SentinelOne security researcher Alex Delamotte said in a report


feed_id: https://thehackernews.com/2023/05/andoryu-botnet-exploits-critical-ruckus.html
title: Andoryu Botnet Exploits Critical Ruckus Wireless Flaw for Widespread Attack
uri: 2023-05-14-Andoryu-Botnet-Exploits-Critical-Ruckus-Wireless-Flaw-for-Widespread-A
url: https://thehackernews.com/2023/05/andoryu-botnet-exploits-critical-ruckus.html
content:
A nascent botnet called Andoryu has been found to exploit a now-patched critical security flaw in the Ruckus Wireless Admin panel to break into vulnerable devices.
The flaw, tracked as CVE-2023-25717 (CVSS score: 9.8), stems from improper handling of HTTP requests, leading to unauthenticated remote code execution and a complete compromise of wireless Access Point (AP) equipment.
Andoryu was 


feed_id: https://thehackernews.com/2023/05/twitter-finally-rolling-out-encrypted.html
title: Twitter Finally Rolling Out Encrypted Direct Messages — Starting with Verified Users
uri: 2023-05-14-Twitter-Finally-Rolling-Out-Encrypted-Direct-Messages-Starting-wit
url: https://thehackernews.com/2023/05/twitter-finally-rolling-out-encrypted.html
content:
Twitter is officially beginning to roll out support for encrypted direct messages (DMs) on the platform, more than five months after its chief executive Elon Musk confirmed plans for the feature in November 2022.
The "Phase 1" of the initiative will appear as separate conversations alongside existing direct messages on users' inboxes. Encrypted chats carry a lock icon badge to visually


feed_id: https://thehackernews.com/2023/05/github-extends-push-protection-to.html
title: GitHub Extends Push Protection to Prevent Accidental Leaks of Keys and Other Secrets
uri: 2023-05-14-GitHub-Extends-Push-Protection-to-Prevent-Accidental-Leaks-of-Keys-and
url: https://thehackernews.com/2023/05/github-extends-push-protection-to.html
content:
GitHub has announced the general availability of a new security feature called push protection, which aims to prevent developers from inadvertently leaking keys and other secrets in their code.
The Microsoft-owned cloud-based repository hosting platform, which began testing the feature a year ago, said it's also extending push protection to all public repositories at no extra cost.
The


feed_id: https://thehackernews.com/2023/05/google-announces-new-privacy-safety-and.html
title: Google Announces New Privacy, Safety, and Security Features Across Its Services
uri: 2023-05-14-Google-Announces-New-Privacy-Safety-and-Security-Features-Across-Its
url: https://thehackernews.com/2023/05/google-announces-new-privacy-safety-and.html
content:
Google unveiled a slew of new privacy, safety, and security features today at its annual developer conference, Google I/O. The tech giant's latest initiatives are aimed at protecting its users from cyber threats, including phishing attacks and malicious websites, while providing more control and transparency over their personal data.
Here is a short list of the newly introduced features -


feed_id: https://thehackernews.com/2023/05/experts-detail-new-zero-click-windows.html
title: Experts Detail New Zero-Click Windows Vulnerability for NTLM Credential Theft
uri: 2023-05-14-Experts-Detail-New-Zero-Click-Windows-Vulnerability-for-NTLM-Credentia
url: https://thehackernews.com/2023/05/experts-detail-new-zero-click-windows.html
content:
Cybersecurity researchers have shared details about a now-patched security flaw in Windows MSHTML platform that could be abused to bypass integrity protections on targeted machines.
The vulnerability, tracked as CVE-2023-29324 (CVSS score: 6.5), has been described as a security feature bypass. It was addressed by Microsoft as part of its Patch Tuesday updates for May 2023.
Akamai security


feed_id: https://thehackernews.com/2023/05/sophisticated-downex-malware-campaign.html
title: Sophisticated DownEx Malware Campaign Targeting Central Asian Governments
uri: 2023-05-14-Sophisticated-DownEx-Malware-Campaign-Targeting-Central-Asian-Governme
url: https://thehackernews.com/2023/05/sophisticated-downex-malware-campaign.html
content:
Government organizations in Central Asia are the target of a sophisticated espionage campaign that leverages a previously undocumented strain of malware dubbed DownEx.
Bitdefender, in a report shared with The Hacker News, said the activity remains active, with evidence likely pointing to the involvement of Russia-based threat actors.
The Romanian cybersecurity firm said it first detected the


feed_id: https://thehackernews.com/2023/05/why-honeytokens-are-future-of-intrusion.html
title: Why Honeytokens Are the Future of Intrusion Detection
uri: 2023-05-14-Why-Honeytokens-Are-the-Future-of-Intrusion-Detection
url: https://thehackernews.com/2023/05/why-honeytokens-are-future-of-intrusion.html
content:
A few weeks ago, the 32nd edition of RSA, one of the world's largest cybersecurity conferences, wrapped up in San Francisco. Among the highlights, Kevin Mandia, CEO of Mandiant at Google Cloud, presented a retrospective on the state of cybersecurity. During his keynote, Mandia stated:
"There are clear steps organizations can take beyond common safeguards and security tools to strengthen their


feed_id: https://thehackernews.com/2023/05/mastermind-behind-twitter-2020-hack.html
title: Mastermind Behind Twitter 2020 Hack Pleads Guilty and Faces up to 70 Years in Prison
uri: 2023-05-14-Mastermind-Behind-Twitter-2020-Hack-Pleads-Guilty-and-Faces-up-to-70-Y
url: https://thehackernews.com/2023/05/mastermind-behind-twitter-2020-hack.html
content:
A U.K. national has pleaded guilty in the U.S. in connection with the July 2020 Twitter attack affecting numerous high-profile accounts and defrauding other users of the platform.
Joseph James O'Connor, who also went by the online alias PlugwalkJoe, admitted to "his role in cyberstalking and multiple schemes that involve computer hacking, including the July 2020 hack of Twitter," the U.S.


feed_id: https://thehackernews.com/2023/05/us-government-neutralizes-russias-most.html
title: U.S. Government Neutralizes Russia's Most Sophisticated Snake Cyber Espionage Tool
uri: 2023-05-14-U-S-Government-Neutralizes-Russia-s-Most-Sophisticated-Snake-Cyber-Es
url: https://thehackernews.com/2023/05/us-government-neutralizes-russias-most.html
content:
The U.S. government on Tuesday announced the court-authorized disruption of a global network compromised by an advanced malware strain known as Snake wielded by Russia's Federal Security Service (FSB).
Snake, dubbed the "most sophisticated cyber espionage tool," is the handiwork of a Russian state-sponsored group called Turla (aka Iron Hunter, Secret Blizzard, SUMMIT, Uroburos, Venomous Bear,


feed_id: https://thehackernews.com/2023/05/microsofts-may-patch-tuesday-fixes-38.html
title: Microsoft's May Patch Tuesday Fixes 38 Flaws, Including 2 Exploited Zero-Day Bugs
uri: Microsoft-s-May-Patch-Tuesday-Fixes-38-Flaws-Including-2-Exploited-Ze
url: https://thehackernews.com/2023/05/microsofts-may-patch-tuesday-fixes-38.html
content:
Microsoft has rolled out Patch Tuesday updates for May 2023 to address 38 security flaws, including two zero-day bugs that it said is being actively exploited in the wild.
Trend Micro's Zero Day Initiative (ZDI) said the volume is the lowest since August 2021, although it pointed out that "this number is expected to rise in the coming months."
Of the 38 vulnerabilities, six are rated Critical


feed_id: https://thehackernews.com/2023/05/us-authorities-seize-13-domains.html
title: U.S. Authorities Seize 13 Domains Offering Criminal DDoS-for-Hire Services
uri: 2023-05-14-U-S-Authorities-Seize-13-Domains-Offering-Criminal-DDoS-for-Hire-Serv
url: https://thehackernews.com/2023/05/us-authorities-seize-13-domains.html
content:
U.S. authorities have announced the seizure of 13 internet domains that offered DDoS-for-hire services to other criminal actors.
The takedown is part of an ongoing international initiative dubbed Operation PowerOFF that's aimed at dismantling criminal DDoS-for-hire infrastructures worldwide.
The development comes almost five months after a "sweep" in December 2022 dismantled 48 similar services 


feed_id: https://thehackernews.com/2023/05/operation-chattygoblin-hackers.html
title: Operation ChattyGoblin: Hackers Targeting Gambling Firms via Chat Apps
uri: 2023-05-14-Operation-ChattyGoblin-Hackers-Targeting-Gambling-Firms-via-Chat-Apps
url: https://thehackernews.com/2023/05/operation-chattygoblin-hackers.html
content:
A gambling company in the Philippines was the target of a China-aligned threat actor as part of a campaign that has been ongoing since October 2021.
Slovak cybersecurity firm ESET is tracking the series of attacks against Southeast Asian gambling companies under the name Operation ChattyGoblin.
"These attacks use a specific tactic: targeting the victim companies' support agents via chat


feed_id: https://thehackernews.com/2023/05/strengthening-product-security.html
title: Product Security: Harnessing the Collective Experience and Collaborative Tools in DevSecOps
uri: Product-Security-Harnessing-the-Collective-Experience-and-Collaborati
url: https://thehackernews.com/2023/05/strengthening-product-security.html
content:
In the fast-paced cybersecurity landscape, product security takes center stage. DevSecOps swoops in, seamlessly merging security practices into DevOps, empowering teams to tackle challenges. Let's dive into DevSecOps and explore how collaboration can give your team the edge to fight cyber villains.
Application security and product security
Regrettably, application security teams often intervene


feed_id: https://thehackernews.com/2023/05/researchers-uncover-sidewinders-latest.html
title: Researchers Uncover SideWinder's Latest Server-Based Polymorphism Technique
uri: 2023-05-14-Researchers-Uncover-SideWinder-s-Latest-Server-Based-Polymorphism-Tech
url: https://thehackernews.com/2023/05/researchers-uncover-sidewinders-latest.html
content:
The advanced persistent threat (APT) actor known as SideWinder has been accused of deploying a backdoor in attacks directed against Pakistan government organizations as part of a campaign that commenced in late November 2022.
"In this campaign, the SideWinder advanced persistent threat (APT) group used a server-based polymorphism technique to deliver the next stage payload," the BlackBerry


feed_id: https://thehackernews.com/2023/05/microsoft-warns-of-state-sponsored.html
title: Microsoft Warns of State-Sponsored Attacks Exploiting Critical PaperCut Vulnerability
uri: 2023-05-14-Microsoft-Warns-of-State-Sponsored-Attacks-Exploiting-Critical-PaperCu
url: https://thehackernews.com/2023/05/microsoft-warns-of-state-sponsored.html
content:
Iranian nation-state groups have now joined financially motivated actors in actively exploiting a critical flaw in PaperCut print management software, Microsoft disclosed over the weekend.
The tech giant's threat intelligence team said it observed both Mango Sandstorm (Mercury) and Mint Sandstorm (Phosphorus) weaponizing CVE-2023-27350 in their operations to achieve initial access.
"This


feed_id: https://thehackernews.com/2023/05/new-ransomware-strain-cactus-exploits.html
title: New Ransomware Strain 'CACTUS' Exploits VPN Flaws to Infiltrate Networks
uri: 2023-05-14-New-Ransomware-Strain-CACTUS-Exploits-VPN-Flaws-to-Infiltrate-Networ
url: https://thehackernews.com/2023/05/new-ransomware-strain-cactus-exploits.html
content:
Cybersecurity researchers have shed light on a new ransomware strain called CACTUS that has been found to leverage known flaws in VPN appliances to obtain initial access to targeted networks.
"Once inside the network, CACTUS actors attempt to enumerate local and network user accounts in addition to reachable endpoints before creating new user accounts and leveraging custom scripts to automate


feed_id: https://thehackernews.com/2023/05/join-our-webinar-learn-how-to-defeat.html
title: Join Our Webinar: Learn How to Defeat Ransomware with Identity-Focused Protection
uri: 2023-05-14-Join-Our-Webinar-Learn-How-to-Defeat-Ransomware-with-Identity-Focused
url: https://thehackernews.com/2023/05/join-our-webinar-learn-how-to-defeat.html
content:
Are you concerned about ransomware attacks? You're not alone. In recent years, these attacks have become increasingly common and can cause significant damage to organizations of all sizes. But there's good news - with the right security measures in place, such as real-time MFA and service account protection, you can effectively protect yourself against these types of attacks.
That's why we're


feed_id: https://thehackernews.com/2023/05/msi-data-breach-private-code-signing.html
title: MSI Data Breach: Private Code Signing Keys Leaked on the Dark Web
uri: 2023-05-14-MSI-Data-Breach-Private-Code-Signing-Keys-Leaked-on-the-Dark-Web
url: https://thehackernews.com/2023/05/msi-data-breach-private-code-signing.html
content:
The threat actors behind the ransomware attack on Taiwanese PC maker MSI last month have leaked the company's private code signing keys on their dark website.
"Confirmed, Intel OEM private key leaked, causing an impact on the entire ecosystem," Alex Matrosov, founder and CEO of firmware security firm Binarly, said in a tweet over the weekend.
"It appears that Intel Boot Guard may not be


feed_id: https://thehackernews.com/2023/05/western-digital-confirms-customer-data.html
title: Western Digital Confirms Customer Data Stolen by Hackers in March Breach
uri: 2023-05-14-Western-Digital-Confirms-Customer-Data-Stolen-by-Hackers-in-March-Brea
url: https://thehackernews.com/2023/05/western-digital-confirms-customer-data.html
content:
Digital storage giant Western Digital confirmed that an "unauthorized third party" gained access to its systems and stole personal information belonging to the company's online store customers.
"This information included customer names, billing and shipping addresses, email addresses and telephone numbers," the San Jose-based company said in a disclosure last week.
"In addition, the database


feed_id: https://thehackernews.com/2023/05/sidecopy-using-action-rat-and-allakore.html
title: SideCopy Using Action RAT and AllaKore RAT to infiltrate Indian Organizations
uri: 2023-05-14-SideCopy-Using-Action-RAT-and-AllaKore-RAT-to-infiltrate-Indian-Organi
url: https://thehackernews.com/2023/05/sidecopy-using-action-rat-and-allakore.html
content:
The suspected Pakistan-aligned threat actor known as SideCopy has been observed leveraging themes related to the Indian military research organization as part of an ongoing phishing campaign.
This involves using a ZIP archive lure pertaining to India's Defence Research and Development Organization (DRDO) to deliver a malicious payload capable of harvesting sensitive information, Fortinet


feed_id: https://thehackernews.com/2023/05/how-to-set-up-threat-hunting-and-threat.html
title: How to Set Up a Threat Hunting and Threat Intelligence Program
uri: 2023-05-14-How-to-Set-Up-a-Threat-Hunting-and-Threat-Intelligence-Program
url: https://thehackernews.com/2023/05/how-to-set-up-threat-hunting-and-threat.html
content:
Threat hunting is an essential component of your cybersecurity strategy. Whether you're getting started or in an advanced state, this article will help you ramp up your threat intelligence program.
What is Threat Hunting?
The cybersecurity industry is shifting from a reactive to a proactive approach. Instead of waiting for cybersecurity alerts and then addressing them, security organizations are


feed_id: https://thehackernews.com/2023/05/cert-ua-warns-of-smokeloader-and.html
title: CERT-UA Warns of SmokeLoader and RoarBAT Malware Attacks Against Ukraine
uri: 2023-05-14-CERT-UA-Warns-of-SmokeLoader-and-RoarBAT-Malware-Attacks-Against-Ukrai
url: https://thehackernews.com/2023/05/cert-ua-warns-of-smokeloader-and.html
content:
An ongoing phishing campaign with invoice-themed lures is being used to distribute the SmokeLoader malware in the form of a polyglot file, according to the Computer Emergency Response Team of Ukraine (CERT-UA).
The emails, per the agency, are sent using compromised accounts and come with a ZIP archive that, in reality, is a polyglot file containing a decoy document and a JavaScript file.
The


feed_id: https://thehackernews.com/2023/05/dragon-breath-apt-group-using-double.html
title: Dragon Breath APT Group Using Double-Clean-App Technique to Target Gambling Industry
uri: 2023-05-14-Dragon-Breath-APT-Group-Using-Double-Clean-App-Technique-to-Target-Gam
url: https://thehackernews.com/2023/05/dragon-breath-apt-group-using-double.html
content:
An advanced persistent threat (APT) actor known as Dragon Breath has been observed adding new layers of complexity to its attacks by adopting a novel DLL side-loading mechanism.
"The attack is based on a classic side-loading attack, consisting of a clean application, a malicious loader, and an encrypted payload, with various modifications made to these components over time," Sophos researcher


feed_id: https://thehackernews.com/2023/05/new-vulnerability-in-popular-wordpress.html
title: New Vulnerability in Popular WordPress Plugin Exposes Over 2 Million Sites to Cyberattacks
uri: 2023-05-14-New-Vulnerability-in-Popular-WordPress-Plugin-Exposes-Over-2-Million-S
url: https://thehackernews.com/2023/05/new-vulnerability-in-popular-wordpress.html
content:
Users of Advanced Custom Fields plugin for WordPress are being urged to update version 6.1.6 following the discovery of a security flaw.
The issue, assigned the identifier CVE-2023-30777, relates to a case of reflected cross-site scripting (XSS) that could be abused to inject arbitrary executable scripts into otherwise benign websites.
The plugin, which is available both as a free and pro


feed_id: https://thehackernews.com/2023/05/new-android-malware-fluhorse-targeting.html
title: New Android Malware 'FluHorse' Targeting East Asian Markets with Deceptive Tactics
uri: 2023-05-14-New-Android-Malware-FluHorse-Targeting-East-Asian-Markets-with-Decep
url: https://thehackernews.com/2023/05/new-android-malware-fluhorse-targeting.html
content:
Various sectors in East Asian markets have been subjected to a new email phishing campaign that distributes a previously undocumented strain of Android malware called FluHorse that abuses the Flutter software development framework.
"The malware features several malicious Android applications that mimic legitimate applications, most of which have more than 1,000,000 installs," Check Point said in


feed_id: https://thehackernews.com/2023/05/hackers-targeting-italian-corporate.html
title: Hackers Targeting Italian Corporate Banking Clients with New Web-Inject Toolkit DrIBAN
uri: 2023-05-14-Hackers-Targeting-Italian-Corporate-Banking-Clients-with-New-Web-Injec
url: https://thehackernews.com/2023/05/hackers-targeting-italian-corporate.html
content:
Italian corporate banking clients are the target of an ongoing financial fraud campaign that has been leveraging a new web-inject toolkit called drIBAN since at least 2019.
"The main goal of drIBAN fraud operations is to infect Windows workstations inside corporate environments trying to alter legitimate banking transfers performed by the victims by changing the beneficiary and transferring


feed_id: https://thehackernews.com/2023/05/n-korean-kimsuky-hackers-using-new.html
title: N. Korean Kimsuky Hackers Using New Recon Tool ReconShark in Latest Cyberattacks
uri: 2023-05-14-N-Korean-Kimsuky-Hackers-Using-New-Recon-Tool-ReconShark-in-Latest-Cy
url: https://thehackernews.com/2023/05/n-korean-kimsuky-hackers-using-new.html
content:
The North Korean state-sponsored threat actor known as Kimsuky has been discovered using a new reconnaissance tool called ReconShark as part of an ongoing global campaign.
"[ReconShark] is actively delivered to specifically targeted individuals through spear-phishing emails, OneDrive links leading to document downloads, and the execution of malicious macros," SentinelOne researchers Tom Hegel


feed_id: https://thehackernews.com/2023/05/lack-of-visibility-challenge-of.html
title: Lack of Visibility: The Challenge of Protecting Websites from Third-Party Scripts
uri: 2023-05-14-Lack-of-Visibility-The-Challenge-of-Protecting-Websites-from-Third-Pa
url: https://thehackernews.com/2023/05/lack-of-visibility-challenge-of.html
content:
Third-party apps such as Google Analytics, Meta Pixel, HotJar, and JQuery have become critical tools for businesses to optimize their website performance and services for a global audience. However, as their importance has grown, so has the threat of cyber incidents involving unmanaged third-party apps and open-source tools. Online businesses increasingly struggle to maintain complete visibility


feed_id: https://thehackernews.com/2023/05/packagist-repository-hacked-over-dozen.html
title: Packagist Repository Hacked: Over a Dozen PHP Packages with 500 Million Installs Compromised
uri: 2023-05-14-Packagist-Repository-Hacked-Over-a-Dozen-PHP-Packages-with-500-Millio
url: https://thehackernews.com/2023/05/packagist-repository-hacked-over-dozen.html
content:
PHP software package repository Packagist revealed that an "attacker" gained access to four inactive accounts on the platform to hijack over a dozen packages with over 500 million installs to date.
"The attacker forked each of the packages and replaced the package description in composer.json with their own message but did not otherwise make any malicious changes," Packagist's Nils Adermann said


feed_id: https://thehackernews.com/2023/05/fleckpe-android-malware-sneaks-onto.html
title: Fleckpe Android Malware Sneaks onto Google Play Store with Over 620,000 Downloads
uri: 2023-05-14-Fleckpe-Android-Malware-Sneaks-onto-Google-Play-Store-with-Over-620-00
url: https://thehackernews.com/2023/05/fleckpe-android-malware-sneaks-onto.html
content:
A new Android subscription malware named Fleckpe has been unearthed on the Google Play Store, amassing more than 620,000 downloads in total since 2022.
Kaspersky, which identified 11 apps on the official app storefront, said the malware masqueraded as legitimate photo editing apps, camera, and smartphone wallpaper packs. The apps have since been taken down.
The operation primarily targets users


feed_id: https://thehackernews.com/2023/05/cisco-warns-of-vulnerability-in-popular.html
title: Cisco Warns of Vulnerability in Popular Phone Adapter, Urges Migration to Newer Model
uri: 2023-05-14-Cisco-Warns-of-Vulnerability-in-Popular-Phone-Adapter-Urges-Migration
url: https://thehackernews.com/2023/05/cisco-warns-of-vulnerability-in-popular.html
content:
Cisco has warned of a critical security flaw in SPA112 2-Port Phone Adapters that it said could be exploited by a remote attacker to execute arbitrary code on affected devices.
The issue, tracked as CVE-2023-20126, is rated 9.8 out of a maximum of 10 on the CVSS scoring system. The company credited Catalpa of DBappSecurity for reporting the shortcoming.
The product in question makes it possible


feed_id: https://thehackernews.com/2023/05/researchers-discover-3-vulnerabilities.html
title: Researchers Discover 3 Vulnerabilities in Microsoft Azure API Management Service
uri: 2023-05-14-Researchers-Discover-3-Vulnerabilities-in-Microsoft-Azure-API-Manageme
url: https://thehackernews.com/2023/05/researchers-discover-3-vulnerabilities.html
content:
Three new security flaws have been disclosed in Microsoft Azure API Management service that could be abused by malicious actors to gain access to sensitive information or backend services.
This includes two server-side request forgery (SSRF) flaws and one instance of unrestricted file upload functionality in the API Management developer portal, according to Israeli cloud security firm Ermetic.
"


feed_id: https://thehackernews.com/2023/05/researchers-uncover-new-exploit-for.html
title: Researchers Uncover New Exploit for PaperCut Vulnerability That Can Bypass Detection
uri: 2023-05-14-Researchers-Uncover-New-Exploit-for-PaperCut-Vulnerability-That-Can-By
url: https://thehackernews.com/2023/05/researchers-uncover-new-exploit-for.html
content:
Cybersecurity researchers have found a way to exploit a recently disclosed critical flaw in PaperCut servers in a manner that bypasses all current detections.
Tracked as CVE-2023-27350 (CVSS score: 9.8), the issue affects PaperCut MF and NG installations that could be exploited by an unauthenticated attacker to execute arbitrary code with SYSTEM privileges.
While the flaw was patched by the


feed_id: https://thehackernews.com/2023/05/why-things-you-dont-know-about-dark-web.html
title: Why the Things You Don't Know about the Dark Web May Be Your Biggest Cybersecurity Threat
uri: 2023-05-14-Why-the-Things-You-Don-t-Know-about-the-Dark-Web-May-Be-Your-Biggest-C
url: https://thehackernews.com/2023/05/why-things-you-dont-know-about-dark-web.html
content:
IT and cybersecurity teams are so inundated with security notifications and alerts within their own systems, it’s difficult to monitor external malicious environments – which only makes them that much more threatening. 
In March, a high-profile data breach hit national headlines when personally identifiable information connected to hundreds of lawmakers and staff was leaked on the dark web. The


feed_id: https://thehackernews.com/2023/05/meta-uncovers-massive-social-media.html
title: Meta Uncovers Massive Social Media Cyber Espionage Operations Across South Asia
uri: 2023-05-14-Meta-Uncovers-Massive-Social-Media-Cyber-Espionage-Operations-Across-S
url: https://thehackernews.com/2023/05/meta-uncovers-massive-social-media.html
content:
Three different threat actors leveraged hundreds of elaborate fictitious personas on Facebook and Instagram to target individuals located in South Asia as part of disparate attacks.
"Each of these APTs relied heavily on social engineering to trick people into clicking on malicious links, downloading malware or sharing personal information across the internet," Guy Rosen, chief information


feed_id: https://thehackernews.com/2023/05/meta-takes-down-malware-campaign-that.html
title: Meta Takes Down Malware Campaign That Used ChatGPT as a Lure to Steal Accounts
uri: 2023-05-14-Meta-Takes-Down-Malware-Campaign-That-Used-ChatGPT-as-a-Lure-to-Steal
url: https://thehackernews.com/2023/05/meta-takes-down-malware-campaign-that.html
content:
Meta said it took steps to take down more than 1,000 malicious URLs from being shared across its services that were found to leverage OpenAI's ChatGPT as a lure to propagate about 10 malware families since March 2023.
The development comes against the backdrop of fake ChatGPT web browser extensions being increasingly used to steal users' Facebook account credentials with an aim to run


feed_id: https://thehackernews.com/2023/05/hackers-using-golang-variant-of-cobalt.html
title: Hackers Using Golang Variant of Cobalt Strike to Target Apple macOS Systems
uri: 2023-05-16-Hackers-Using-Golang-Variant-of-Cobalt-Strike-to-Target-Apple-macOS-Sy
url: https://thehackernews.com/2023/05/hackers-using-golang-variant-of-cobalt.html
content:
A Golang implementation of Cobalt Strike called Geacon is likely to garner the attention of threat actors looking to target Apple macOS systems.
The findings come from SentinelOne, which observed an uptick in the number of Geacon payloads appearing on VirusTotal in recent months.
"While some of these are likely red-team operations, others bear the characteristics of genuine malicious attacks,"


feed_id: https://thehackernews.com/2023/05/industrial-cellular-routers-at-risk-11.html
title: Industrial Cellular Routers at Risk: 11 New Vulnerabilities Expose OT Networks
uri: 2023-05-16-Industrial-Cellular-Routers-at-Risk-11-New-Vulnerabilities-Expose-OT
url: https://thehackernews.com/2023/05/industrial-cellular-routers-at-risk-11.html
content:
Several security vulnerabilities have been disclosed in cloud management platforms associated with three industrial cellular router vendors that could expose operational technology (OT) networks to external attacks.
The findings were presented by Israeli industrial cybersecurity firm OTORIO at the Black Hat Asia 2023 conference last week.
The 11 vulnerabilities allow "remote code execution and


feed_id: https://thehackernews.com/2023/05/new-ransomware-gang-ra-group-hits-us.html
title: New Ransomware Gang RA Group Hits U.S. and South Korean Organizations
uri: 2023-05-16-New-Ransomware-Gang-RA-Group-Hits-U-S-and-South-Korean-Organizations
url: https://thehackernews.com/2023/05/new-ransomware-gang-ra-group-hits-us.html
content:
A new ransomware group known as RA Group has become the latest threat actor to leverage the leaked Babuk ransomware source code to spawn its own locker variant.
The cybercriminal gang, which is said to have been operating since at least April 22, 2023, is rapidly expanding its operations, according to cybersecurity firm Cisco Talos.
"To date, the group has compromised three organizations in the


feed_id: https://thehackernews.com/2023/05/why-high-tech-companies-struggle-with.html
title: Why High Tech Companies Struggle with SaaS Security
uri: 2023-05-16-Why-High-Tech-Companies-Struggle-with-SaaS-Security
url: https://thehackernews.com/2023/05/why-high-tech-companies-struggle-with.html
content:
It's easy to think high-tech companies have a security advantage over other older, more mature industries. Most are unburdened by 40 years of legacy systems and software. They draw some of the world’s youngest, brightest digital natives to their ranks, all of whom consider cybersecurity issues their entire lives.
Perhaps it is due to their familiarity with technology that causes them to overlook


feed_id: https://thehackernews.com/2023/05/researchers-uncover-powerful-backdoor.html
title: Researchers Uncover Powerful Backdoor and Custom Implant in Year-Long Cyber Campaign
uri: 2023-05-16-Researchers-Uncover-Powerful-Backdoor-and-Custom-Implant-in-Year-Long
url: https://thehackernews.com/2023/05/researchers-uncover-powerful-backdoor.html
content:
Government, aviation, education, and telecom sectors located in South and Southeast Asia have come under the radar of a new hacking group as part of a highly-targeted campaign that commenced in mid-2022 and continued into the first quarter of 2023.
Symantec, by Broadcom Software, is tracking the activity under its insect-themed moniker Lancefly, with the attacks making use of a "powerful"


feed_id: https://thehackernews.com/2023/05/new-michaelkors-ransomware-as-service.html
title: New 'MichaelKors' Ransomware-as-a-Service Targeting Linux and VMware ESXi Systems
uri: 2023-05-16-New-MichaelKors-Ransomware-as-a-Service-Targeting-Linux-and-VMware-E
url: https://thehackernews.com/2023/05/new-michaelkors-ransomware-as-service.html
content:
A new ransomware-as-service (RaaS) operation called MichaelKors has become the latest file-encrypting malware to target Linux and VMware ESXi systems as of April 2023.
The development points to cybercriminal actors increasingly setting their eyes on the ESXi, cybersecurity firm CrowdStrike said in a report shared with The Hacker News.
"This trend is especially noteworthy given the fact that ESXi


feed_id: https://thehackernews.com/2023/05/clr-sqlshell-malware-targets-ms-sql.html
title: CLR SqlShell Malware Targets MS SQL Servers for Crypto Mining and Ransomware
uri: 2023-05-16-CLR-SqlShell-Malware-Targets-MS-SQL-Servers-for-Crypto-Mining-and-Rans
url: https://thehackernews.com/2023/05/clr-sqlshell-malware-targets-ms-sql.html
content:
Poorly managed Microsoft SQL (MS SQL) servers are the target of a new campaign that's designed to propagate a category of malware called CLR SqlShell that ultimately facilitates the deployment of cryptocurrency miners and ransomware.
"Similar to web shell, which can be installed on web servers, SqlShell is a malware strain that supports various features after being installed on an MS SQL server,


feed_id: https://thehackernews.com/2023/05/former-ubiquiti-employee-gets-6-years.html
title: Former Ubiquiti Employee Gets 6 Years in Jail for $2 Million Crypto Extortion Case
uri: 2023-05-16-Former-Ubiquiti-Employee-Gets-6-Years-in-Jail-for-2-Million-Crypto-Ex
url: https://thehackernews.com/2023/05/former-ubiquiti-employee-gets-6-years.html
content:
A former employee of Ubiquiti has been sentenced to six years in jail after he pleaded guilty to posing as an anonymous hacker and a whistleblower in an attempt to extort almost $2 million worth of cryptocurrency while working at the company.
Nickolas Sharp, 37, was arrested in December 2021 for using his insider access as a senior developer to steal confidential data and sending an anonymous


feed_id: https://thehackernews.com/2023/05/what-to-look-for-when-selecting-static.html
title: What to Look for When Selecting a Static Application Security Testing (SAST) Solution
uri: 2023-05-24-What-to-Look-for-When-Selecting-a-Static-Application-Security-Testing
url: https://thehackernews.com/2023/05/what-to-look-for-when-selecting-static.html
content:
If you're involved in securing the applications your organization develops, there is no question that Static Application Security Testing (SAST) solutions are an important part of a comprehensive application security strategy. SAST secures software, supports business more securely, cuts down on costs, reduces risk, and speeds time to development, delivery, and deployment of mission-critical


feed_id: https://thehackernews.com/2023/05/data-stealing-malware-discovered-in.html
title: Data Stealing Malware Discovered in Popular Android Screen Recorder App
uri: 2023-05-24-Data-Stealing-Malware-Discovered-in-Popular-Android-Screen-Recorder-Ap
url: https://thehackernews.com/2023/05/data-stealing-malware-discovered-in.html
content:
Google has removed a screen recording app named "iRecorder - Screen Recorder" from the Play Store after it was found to sneak in information stealing capabilities nearly a year after the app was published as an innocuous app.
The app (APK package name "com.tsoft.app.iscreenrecorder"), which accrued over 50,000 installations, was first uploaded on September 19, 2021. The malicious functionality


feed_id: https://thehackernews.com/2023/05/legion-malware-upgraded-to-target-ssh.html
title: Legion Malware Upgraded to Target SSH Servers and AWS Credentials
uri: 2023-05-24-Legion-Malware-Upgraded-to-Target-SSH-Servers-and-AWS-Credentials
url: https://thehackernews.com/2023/05/legion-malware-upgraded-to-target-ssh.html
content:
An updated version of the commodity malware called Legion comes with expanded features to compromise SSH servers and Amazon Web Services (AWS) credentials associated with DynamoDB and CloudWatch.
"This recent update demonstrates a widening of scope, with new capabilities such the ability to compromise SSH servers and retrieve additional AWS-specific credentials from Laravel web applications,"


feed_id: https://thehackernews.com/2023/05/n-korean-lazarus-group-targets.html
title: N. Korean Lazarus Group Targets Microsoft IIS Servers to Deploy Espionage Malware
uri: 2023-05-24-N-Korean-Lazarus-Group-Targets-Microsoft-IIS-Servers-to-Deploy-Espion
url: https://thehackernews.com/2023/05/n-korean-lazarus-group-targets.html
content:
The infamous Lazarus Group actor has been targeting vulnerable versions of Microsoft Internet Information Services (IIS) servers as an initial breach route to deploy malware on targeted systems.
The findings come from the AhnLab Security Emergency response Center (ASEC), which detailed the advanced persistent threat's (APT) continued abuse of DLL side-loading techniques to run arbitrary payloads


feed_id: https://thehackernews.com/2023/05/cyber-attacks-strike-ukraines-state.html
title: Cyber Attacks Strike Ukraine's State Bodies in Espionage Operation
uri: 2023-05-24-Cyber-Attacks-Strike-Ukraine-s-State-Bodies-in-Espionage-Operation
url: https://thehackernews.com/2023/05/cyber-attacks-strike-ukraines-state.html
content:
The Computer Emergency Response Team of Ukraine (CERT-UA) has warned of cyber attacks targeting state bodies in the country as part of an espionage campaign.
The intrusion set, attributed to a threat actor tracked by the authority as UAC-0063 since 2021, leverages phishing lures to deploy a variety of malicious tools on infected systems. The origins of the hacking crew are presently unknown.
In


feed_id: https://thehackernews.com/2023/05/goldenjackal-new-threat-group-targeting.html
title: GoldenJackal: New Threat Group Targeting Middle Eastern and South Asian Governments
uri: 2023-05-24-GoldenJackal-New-Threat-Group-Targeting-Middle-Eastern-and-South-Asia
url: https://thehackernews.com/2023/05/goldenjackal-new-threat-group-targeting.html
content:
Government and diplomatic entities in the Middle East and South Asia are the target of a new advanced persistent threat actor named GoldenJackal.
Russian cybersecurity firm Kaspersky, which has been keeping tabs on the group's activities since mid-2020, characterized the adversary as both capable and stealthy.
The targeting scope of the campaign is focused on Afghanistan, Azerbaijan, Iran, Iraq,


feed_id: https://thehackernews.com/2023/05/north-korean-kimsuky-hackers-strike.html
title: North Korean Kimsuky Hackers Strike Again with Advanced Reconnaissance Malware
uri: 2023-05-24-North-Korean-Kimsuky-Hackers-Strike-Again-with-Advanced-Reconnaissance
url: https://thehackernews.com/2023/05/north-korean-kimsuky-hackers-strike.html
content:
The North Korean advanced persistent threat (APT) group known as Kimsuky has been observed using a piece of custom malware called RandomQuery as part of a reconnaissance and information exfiltration operation.
"Lately, Kimsuky has been consistently distributing custom malware as part of reconnaissance campaigns to enable subsequent attacks," SentinelOne researchers Aleksandar Milenkoski and Tom


feed_id: https://thehackernews.com/2023/05/the-rising-threat-of-secrets-sprawl-and.html
title: The Rising Threat of Secrets Sprawl and the Need for Action
uri: 2023-05-24-The-Rising-Threat-of-Secrets-Sprawl-and-the-Need-for-Action
url: https://thehackernews.com/2023/05/the-rising-threat-of-secrets-sprawl-and.html
content:
The most precious asset in today's information age is the secret safeguarded under lock and key. Regrettably, maintaining secrets has become increasingly challenging, as highlighted by the 2023 State of Secrets Sprawl report, the largest analysis of public GitHub activity. 
The report shows a 67% year-over-year increase in the number of secrets found, with 10 million hard-coded secrets detected


feed_id: https://thehackernews.com/2023/05/new-wintapixsys-malware-engages-in.html
title: New WinTapix.sys Malware Engages in Multi-Stage Attack Across Middle East
uri: 2023-05-24-New-WinTapix-sys-Malware-Engages-in-Multi-Stage-Attack-Across-Middle-E
url: https://thehackernews.com/2023/05/new-wintapixsys-malware-engages-in.html
content:
An unknown threat actor has been observed leveraging a malicious Windows kernel driver in attacks likely targeting the Middle East since at least May 2020.
Fortinet Fortiguard Labs, which dubbed the artifact WINTAPIX (WinTapix.sys), attributed the malware with low confidence to an Iranian threat actor.
"WinTapix.sys is essentially a loader," security researchers Geri Revay and Hossein Jazi said


feed_id: https://thehackernews.com/2023/05/china-bans-us-chip-giant-micron-citing.html
title: China Bans U.S. Chip Giant Micron, Citing "Serious Cybersecurity Problems"
uri: 2023-05-24-China-Bans-U-S-Chip-Giant-Micron-Citing-Serious-Cybersecurity-Probl
url: https://thehackernews.com/2023/05/china-bans-us-chip-giant-micron-citing.html
content:
China has banned U.S. chip maker Micron from selling its products to Chinese companies working on key infrastructure projects, citing national security risks.
The development comes nearly two months after the country's cybersecurity authority initiated a probe in late March 2023 to assess potential network security risks.
"The purpose of this network security review of Micron's products is to


feed_id: https://thehackernews.com/2023/05/eu-regulators-hit-meta-with-record-13.html
title: E.U. Regulators Hit Meta with Record $1.3 Billion Fine for Data Transfer Violations
uri: E-U-Regulators-Hit-Meta-with-Record-1-3-Billion-Fine-for-Data-Transf
url: https://thehackernews.com/2023/05/eu-regulators-hit-meta-with-record-13.html
content:
Facebook's parent company Meta has been fined a record $1.3 billion by European Union data protection regulators for transferring the personal data of users in the region to the U.S.
In a binding decision taken by the European Data Protection Board (EDPB), the social media giant has been ordered to bring its data transfers into compliance with the GDPR and delete unlawfully stored and processed


feed_id: https://thehackernews.com/2023/05/indonesian-cybercriminals-exploit-aws.html
title: Indonesian Cybercriminals Exploit AWS for Profitable Crypto Mining Operations
uri: 2023-05-24-Indonesian-Cybercriminals-Exploit-AWS-for-Profitable-Crypto-Mining-Ope
url: https://thehackernews.com/2023/05/indonesian-cybercriminals-exploit-aws.html
content:
A financially motivated threat actor of Indonesian origin has been observed leveraging Amazon Web Services (AWS) Elastic Compute Cloud (EC2) instances to carry out illicit crypto mining operations.
Cloud security company's Permiso P0 Labs, which first detected the group in November 2021, has assigned it the moniker GUI-vil (pronounced Goo-ee-vil).
"The group displays a preference for Graphical


feed_id: https://thehackernews.com/2023/05/bad-magics-extended-reign-in-cyber.html
title: Bad Magic's Extended Reign in Cyber Espionage Goes Back Over a Decade
uri: 2023-05-24-Bad-Magic-s-Extended-Reign-in-Cyber-Espionage-Goes-Back-Over-a-Decade
url: https://thehackernews.com/2023/05/bad-magics-extended-reign-in-cyber.html
content:
New findings about a hacker group linked to cyber attacks targeting companies in the Russo-Ukrainian conflict area reveal that it may have been around for much longer than previously thought.
The threat actor, tracked as Bad Magic (aka Red Stinger), has not only been linked to a fresh sophisticated campaign, but also to an activity cluster that first came to light in May 2016.
"While the


feed_id: https://thehackernews.com/2023/05/are-your-apis-leaking-sensitive-data.html
title: Are Your APIs Leaking Sensitive Data?
uri: 2023-05-24-Are-Your-APIs-Leaking-Sensitive-Data
url: https://thehackernews.com/2023/05/are-your-apis-leaking-sensitive-data.html
content:
It's no secret that data leaks have become a major concern for both citizens and institutions across the globe. They can cause serious damage to an organization's reputation, induce considerable financial losses, and even have serious legal repercussions. From the infamous Cambridge Analytica scandal to the Equifax data breach, there have been some pretty high-profile leaks resulting in massive


feed_id: https://thehackernews.com/2023/05/uk-fraudster-behind-ispoof-scam.html
title: U.K. Fraudster Behind iSpoof Scam Receives 13-Year Jail Term for Cyber Crimes
uri: 2023-05-24-U-K-Fraudster-Behind-iSpoof-Scam-Receives-13-Year-Jail-Term-for-Cyber
url: https://thehackernews.com/2023/05/uk-fraudster-behind-ispoof-scam.html
content:
A U.K. national responsible for his role as the administrator of the now-defunct iSpoof online phone number spoofing service has been sentenced to 13 years and 4 months in prison.
Tejay Fletcher, 35, of Western Gateway, London, was awarded the sentence on May 18, 2023. He pleaded guilty last month to a number of cyber offenses, including facilitating fraud and possessing and transferring


feed_id: https://thehackernews.com/2023/05/keepass-exploit-allows-attackers-to.html
title: KeePass Exploit Allows Attackers to Recover Master Passwords from Memory
uri: 2023-05-24-KeePass-Exploit-Allows-Attackers-to-Recover-Master-Passwords-from-Memo
url: https://thehackernews.com/2023/05/keepass-exploit-allows-attackers-to.html
content:
A proof-of-concept (PoC) has been made available for a security flaw impacting the KeePass password manager that could be exploited to recover a victim's master password in cleartext under specific circumstances.
The issue, tracked as CVE-2023-32784, impacts KeePass versions 2.x for Windows, Linux, and macOS, and is expected to be patched in version 2.54, which is likely to be released early


feed_id: https://thehackernews.com/2023/05/pypi-repository-under-attack-user-sign.html
title: PyPI Repository Under Attack: User Sign-Ups and Package Uploads Temporarily Halted
uri: 2023-05-24-PyPI-Repository-Under-Attack-User-Sign-Ups-and-Package-Uploads-Tempor
url: https://thehackernews.com/2023/05/pypi-repository-under-attack-user-sign.html
content:
The maintainers of Python Package Index (PyPI), the official third-party software repository for the Python programming language, have temporarily disabled the ability for users to sign up and upload new packages until further notice.
"The volume of malicious users and malicious projects being created on the index in the past week has outpaced our ability to respond to it in a timely fashion,


feed_id: https://thehackernews.com/2023/05/meet-jack-from-romania-mastermind.html
title: Meet 'Jack' from Romania! Mastermind Behind Golden Chickens Malware
uri: 2023-05-24-Meet-Jack-from-Romania-Mastermind-Behind-Golden-Chickens-Malware
url: https://thehackernews.com/2023/05/meet-jack-from-romania-mastermind.html
content:
The identity of the second threat actor behind the Golden Chickens malware has been uncovered courtesy of a "fatal" operational security blunder, cybersecurity firm eSentire said.

The individual in question, who lives in Bucharest, Romania, has been given the codename Jack. He is one of the two criminals operating an account on the Russian-language Exploit.in forum under the name "badbullzvenom


feed_id: https://thehackernews.com/2023/05/notorious-cyber-gang-fin7-returns-cl0p.html
title: Notorious Cyber Gang FIN7 Returns With Cl0p Ransomware in New Wave of Attacks
uri: Notorious-Cyber-Gang-FIN7-Returns-With-Cl0p-Ransomware-in-New-Wave-of
url: https://thehackernews.com/2023/05/notorious-cyber-gang-fin7-returns-cl0p.html
content:
The notorious cybercrime group known as FIN7 has been observed deploying Cl0p (aka Clop) ransomware, marking the threat actor's first ransomware campaign since late 2021.
Microsoft, which detected the activity in April 2023, is tracking the financially motivated actor under its new taxonomy Sangria Tempest.
"In these recent attacks, Sangria Tempest uses the PowerShell script POWERTRASH to load


feed_id: https://thehackernews.com/2023/05/samsung-devices-under-active.html
title: Warning: Samsung Devices Under Attack! New Security Flaw Exposed
uri: Warning-Samsung-Devices-Under-Attack-New-Security-Flaw-Exposed
url: https://thehackernews.com/2023/05/samsung-devices-under-active.html
content:
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has warned of active exploitation of a medium-severity flaw affecting Samsung devices.
The issue, tracked as CVE-2023-21492 (CVSS score: 4.4), impacts select Samsung devices running Android versions 11, 12, and 13.
The South Korean electronics giant described the issue as an information disclosure flaw that could be exploited by a


feed_id: https://thehackernews.com/2023/05/privacy-sandbox-initiative-google-to.html
title: Privacy Sandbox Initiative: Google to Phase Out Third-Party Cookies Starting 2024
uri: 2023-05-24-Privacy-Sandbox-Initiative-Google-to-Phase-Out-Third-Party-Cookies-St
url: https://thehackernews.com/2023/05/privacy-sandbox-initiative-google-to.html
content:
Google has announced plans to officially flip the switch on its twice-delayed Privacy Sandbox initiatives as it slowly works its way to deprecate support for third-party cookies in Chrome browser.
To that end, the search and advertising giant said it intends to phase out third-party cookies for 1% of Chrome users globally in the first quarter of 2024.
"This will support developers in conducting


feed_id: https://thehackernews.com/2023/05/dr-active-directory-vs-mr-exposed.html
title: Dr. Active Directory vs. Mr. Exposed Attack Surface: Who'll Win This Fight?
uri: 2023-05-24-Dr-Active-Directory-vs-Mr-Exposed-Attack-Surface-Who-ll-Win-This-F
url: https://thehackernews.com/2023/05/dr-active-directory-vs-mr-exposed.html
content:
Active Directory (AD) is among the oldest pieces of software still used in the production environment and can be found in most organizations today. This is despite the fact that its historical security gaps have never been amended. For example, because of its inability to apply any security measures beyond checking for a password and username match, AD (as well the resources it manages) is


feed_id: https://thehackernews.com/2023/05/developer-alert-npm-packages-for-nodejs.html
title: Developer Alert: NPM Packages for Node.js Hiding Dangerous TurkoRat Malware
uri: 2023-05-24-Developer-Alert-NPM-Packages-for-Node-js-Hiding-Dangerous-TurkoRat-Ma
url: https://thehackernews.com/2023/05/developer-alert-npm-packages-for-nodejs.html
content:
Two malicious packages discovered in the npm package repository have been found to conceal an open source information stealer malware called TurkoRat.
The packages – named nodejs-encrypt-agent and nodejs-cookie-proxy-agent – were collectively downloaded approximately 1,200 times and were available for more than two months before they were identified and taken down.
ReversingLabs, which broke


feed_id: https://thehackernews.com/2023/05/searching-for-ai-tools-watch-out-for.html
title: Searching for AI Tools? Watch Out for Rogue Sites Distributing RedLine Malware
uri: 2023-05-24-Searching-for-AI-Tools-Watch-Out-for-Rogue-Sites-Distributing-RedLine
url: https://thehackernews.com/2023/05/searching-for-ai-tools-watch-out-for.html
content:
Malicious Google Search ads for generative AI services like OpenAI ChatGPT and Midjourney are being used to direct users to sketchy websites as part of a BATLOADER campaign designed to deliver RedLine Stealer malware.
"Both AI services are extremely popular but lack first-party standalone apps (i.e., users interface with ChatGPT via their web interface while Midjourney uses Discord)," eSentire


feed_id: https://thehackernews.com/2023/05/webkit-under-attack-apple-issues.html
title: WebKit Under Attack: Apple Issues Emergency Patches for 3 New Zero-Day Vulnerabilities
uri: 2023-05-24-WebKit-Under-Attack-Apple-Issues-Emergency-Patches-for-3-New-Zero-Day
url: https://thehackernews.com/2023/05/webkit-under-attack-apple-issues.html
content:
Apple on Thursday rolled out security updates to iOS, iPadOS, macOS, tvOS, watchOS, and the Safari web browser to address dozens of flaws, including three new zero-days that it said are being actively exploited in the wild.
The three security shortcomings are listed below -

CVE-2023-32409 - A WebKit flaw that could be exploited by a malicious actor to break out of the Web Content sandbox. It


feed_id: https://thehackernews.com/2023/05/this-cybercrime-syndicate-pre-infected.html
title: This Cybercrime Syndicate Pre-Infected Over 8.9 Million Android Phones Worldwide
uri: 2023-05-24-This-Cybercrime-Syndicate-Pre-Infected-Over-8-9-Million-Android-Phones
url: https://thehackernews.com/2023/05/this-cybercrime-syndicate-pre-infected.html
content:
A cybercrime enterprise known as Lemon Group is leveraging millions of pre-infected Android smartphones worldwide to carry out their malicious operations, posing significant supply chain risks.
"The infection turns these devices into mobile proxies, tools for stealing and selling SMS messages, social media and online messaging accounts and monetization via advertisements and click fraud,"


feed_id: https://thehackernews.com/2023/05/join-this-webinar-zero-trust-deception.html
title: Zero Trust + Deception: Join This Webinar to Learn How to Outsmart Attackers!
uri: Zero-Trust-Deception-Join-This-Webinar-to-Learn-How-to-Outsmart-Att
url: https://thehackernews.com/2023/05/join-this-webinar-zero-trust-deception.html
content:
Cybersecurity is constantly evolving, but complexity can give hostile actors an advantage. To stay ahead of current and future attacks, it's essential to simplify and reframe your defenses. Zscaler Deception is a state-of-the-art next-generation deception technology seamlessly integrated with the Zscaler Zero Trust Exchange. It creates a hostile environment for attackers and enables you to track


feed_id: https://thehackernews.com/2023/05/how-to-reduce-exposure-on-manufacturing.html
title: How to Reduce Exposure on the Manufacturing Attack Surface
uri: 2023-05-24-How-to-Reduce-Exposure-on-the-Manufacturing-Attack-Surface
url: https://thehackernews.com/2023/05/how-to-reduce-exposure-on-manufacturing.html
content:
Digitalization initiatives are connecting once-isolated Operational Technology (OT) environments with their Information Technology (IT) counterparts. This digital transformation of the factory floor has accelerated the connection of machinery to digital systems and data. Computer systems for managing and monitoring digital systems and data have been added to the hardware and software used for


feed_id: https://thehackernews.com/2023/05/escalating-china-taiwan-tensions-fuel.html
title: Escalating China-Taiwan Tensions Fuel Alarming Surge in Cyber Attacks
uri: 2023-05-24-Escalating-China-Taiwan-Tensions-Fuel-Alarming-Surge-in-Cyber-Attacks
url: https://thehackernews.com/2023/05/escalating-china-taiwan-tensions-fuel.html
content:
The rising geopolitical tensions between China and Taiwan in recent months have sparked a noticeable uptick in cyber attacks on the East Asian island country.
"From malicious emails and URLs to malware, the strain between China's claim of Taiwan as part of its territory and Taiwan's maintained independence has evolved into a worrying surge in attacks," the Trellix Advanced Research Center said 


feed_id: https://thehackernews.com/2023/05/8220-gang-exploiting-oracle-weblogic.html
title: 8220 Gang Exploiting Oracle WebLogic Flaw to Hijack Servers and Mine Cryptocurrency
uri: 2023-05-24-8220-Gang-Exploiting-Oracle-WebLogic-Flaw-to-Hijack-Servers-and-Mine-C
url: https://thehackernews.com/2023/05/8220-gang-exploiting-oracle-weblogic.html
content:
The notorious cryptojacking group tracked as 8220 Gang has been spotted weaponizing a six-year-old security flaw in Oracle WebLogic servers to ensnare vulnerable instances into a botnet and distribute cryptocurrency mining malware.
The flaw in question is CVE-2017-3506 (CVSS score: 7.4), which, when successfully exploited, could allow an unauthenticated attacker to execute arbitrary commands


feed_id: https://thehackernews.com/2023/05/darknet-carding-kingpin-pleads-guilty.html
title: Darknet Carding Kingpin Pleads Guilty: Sold Financial Info of Tens of Thousands
uri: 2023-05-24-Darknet-Carding-Kingpin-Pleads-Guilty-Sold-Financial-Info-of-Tens-of
url: https://thehackernews.com/2023/05/darknet-carding-kingpin-pleads-guilty.html
content:
A U.S. national has pleaded guilty in a Missouri court to operating a darknet carding site and selling financial information belonging to tens of thousands of victims in the country.
Michael D. Mihalo, aka Dale Michael Mihalo Jr. and ggmccloud1, has been accused of setting up a carding site called Skynet Market that specialized in the trafficking of credit and debit card data.
Mihalo and his


feed_id: https://thehackernews.com/2023/05/apple-thwarts-2-billion-in-app-store.html
title: Apple Thwarts $2 Billion in App Store Fraud, Rejects 1.7 Million App Submissions
uri: 2023-05-24-Apple-Thwarts-2-Billion-in-App-Store-Fraud-Rejects-1-7-Million-App-S
url: https://thehackernews.com/2023/05/apple-thwarts-2-billion-in-app-store.html
content:
Apple has announced that it prevented over $2 billion in potentially fraudulent transactions and rejected roughly 1.7 million app submissions for privacy and security violations in 2022.
The computing giant said it terminated 428,000 developer accounts for potential fraudulent activity, blocked 105,000 fake developer account creations, and deactivated 282 million bogus customer accounts. It


feed_id: https://thehackernews.com/2023/05/critical-flaws-in-cisco-small-business.html
title: Critical Flaws in Cisco Small Business Switches Could Allow Remote Attacks
uri: 2023-05-24-Critical-Flaws-in-Cisco-Small-Business-Switches-Could-Allow-Remote-Att
url: https://thehackernews.com/2023/05/critical-flaws-in-cisco-small-business.html
content:
Cisco has released updates to address a set of nine security flaws in its Small Business Series Switches that could be exploited by an unauthenticated, remote attacker to run arbitrary code or cause a denial-of-service (DoS) condition.
"These vulnerabilities are due to improper validation of requests that are sent to the web interface," Cisco said, crediting an unnamed external researcher for


feed_id: https://thehackernews.com/2023/05/oilalpha-emerging-houthi-linked-cyber.html
title: OilAlpha: Emerging Houthi-linked Cyber Threat Targets Arabian Android Users
uri: 2023-05-24-OilAlpha-Emerging-Houthi-linked-Cyber-Threat-Targets-Arabian-Android
url: https://thehackernews.com/2023/05/oilalpha-emerging-houthi-linked-cyber.html
content:
A hacking group dubbed OilAlpha with suspected ties to Yemen's Houthi movement has been linked to a cyber espionage campaign targeting development, humanitarian, media, and non-governmental organizations in the Arabian peninsula.
"OilAlpha used encrypted chat messengers like WhatsApp to launch social engineering attacks against its targets," cybersecurity company Recorded Future said in a


feed_id: https://thehackernews.com/2023/05/identifying-patch-management-solution.html
title: Identifying a Patch Management Solution: Overview of Key Criteria
uri: 2023-05-24-Identifying-a-Patch-Management-Solution-Overview-of-Key-Criteria
url: https://thehackernews.com/2023/05/identifying-patch-management-solution.html
content:
Software is rarely a one-and-done proposition.
In fact, any application available today will likely need to be updated – or patched – to fix bugs, address vulnerabilities, and update key features at multiple points in the future.
With the typical enterprise relying on a multitude of applications, servers, and end-point devices in their day-to-day operations, the acquisition of a robust patch


feed_id: https://thehackernews.com/2023/05/threat-group-unc3944-abusing-azure.html
title: Threat Group UNC3944 Abusing Azure Serial Console for Total VM Takeover
uri: 2023-05-24-Threat-Group-UNC3944-Abusing-Azure-Serial-Console-for-Total-VM-Takeove
url: https://thehackernews.com/2023/05/threat-group-unc3944-abusing-azure.html
content:
A financially motivated cyber actor has been observed abusing Microsoft Azure Serial Console on virtual machines (VMs) to install third-party remote management tools within compromised environments.
Google-owned Mandiant attributed the activity to a threat group it tracks under the name UNC3944, which is also known as Roasted 0ktapus and Scattered Spider.
"This method of attack was unique in


feed_id: https://thehackernews.com/2023/05/serious-unpatched-vulnerability.html
title: Serious Unpatched Vulnerability Uncovered in Popular Belkin Wemo Smart Plugs
uri: 2023-05-24-Serious-Unpatched-Vulnerability-Uncovered-in-Popular-Belkin-Wemo-Smart
url: https://thehackernews.com/2023/05/serious-unpatched-vulnerability.html
content:
The second generation version of Belkin's Wemo Mini Smart Plug has been found to contain a buffer overflow vulnerability that could be weaponized by a threat actor to inject arbitrary commands remotely.
The issue, assigned the identifier CVE-2023-27217, was discovered and reported to Belkin on January 9, 2023, by Israeli IoT security company Sternum, which reverse-engineered the device and


feed_id: https://thehackernews.com/2023/05/state-sponsored-sidewinder-hacker.html
title: State-Sponsored Sidewinder Hacker Group's Covert Attack Infrastructure Uncovered
uri: 2023-05-24-State-Sponsored-Sidewinder-Hacker-Group-s-Covert-Attack-Infrastructure
url: https://thehackernews.com/2023/05/state-sponsored-sidewinder-hacker.html
content:
Cybersecurity researchers have unearthed previously undocumented attack infrastructure used by the prolific state-sponsored group SideWinder to strike entities located in Pakistan and China.
This comprises a network of 55 domains and IP addresses used by the threat actor, cybersecurity companies Group-IB and Bridewell said in a joint report shared with The Hacker News.
"The identified phishing


feed_id: https://thehackernews.com/2023/05/us-offers-10-million-bounty-for-capture.html
title: U.S. Offers $10 Million Bounty for Capture of Notorious Russian Ransomware Operator
uri: 2023-05-24-U-S-Offers-10-Million-Bounty-for-Capture-of-Notorious-Russian-Ransom
url: https://thehackernews.com/2023/05/us-offers-10-million-bounty-for-capture.html
content:
A Russian national has been charged and indicted by the U.S. Department of Justice (DoJ) for launching ransomware attacks against "thousands of victims" in the country and across the world.
Mikhail Pavlovich Matveev (aka Wazawaka, m1x, Boriselcin, and Uhodiransomwar), the 30-year-old individual in question, is alleged to be a "central figure" in the development and deployment of LockBit, Babuk,


feed_id: https://thehackernews.com/2023/05/chinas-mustang-panda-hackers-exploit-tp.html
title: China's Mustang Panda Hackers Exploit TP-Link Routers for Persistent Attacks
uri: 2023-05-24-China-s-Mustang-Panda-Hackers-Exploit-TP-Link-Routers-for-Persistent-A
url: https://thehackernews.com/2023/05/chinas-mustang-panda-hackers-exploit-tp.html
content:
The Chinese nation-state actor known as Mustang Panda has been linked to a new set of sophisticated and targeted attacks aimed at European foreign affairs entities since January 2023.
An analysis of these intrusions, per Check Point researchers Itay Cohen and Radoslaw Madej, has revealed a custom firmware implant designed explicitly for TP-Link routers.
"The implant features several malicious


feed_id: https://thehackernews.com/2023/05/inside-qilin-ransomware-affiliates-take.html
title: Inside Qilin Ransomware: Affiliates Take Home 85% of Ransom Payouts
uri: 2023-05-24-Inside-Qilin-Ransomware-Affiliates-Take-Home-85-of-Ransom-Payouts
url: https://thehackernews.com/2023/05/inside-qilin-ransomware-affiliates-take.html
content:
Ransomware affiliates associated with the Qilin ransomware-as-a-service (RaaS) scheme earn anywhere between 80% to 85% of each ransom payment, according to new findings from Group-IB.
The cybersecurity firm said it was able to infiltrate the group in March 2023, uncovering details about the affiliates' payment structure and the inner workings of the RaaS program following a private conversation


feed_id: https://thehackernews.com/2023/05/cyolo-product-overview-secure-remote.html
title: Cyolo Product Overview: Secure Remote Access to All Environments
uri: 2023-05-24-Cyolo-Product-Overview-Secure-Remote-Access-to-All-Environments
url: https://thehackernews.com/2023/05/cyolo-product-overview-secure-remote.html
content:
Operational technology (OT) cybersecurity is a challenging but critical aspect of protecting organizations' essential systems and resources. Cybercriminals no longer break into systems, but instead log in – making access security more complex and also more important to manage and control than ever before. In an effort to solve the access-related challenges facing OT and critical infrastructure


feed_id: https://thehackernews.com/2023/05/water-orthrus-copperstealer-malware.html
title: CopperStealer Malware Crew Resurfaces with New Rootkit and Phishing Kit Modules
uri: 2023-05-24-CopperStealer-Malware-Crew-Resurfaces-with-New-Rootkit-and-Phishing-Ki
url: https://thehackernews.com/2023/05/water-orthrus-copperstealer-malware.html
content:
The threat actors behind the CopperStealer malware resurfaced with two new campaigns in March and April 2023 that are designed to deliver two novel payloads dubbed CopperStealth and CopperPhish.
Trend Micro is tracking the financially motivated group under the name Water Orthrus. The adversary is also assessed to be behind another campaign known as Scranos, which was detailed by Bitdefender in


feed_id: tag:blogger.com,1999:blog-4802841478634147276.post-8831320177961436193
uri: 3-Challenges-in-Building-a-Continuous-Threat-Exposure-Management-(CTEM
url: https://www.blogger.com/feeds/4802841478634147276/posts/default/8831320177961436193
title:
3 Challenges in Building a Continuous Threat Exposure Management (CTEM) Program and How to Beat Them


feed_id: tag:blogger.com,1999:blog-4802841478634147276.post-8377008202367904427
uri: Cloud-Security-Tops-Concerns-for-Cybersecurity-Leaders-EC-Council-s-C
url: http://www.blogger.com/feeds/4802841478634147276/posts/default/8377008202367904427
title:
Cloud Security Tops Concerns for Cybersecurity Leaders: EC-Council's Certified CISO Hall of Fame Report 2023


feed_id: https://thehackernews.com/2023/06/asylum-ambuscade-cybercrime-group-with.html
title: Asylum Ambuscade: A Cybercrime Group with Espionage Ambitions
uri: Asylum-Ambuscade-A-Cybercrime-Group-with-Espionage-Ambitions
url: https://thehackernews.com/2023/06/asylum-ambuscade-cybercrime-group-with.html
content:
The threat actor known as Asylum Ambuscade has been observed straddling cybercrime and cyber espionage operations since at least early 2020.
"It is a crimeware group that targets bank customers and cryptocurrency traders in various regions, including North America and Europe," ESET said in an analysis published Thursday. "Asylum Ambuscade also does espionage against government entities in Europe


feed_id: https://thehackernews.com/2023/06/5-reasons-why-access-management-is-key.html
title: 5 Reasons Why Access Management is the Key to Securing the Modern Workplace
uri: 2023-06-09-5-Reasons-Why-Access-Management-is-the-Key-to-Securing-the-Modern-Work
url: https://thehackernews.com/2023/06/5-reasons-why-access-management-is-key.html
content:
The way we work has undergone a dramatic transformation in recent years. We now operate within digital ecosystems, where remote work and the reliance on a multitude of digital tools is the norm rather than the exception. This shift – as you likely know from your own life – has led to superhuman levels of productivity that we wouldn't ever want to give up. But moving fast comes at a cost. And for


feed_id: https://thehackernews.com/2023/06/stealth-soldier-new-custom-backdoor.html
title: Stealth Soldier: A New Custom Backdoor Targets North Africa with Espionage Attacks
uri: 2023-06-09-Stealth-Soldier-A-New-Custom-Backdoor-Targets-North-Africa-with-Espio
url: https://thehackernews.com/2023/06/stealth-soldier-new-custom-backdoor.html
content:
A new custom backdoor dubbed Stealth Soldier has been deployed as part of a set of highly-targeted espionage attacks in North Africa.
"Stealth Soldier malware is an undocumented backdoor that primarily operates surveillance functions such as file exfiltration, screen and microphone recording, keystroke logging and stealing browser information," cybersecurity company Check Point said in a


feed_id: https://thehackernews.com/2023/06/experts-unveil-poc-exploit-for-recent.html
title: Experts Unveil Exploit for Recent Windows Vulnerability Under Active Exploitation
uri: 2023-06-09-Experts-Unveil-Exploit-for-Recent-Windows-Vulnerability-Under-Active-E
url: https://thehackernews.com/2023/06/experts-unveil-poc-exploit-for-recent.html
content:
Details have emerged about a now-patched actively exploited security flaw in Microsoft Windows that could be abused by a threat actor to gain elevated privileges on affected systems.
The vulnerability, tracked as CVE-2023-29336, is rated 7.8 for severity and concerns an elevation of privilege bug in the Win32k component.
"An attacker who successfully exploited this vulnerability could gain


feed_id: https://thehackernews.com/2023/06/clop-ransomware-gang-likely-exploiting.html
title: Clop Ransomware Gang Likely Aware of MOVEit Transfer Vulnerability Since 2021
uri: Clop-Ransomware-Gang-Likely-Aware-of-MOVEit-Transfer-Vulnerability-Sin
url: https://thehackernews.com/2023/06/clop-ransomware-gang-likely-exploiting.html
content:
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) and Federal Bureau of Investigation (FBI) have published a joint advisory regarding the active exploitation of a recently disclosed critical flaw in Progress Software's MOVEit Transfer application to drop ransomware.
"The Cl0p Ransomware Gang, also known as TA505, reportedly began exploiting a previously unknown SQL injection


feed_id: https://thehackernews.com/2023/06/how-to-improve-your-api-security-posture.html
title: How to Improve Your API Security Posture
uri: 2023-06-09-How-to-Improve-Your-API-Security-Posture
url: https://thehackernews.com/2023/06/how-to-improve-your-api-security-posture.html
content:
APIs, more formally known as application programming interfaces, empower apps and microservices to communicate and share data. However, this level of connectivity doesn't come without major risks. Hackers can exploit vulnerabilities in APIs to gain unauthorized access to sensitive data or even take control of the entire system. Therefore, it's essential to have a robust API security posture to


feed_id: https://thehackernews.com/2023/06/urgent-security-updates-cisco-and.html
title: Urgent Security Updates: Cisco and VMware Address Critical Vulnerabilities
uri: 2023-06-09-Urgent-Security-Updates-Cisco-and-VMware-Address-Critical-Vulnerabili
url: https://thehackernews.com/2023/06/urgent-security-updates-cisco-and.html
content:
VMware has released security updates to fix a trio of flaws in Aria Operations for Networks that could result in information disclosure and remote code execution.
The most critical of the three vulnerabilities is a command injection vulnerability tracked as CVE-2023-20887 (CVSS score: 9.8) that could allow a malicious actor with network access to achieve remote code execution.
Also patched by


feed_id: https://thehackernews.com/2023/06/kimsuky-targets-think-tanks-and-news.html
title: Kimsuky Targets Think Tanks and News Media with Social Engineering Attacks
uri: 2023-06-09-Kimsuky-Targets-Think-Tanks-and-News-Media-with-Social-Engineering-Att
url: https://thehackernews.com/2023/06/kimsuky-targets-think-tanks-and-news.html
content:
The North Korean nation-state threat actor known as Kimsuky has been linked to a social engineering campaign targeting experts in North Korean affairs with the goal of stealing Google credentials and delivering reconnaissance malware.
"Further, Kimsuky's objective extends to the theft of subscription credentials from NK News," cybersecurity firm SentinelOne said in a report shared with The


feed_id: https://thehackernews.com/2023/06/barracuda-urges-immediate-replacement.html
title: Barracuda Urges Immediate Replacement of Hacked ESG Appliances
uri: 2023-06-09-Barracuda-Urges-Immediate-Replacement-of-Hacked-ESG-Appliances
url: https://thehackernews.com/2023/06/barracuda-urges-immediate-replacement.html
content:
Enterprise security company Barracuda is now urging customers who were impacted by a recently disclosed zero-day flaw in its Email Security Gateway (ESG) appliances to immediately replace them.
"Impacted ESG appliances must be immediately replaced regardless of patch version level," the company said in an update, adding its "remediation recommendation at this time is full replacement of the


feed_id: https://thehackernews.com/2023/06/microsoft-to-pay-20-million-penalty-for.html
title: Microsoft to Pay $20 Million Penalty for Illegally Collecting Kids' Data on Xbox
uri: 2023-06-09-Microsoft-to-Pay-20-Million-Penalty-for-Illegally-Collecting-Kids-Da
url: https://thehackernews.com/2023/06/microsoft-to-pay-20-million-penalty-for.html
content:
Microsoft has agreed to pay a penalty of $20 million to settle U.S. Federal Trade Commission (FTC) charges that the company illegally collected and retained the data of children who signed up to use its Xbox video game console without their parents' knowledge or consent.
"Our proposed order makes it easier for parents to protect their children's privacy on Xbox, and limits what information


feed_id: https://thehackernews.com/2023/06/winning-mind-game-role-of-ransomware.html
title: Winning the Mind Game: The Role of the Ransomware Negotiator
uri: 2023-06-09-Winning-the-Mind-Game-The-Role-of-the-Ransomware-Negotiator
url: https://thehackernews.com/2023/06/winning-mind-game-role-of-ransomware.html
content:
Get exclusive insights from a real ransomware negotiator who shares authentic stories from network hostage situations and how he managed them.
The Ransomware Industry
Ransomware is an industry. As such, it has its own business logic: organizations pay money, in crypto-currency, in order to regain control over their systems and data.
This industry's landscape is made up of approximately 10-20


feed_id: https://thehackernews.com/2023/06/new-powerdrop-malware-targeting-us.html
title: New PowerDrop Malware Targeting U.S. Aerospace Industry
uri: 2023-06-09-New-PowerDrop-Malware-Targeting-U-S-Aerospace-Industry
url: https://thehackernews.com/2023/06/new-powerdrop-malware-targeting-us.html
content:
An unknown threat actor has been observed targeting the U.S. aerospace industry with a new PowerShell-based malware called PowerDrop.
"PowerDrop uses advanced techniques to evade detection such as deception, encoding, and encryption," according to Adlumin, which found the malware implanted in an unnamed domestic aerospace defense contractor in May 2023.
"The name is derived from the tool,


feed_id: https://thehackernews.com/2023/06/new-malware-campaign-leveraging-satacom.html
title: New Malware Campaign Leveraging Satacom Downloader to Steal Cryptocurrency
uri: 2023-06-09-New-Malware-Campaign-Leveraging-Satacom-Downloader-to-Steal-Cryptocurr
url: https://thehackernews.com/2023/06/new-malware-campaign-leveraging-satacom.html
content:
A recent malware campaign has been found to leverage Satacom downloader as a conduit to deploy stealthy malware capable of siphoning cryptocurrency using a rogue extension for Chromium-based browsers.
"The main purpose of the malware that is dropped by the Satacom downloader is to steal BTC from the victim's account by performing web injections into targeted cryptocurrency websites," Kaspersky


feed_id: https://thehackernews.com/2023/06/over-60k-adware-apps-posing-as-cracked.html
title: Over 60K Adware Apps Posing as Cracked Versions of Popular Apps Target Android Devices
uri: 2023-06-09-Over-60K-Adware-Apps-Posing-as-Cracked-Versions-of-Popular-Apps-Target
url: https://thehackernews.com/2023/06/over-60k-adware-apps-posing-as-cracked.html
content:
Thousands of adware apps for Android have been found to masquerade as cracks or modded versions of popular applications to serve unwanted ads to users as part of a campaign ongoing since October 2022.
"The campaign is designed to aggressively push adware to Android devices with the purpose to drive revenue," Bitdefender said in a technical report shared with The Hacker News. "However, the threat


feed_id: https://thehackernews.com/2023/06/5-reasons-why-it-security-tools-dont.html
title: 5 Reasons Why IT Security Tools Don't Work For OT
uri: 2023-06-09-5-Reasons-Why-IT-Security-Tools-Don-t-Work-For-OT
url: https://thehackernews.com/2023/06/5-reasons-why-it-security-tools-dont.html
content:
Attacks on critical infrastructure and other OT systems are on the rise as digital transformation and OT/IT convergence continue to accelerate. Water treatment facilities, energy providers, factories, and chemical plants — the infrastructure that undergirds our daily lives could all be at risk. Disrupting or manipulating OT systems stands to pose real physical harm to citizens, environments, and


feed_id: https://thehackernews.com/2023/06/zero-day-alert-google-issues-patch-for.html
title: Zero-Day Alert: Google Issues Patch for New Chrome Vulnerability - Update Now!
uri: 2023-06-09-Zero-Day-Alert-Google-Issues-Patch-for-New-Chrome-Vulnerability-Upd
url: https://thehackernews.com/2023/06/zero-day-alert-google-issues-patch-for.html
content:
Google on Monday released security updates to patch a high-severity flaw in its Chrome web browser that it said is being actively exploited in the wild.
Tracked as CVE-2023-3079, the vulnerability has been described as a type confusion bug in the V8 JavaScript engine. Clement Lecigne of Google's Threat Analysis Group (TAG) has been credited with reporting the issue on June 1, 2023.
"Type


feed_id: https://thehackernews.com/2023/06/cyclops-ransomware-gang-offers-go-based.html
title: Cyclops Ransomware Gang Offers Go-Based Info Stealer to Cybercriminals
uri: 2023-06-09-Cyclops-Ransomware-Gang-Offers-Go-Based-Info-Stealer-to-Cybercriminals
url: https://thehackernews.com/2023/06/cyclops-ransomware-gang-offers-go-based.html
content:
Threat actors associated with the Cyclops ransomware have been observed offering an information stealer malware that's designed to capture sensitive data from infected hosts.
"The threat actor behind this [ransomware-as-a-service] promotes its offering on forums," Uptycs said in a new report. "There it requests a share of profits from those engaging in malicious activities using its malware."


feed_id: https://thehackernews.com/2023/06/chinese-postalfurious-gang-strikes-uae.html
title: Chinese PostalFurious Gang Strikes UAE Users with Sneaky SMS Phishing Scheme
uri: 2023-06-09-Chinese-PostalFurious-Gang-Strikes-UAE-Users-with-Sneaky-SMS-Phishing
url: https://thehackernews.com/2023/06/chinese-postalfurious-gang-strikes-uae.html
content:
A Chinese-speaking phishing gang dubbed PostalFurious has been linked to a new SMS campaign that's targeting users in the U.A.E. by masquerading as postal services and toll operators, per Group-IB.
The fraudulent scheme entails sending users bogus text messages asking them to pay a vehicle trip fee to avoid additional fines. The messages also contain a shortened URL to conceal the actual


feed_id: https://thehackernews.com/2023/06/zyxel-firewalls-under-attack-urgent.html
title: Zyxel Firewalls Under Attack! Urgent Patching Required
uri: 2023-06-09-Zyxel-Firewalls-Under-Attack-Urgent-Patching-Required
url: https://thehackernews.com/2023/06/zyxel-firewalls-under-attack-urgent.html
content:
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday placed two recently disclosed flaws in Zyxel firewalls to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation.
The vulnerabilities, tracked as CVE-2023-33009 and CVE-2023-33010, are buffer overflow vulnerabilities that could enable an unauthenticated attacker to cause a


feed_id: https://thehackernews.com/2023/06/microsoft-lace-tempest-hackers-behind.html
title: Microsoft: Lace Tempest Hackers Behind Active Exploitation of MOVEit Transfer App
uri: 2023-06-09-Microsoft-Lace-Tempest-Hackers-Behind-Active-Exploitation-of-MOVEit-T
url: https://thehackernews.com/2023/06/microsoft-lace-tempest-hackers-behind.html
content:
Microsoft has officially linked the ongoing active exploitation of a critical flaw in the Progress Software MOVEit Transfer application to a threat actor it tracks as Lace Tempest.
"Exploitation is often followed by deployment of a web shell with data exfiltration capabilities," the Microsoft Threat Intelligence team said in a series of tweets today. "CVE-2023-34362 allows attackers to


feed_id: https://thehackernews.com/2023/06/the-annual-report-2024-plans-and.html
title: The Annual Report: 2024 Plans and Priorities for SaaS Security
uri: 2023-06-09-The-Annual-Report-2024-Plans-and-Priorities-for-SaaS-Security
url: https://thehackernews.com/2023/06/the-annual-report-2024-plans-and.html
content:
Over 55% of security executives report that they have experienced a SaaS security incident in the past two years — ranging from data leaks and data breaches to SaaS ransomware and malicious apps (as seen in figures 1 and 2). 
Figure 1. How many organizations have experienced a SaaS security incident within the past two years
The SaaS Security Survey Report: Plans and Priorities for 2024,


feed_id: https://thehackernews.com/2023/06/magento-woocommerce-wordpress-and.html
title: Magento, WooCommerce, WordPress, and Shopify Exploited in Web Skimmer Attack
uri: 2023-06-09-Magento-WooCommerce-WordPress-and-Shopify-Exploited-in-Web-Skimmer
url: https://thehackernews.com/2023/06/magento-woocommerce-wordpress-and.html
content:
Cybersecurity researchers have unearthed a new ongoing Magecart-style web skimmer campaign that's designed to steal personally identifiable information (PII) and credit card data from e-commerce websites.
A noteworthy aspect that sets it apart from other Magecart campaigns is that the hijacked sites further serve as "makeshift" command-and-control (C2) servers, using the cover to facilitate the


feed_id: https://thehackernews.com/2023/06/brazilian-cybercriminals-using-lolbas.html
title: Brazilian Cybercriminals Using LOLBaS and CMD Scripts to Drain Bank Accounts
uri: 2023-06-09-Brazilian-Cybercriminals-Using-LOLBaS-and-CMD-Scripts-to-Drain-Bank-Ac
url: https://thehackernews.com/2023/06/brazilian-cybercriminals-using-lolbas.html
content:
An unknown cybercrime threat actor has been observed targeting Spanish- and Portuguese-speaking victims to compromise online banking accounts in Mexico, Peru, and Portugal.
"This threat actor employs tactics such as LOLBaS (living-off-the-land binaries and scripts), along with CMD-based scripts to carry out its malicious activities," the BlackBerry Research and Intelligence Team said in a report


feed_id: https://thehackernews.com/2023/06/alarming-surge-in-truebot-activity.html
title: Alarming Surge in TrueBot Activity Revealed with New Delivery Vectors
uri: 2023-06-09-Alarming-Surge-in-TrueBot-Activity-Revealed-with-New-Delivery-Vectors
url: https://thehackernews.com/2023/06/alarming-surge-in-truebot-activity.html
content:
A surge in TrueBot activity was observed in May 2023, cybersecurity researchers disclosed.
"TrueBot is a downloader trojan botnet that uses command and control servers to collect information on compromised systems and uses that compromised system as a launching point for further attacks," VMware's Fae Carlisle said.
Active since at least 2017, TrueBot is linked to a group known as Silence that's


feed_id: https://thehackernews.com/2023/06/new-linux-ransomware-strain-blacksuit.html
title: New Linux Ransomware Strain BlackSuit Shows Striking Similarities to Royal
uri: 2023-06-09-New-Linux-Ransomware-Strain-BlackSuit-Shows-Striking-Similarities-to-R
url: https://thehackernews.com/2023/06/new-linux-ransomware-strain-blacksuit.html
content:
An analysis of the Linux variant of a new ransomware strain called BlackSuit has covered significant similarities with another ransomware family called Royal.
Trend Micro, which examined an x64 VMware ESXi version targeting Linux machines, said it identified an "extremely high degree of similarity" between Royal and BlackSuit.
"In fact, they're nearly identical, with 98% similarities in


feed_id: https://thehackernews.com/2023/06/cloud-security-tops-concerns-for.html
uri: 2023-06-09-Cloud-Security-Tops-Concerns-for-Cybersecurity-Leaders-EC-Council-s-C
url: https://thehackernews.com/2023/06/cloud-security-tops-concerns-for.html
title:
Cloud Security Tops Concerns for Cybersecurity Leaders: EC-Council's Certified CISO Hall of Fame Report 2023

content:
A survey of global cybersecurity leaders through the 2023 Certified CISO Hall of Fame Report commissioned by the EC-Council identified 4 primary areas of grave concern: cloud security, data security, security governance, and lack of cybersecurity talent.
EC-Council, the global leader in cybersecurity education and training, released its Certified Chief Information Security Officer Hall of Fame


feed_id: https://thehackernews.com/2023/06/ftc-slams-amazon-with-308m-fine-for.html
title: FTC Slams Amazon with $30.8M Fine for Privacy Violations Involving Alexa and Ring
uri: 2023-06-09-FTC-Slams-Amazon-with-30-8M-Fine-for-Privacy-Violations-Involving-Ale
url: https://thehackernews.com/2023/06/ftc-slams-amazon-with-308m-fine-for.html
content:
The U.S. Federal Trade Commission (FTC) has fined Amazon a cumulative $30.8 million over a series of privacy lapses regarding its Alexa assistant and Ring security cameras.
This comprises a $25 million penalty for breaching children's privacy laws by retaining their Alexa voice recordings for indefinite time periods and preventing parents from exercising their deletion rights.
"Amazon's history


feed_id: https://thehackernews.com/2023/06/new-botnet-malware-horabot-targets.html
title: New Botnet Malware 'Horabot' Targets Spanish-Speaking Users in Latin America
uri: 2023-06-09-New-Botnet-Malware-Horabot-Targets-Spanish-Speaking-Users-in-Latin-A
url: https://thehackernews.com/2023/06/new-botnet-malware-horabot-targets.html
content:
Spanish-speaking users in Latin America have been at the receiving end of a new botnet malware dubbed Horabot since at least November 2020.
"Horabot enables the threat actor to control the victim's Outlook mailbox, exfiltrate contacts' email addresses, and send phishing emails with malicious HTML attachments to all addresses in the victim's mailbox," Cisco Talos researcher Chetan Raghuprasad 


feed_id: https://thehackernews.com/2023/06/the-importance-of-managing-your-data.html
title: The Importance of Managing Your Data Security Posture
uri: 2023-06-09-The-Importance-of-Managing-Your-Data-Security-Posture
url: https://thehackernews.com/2023/06/the-importance-of-managing-your-data.html
content:
Data security is reinventing itself. As new data security posture management solutions come to market, organizations are increasingly recognizing the opportunity to provide evidence-based security that proves how their data is being protected. But what exactly is data security posture, and how do you manage it? 
Data security posture management (DSPM) became mainstream following the publication


feed_id: https://thehackernews.com/2023/06/camaro-dragon-strikes-with-new-tinynote.html
title: Camaro Dragon Strikes with New TinyNote Backdoor for Intelligence Gathering
uri: 2023-06-09-Camaro-Dragon-Strikes-with-New-TinyNote-Backdoor-for-Intelligence-Gath
url: https://thehackernews.com/2023/06/camaro-dragon-strikes-with-new-tinynote.html
content:
The Chinese nation-state group known as Camaro Dragon has been linked to yet another backdoor that's designed to meet its intelligence-gathering goals.
Israeli cybersecurity firm Check Point, which dubbed the Go-based malware TinyNote, said it functions as a first-stage payload capable of "basic machine enumeration and command execution via PowerShell or Goroutines."
What the malware lacks in


feed_id: https://thehackernews.com/2023/06/north-koreas-kimsuky-group-mimics-key.html
title: North Korea's Kimsuky Group Mimics Key Figures in Targeted Cyber Attacks
uri: 2023-06-09-North-Korea-s-Kimsuky-Group-Mimics-Key-Figures-in-Targeted-Cyber-Attac
url: https://thehackernews.com/2023/06/north-koreas-kimsuky-group-mimics-key.html
content:
U.S. and South Korean intelligence agencies have issued a new alert warning of North Korean cyber actors' use of social engineering tactics to strike think tanks, academia, and news media sectors.
The "sustained information gathering efforts" have been attributed to a state-sponsored cluster dubbed Kimsuky, which is also known by the names APT43, ARCHIPELAGO, Black Banshee, Emerald Sleet (


feed_id: https://thehackernews.com/2023/06/moveit-transfer-under-attack-zero-day.html
title: MOVEit Transfer Under Attack: Zero-Day Vulnerability Actively Being Exploited
uri: 2023-06-09-MOVEit-Transfer-Under-Attack-Zero-Day-Vulnerability-Actively-Being-Ex
url: https://thehackernews.com/2023/06/moveit-transfer-under-attack-zero-day.html
content:
A critical flaw in Progress Software's in MOVEit Transfer managed file transfer application has come under widespread exploitation in the wild to take over vulnerable systems.
The shortcoming, which is assigned the CVE identifier CVE-2023-34362, relates to a severe SQL injection vulnerability that could lead to escalated privileges and potential unauthorized access to the environment.
"An SQL


feed_id: https://thehackernews.com/2023/06/evasive-qbot-malware-leverages-short.html
title: Evasive QBot Malware Leverages Short-lived Residential IPs for Dynamic Attacks
uri: 2023-06-09-Evasive-QBot-Malware-Leverages-Short-lived-Residential-IPs-for-Dynamic
url: https://thehackernews.com/2023/06/evasive-qbot-malware-leverages-short.html
content:
An analysis of the "evasive and tenacious" malware known as QBot has revealed that 25% of its command-and-control (C2) servers are merely active for a single day.
What's more, 50% of the servers don't remain active for more than a week, indicating the use of an adaptable and dynamic C2 infrastructure, Lumen Black Lotus Labs said in a report shared with The Hacker News.
"This botnet has adapted


feed_id: https://thehackernews.com/2023/06/new-zero-click-hack-targets-ios-users.html
title: New Zero-Click Hack Targets iOS Users with Stealthy Root-Privilege Malware
uri: 2023-06-09-New-Zero-Click-Hack-Targets-iOS-Users-with-Stealthy-Root-Privilege-Mal
url: https://thehackernews.com/2023/06/new-zero-click-hack-targets-ios-users.html
content:
A previously unknown advanced persistent threat (APT) is targeting iOS devices as part of a sophisticated and long-running mobile campaign dubbed Operation Triangulation that began in 2019.
"The targets are infected using zero-click exploits via the iMessage platform, and the malware runs with root privileges, gaining complete control over the device and user data," Kaspersky said.
The Russian


feed_id: https://thehackernews.com/2023/06/unmasking-xe-group-experts-reveal.html
title: Unmasking XE Group: Experts Reveal Identity of Suspected Cybercrime Kingpin
uri: 2023-06-09-Unmasking-XE-Group-Experts-Reveal-Identity-of-Suspected-Cybercrime-Ki
url: https://thehackernews.com/2023/06/unmasking-xe-group-experts-reveal.html
content:
Cybersecurity researchers have unmasked the identity of one of the individuals who is believed to be associated with the e-crime actor known as XE Group.
According to Menlo Security, which pieced together the information from different online sources, "Nguyen Huu Tai, who also goes by the names Joe Nguyen and Thanh Nguyen, has the strongest likelihood of being involved with the XE Group."
XE


feed_id: https://thehackernews.com/2023/06/malicious-pypi-packages-using-compiled.html
title: Malicious PyPI Packages Using Compiled Python Code to Bypass Detection
uri: 2023-06-09-Malicious-PyPI-Packages-Using-Compiled-Python-Code-to-Bypass-Detection
url: https://thehackernews.com/2023/06/malicious-pypi-packages-using-compiled.html
content:
Researchers have discovered a novel attack on the Python Package Index (PyPI) repository that employs compiled Python code to sidestep detection by application security tools.
"It may be the first supply chain attack to take advantage of the fact that Python bytecode (PYC) files can be directly executed," ReversingLabs analyst Karlo Zanki said in a report shared with The Hacker News.
The package


feed_id: https://thehackernews.com/2023/06/how-wazuh-improves-it-hygiene-for-cyber.html
title: How Wazuh Improves IT Hygiene for Cyber Security Resilience
uri: 2023-06-09-How-Wazuh-Improves-IT-Hygiene-for-Cyber-Security-Resilience
url: https://thehackernews.com/2023/06/how-wazuh-improves-it-hygiene-for-cyber.html
content:
IT hygiene is a security best practice that ensures that digital assets in an organization's environment are secure and running properly. Good IT hygiene includes vulnerability management, security configuration assessments, maintaining asset and system inventories, and comprehensive visibility into the activities occurring in an environment.
As technology advances and the tools used by


feed_id: https://thehackernews.com/2023/06/improved-blackcat-ransomware-strikes.html
title: Improved BlackCat Ransomware Strikes with Lightning Speed and Stealthy Tactics
uri: 2023-06-09-Improved-BlackCat-Ransomware-Strikes-with-Lightning-Speed-and-Stealthy
url: https://thehackernews.com/2023/06/improved-blackcat-ransomware-strikes.html
content:
The threat actors behind BlackCat ransomware have come up with an improved variant that prioritizes speed and stealth in an attempt to bypass security guardrails and achieve their goals.
The new version, dubbed Sphynx and announced in February 2023, packs a "number of updated capabilities that strengthen the group's efforts to evade detection," IBM Security X-Force said in a new analysis.
The "


feed_id: https://thehackernews.com/2023/06/n-korean-scarcruft-hackers-exploit.html
title: N. Korean ScarCruft Hackers Exploit LNK Files to Spread RokRAT
uri: 2023-06-09-N-Korean-ScarCruft-Hackers-Exploit-LNK-Files-to-Spread-RokRAT
url: https://thehackernews.com/2023/06/n-korean-scarcruft-hackers-exploit.html
content:
Cybersecurity researchers have offered a closer look at the RokRAT remote access trojan that's employed by the North Korean state-sponsored actor known as ScarCruft.
"RokRAT is a sophisticated remote access trojan (RAT) that has been observed as a critical component within the attack chain, enabling the threat actors to gain unauthorized access, exfiltrate sensitive information, and potentially


feed_id: https://thehackernews.com/2023/06/active-mirai-botnet-variant-exploiting.html
title: Active Mirai Botnet Variant Exploiting Zyxel Devices for DDoS Attacks
uri: 2023-06-09-Active-Mirai-Botnet-Variant-Exploiting-Zyxel-Devices-for-DDoS-Attacks
url: https://thehackernews.com/2023/06/active-mirai-botnet-variant-exploiting.html
content:
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a recently patched critical security flaw in Zyxel gear to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation.
Tracked as CVE-2023-28771 (CVSS score: 9.8), the issue relates to a command injection flaw impacting different firewall models that could enable an unauthenticated attacker


feed_id: https://thehackernews.com/2023/06/urgent-wordpress-update-fixes-critical.html
title: Urgent WordPress Update Fixes Critical Flaw in Jetpack Plugin on Million of Sites
uri: 2023-06-09-Urgent-WordPress-Update-Fixes-Critical-Flaw-in-Jetpack-Plugin-on-Milli
url: https://thehackernews.com/2023/06/urgent-wordpress-update-fixes-critical.html
content:
WordPress has issued an automatic update to address a critical flaw in the Jetpack plugin that’s installed on over five million sites.
The vulnerability, which was unearthed during an internal security audit, resides in an API present in the plugin since version 2.0, which was released in November 2012.
“This vulnerability could be used by authors on a site to manipulate any files in the


feed_id: https://thehackernews.com/2023/05/cybercriminals-targeting-apache-nifi.html
title: Cybercriminals Targeting Apache NiFi Instances for Cryptocurrency Mining
uri: 2023-06-09-Cybercriminals-Targeting-Apache-NiFi-Instances-for-Cryptocurrency-Mini
url: https://thehackernews.com/2023/05/cybercriminals-targeting-apache-nifi.html
content:
A financially motivated threat actor is actively scouring the internet for unprotected Apache NiFi instances to covertly install a cryptocurrency miner and facilitate lateral movement.
The findings come from the SANS Internet Storm Center (ISC), which detected a spike in HTTP requests for “/nifi” on May 19, 2023.
“Persistence is achieved via timed processors or entries to cron,” said Dr.


feed_id: https://thehackernews.com/2023/05/critical-firmware-vulnerability-in.html
title: Critical Firmware Vulnerability in Gigabyte Systems Exposes ~7 Million Devices
uri: 2023-06-09-Critical-Firmware-Vulnerability-in-Gigabyte-Systems-Exposes-7-Million
url: https://thehackernews.com/2023/05/critical-firmware-vulnerability-in.html
content:
Cybersecurity researchers have found "backdoor-like behavior" within Gigabyte systems, which they say enables the UEFI firmware of the devices to drop a Windows executable and retrieve updates in an unsecure format.
Firmware security firm Eclypsium said it first detected the anomaly in April 2023. Gigabyte has since acknowledged and addressed the issue.
"Most Gigabyte firmware includes a Windows


feed_id: https://thehackernews.com/2023/05/beware-of-ghost-sites-silent-threat.html
title: Beware of Ghost Sites: Silent Threat Lurking in Your Salesforce Communities
uri: 2023-06-09-Beware-of-Ghost-Sites-Silent-Threat-Lurking-in-Your-Salesforce-Commun
url: https://thehackernews.com/2023/05/beware-of-ghost-sites-silent-threat.html
content:
Improperly deactivated and abandoned Salesforce Sites and Communities (aka Experience Cloud) could pose severe risks to organizations, leading to unauthorized access to sensitive data.
Data security firm Varonis dubbed the abandoned, unprotected, and unmonitored resources “ghost sites.”
“When these Communities are no longer needed, though, they are often set aside but not deactivated,” Varonis


feed_id: https://thehackernews.com/2023/05/microsoft-details-critical-apple-macos.html
title: Microsoft Details Critical Apple macOS Vulnerability Allowing SIP Protection Bypass
uri: 2023-06-09-Microsoft-Details-Critical-Apple-macOS-Vulnerability-Allowing-SIP-Prot
url: https://thehackernews.com/2023/05/microsoft-details-critical-apple-macos.html
content:
Microsoft has shared details of a now-patched flaw in Apple macOS that could be abused by threat actors with root access to bypass security enforcements and perform arbitrary actions on affected devices.
Specifically, the flaw – dubbed Migraine and tracked as CVE-2023-32369 – could be abused to get around a key security measure called System Integrity Protection (SIP), or “rootless,” which


feed_id: https://thehackernews.com/2023/05/6-steps-to-effective-threat-hunting.html
title: 6 Steps to Effectively Threat Hunting: Safeguard Critical Assets and Fight Cybercrime
uri: 2023-06-09-6-Steps-to-Effectively-Threat-Hunting-Safeguard-Critical-Assets-and-F
url: https://thehackernews.com/2023/05/6-steps-to-effective-threat-hunting.html
content:
Finding threat actors before they find you is key to beefing up your cyber defenses. How to do that efficiently and effectively is no small task – but with a small investment of time, you can master threat hunting and save your organization millions of dollars.
Consider this staggering statistic. Cybersecurity Ventures estimates that cybercrime will take a $10.5 trillion toll on the global


feed_id: https://thehackernews.com/2023/05/dark-pink-apt-group-leverages.html
title: Dark Pink APT Group Leverages TelePowerBot and KamiKakaBot in Sophisticated Attacks
uri: 2023-06-09-Dark-Pink-APT-Group-Leverages-TelePowerBot-and-KamiKakaBot-in-Sophisti
url: https://thehackernews.com/2023/05/dark-pink-apt-group-leverages.html
content:
The threat actor known as Dark Pink has been linked to five new attacks aimed at various entities in Belgium, Brunei, Indonesia, Thailand, and Vietnam between February 2022 and April 2023.
This includes educational institutions, government agencies, military bodies, and non-profit organizations, indicating the adversarial crew’s continued focus on high-value targets.
Dark Pink, also called


feed_id: https://thehackernews.com/2023/05/romcom-rat-using-deceptive-web-of-rogue.html
title: RomCom RAT Using Deceptive Web of Rogue Software Sites for Covert Attacks
uri: 2023-06-09-RomCom-RAT-Using-Deceptive-Web-of-Rogue-Software-Sites-for-Covert-Atta
url: https://thehackernews.com/2023/05/romcom-rat-using-deceptive-web-of-rogue.html
content:
The threat actors behind RomCom RAT are leveraging a network of fake websites advertising rogue versions of popular software at least since July 2022 to infiltrate targets.
Cybersecurity firm Trend Micro is tracking the activity cluster under the name Void Rabisu, which is also known as Tropical Scorpius (Unit 42) and UNC2596 (Mandiant).
"These lure sites are most likely only meant for a small


feed_id: https://thehackernews.com/2023/05/alert-hackers-exploit-barracuda-email.html
title: Alert: Hackers Exploit Barracuda Email Security Gateway 0-Day Flaw for 7 Months
uri: 2023-06-09-Alert-Hackers-Exploit-Barracuda-Email-Security-Gateway-0-Day-Flaw-for
url: https://thehackernews.com/2023/05/alert-hackers-exploit-barracuda-email.html
content:
Enterprise security firm Barracuda on Tuesday disclosed that a recently patched zero-day flaw in its Email Security Gateway (ESG) appliances had been abused by threat actors since October 2022 to backdoor the devices.
The latest findings show that the critical vulnerability, tracked as CVE-2023-2868 (CVSS score: N/A), has been actively exploited for at least seven months prior to its discovery.


feed_id: https://thehackernews.com/2023/05/hackers-win-105000-for-reporting.html
title: Hackers Win $105,000 for Reporting Critical Security Flaws in Sonos One Speakers
uri: 2023-06-09-Hackers-Win-105-000-for-Reporting-Critical-Security-Flaws-in-Sonos-On
url: https://thehackernews.com/2023/05/hackers-win-105000-for-reporting.html
content:
Multiple security flaws uncovered in Sonos One wireless speakers could be potentially exploited to achieve information disclosure and remote code execution, the Zero Day Initiative (ZDI) said in a report published last week.
The vulnerabilities were demonstrated by three different teams from Qrious Secure, STAR Labs, and DEVCORE at the Pwn2Own hacking contest held in Toronto late last year,


feed_id: https://thehackernews.com/2023/06/beware-new-doublefinger-loader-targets.html
title: Beware: New DoubleFinger Loader Targets Cryptocurrency Wallets with Stealer
uri: 2023-06-14-Beware-New-DoubleFinger-Loader-Targets-Cryptocurrency-Wallets-with-St
url: https://thehackernews.com/2023/06/beware-new-doublefinger-loader-targets.html
content:
A novel multi-stage loader called DoubleFinger has been observed delivering a cryptocurrency stealer dubbed GreetingGhoul in what's an advanced attack targeting users in Europe, the U.S., and Latin America.
"DoubleFinger is deployed on the target machine, when the victim opens a malicious PIF attachment in an email message, ultimately executing the first of DoubleFinger's loader stages,"


feed_id: https://thehackernews.com/2023/06/over-half-of-security-leaders-lack.html
title: Over Half of Security Leaders Lack Confidence in Protecting App Secrets, Study Reveals
uri: 2023-06-14-Over-Half-of-Security-Leaders-Lack-Confidence-in-Protecting-App-Secret
url: https://thehackernews.com/2023/06/over-half-of-security-leaders-lack.html
content:
It might come as a surprise, but secrets management has become the elephant in the AppSec room. While security vulnerabilities like Common Vulnerabilities and Exposures (CVEs) often make headlines in the cybersecurity world, secrets management remains an overlooked issue that can have immediate and impactful consequences for corporate safety. 
A recent study by GitGuardian found that 75% of IT


feed_id: https://thehackernews.com/2023/06/adversary-in-middle-attack-campaign.html
title: Adversary-in-the-Middle Attack Campaign Hits Dozens of Global Organizations
uri: 2023-06-14-Adversary-in-the-Middle-Attack-Campaign-Hits-Dozens-of-Global-Organiza
url: https://thehackernews.com/2023/06/adversary-in-middle-attack-campaign.html
content:
"Dozens" of organizations across the world have been targeted as part of a broad business email compromise (BEC) campaign that involved the use of adversary-in-the-middle (AitM) techniques to carry out the attacks.
"Following a successful phishing attempt, the threat actor gained initial access to one of the victim employee's account and executed an 'adversary-in-the-middle' attack to bypass


feed_id: https://thehackernews.com/2023/06/webinar-mastering-api-security.html
title: Webinar - Mastering API Security: Understanding Your True Attack Surface
uri: 2023-06-14-Webinar-Mastering-API-Security-Understanding-Your-True-Attack-Surfa
url: https://thehackernews.com/2023/06/webinar-mastering-api-security.html
content:
Believe it or not, your attack surface is expanding faster than you realize. How? APIs, of course! More formally known as application programming interfaces, API calls are growing twice as fast as HTML traffic, making APIs an ideal candidate for new security solutions aimed at protecting customer data, according to Cloudflare.
According to the "Quantifying the Cost of API Insecurity" report, US


feed_id: https://thehackernews.com/2023/06/two-russian-nationals-charged-for.html
title: Two Russian Nationals Charged for Masterminding Mt. Gox Crypto Exchange Hack
uri: 2023-06-14-Two-Russian-Nationals-Charged-for-Masterminding-Mt-Gox-Crypto-Exchang
url: https://thehackernews.com/2023/06/two-russian-nationals-charged-for.html
content:
The U.S. Department of Justice (DoJ) has charged two Russian nationals in connection with masterminding the 2014 digital heist of the now-defunct cryptocurrency exchange Mt. Gox.
According to unsealed indictments released last week, Alexey Bilyuchenko, 43, and Aleksandr Verner, 29, have been accused of conspiring to launder approximately 647,000 bitcoins stolen from September 2011 through at


feed_id: https://thehackernews.com/2023/06/critical-fortios-and-fortiproxy.html
title: Critical FortiOS and FortiProxy Vulnerability Likely Exploited - Patch Now!
uri: 2023-06-14-Critical-FortiOS-and-FortiProxy-Vulnerability-Likely-Exploited-Patch
url: https://thehackernews.com/2023/06/critical-fortios-and-fortiproxy.html
content:
Fortinet on Monday disclosed that a newly patched critical flaw impacting FortiOS and FortiProxy may have been "exploited in a limited number of cases" in attacks targeting government, manufacturing, and critical infrastructure sectors.
The vulnerability, tracked as CVE-2023-27997 (CVSS score: 9.2), concerns a heap-based buffer overflow vulnerability in FortiOS and FortiProxy SSL-VPN that could


feed_id: https://thehackernews.com/2023/06/researchers-uncover-publisher-spoofing.html
title: Researchers Uncover Publisher Spoofing Bug in Microsoft Visual Studio Installer
uri: 2023-06-14-Researchers-Uncover-Publisher-Spoofing-Bug-in-Microsoft-Visual-Studio
url: https://thehackernews.com/2023/06/researchers-uncover-publisher-spoofing.html
content:
Security researchers have warned about an "easily exploitable" flaw in the Microsoft Visual Studio installer that could be abused by a malicious actor to impersonate a legitimate publisher and distribute malicious extensions.
"A threat actor could impersonate a popular publisher and issue a malicious extension to compromise a targeted system," Varonis researcher Dolev Taler said. "Malicious


feed_id: https://thehackernews.com/2023/06/why-now-rise-of-attack-surface.html
title: Why Now? The Rise of Attack Surface Management
uri: 2023-06-14-Why-Now-The-Rise-of-Attack-Surface-Management
url: https://thehackernews.com/2023/06/why-now-rise-of-attack-surface.html
content:
The term "attack surface management" (ASM) went from unknown to ubiquitous in the cybersecurity space over the past few years. Gartner and Forrester have both highlighted the importance of ASM recently, multiple solution providers have emerged in the space, and investment and acquisition activity have seen an uptick. 
Many concepts come and go in cybersecurity, but attack surface management


feed_id: https://thehackernews.com/2023/06/cybercriminals-using-powerful-batcloak.html
title: Cybercriminals Using Powerful BatCloak Engine to Make Malware Fully Undetectable
uri: 2023-06-14-Cybercriminals-Using-Powerful-BatCloak-Engine-to-Make-Malware-Fully-Un
url: https://thehackernews.com/2023/06/cybercriminals-using-powerful-batcloak.html
content:
A fully undetectable (FUD) malware obfuscation engine named BatCloak is being used to deploy various malware strains since September 2022, while persistently evading antivirus detection.
The samples grant "threat actors the ability to load numerous malware families and exploits with ease through highly obfuscated batch files," Trend Micro researchers said.
About 79.6% of the total 784 artifacts


feed_id: https://thehackernews.com/2023/06/password-reset-hack-exposed-in-hondas-e.html
title: Password Reset Hack Exposed in Honda's E-Commerce Platform, Dealers Data at Risk
uri: 2023-06-14-Password-Reset-Hack-Exposed-in-Honda-s-E-Commerce-Platform-Dealers-Da
url: https://thehackernews.com/2023/06/password-reset-hack-exposed-in-hondas-e.html
content:
Security vulnerabilities discovered in Honda's e-commerce platform could have been exploited to gain unrestricted access to sensitive dealer information.
"Broken/missing access controls made it possible to access all data on the platform, even when logged in as a test account," security researcher Eaton Zveare said in a report published last week.
The platform is designed for the sale of power


feed_id: https://thehackernews.com/2023/06/beware-1000-fake-cryptocurrency-sites.html
title: Beware: 1,000+ Fake Cryptocurrency Sites Trap Users in Bogus Rewards Scheme
uri: 2023-06-14-Beware-1-000-Fake-Cryptocurrency-Sites-Trap-Users-in-Bogus-Rewards-S
url: https://thehackernews.com/2023/06/beware-1000-fake-cryptocurrency-sites.html
content:
A previously undetected cryptocurrency scam has leveraged a constellation of over 1,000 fraudulent websites to ensnare users into a bogus rewards scheme since at least January 2021.
"This massive campaign has likely resulted in thousands of people being scammed worldwide," Trend Micro researchers said in a report published last week, linking it to a Russian-speaking threat actor named "Impulse


feed_id: https://thehackernews.com/2023/06/critical-rce-flaw-discovered-in.html
title: Critical RCE Flaw Discovered in Fortinet FortiGate Firewalls - Patch Now!
uri: 2023-06-14-Critical-RCE-Flaw-Discovered-in-Fortinet-FortiGate-Firewalls-Patch-N
url: https://thehackernews.com/2023/06/critical-rce-flaw-discovered-in.html
content:
Fortinet has released patches to address a critical security flaw in its FortiGate firewalls that could be abused by a threat actor to achieve remote code execution.
The vulnerability, tracked as CVE-2023-27997, is "reachable pre-authentication, on every SSL VPN appliance," Lexfo Security researcher Charles Fol, who discovered and reported the flaw alongside Dany Bach, said in a tweet over the


feed_id: https://thehackernews.com/2023/06/apples-safari-private-browsing-now.html
title: Apple's Safari Private Browsing Now Automatically Removes Tracking Parameters in URLs
uri: 2023-06-14-Apple-s-Safari-Private-Browsing-Now-Automatically-Removes-Tracking-Par
url: https://thehackernews.com/2023/06/apples-safari-private-browsing-now.html
content:
Apple is introducing major updates to Safari Private Browsing, offering users better protections against third-party trackers as they browse the web.
"Advanced tracking and fingerprinting protections go even further to help prevent websites from using the latest techniques to track or identify a user's device," the iPhone maker said.
"Private Browsing now locks when not in use, allowing a user


feed_id: https://thehackernews.com/2023/06/new-spectralviper-backdoor-targeting.html
title: New SPECTRALVIPER Backdoor Targeting Vietnamese Public Companies
uri: 2023-06-14-New-SPECTRALVIPER-Backdoor-Targeting-Vietnamese-Public-Companies
url: https://thehackernews.com/2023/06/new-spectralviper-backdoor-targeting.html
content:
Vietnamese public companies have been targeted as part of an ongoing campaign that deploys a novel backdoor called SPECTRALVIPER.
"SPECTRALVIPER is a heavily obfuscated, previously undisclosed, x64 backdoor that brings PE loading and injection, file upload and download, file and directory manipulation, and token impersonation capabilities," Elastic Security Labs said in a Friday report.
The


feed_id: https://thehackernews.com/2023/06/new-critical-moveit-transfer-sql.html
title: New Critical MOVEit Transfer SQL Injection Vulnerabilities Discovered - Patch Now!
uri: 2023-06-14-New-Critical-MOVEit-Transfer-SQL-Injection-Vulnerabilities-Discovered
url: https://thehackernews.com/2023/06/new-critical-moveit-transfer-sql.html
content:
Progress Software, the company behind the MOVEit Transfer application, has released patches to address brand new SQL injection vulnerabilities affecting the file transfer solution that could enable the theft of sensitive information.
"Multiple SQL injection vulnerabilities have been identified in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain


feed_id: https://thehackernews.com/2023/06/microsoft-uncovers-banking-aitm.html
title: Microsoft Uncovers Banking AitM Phishing and BEC Attacks Targeting Financial Giants
uri: 2023-06-14-Microsoft-Uncovers-Banking-AitM-Phishing-and-BEC-Attacks-Targeting-Fin
url: https://thehackernews.com/2023/06/microsoft-uncovers-banking-aitm.html
content:
Banking and financial services organizations are the targets of a new multi-stage adversary-in-the-middle (AitM) phishing and business email compromise (BEC) attack, Microsoft has revealed.
"The attack originated from a compromised trusted vendor and transitioned into a series of AiTM attacks and follow-on BEC activity spanning multiple organizations," the tech giant disclosed in a Thursday


feed_id: tag:blogger.com,1999:blog-4802841478634147276.post-3211825176767522062
uri: How-Generative-AI-Can-Dupe-SaaS-Authentication-Protocols-And-Effec
url: http://www.blogger.com/feeds/4802841478634147276/posts/default/3211825176767522062
title:
How Generative AI Can Dupe SaaS Authentication Protocols — And Effective Ways To Prevent Other Key AI Risks in SaaS


feed_id: https://thehackernews.com/2023/07/unpatched-wordpress-plugin-flaw-could.html
title: Hackers Exploiting Unpatched WordPress Plugin Flaw to Create Secret Admin Accounts
uri: 2023-07-02-Hackers-Exploiting-Unpatched-WordPress-Plugin-Flaw-to-Create-Secret-Ad
url: https://thehackernews.com/2023/07/unpatched-wordpress-plugin-flaw-could.html
content:
As many as 200,000 WordPress websites are at risk of ongoing attacks exploiting a critical unpatched security vulnerability in the Ultimate Member plugin.
The flaw, tracked as CVE-2023-3460 (CVSS score: 9.8), impacts all versions of the Ultimate Member plugin, including the latest version (2.6.6) that was released on June 29, 2023.
Ultimate Member is a popular plugin that facilitates the


feed_id: https://thehackernews.com/2023/07/beware-new-rustbucket-malware-variant.html
title: Beware: New 'Rustbucket' Malware Variant Targeting macOS Users
uri: 2023-07-02-Beware-New-Rustbucket-Malware-Variant-Targeting-macOS-Users
url: https://thehackernews.com/2023/07/beware-new-rustbucket-malware-variant.html
content:
Researchers have pulled back the curtain on an updated version of an Apple macOS malware called Rustbucket that comes with improved capabilities to establish persistence and avoid detection by security software.
"This variant of Rustbucket, a malware family that targets macOS systems, adds persistence capabilities not previously observed," Elastic Security Labs researchers said in a report


feed_id: https://thehackernews.com/2023/06/iranian-hackers-charming-kitten-utilize.html
title: Iranian Hackers Using POWERSTAR Backdoor in Targeted Espionage Attacks
uri: Iranian-Hackers-Using-POWERSTAR-Backdoor-in-Targeted-Espionage-Attacks
url: https://thehackernews.com/2023/06/iranian-hackers-charming-kitten-utilize.html
content:
Charming Kitten, the nation-state actor affiliated with Iran's Islamic Revolutionary Guard Corps (IRGC), has been attributed to a bespoke spear-phishing campaign that delivers an updated version of a fully-featured PowerShell backdoor called POWERSTAR.
"There have been improved operational security measures placed in the malware to make it more difficult to analyze and collect intelligence,"


feed_id: https://thehackernews.com/2023/06/3-reasons-saas-security-is-imperative.html
title: 3 Reasons SaaS Security is the Imperative First Step to Ensuring Secure AI Usage
uri: 2023-07-02-3-Reasons-SaaS-Security-is-the-Imperative-First-Step-to-Ensuring-Secur
url: https://thehackernews.com/2023/06/3-reasons-saas-security-is-imperative.html
content:
In today's fast-paced digital landscape, the widespread adoption of AI (Artificial Intelligence) tools is transforming the way organizations operate. From chatbots to generative AI models, these SaaS-based applications offer numerous benefits, from enhanced productivity to improved decision-making. Employees using AI tools experience the advantages of quick answers and accurate results, enabling


feed_id: https://thehackernews.com/2023/06/whatsapp-upgrades-proxy-feature-against.html
title: WhatsApp Upgrades Proxy Feature Against Internet Shutdowns
uri: 2023-07-02-WhatsApp-Upgrades-Proxy-Feature-Against-Internet-Shutdowns
url: https://thehackernews.com/2023/06/whatsapp-upgrades-proxy-feature-against.html
content:
Meta's WhatsApp has rolled out updates to its proxy feature, allowing more flexibility in the kind of content that can be shared in conversations.
This includes the ability to send and receive images, voice notes, files, stickers and GIFs, WhatsApp told The Hacker News. The new features were first reported by BBC Persian.
Some of the other improvements include streamlined steps to simplify the


feed_id: https://thehackernews.com/2023/06/cybercriminals-hijacking-vulnerable-ssh.html
title: Cybercriminals Hijacking Vulnerable SSH Servers in New Proxyjacking Campaign
uri: 2023-07-02-Cybercriminals-Hijacking-Vulnerable-SSH-Servers-in-New-Proxyjacking-Ca
url: https://thehackernews.com/2023/06/cybercriminals-hijacking-vulnerable-ssh.html
content:
An active financially motivated campaign is targeting vulnerable SSH servers to covertly ensnare them into a proxy network.
"This is an active campaign in which the attacker leverages SSH for remote access, running malicious scripts that stealthily enlist victim servers into a peer-to-peer (P2P) proxy network, such as Peer2Profit or Honeygain," Akamai researcher Allen West said in a Thursday


feed_id: https://thehackernews.com/2023/06/mitre-unveils-top-25-most-dangerous.html
title: MITRE Unveils Top 25 Most Dangerous Software Weaknesses of 2023: Are You at Risk?
uri: 2023-07-02-MITRE-Unveils-Top-25-Most-Dangerous-Software-Weaknesses-of-2023-Are-Y
url: https://thehackernews.com/2023/06/mitre-unveils-top-25-most-dangerous.html
content:
MITRE has released its annual list of the Top 25 "most dangerous software weaknesses" for the year 2023.
"These weaknesses lead to serious vulnerabilities in software," the U.S. Cybersecurity and Infrastructure Security Agency (CISA) said. "An attacker can often exploit these vulnerabilities to take control of an affected system, steal data, or prevent applications from working."
The list is


feed_id: https://thehackernews.com/2023/06/from-muddyc3-to-phonyc2-irans.html
title: From MuddyC3 to PhonyC2: Iran's MuddyWater Evolves with a New Cyber Weapon
uri: 2023-07-02-From-MuddyC3-to-PhonyC2-Iran-s-MuddyWater-Evolves-with-a-New-Cyber-We
url: https://thehackernews.com/2023/06/from-muddyc3-to-phonyc2-irans.html
content:
The Iranian state-sponsored group dubbed MuddyWater has been attributed to a previously unseen command-and-control (C2) framework called PhonyC2 that's been put to use by the actor since 2021.
Evidence shows that the custom made, actively developed framework has been leveraged in the February 2023 attack on Technion, an Israeli research institute, cybersecurity firm Deep Instinct said in a


feed_id: https://thehackernews.com/2023/06/fluhorse-flutter-based-android-malware.html
title: Fluhorse: Flutter-Based Android Malware Targets Credit Cards and 2FA Codes
uri: 2023-07-02-Fluhorse-Flutter-Based-Android-Malware-Targets-Credit-Cards-and-2FA-C
url: https://thehackernews.com/2023/06/fluhorse-flutter-based-android-malware.html
content:
Cybersecurity researchers have shared the inner workings of an Android malware family called Fluhorse.
The malware "represents a significant shift as it incorporates the malicious components directly within the Flutter code," Fortinet FortiGuard Labs researcher Axelle Apvrille said in a report published last week.
Fluhorse was first documented by Check Point in early May 2023, detailing its


feed_id: https://thehackernews.com/2023/06/the-right-way-to-enhance-cti-with-ai.html
title: The Right Way to Enhance CTI with AI (Hint: It's the Data)
uri: 2023-07-02-The-Right-Way-to-Enhance-CTI-with-AI-(Hint-It-s-the-Data)
url: https://thehackernews.com/2023/06/the-right-way-to-enhance-cti-with-ai.html
content:
Cyber threat intelligence is an effective weapon in the ongoing battle to protect digital assets and infrastructure - especially when combined with AI. But AI is only as good as the data feeding it. Access to unique, underground sources is key.
Threat Intelligence offers tremendous value to people and companies. At the same time, its ability to address organizations' cybersecurity needs and the


feed_id: https://thehackernews.com/2023/06/north-korean-hacker-group-andariel.html
title: North Korean Hacker Group Andariel Strikes with New EarlyRat Malware
uri: 2023-07-02-North-Korean-Hacker-Group-Andariel-Strikes-with-New-EarlyRat-Malware
url: https://thehackernews.com/2023/06/north-korean-hacker-group-andariel.html
content:
The North Korea-aligned threat actor known as Andariel leveraged a previously undocumented malware called EarlyRat in phishing attacks, adding another piece to the group's wide-ranging toolset.
"Andariel infects machines by executing a Log4j exploit, which, in turn, downloads further malware from the command-and-control (C2) server," Kaspersky said in a new report.
Also called Silent Chollima


feed_id: https://thehackernews.com/2023/06/android-spy-app-letmespy-suffers-major.html
title: Android Spy App LetMeSpy Suffers Major Data Breach, Exposing Users' Personal Data
uri: 2023-07-02-Android-Spy-App-LetMeSpy-Suffers-Major-Data-Breach-Exposing-Users-Pe
url: https://thehackernews.com/2023/06/android-spy-app-letmespy-suffers-major.html
content:
Android-based phone monitoring app LetMeSpy has disclosed a security breach that allowed an unauthorized third-party to steal sensitive data associated with thousands of Android users.
"As a result of the attack, the criminals gained access to email addresses, telephone numbers and the content of messages collected on accounts," LetMeSpy said in an announcement on its website, noting the


feed_id: https://thehackernews.com/2023/06/critical-security-flaw-in-social-login.html
title: Critical Security Flaw in Social Login Plugin for WordPress Exposes Users' Accounts
uri: 2023-07-02-Critical-Security-Flaw-in-Social-Login-Plugin-for-WordPress-Exposes-Us
url: https://thehackernews.com/2023/06/critical-security-flaw-in-social-login.html
content:
A critical security flaw has been disclosed in miniOrange's Social Login and Register plugin for WordPress that could enable a malicious actor to log in as any user-provided information about email address is already known.
Tracked as CVE-2023-2982 (CVSS score: 9.8), the authentication bypass flaw impacts all versions of the plugin, including and prior to 7.6.4. It was addressed on June 14, 2023


feed_id: https://thehackernews.com/2023/06/newly-uncovered-thirdeye-windows-based.html
title: Newly Uncovered ThirdEye Windows-Based Malware Steals Sensitive Data
uri: 2023-07-02-Newly-Uncovered-ThirdEye-Windows-Based-Malware-Steals-Sensitive-Data
url: https://thehackernews.com/2023/06/newly-uncovered-thirdeye-windows-based.html
content:
A previously undocumented Windows-based information stealer called ThirdEye has been discovered in the wild with capabilities to harvest sensitive data from infected hosts.
Fortinet FortiGuard Labs, which made the discovery, said it found the malware in an executable that masqueraded as a PDF file with a Russian name "CMK Правила оформления больничных листов.pdf.exe," which translates to "CMK


feed_id: https://thehackernews.com/2023/06/alert-new-electromagnetic-attacks-on.html
title: Alert: New Electromagnetic Attacks on Drones Could Let Attackers Take Control
uri: 2023-07-02-Alert-New-Electromagnetic-Attacks-on-Drones-Could-Let-Attackers-Take
url: https://thehackernews.com/2023/06/alert-new-electromagnetic-attacks-on.html
content:
Drones that don't have any known security weaknesses could be the target of electromagnetic fault injection (EMFI) attacks, potentially enabling a threat actor to achieve arbitrary code execution and compromise their functionality and safety.
The research comes from IOActive, which found that it is "feasible to compromise the targeted device by injecting a specific EM glitch at the right time


feed_id: https://thehackernews.com/2023/06/cryptoslabs-scam-ring-targets-french.html
title: CryptosLabs Scam Ring Targets French-Speaking Investors, Rakes in €480 Million
uri: 2023-07-02-CryptosLabs-Scam-Ring-Targets-French-Speaking-Investors-Rakes-in-4
url: https://thehackernews.com/2023/06/cryptoslabs-scam-ring-targets-french.html
content:
Cybersecurity researchers have exposed the workings of a scam ring called CryptosLabs that's estimated to have made €480 million in illegal profits by targeting users in French-speaking individuals in France, Belgium, and Luxembourg since April 2018.
The syndicate's massive fake investment schemes primarily involve impersonating 40 well-known banks, fin-techs, asset management firms, and crypto


feed_id: https://thehackernews.com/2023/06/5-things-cisos-need-to-know-about.html
title: 5 Things CISOs Need to Know About Securing OT Environments
uri: 2023-07-02-5-Things-CISOs-Need-to-Know-About-Securing-OT-Environments
url: https://thehackernews.com/2023/06/5-things-cisos-need-to-know-about.html
content:
For too long the cybersecurity world focused exclusively on information technology (IT), leaving operational technology (OT) to fend for itself. Traditionally, few industrial enterprises had dedicated cybersecurity leaders. Any security decisions that arose fell to the plant and factory managers, who are highly skilled technical experts in other areas but often lack cybersecurity training or


feed_id: https://thehackernews.com/2023/06/8base-ransomware-spikes-in-activity.html
title: 8Base Ransomware Spikes in Activity, Threatens U.S. and Brazilian Businesses
uri: 2023-07-02-8Base-Ransomware-Spikes-in-Activity-Threatens-U-S-and-Brazilian-Busi
url: https://thehackernews.com/2023/06/8base-ransomware-spikes-in-activity.html
content:
A ransomware threat called 8Base that has been operating under the radar for over a year has been attributed to a "massive spike in activity" in May and June 2023.
"The group utilizes encryption paired with 'name-and-shame' techniques to compel their victims to pay their ransoms," VMware Carbon Black researchers Deborah Snyder and Fae Carlisle said in a report shared with The Hacker News. "8Base


feed_id: https://thehackernews.com/2023/06/critical-sql-injection-flaws-expose.html
title: Critical SQL Injection Flaws Expose Gentoo Soko to Remote Code Execution
uri: 2023-07-02-Critical-SQL-Injection-Flaws-Expose-Gentoo-Soko-to-Remote-Code-Executi
url: https://thehackernews.com/2023/06/critical-sql-injection-flaws-expose.html
content:
Multiple SQL injection vulnerabilities have been disclosed in Gentoo Soko that could lead to remote code execution (RCE) on vulnerable systems.
"These SQL injections happened despite the use of an Object-Relational Mapping (ORM) library and prepared statements," SonarSource researcher Thomas Chauchefoin said, adding they could result in RCE on Soko because of a "misconfiguration of the database.


feed_id: https://thehackernews.com/2023/06/new-mockingjay-process-injection.html
title: New Mockingjay Process Injection Technique Could Let Malware Evade Detection
uri: 2023-07-02-New-Mockingjay-Process-Injection-Technique-Could-Let-Malware-Evade-Det
url: https://thehackernews.com/2023/06/new-mockingjay-process-injection.html
content:
A new process injection technique dubbed Mockingjay could be exploited by threat actors to bypass security solutions to execute malicious code on compromised systems.
"The injection is executed without space allocation, setting permissions or even starting a thread," Security Joes researchers Thiago Peixoto, Felipe Duarte, and Ido Naor said in a report shared with The Hacker News. "The


feed_id: https://thehackernews.com/2023/06/new-ongoing-campaign-targets-npm.html
title: New Ongoing Campaign Targets npm Ecosystem with Unique Execution Chain
uri: 2023-07-02-New-Ongoing-Campaign-Targets-npm-Ecosystem-with-Unique-Execution-Chain
url: https://thehackernews.com/2023/06/new-ongoing-campaign-targets-npm.html
content:
Cybersecurity researchers have discovered a new ongoing campaign aimed at the npm ecosystem that leverages a unique execution chain to deliver an unknown payload to targeted systems.
"The packages in question seem to be published in pairs, each pair working in unison to fetch additional resources which are subsequently decoded and/or executed," software supply chain security firm Phylum said in


feed_id: https://thehackernews.com/2023/06/beyond-asset-discovery-how-attack.html
title: Beyond Asset Discovery: How Attack Surface Management Prioritizes Vulnerability Remediation
uri: 2023-07-02-Beyond-Asset-Discovery-How-Attack-Surface-Management-Prioritizes-Vuln
url: https://thehackernews.com/2023/06/beyond-asset-discovery-how-attack.html
content:
As the business environment becomes increasingly connected, organizations’ attack surfaces continue to expand, making it challenging to map and secure both known and unknown assets. In particular, unknown assets present security challenges related to shadow IT, misconfigurations, ineffective scan coverage, among others. 
Given attack surface sprawl and evolving threats, many organizations are


feed_id: https://thehackernews.com/2023/06/encrochat-bust-leads-to-6558-criminals.html
title: EncroChat Bust Leads to 6,558 Criminals' Arrests and €900 Million Seizure
uri: 2023-07-02-EncroChat-Bust-Leads-to-6-558-Criminals-Arrests-and-900-Million-Se
url: https://thehackernews.com/2023/06/encrochat-bust-leads-to-6558-criminals.html
content:
Europol on Tuesday announced that the takedown of EncroChat in July 2020 led to 6,558 arrests worldwide and the seizure of €900 million in illicit criminal proceeds.
The law enforcement agency said that a subsequent joint investigation initiated by French and Dutch authorities intercepted and analyzed over 115 million conversations that took place over the encrypted messaging platform between no


feed_id: https://thehackernews.com/2023/06/anatsa-banking-trojan-targeting-users.html
title: Anatsa Banking Trojan Targeting Users in US, UK, Germany, Austria, and Switzerland
uri: 2023-07-02-Anatsa-Banking-Trojan-Targeting-Users-in-US-UK-Germany-Austria-and
url: https://thehackernews.com/2023/06/anatsa-banking-trojan-targeting-users.html
content:
A new Android malware campaign has been observed pushing the Anatsa banking trojan to target banking customers in the U.S., U.K., Germany, Austria, and Switzerland since the start of March 2023.
"The actors behind Anatsa aim to steal credentials used to authorize customers in mobile banking applications and perform Device-Takeover Fraud (DTO) to initiate fraudulent transactions," ThreatFabric 


feed_id: https://thehackernews.com/2023/06/new-fortinets-fortinac-vulnerability.html
title: New Fortinet's FortiNAC Vulnerability Exposes Networks to Code Execution Attacks
uri: 2023-07-02-New-Fortinet-s-FortiNAC-Vulnerability-Exposes-Networks-to-Code-Executi
url: https://thehackernews.com/2023/06/new-fortinets-fortinac-vulnerability.html
content:
Fortinet has rolled out updates to address a critical security vulnerability impacting its FortiNAC network access control solution that could lead to the execution of arbitrary code.
Tracked as CVE-2023-33299, the flaw is rated 9.6 out of 10 for severity on the CVSS scoring system. It has been described as a case of Java untrusted object deserialization.
"A deserialization of untrusted data


feed_id: https://thehackernews.com/2023/06/researchers-find-way-to-recover.html
title: Researchers Find Way to Recover Cryptographic Keys by Analyzing LED Flickers
uri: 2023-07-02-Researchers-Find-Way-to-Recover-Cryptographic-Keys-by-Analyzing-LED-Fl
url: https://thehackernews.com/2023/06/researchers-find-way-to-recover.html
content:
In what's an ingenious side-channel attack, a group of academics has found that it's possible to recover secret keys from a device by analyzing video footage of its power LED.
"Cryptographic computations performed by the CPU change the power consumption of the device which affects the brightness of the device's power LED," researchers from the Ben-Gurion University of the Negev and Cornell


feed_id: https://thehackernews.com/2023/06/japanese-cryptocurrency-exchange-falls.html
title: Japanese Cryptocurrency Exchange Falls Victim to JokerSpy macOS Backdoor Attack
uri: 2023-07-02-Japanese-Cryptocurrency-Exchange-Falls-Victim-to-JokerSpy-macOS-Backdo
url: https://thehackernews.com/2023/06/japanese-cryptocurrency-exchange-falls.html
content:
An unknown cryptocurrency exchange located in Japan was the target of a new attack earlier this month to deploy an Apple macOS backdoor called JokerSpy.
Elastic Security Labs, which is monitoring the intrusion set under the name REF9134, said the attack led to the installation of Swiftbelt, a Swift-based enumeration tool inspired by an open-source utility called SeatBelt.
JokerSky was first


feed_id: https://thehackernews.com/2023/06/how-generative-ai-can-dupe-saas.html
uri: 2023-07-02-How-Generative-AI-Can-Dupe-SaaS-Authentication-Protocols-And-Effec
url: https://thehackernews.com/2023/06/how-generative-ai-can-dupe-saas.html
title:
How Generative AI Can Dupe SaaS Authentication Protocols — And Effective Ways To Prevent Other Key AI Risks in SaaS

content:
Security and IT teams are routinely forced to adopt software before fully understanding the security risks. And AI tools are no exception.
Employees and business leaders alike are flocking to generative AI software and similar programs, often unaware of the major SaaS security vulnerabilities they're introducing into the enterprise. A February 2023 generative AI survey of 1,000 executives 


feed_id: https://thehackernews.com/2023/06/microsoft-warns-of-widescale-credential.html
title: Microsoft Warns of Widescale Credential Stealing Attacks by Russian Hackers
uri: 2023-07-02-Microsoft-Warns-of-Widescale-Credential-Stealing-Attacks-by-Russian-Ha
url: https://thehackernews.com/2023/06/microsoft-warns-of-widescale-credential.html
content:
Microsoft has disclosed that it's detected a spike in credential-stealing attacks conducted by the Russian state-affiliated hacker group known as Midnight Blizzard.
The intrusions, which make use of residential proxy services to obfuscate the source IP address of the attacks, target governments, IT service providers, NGOs, defense, and critical manufacturing sectors, the tech giant's threat


feed_id: https://thehackernews.com/2023/06/chinese-hackers-using-never-before-seen.html
title: Chinese Hackers Using Never-Before-Seen Tactics for Critical Infrastructure Attacks
uri: 2023-07-02-Chinese-Hackers-Using-Never-Before-Seen-Tactics-for-Critical-Infrastru
url: https://thehackernews.com/2023/06/chinese-hackers-using-never-before-seen.html
content:
The newly discovered Chinese nation-state actor known as Volt Typhoon has been observed to be active in the wild since at least mid-2020, with the hacking crew linked to never-before-seen tradecraft to retain remote access to targets of interest.
The findings come from CrowdStrike, which is tracking the adversary under the name Vanguard Panda.
"The adversary consistently employed ManageEngine


feed_id: https://thehackernews.com/2023/06/us-cybersecurity-agency-adds-6-flaws-to.html
title: U.S. Cybersecurity Agency Adds 6 Flaws to Known Exploited Vulnerabilities Catalog
uri: 2023-07-02-U-S-Cybersecurity-Agency-Adds-6-Flaws-to-Known-Exploited-Vulnerabilit
url: https://thehackernews.com/2023/06/us-cybersecurity-agency-adds-6-flaws-to.html
content:
The U.S. Cybersecurity and Infrastructure Security Agency has added a batch of six flaws to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation.
This comprises three vulnerabilities that Apple patched this week (CVE-2023-32434, CVE-2023-32435, and CVE-2023-32439), two flaws in VMware (CVE-2023-20867 and CVE-2023-20887), and one shortcoming impacting Zyxel


feed_id: https://thehackernews.com/2023/06/twitter-hacker-sentenced-to-5-years-in.html
title: Twitter Hacker Sentenced to 5 Years in Prison for $120,000 Crypto Scam
uri: 2023-07-02-Twitter-Hacker-Sentenced-to-5-Years-in-Prison-for-120-000-Crypto-Scam
url: https://thehackernews.com/2023/06/twitter-hacker-sentenced-to-5-years-in.html
content:
A U.K. citizen who took part in the massive July 2020 hack of Twitter has been sentenced to five years in prison in the U.S.
Joseph James O'Connor (aka PlugwalkJoe), 24, was awarded the sentence on Friday in the Southern District of New York, a little over a month after he pleaded guilty to the criminal schemes. He was arrested in Spain in July 2021.
The infamous Twitter breach allowed the


feed_id: https://thehackernews.com/2023/06/cybercrime-group-muddled-libra-targets.html
title: Cybercrime Group 'Muddled Libra' Targets BPO Sector with Advanced Social Engineering
uri: 2023-07-02-Cybercrime-Group-Muddled-Libra-Targets-BPO-Sector-with-Advanced-Soci
url: https://thehackernews.com/2023/06/cybercrime-group-muddled-libra-targets.html
content:
A threat actor known as Muddled Libra is targeting the business process outsourcing (BPO) industry with persistent attacks that leverage advanced social engineering ploys to gain initial access.
"The attack style defining Muddled Libra appeared on the cybersecurity radar in late 2022 with the release of the 0ktapus phishing kit, which offered a prebuilt hosting framework and bundled templates,"


feed_id: https://thehackernews.com/2023/06/the-power-of-browser-fingerprinting.html
title: The Power of Browser Fingerprinting: Personalized UX, Fraud Detection, and Secure Logins
uri: 2023-07-02-The-Power-of-Browser-Fingerprinting-Personalized-UX-Fraud-Detection
url: https://thehackernews.com/2023/06/the-power-of-browser-fingerprinting.html
content:
The case for browser fingerprinting: personalizing user experience, improving fraud detection, and optimizing login security
Have you ever heard of browser fingerprinting? You should! It's an online user identification technique that collects information about a visitor's web browser and its configuration preferences to associate individual browsing sessions with a single website visitor. 
With


feed_id: https://thehackernews.com/2023/06/powerful-javascript-dropper-pindos.html
title: Powerful JavaScript Dropper PindOS Distributes Bumblebee and IcedID Malware
uri: 2023-07-02-Powerful-JavaScript-Dropper-PindOS-Distributes-Bumblebee-and-IcedID-Ma
url: https://thehackernews.com/2023/06/powerful-javascript-dropper-pindos.html
content:
A new strain of JavaScript dropper has been observed delivering next-stage payloads like Bumblebee and IcedID.
Cybersecurity firm Deep Instinct is tracking the malware as PindOS, which contains the name in its "User-Agent" string.
Both Bumblebee and IcedID serve as loaders, acting as a vector for other malware on compromised hosts, including ransomware. A recent report from Proofpoint 


feed_id: https://thehackernews.com/2023/06/nsa-releases-guide-to-combat-powerful.html
title: NSA Releases Guide to Combat Powerful BlackLotus Bootkit Targeting Windows Systems
uri: 2023-07-02-NSA-Releases-Guide-to-Combat-Powerful-BlackLotus-Bootkit-Targeting-Win
url: https://thehackernews.com/2023/06/nsa-releases-guide-to-combat-powerful.html
content:
The U.S. National Security Agency (NSA) on Thursday released guidance to help organizations detect and prevent infections of a Unified Extensible Firmware Interface (UEFI) bootkit called BlackLotus.
To that end, the agency is recommending that "infrastructure owners take action by hardening user executable policies and monitoring the integrity of the boot partition."
BlackLotus is an advanced 


feed_id: https://thehackernews.com/2023/06/new-cryptocurrency-mining-campaign.html
title: New Cryptocurrency Mining Campaign Targets Linux Systems and IoT Devices
uri: 2023-07-02-New-Cryptocurrency-Mining-Campaign-Targets-Linux-Systems-and-IoT-Devic
url: https://thehackernews.com/2023/06/new-cryptocurrency-mining-campaign.html
content:
Internet-facing Linux systems and Internet of Things (IoT) devices are being targeted as part of a new campaign designed to illicitly mine cryptocurrency.
"The threat actors behind the attack use a backdoor that deploys a wide array of tools and components such as rootkits and an IRC bot to steal device resources for mining operations," Microsoft threat intelligence researcher Rotem Sde-Or said.


feed_id: https://thehackernews.com/2023/06/multistorm-campaign-targets-india-and.html
title: MULTI#STORM Campaign Targets India and U.S. with Remote Access Trojans
uri: 2023-07-02-MULTI-STORM-Campaign-Targets-India-and-U-S-with-Remote-Access-Trojans
url: https://thehackernews.com/2023/06/multistorm-campaign-targets-india-and.html
content:
A new phishing campaign codenamed MULTI#STORM has set its sights on India and the U.S. by leveraging JavaScript files to deliver remote access trojans on compromised systems.
"The attack chain ends with the victim machine infected with multiple unique RAT (remote access trojan) malware instances, such as Warzone RAT and Quasar RAT," Securonix researchers Den Iuzvyk, Tim Peck, and Oleg Kolesnikov


feed_id: https://thehackernews.com/2023/06/generative-ai-apps-chatgpt-potential.html
title: Generative-AI apps & ChatGPT: Potential risks and mitigation strategies
uri: 2023-07-02-Generative-AI-apps-ChatGPT-Potential-risks-and-mitigation-strategie
url: https://thehackernews.com/2023/06/generative-ai-apps-chatgpt-potential.html
content:
Losing sleep over Generative-AI apps? You're not alone or wrong. According to the Astrix Security Research Group, mid size organizations already have, on average, 54 Generative-AI integrations to core systems like Slack, GitHub and Google Workspace and this number is only expected to grow. Continue reading to understand the potential risks and how to minimize them. 
Book a Generative-AI


feed_id: https://thehackernews.com/2023/06/alert-million-of-github-repositories.html
title: Alert: Million of GitHub Repositories Likely Vulnerable to RepoJacking Attack
uri: 2023-07-02-Alert-Million-of-GitHub-Repositories-Likely-Vulnerable-to-RepoJacking
url: https://thehackernews.com/2023/06/alert-million-of-github-repositories.html
content:
Millions of software repositories on GitHub are likely vulnerable to an attack called RepoJacking, a new study has revealed.
This includes repositories from organizations such as Google, Lyft, and several others, Massachusetts-based cloud-native security firm Aqua said in a Wednesday report.
The supply chain vulnerability, also known as dependency repository hijacking, is a class of attacks that


feed_id: https://thehackernews.com/2023/06/camaro-dragon-hackers-strike-with-usb.html
title: Camaro Dragon Hackers Strike with USB-Driven Self-Propagating Malware
uri: 2023-07-02-Camaro-Dragon-Hackers-Strike-with-USB-Driven-Self-Propagating-Malware
url: https://thehackernews.com/2023/06/camaro-dragon-hackers-strike-with-usb.html
content:
The Chinese cyber espionage actor known as Camaro Dragon has been observed leveraging a new strain of self-propagating malware that spreads through compromised USB drives.
"While their primary focus has traditionally been Southeast Asian countries, this latest discovery reveals their global reach and highlights the alarming role USB drives play in spreading malware," Check Point said in new


feed_id: https://thehackernews.com/2023/06/unveiling-unseen-identifying-data.html
title: Unveiling the Unseen: Identifying Data Exfiltration with Machine Learning
uri: 2023-07-02-Unveiling-the-Unseen-Identifying-Data-Exfiltration-with-Machine-Learn
url: https://thehackernews.com/2023/06/unveiling-unseen-identifying-data.html
content:
Why Data Exfiltration Detection is Paramount?
The world is witnessing an exponential rise in ransomware and data theft employed to extort companies. At the same time, the industry faces numerous critical vulnerabilities in database software and company websites. This evolution paints a dire picture of data exposure and exfiltration that every security leader and team is grappling with. This


feed_id: https://thehackernews.com/2023/06/critical-flaw-found-in-wordpress-plugin.html
title: Critical Flaw Found in WordPress Plugin for WooCommerce Used by 30,000 Websites
uri: 2023-07-02-Critical-Flaw-Found-in-WordPress-Plugin-for-WooCommerce-Used-by-30-000
url: https://thehackernews.com/2023/06/critical-flaw-found-in-wordpress-plugin.html
content:
A critical security flaw has been disclosed in the WordPress "Abandoned Cart Lite for WooCommerce" plugin that's installed on more than 30,000 websites.
"This vulnerability makes it possible for an attacker to gain access to the accounts of users who have abandoned their carts, who are typically customers but can extend to other high-level users when the right conditions are met," Defiant's


feed_id: https://thehackernews.com/2023/06/zero-day-alert-apple-releases-patches.html
title: Zero-Day Alert: Apple Releases Patches for Actively Exploited Flaws in iOS, macOS, and Safari
uri: 2023-07-02-Zero-Day-Alert-Apple-Releases-Patches-for-Actively-Exploited-Flaws-in
url: https://thehackernews.com/2023/06/zero-day-alert-apple-releases-patches.html
content:
Apple on Wednesday released a slew of updates for iOS, iPadOS, macOS, watchOS, and Safari browser to address a set of flaws it said were actively exploited in the wild.
This includes a pair of zero-days that have been weaponized in a mobile surveillance campaign called Operation Triangulation that has been active since 2019. The exact threat actor behind the activity is not known.


feed_id: https://thehackernews.com/2023/06/scarcruft-hackers-exploit-ably-service.html
title: ScarCruft Hackers Exploit Ably Service for Stealthy Wiretapping Attacks
uri: 2023-07-02-ScarCruft-Hackers-Exploit-Ably-Service-for-Stealthy-Wiretapping-Attack
url: https://thehackernews.com/2023/06/scarcruft-hackers-exploit-ably-service.html
content:
The North Korean threat actor known as ScarCruft has been observed using an information-stealing malware with previously undocumented wiretapping features as well as a backdoor developed using Golang that exploits the Ably real-time messaging service.
"The threat actor sent their commands through the Golang backdoor that is using the Ably service," the AhnLab Security Emergency response Center (


feed_id: https://thehackernews.com/2023/06/new-report-exposes-operation.html
title: New Report Exposes Operation Triangulation's Spyware Implant Targeting iOS Devices
uri: 2023-07-02-New-Report-Exposes-Operation-Triangulation-s-Spyware-Implant-Targeting
url: https://thehackernews.com/2023/06/new-report-exposes-operation.html
content:
More details have emerged about the spyware implant that's delivered to iOS devices as part of a campaign called Operation Triangulation.
Kaspersky, which discovered the operation after becoming one of the targets at the start of the year, said the malware has a lifespan of 30 days, after which it gets automatically uninstalled unless the time period is extended by the attackers.
The Russian


feed_id: https://thehackernews.com/2023/06/startup-security-tactics-friction.html
title: Startup Security Tactics: Friction Surveys
uri: 2023-07-02-Startup-Security-Tactics-Friction-Surveys
url: https://thehackernews.com/2023/06/startup-security-tactics-friction.html
content:
When we do quarterly planning, my team categorizes our goals within four evergreen outcomes:

Reduce the risk of information security incidents
Increase trust in Vanta's information security program
Reduce the friction caused by information security controls
Use security expertise to support the business

In this article, I'm going to focus on number three: reducing friction.
Declaring your


feed_id: https://thehackernews.com/2023/06/critical-noauth-flaw-in-microsoft-azure.html
title: Critical 'nOAuth' Flaw in Microsoft Azure AD Enabled Complete Account Takeover
uri: 2023-07-02-Critical-nOAuth-Flaw-in-Microsoft-Azure-AD-Enabled-Complete-Account
url: https://thehackernews.com/2023/06/critical-noauth-flaw-in-microsoft-azure.html
content:
A security shortcoming in Microsoft Azure Active Directory (AD) Open Authorization (OAuth) process could have been exploited to achieve full account takeover, researchers said.
California-based identity and access management service Descope, which discovered and reported the issue in April 2023, dubbed it nOAuth.
"nOAuth is an authentication implementation flaw that can affect Microsoft Azure AD


feed_id: https://thehackernews.com/2023/06/chinese-hacker-group-flea-targets.html
title: Chinese Hacker Group 'Flea' Targets American Ministries with Graphican Backdoor
uri: 2023-07-02-Chinese-Hacker-Group-Flea-Targets-American-Ministries-with-Graphican
url: https://thehackernews.com/2023/06/chinese-hacker-group-flea-targets.html
content:
Foreign affairs ministries in the Americas have been targeted by a Chinese state-sponsored actor named Flea as part of a recent campaign that spanned from late 2022 to early 2023.
The cyber attacks, per Broadcom's Symantec, involved a new backdoor codenamed Graphican. Some of the other targets included a government finance department and a corporation that markets products in the Americas as


feed_id: https://thehackernews.com/2023/06/new-condi-malware-hijacking-tp-link-wi.html
title: New Condi Malware Hijacking TP-Link Wi-Fi Routers for DDoS Botnet Attacks
uri: 2023-07-02-New-Condi-Malware-Hijacking-TP-Link-Wi-Fi-Routers-for-DDoS-Botnet-Atta
url: https://thehackernews.com/2023/06/new-condi-malware-hijacking-tp-link-wi.html
content:
A new malware called Condi has been observed exploiting a security vulnerability in TP-Link Archer AX21 (AX1800) Wi-Fi routers to rope the devices into a distributed denial-of-service (DDoS) botnet.
Fortinet FortiGuard Labs said the campaign has ramped up since the end of May 2023. Condi is the work of a threat actor who goes by the online alias zxcr9999 on Telegram and runs a Telegram channel


feed_id: https://thehackernews.com/2023/07/chinese-hackers-use-html-smuggling-to.html
title: Chinese Hackers Use HTML Smuggling to Infiltrate European Ministries with PlugX
uri: 2023-07-04-Chinese-Hackers-Use-HTML-Smuggling-to-Infiltrate-European-Ministries-w
url: https://thehackernews.com/2023/07/chinese-hackers-use-html-smuggling-to.html
content:
A Chinese nation-state group has been observed targeting Foreign Affairs ministries and embassies in Europe using HTML smuggling techniques to deliver the PlugX remote access trojan on compromised systems.
Cybersecurity firm Check Point said the activity, dubbed SmugX, has been ongoing since at least December 2022.
"The campaign uses new delivery methods to deploy (most notably – HTML Smuggling)


feed_id: https://thehackernews.com/2023/07/improve-your-security-wordpress-spam.html
title: Improve Your Security WordPress Spam Protection With CleanTalk Anti-Spam
uri: 2023-07-04-Improve-Your-Security-WordPress-Spam-Protection-With-CleanTalk-Anti-Sp
url: https://thehackernews.com/2023/07/improve-your-security-wordpress-spam.html
content:
Every website owner or webmaster grapples with the issue of spam on their website forms. The volume of spam can be so overwhelming that finding useful information within it becomes quite challenging. What exacerbates this issue is that spam can populate your public pages, appearing in comments and reviews. You likely understand how this can damage your website's reputation, affect search results


feed_id: https://thehackernews.com/2023/07/cisa-flags-8-actively-exploited-flaws.html
title: CISA Flags 8 Actively Exploited Flaws in Samsung and D-Link Devices
uri: 2023-07-04-CISA-Flags-8-Actively-Exploited-Flaws-in-Samsung-and-D-Link-Devices
url: https://thehackernews.com/2023/07/cisa-flags-8-actively-exploited-flaws.html
content:
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has placed a set of eight flaws to the Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation.
This includes six shortcomings affecting Samsung smartphones and two vulnerabilities impacting D-Link devices. All the flaws have been patched as of 2021.

CVE-2021-25394 (CVSS score: 6.4) - Samsung mobile


feed_id: https://thehackernews.com/2023/07/evasive-meduza-stealer-targets-19.html
title: Evasive Meduza Stealer Targets 19 Password Managers and 76 Crypto Wallets
uri: 2023-07-04-Evasive-Meduza-Stealer-Targets-19-Password-Managers-and-76-Crypto-Wall
url: https://thehackernews.com/2023/07/evasive-meduza-stealer-targets-19.html
content:
In yet another sign of a lucrative crimeware-as-a-service (CaaS) ecosystem, cybersecurity researchers have discovered a new Windows-based information stealer called Meduza Stealer that's actively being developed by its author to evade detection by software solutions.
"The Meduza Stealer has a singular objective: comprehensive data theft," Uptycs said in a new report. "It pilfers users' browsing


feed_id: https://thehackernews.com/2023/07/blackcat-operators-distributing.html
title: BlackCat Operators Distributing Ransomware Disguised as WinSCP via Malvertising
uri: 2023-07-04-BlackCat-Operators-Distributing-Ransomware-Disguised-as-WinSCP-via-Mal
url: https://thehackernews.com/2023/07/blackcat-operators-distributing.html
content:
Threat actors associated with the BlackCat ransomware have been observed employing malvertising tricks to distribute rogue installers of the WinSCP file transfer application.
"Malicious actors used malvertising to distribute a piece of malware via cloned webpages of legitimate organizations," Trend Micro researchers said in an analysis published last week. "In this case, the distribution


feed_id: https://thehackernews.com/2023/07/surviving-800-gbps-storm-gain-insights.html
title: Surviving the 800 Gbps Storm: Gain Insights from Gcore's 2023 DDoS Attack Statistics
uri: Surviving-the-800-Gbps-Storm-Gain-Insights-from-Gcore-s-2023-DDoS-Att
url: https://thehackernews.com/2023/07/surviving-800-gbps-storm-gain-insights.html
content:
Gcore Radar is a quarterly report prepared by Gcore that provides insights into the current state of the DDoS protection market and cybersecurity trends. This report offers you an understanding of the evolving threat landscape and highlights the measures required to protect against attacks effectively. It serves as an insight for businesses and individuals seeking to stay informed about the


feed_id: https://thehackernews.com/2023/07/researchers-uncover-new-linux-kernel.html
title: Researchers Uncover New Linux Kernel 'StackRot' Privilege Escalation Vulnerability
uri: 2023-07-06-Researchers-Uncover-New-Linux-Kernel-StackRot-Privilege-Escalation-V
url: https://thehackernews.com/2023/07/researchers-uncover-new-linux-kernel.html
content:
Details have emerged about a newly identified security flaw in the Linux kernel that could allow a user to gain elevated privileges on a target host.
Dubbed StackRot (CVE-2023-3269, CVSS score: 7.8), the flaw impacts Linux versions 6.1 through 6.4. There is no evidence that the shortcoming has been exploited in the wild to date.
"As StackRot is a Linux kernel vulnerability found in the memory


feed_id: https://thehackernews.com/2023/07/how-pen-testing-can-soften-blow-on.html
title: How Pen Testing can Soften the Blow on Rising Costs of Cyber Insurance
uri: 2023-07-06-How-Pen-Testing-can-Soften-the-Blow-on-Rising-Costs-of-Cyber-Insurance
url: https://thehackernews.com/2023/07/how-pen-testing-can-soften-blow-on.html
content:
As technology advances and organizations become more reliant on data, the risks associated with data breaches and cyber-attacks also increase. The introduction of data privacy laws, such as the GDPR, has made it mandatory for organizations to disclose breaches of personal data to those affected. As such, it has become essential for businesses to protect themselves from the financial and


feed_id: https://thehackernews.com/2023/07/silentbob-campaign-cloud-native.html
title: Silentbob Campaign: Cloud-Native Environments Under Attack
uri: 2023-07-06-Silentbob-Campaign-Cloud-Native-Environments-Under-Attack
url: https://thehackernews.com/2023/07/silentbob-campaign-cloud-native.html
content:
Cybersecurity researchers have unearthed an attack infrastructure that's being used as part of a "potentially massive campaign" against cloud-native environments.
"This infrastructure is in early stages of testing and deployment, and is mainly consistent of an aggressive cloud worm, designed to deploy on exposed JupyterLab and Docker APIs in order to deploy Tsunami malware, cloud credentials


feed_id: https://thehackernews.com/2023/07/interpol-nabs-hacking-crew-opera1ers.html
title: INTERPOL Nabs Hacking Crew OPERA1ER's Leader Behind $11 Million Cybercrime
uri: 2023-07-06-INTERPOL-Nabs-Hacking-Crew-OPERA1ER-s-Leader-Behind-11-Million-Cyberc
url: https://thehackernews.com/2023/07/interpol-nabs-hacking-crew-opera1ers.html
content:
A suspected senior member of a French-speaking hacking crew known as OPERA1ER has been arrested as part of an international law enforcement operation codenamed Nervone, Interpol has announced.
"The group is believed to have stolen an estimated USD 11 million -- potentially as much as 30 million -- in more than 30 attacks across 15 countries in Africa, Asia, and Latin America," the agency said.


feed_id: https://thehackernews.com/2023/07/redenergy-stealer-as-ransomware-threat.html
title: RedEnergy Stealer-as-a-Ransomware Threat Targeting Energy and Telecom Sectors
uri: 2023-07-06-RedEnergy-Stealer-as-a-Ransomware-Threat-Targeting-Energy-and-Telecom
url: https://thehackernews.com/2023/07/redenergy-stealer-as-ransomware-threat.html
content:
A sophisticated stealer-as-a-ransomware threat dubbed RedEnergy has been spotted in the wild targeting energy utilities, oil, gas, telecom, and machinery sectors in Brazil and the Philippines through their LinkedIn pages.
The .NET malware "possesses the ability to steal information from various browsers, enabling the exfiltration of sensitive data, while also incorporating different modules for


feed_id: https://thehackernews.com/2023/07/secrets-secrets-are-no-fun-secrets.html
title: Secrets, Secrets Are No Fun. Secrets, Secrets (Stored in Plain Text Files) Hurt Someone
uri: 2023-07-06-Secrets-Secrets-Are-No-Fun-Secrets-Secrets-(Stored-in-Plain-Text-Fi
url: https://thehackernews.com/2023/07/secrets-secrets-are-no-fun-secrets.html
content:
Secrets are meant to be hidden or, at the very least, only known to a specific and limited set of individuals (or systems). Otherwise, they aren't really secrets. In personal life, a secret revealed can damage relationships, lead to social stigma, or, at the very least, be embarrassing. In a developer's or application security engineer's professional life, the consequences of exposing secrets


feed_id: https://thehackernews.com/2023/07/nodejs-users-beware-manifest-confusion.html
title: Node.js Users Beware: Manifest Confusion Attack Opens Door to Malware
uri: 2023-07-06-Node-js-Users-Beware-Manifest-Confusion-Attack-Opens-Door-to-Malware
url: https://thehackernews.com/2023/07/nodejs-users-beware-manifest-confusion.html
content:
The npm registry for the Node.js JavaScript runtime environment is susceptible to what's called a manifest confusion attack that could potentially allow threat actors to conceal malware in project dependencies or perform arbitrary script execution during installation.
"A npm package's manifest is published independently from its tarball," Darcy Clarke, a former GitHub and npm engineering manager


feed_id: https://thehackernews.com/2023/07/instagrams-twitter-alternative-threads.html
title: Instagram's Twitter Alternative 'Threads' Launch Halted in Europe Over Privacy Concerns
uri: 2023-07-06-Instagram-s-Twitter-Alternative-Threads-Launch-Halted-in-Europe-Over
url: https://thehackernews.com/2023/07/instagrams-twitter-alternative-threads.html
content:
Instagram Threads, the upcoming Twitter competitor from Meta, will not be launched in the European Union due to privacy concerns, according to Ireland's Data Protection Commission (DPC).
The development was reported by the Irish Independent, which said the watchdog has been in contact with the social media giant about the new product and confirmed the release won't extend to the E.U. "at this


feed_id: https://thehackernews.com/2023/07/swedish-data-protection-authority-warns.html
title: Swedish Data Protection Authority Warns Companies Against Google Analytics Use
uri: 2023-07-06-Swedish-Data-Protection-Authority-Warns-Companies-Against-Google-Analy
url: https://thehackernews.com/2023/07/swedish-data-protection-authority-warns.html
content:
The Swedish data protection watchdog has warned companies against using Google Analytics due to risks posed by U.S. government surveillance, following similar moves by Austria, France, and Italy last year.
The development comes in the aftermath of an audit initiated by the Swedish Authority for Privacy Protection (IMY) against four companies CDON, Coop, Dagens Industri, and Tele2.
"In its audits


feed_id: https://thehackernews.com/2023/07/ddosia-attack-tool-evolves-with.html
title: DDoSia Attack Tool Evolves with Encryption, Targeting Multiple Sectors
uri: 2023-07-06-DDoSia-Attack-Tool-Evolves-with-Encryption-Targeting-Multiple-Sectors
url: https://thehackernews.com/2023/07/ddosia-attack-tool-evolves-with.html
content:
The threat actors behind the DDoSia attack tool have come up with a new version that incorporates a new mechanism to retrieve the list of targets to be bombarded with junk HTTP requests in an attempt to bring them down.
The updated variant, written in Golang, "implements an additional security mechanism to conceal the list of targets, which is transmitted from the [command-and-control] to the


feed_id: https://thehackernews.com/2023/07/mexico-based-hacker-targets-global.html
title: Mexico-Based Hacker Targets Global Banks with Android Malware
uri: 2023-07-06-Mexico-Based-Hacker-Targets-Global-Banks-with-Android-Malware
url: https://thehackernews.com/2023/07/mexico-based-hacker-targets-global.html
content:
An e-crime actor of Mexican provenance has been linked to an Android mobile malware campaign targeting financial institutions globally, but with a specific focus on Spanish and Chilean banks, from June 2021 to April 2023.
The activity is being attributed to an actor codenamed Neo_Net, according to security researcher Pol Thill. The findings were published by SentinelOne following a Malware


feed_id: https://thehackernews.com/2023/07/alert-330000-fortigate-firewalls-still.html
title: Alert: 330,000 FortiGate Firewalls Still Unpatched to CVE-2023-27997 RCE Flaw
uri: 2023-07-06-Alert-330-000-FortiGate-Firewalls-Still-Unpatched-to-CVE-2023-27997-R
url: https://thehackernews.com/2023/07/alert-330000-fortigate-firewalls-still.html
content:
No less than 330,000 FortiGate firewalls are still unpatched and vulnerable to CVE-2023-27997, a critical security flaw affecting Fortinet devices that has come under active exploitation in the wild.
Cybersecurity firm Bishop Fox, in a report published last week, said that out of nearly 490,000 Fortinet SSL-VPN interfaces exposed on the internet, about 69 percent remain unpatched.
CVE-2023-27997


feed_id: https://thehackernews.com/2023/07/two-spyware-apps-on-google-play-with-15.html
title: Two Spyware Apps on Google Play with 1.5 Million Users Sending Data to China
uri: 2023-07-10-Two-Spyware-Apps-on-Google-Play-with-1-5-Million-Users-Sending-Data-to
url: https://thehackernews.com/2023/07/two-spyware-apps-on-google-play-with-15.html
content:
Two file management apps on the Google Play Store have been discovered to be spyware, putting the privacy and security of up to 1.5 million Android users at risk. These apps engage in deceptive behaviour and secretly send sensitive user data to malicious servers in China.
Pradeo, a leading mobile security company, has uncovered this alarming infiltration. The report shows that both spyware apps,


feed_id: https://thehackernews.com/2023/07/vishing-goes-high-tech-new-letscall.html
title: Vishing Goes High-Tech: New 'Letscall' Malware Employs Voice Traffic Routing
uri: 2023-07-10-Vishing-Goes-High-Tech-New-Letscall-Malware-Employs-Voice-Traffic-R
url: https://thehackernews.com/2023/07/vishing-goes-high-tech-new-letscall.html
content:
Researchers have issued a warning about an emerging and advanced form of voice phishing (vishing) known as "Letscall." This technique is currently targeting individuals in South Korea.
The criminals behind "Letscall" employ a multi-step attack to deceive victims into downloading malicious apps from a counterfeit Google Play Store website.
Once the malicious software is installed, it redirects


feed_id: https://thehackernews.com/2023/07/another-critical-unauthenticated-sqli.html
title: Another Critical Unauthenticated SQLi Flaw Discovered in MOVEit Transfer Software
uri: 2023-07-10-Another-Critical-Unauthenticated-SQLi-Flaw-Discovered-in-MOVEit-Transf
url: https://thehackernews.com/2023/07/another-critical-unauthenticated-sqli.html
content:
Progress Software has announced the discovery and patching of a critical SQL injection vulnerability in MOVEit Transfer, popular software used for secure file transfer. In addition, Progress Software has patched two other high-severity vulnerabilities.
The identified SQL injection vulnerability, tagged as CVE-2023-36934, could potentially allow unauthenticated attackers to gain unauthorized


feed_id: https://thehackernews.com/2023/07/mastodon-social-network-patches.html
title: Mastodon Social Network Patches Critical Flaws Allowing Server Takeover
uri: 2023-07-10-Mastodon-Social-Network-Patches-Critical-Flaws-Allowing-Server-Takeove
url: https://thehackernews.com/2023/07/mastodon-social-network-patches.html
content:
Mastodon, a popular decentralized social network, has released a security update to fix critical vulnerabilities that could expose millions of users to potential attacks.
Mastodon is known for its federated model, consisting of thousands of separate servers called "instances," and it has over 14 million users across more than 20,000 instances.
The most critical vulnerability, CVE-2023-36460,


feed_id: https://thehackernews.com/2023/07/close-security-gaps-with-continuous.html
title: Close Security Gaps with Continuous Threat Exposure Management
uri: 2023-07-10-Close-Security-Gaps-with-Continuous-Threat-Exposure-Management
url: https://thehackernews.com/2023/07/close-security-gaps-with-continuous.html
content:
CISOs, security leaders, and SOC teams often struggle with limited visibility into all connections made to their company-owned assets and networks. They are hindered by a lack of open-source intelligence and powerful technology required for proactive, continuous, and effective discovery and protection of their systems, data, and assets.
As advanced threat actors constantly search for easily


feed_id: https://thehackernews.com/2023/07/blackbyte-20-ransomware-infiltrate.html
title: BlackByte 2.0 Ransomware: Infiltrate, Encrypt, and Extort in Just 5 Days
uri: 2023-07-10-BlackByte-2-0-Ransomware-Infiltrate-Encrypt-and-Extort-in-Just-5-Da
url: https://thehackernews.com/2023/07/blackbyte-20-ransomware-infiltrate.html
content:
Ransomware attacks are a major problem for organizations everywhere, and the severity of this problem continues to intensify.
Recently, Microsoft's Incident Response team investigated the BlackByte 2.0 ransomware attacks and exposed these cyber strikes' terrifying velocity and damaging nature.
The findings indicate that hackers can complete the entire attack process, from gaining initial access


feed_id: https://thehackernews.com/2023/07/google-releases-android-patch-update.html
title: Google Releases Android Patch Update for 3 Actively Exploited Vulnerabilities
uri: 2023-07-10-Google-Releases-Android-Patch-Update-for-3-Actively-Exploited-Vulnerab
url: https://thehackernews.com/2023/07/google-releases-android-patch-update.html
content:
Google has released its monthly security updates for the Android operating system, addressing 46 new software vulnerabilities. Among these, three vulnerabilities have been identified as actively exploited in targeted attacks.
One of the vulnerabilities tracked as CVE-2023-26083 is a memory leak flaw affecting the Arm Mali GPU driver for Bifrost, Avalon, and Valhall chips. This particular


feed_id: https://thehackernews.com/2023/07/jumpcloud-resets-api-keys-amid-ongoing.html
title: JumpCloud Resets API Keys Amid Ongoing Cybersecurity Incident
uri: 2023-07-10-JumpCloud-Resets-API-Keys-Amid-Ongoing-Cybersecurity-Incident
url: https://thehackernews.com/2023/07/jumpcloud-resets-api-keys-amid-ongoing.html
content:
JumpCloud, a provider of cloud-based identity and access management solutions, has swiftly reacted to an ongoing cybersecurity incident that impacted some of its clients.
As part of its damage control efforts, JumpCloud has reset the application programming interface (API) keys of all customers affected by this event, aiming to protect their valuable data.
The company has informed the concerned


feed_id: https://thehackernews.com/2023/07/cybersecurity-agencies-sound-alarm-on.html
title: Cybersecurity Agencies Sound Alarm on Rising TrueBot Malware Attacks
uri: 2023-07-10-Cybersecurity-Agencies-Sound-Alarm-on-Rising-TrueBot-Malware-Attacks
url: https://thehackernews.com/2023/07/cybersecurity-agencies-sound-alarm-on.html
content:
Cybersecurity agencies have warned about the emergence of new variants of the TrueBot malware. This enhanced threat is now targeting companies in the U.S. and Canada with the intention of extracting confidential data from infiltrated systems.
These sophisticated attacks exploit a critical vulnerability (CVE-2022-31199) in the widely used Netwrix Auditor server and its associated agents.
This


feed_id: https://thehackernews.com/2023/07/iranian-hackers-sophisticated-malware.html
title: Iranian Hackers' Sophisticated Malware Targets Windows and macOS Users
uri: 2023-07-10-Iranian-Hackers-Sophisticated-Malware-Targets-Windows-and-macOS-Users
url: https://thehackernews.com/2023/07/iranian-hackers-sophisticated-malware.html
content:
The Iranian nation-state actor known as TA453 has been linked to a new set of spear-phishing attacks that infect both Windows and macOS operating systems with malware.
"TA453 eventually used a variety of cloud hosting providers to deliver a novel infection chain that deploys the newly identified PowerShell backdoor GorjolEcho," Proofpoint said in a new report.
"When given the opportunity, TA453


feed_id: https://thehackernews.com/2023/07/the-risks-and-preventions-of-ai-in.html
title: The Risks and Preventions of AI in Business: Safeguarding Against Potential Pitfalls
uri: 2023-07-12-The-Risks-and-Preventions-of-AI-in-Business-Safeguarding-Against-Pote
url: https://thehackernews.com/2023/07/the-risks-and-preventions-of-ai-in.html
content:
Artificial intelligence (AI) holds immense potential for optimizing internal processes within businesses. However, it also comes with legitimate concerns regarding unauthorized use, including data loss risks and legal consequences. In this article, we will explore the risks associated with AI implementation and discuss measures to minimize damages. Additionally, we will examine regulatory


feed_id: https://thehackernews.com/2023/07/microsoft-thwarts-chinese-cyber-attack.html
title: Microsoft Thwarts Chinese Cyber Attack Targeting Western European Governments
uri: 2023-07-12-Microsoft-Thwarts-Chinese-Cyber-Attack-Targeting-Western-European-Gove
url: https://thehackernews.com/2023/07/microsoft-thwarts-chinese-cyber-attack.html
content:
Microsoft on Tuesday revealed that it repelled a cyber attack staged by a Chinese nation-state actor targeting two dozen organizations, some of which include government agencies, in a cyber espionage campaign designed to acquire confidential data.
The attacks, which commenced on May 15, 2023, entailed access to email accounts affecting approximately 25 entities and a small number of related


feed_id: https://thehackernews.com/2023/07/chinese-hackers-deploy-microsoft-signed.html
title: Chinese Hackers Deploy Microsoft-Signed Rootkit to Target Gaming Sector
uri: 2023-07-12-Chinese-Hackers-Deploy-Microsoft-Signed-Rootkit-to-Target-Gaming-Secto
url: https://thehackernews.com/2023/07/chinese-hackers-deploy-microsoft-signed.html
content:
Cybersecurity researchers have unearthed a novel rootkit signed by Microsoft that's engineered to communicate with an actor-controlled attack infrastructure.
Trend Micro has attributed the activity cluster to the same actor that was previously identified as behind the FiveSys rootkit, which came to light in October 2021.
"This malicious actor originates from China and their main victims are the


feed_id: https://thehackernews.com/2023/07/python-based-pyloose-fileless-attack.html
title: Python-Based PyLoose Fileless Attack Targets Cloud Workloads for Cryptocurrency Mining
uri: 2023-07-12-Python-Based-PyLoose-Fileless-Attack-Targets-Cloud-Workloads-for-Crypt
url: https://thehackernews.com/2023/07/python-based-pyloose-fileless-attack.html
content:
A new fileless attack dubbed PyLoose has been observed striking cloud workloads with the goal of delivering a cryptocurrency miner, new findings from Wiz reveal.
"The attack consists of Python code that loads an XMRig Miner directly into memory using memfd, a known Linux fileless technique," security researchers Avigayil Mechtinger, Oren Ofer, and Itamar Gilad said. "This is the first publicly


feed_id: https://thehackernews.com/2023/07/microsoft-releases-patches-for-130.html
title: Microsoft Releases Patches for 132 Vulnerabilities, Including 6 Under Active Attack
uri: Microsoft-Releases-Patches-for-132-Vulnerabilities-Including-6-Under
url: https://thehackernews.com/2023/07/microsoft-releases-patches-for-130.html
content:
Microsoft on Tuesday released updates to address a total of 132 new security flaws spanning its software, including six zero-day flaws that it said have been actively exploited in the wild.
Of the 132 vulnerabilities, nine are rated Critical, 122 are rated Important in severity, and one has been assigned a severity rating of "None." This is in addition to eight flaws the tech giant patched in


feed_id: https://thehackernews.com/2023/07/hackers-exploit-windows-policy-loophole.html
title: Hackers Exploit Windows Policy Loophole to Forge Kernel-Mode Driver Signatures
uri: 2023-07-12-Hackers-Exploit-Windows-Policy-Loophole-to-Forge-Kernel-Mode-Driver-Si
url: https://thehackernews.com/2023/07/hackers-exploit-windows-policy-loophole.html
content:
A Microsoft Windows policy loophole has been observed being exploited primarily by native Chinese-speaking threat actors to forge signatures on kernel-mode drivers.
"Actors are leveraging multiple open-source tools that alter the signing date of kernel mode drivers to load malicious and unverified drivers signed with expired certificates," Cisco Talos said in an exhaustive two-part report shared


feed_id: https://thehackernews.com/2023/07/how-to-apply-mitre-att-to-your.html
title: How to Apply MITRE ATT&CK to Your Organization
uri: 2023-07-12-How-to-Apply-MITRE-ATT-CK-to-Your-Organization
url: https://thehackernews.com/2023/07/how-to-apply-mitre-att-to-your.html
content:
Discover all the ways MITRE ATT&CK can help you defend your organization. Build your security strategy and policies by making the most of this important framework.
What is the MITRE ATT&CK Framework?
MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) is a widely adopted framework and knowledge base that outlines and categorizes the tactics, techniques, and procedures (TTPs)


feed_id: https://thehackernews.com/2023/07/scarleteel-cryptojacking-campaign.html
title: SCARLETEEL Cryptojacking Campaign Exploiting AWS Fargate in Ongoing Campaign
uri: 2023-07-12-SCARLETEEL-Cryptojacking-Campaign-Exploiting-AWS-Fargate-in-Ongoing-Ca
url: https://thehackernews.com/2023/07/scarleteel-cryptojacking-campaign.html
content:
Cloud environments continue to be at the receiving end of an ongoing advanced attack campaign dubbed SCARLETEEL, with the threat actors now setting their sights on Amazon Web Services (AWS) Fargate.
"Cloud environments are still their primary target, but the tools and techniques used have adapted to bypass new security measures, along with a more resilient and stealthy command and control


feed_id: https://thehackernews.com/2023/07/beware-of-big-head-ransomware-spreading.html
title: Beware of Big Head Ransomware: Spreading Through Fake Windows Updates
uri: 2023-07-12-Beware-of-Big-Head-Ransomware-Spreading-Through-Fake-Windows-Updates
url: https://thehackernews.com/2023/07/beware-of-big-head-ransomware-spreading.html
content:
A developing piece of ransomware called Big Head is being distributed as part of a malvertising campaign that takes the form of bogus Microsoft Windows updates and Word installers.
Big Head was first documented by Fortinet FortiGuard Labs last month, when it discovered multiple variants of the ransomware that are designed to encrypt files on victims' machines in exchange for a cryptocurrency


feed_id: https://thehackernews.com/2023/07/apple-issues-urgent-patch-for-zero-day.html
title: Apple Issues Urgent Patch for Zero-Day Flaw Targeting iOS, iPadOS, macOS, and Safari
uri: 2023-07-12-Apple-Issues-Urgent-Patch-for-Zero-Day-Flaw-Targeting-iOS-iPadOS-mac
url: https://thehackernews.com/2023/07/apple-issues-urgent-patch-for-zero-day.html
content:
Apple has released Rapid Security Response updates for iOS, iPadOS, macOS, and Safari web browser to address a zero-day flaw that it said has been actively exploited in the wild.
The WebKit bug, cataloged as CVE-2023-37450, could allow threat actors to achieve arbitrary code execution when processing specially crafted web content. The iPhone maker said it addressed the issue with improved checks


feed_id: https://thehackernews.com/2023/07/new-mozilla-feature-blocks-risky-add.html
title: New Mozilla Feature Blocks Risky Add-Ons on Specific Websites to Safeguard User Security
uri: 2023-07-12-New-Mozilla-Feature-Blocks-Risky-Add-Ons-on-Specific-Websites-to-Safeg
url: https://thehackernews.com/2023/07/new-mozilla-feature-blocks-risky-add.html
content:
Mozilla has announced that some add-ons may be blocked from running on certain sites as part of a new feature called Quarantined Domains.
"We have introduced a new back-end feature to only allow some extensions monitored by Mozilla to run on specific websites for various reasons, including security concerns," the company said in its Release Notes for Firefox 115.0 shipped last week.
The company


feed_id: https://thehackernews.com/2023/07/new-toitoin-banking-trojan-targeting.html
title: New TOITOIN Banking Trojan Targeting Latin American Businesses
uri: 2023-07-12-New-TOITOIN-Banking-Trojan-Targeting-Latin-American-Businesses
url: https://thehackernews.com/2023/07/new-toitoin-banking-trojan-targeting.html
content:
Businesses operating in the Latin American (LATAM) region are the target of a new Windows-based banking trojan called TOITOIN since May 2023.
"This sophisticated campaign employs a trojan that follows a multi-staged infection chain, utilizing specially crafted modules throughout each stage," Zscaler researchers Niraj Shivtarkar and Preet Kamal said in a report published last week.
"These modules


feed_id: https://thehackernews.com/2023/07/global-retailers-must-keep-eye-on-their.html
title: Global Retailers Must Keep an Eye on Their SaaS Stack
uri: 2023-07-12-Global-Retailers-Must-Keep-an-Eye-on-Their-SaaS-Stack
url: https://thehackernews.com/2023/07/global-retailers-must-keep-eye-on-their.html
content:
Brick-and-mortar retailers and e-commerce sellers may be locked in a fierce battle for market share, but one area both can agree on is the need to secure their SaaS stack. From communications tools to order management and fulfillment systems, much of today's critical retail software lives in SaaS apps in the cloud. Securing those applications is crucial to ongoing operations, chain management,


feed_id: https://thehackernews.com/2023/07/romcom-rat-targeting-nato-and-ukraine.html
title: RomCom RAT Targeting NATO and Ukraine Support Groups
uri: 2023-07-12-RomCom-RAT-Targeting-NATO-and-Ukraine-Support-Groups
url: https://thehackernews.com/2023/07/romcom-rat-targeting-nato-and-ukraine.html
content:
The threat actors behind the RomCom RAT have been suspected of phishing attacks targeting the upcoming NATO Summit in Vilnius as well as an identified organization supporting Ukraine abroad.
The findings come from the BlackBerry Threat Research and Intelligence team, which found two malicious documents submitted from a Hungarian IP address on July 4, 2023.
RomCom, also tracked under the names


feed_id: https://thehackernews.com/2023/07/hackers-steal-20-million-by-exploiting.html
title: Revolut Faces $20 Million Loss as Attackers Exploit Payment System Weakness
uri: Revolut-Faces-20-Million-Loss-as-Attackers-Exploit-Payment-System-Wea
url: https://thehackernews.com/2023/07/hackers-steal-20-million-by-exploiting.html
content:
Malicious actors exploited an unknown flaw in Revolut's payment systems to steal more than $20 million of the company's funds in early 2022.
The development was reported by the Financial Times, citing multiple unnamed sources with knowledge of the incident. The breach has not been disclosed publicly.
The fault stemmed from discrepancies between Revolut's U.S. and European systems, causing funds


feed_id: https://thehackernews.com/2023/07/critical-mikrotik-routeros.html
title: Critical MikroTik RouterOS Vulnerability Exposes Over Half a Million Devices to Hacking
uri: Critical-MikroTik-RouterOS-Vulnerability-Exposes-Over-Half-a-Million-D
url: https://thehackernews.com/2023/07/critical-mikrotik-routeros.html
content:
A severe privilege escalation issue impacting MikroTik RouterOS could be weaponized by remote malicious actors to execute arbitrary code and seize full control of vulnerable devices.
Cataloged as CVE-2023-30799 (CVSS score: 9.1), the shortcoming is expected to put approximately 500,000 and 900,000 RouterOS systems at risk of exploitation via their web and/or Winbox interfaces, respectively,


feed_id: https://thehackernews.com/2023/07/north-korean-nation-state-actors.html
title: North Korean Nation-State Actors Exposed in JumpCloud Hack After OPSEC Blunder
uri: North-Korean-Nation-State-Actors-Exposed-in-JumpCloud-Hack-After-OPSEC
url: https://thehackernews.com/2023/07/north-korean-nation-state-actors.html
content:
North Korean nation-state actors affiliated with the Reconnaissance General Bureau (RGB) have been attributed to the JumpCloud hack following an operational security (OPSEC) blunder that exposed their actual IP address.
Google-owned threat intelligence firm Mandiant attributed the activity to a threat actor it tracks under the name UNC4899, which likely shares overlaps with clusters already


feed_id: https://thehackernews.com/2023/07/casbaneiro-banking-malware-goes-under.html
title: Casbaneiro Banking Malware Goes Under the Radar with UAC Bypass Technique
uri: Casbaneiro-Banking-Malware-Goes-Under-the-Radar-with-UAC-Bypass-Techni
url: https://thehackernews.com/2023/07/casbaneiro-banking-malware-goes-under.html
content:
The financially motivated threat actors behind the Casbaneiro banking malware family have been observed making use of a User Account Control (UAC) bypass technique to gain full administrative privileges on a machine, a sign that the threat actor is evolving their tactics to avoid detection and execute malicious code on compromised assets.
"They are still heavily focused on Latin American


feed_id: https://thehackernews.com/2023/07/macos-under-attack-examining-growing.html
title: macOS Under Attack: Examining the Growing Threat and User Perspectives
uri: macOS-Under-Attack-Examining-the-Growing-Threat-and-User-Perspectives
url: https://thehackernews.com/2023/07/macos-under-attack-examining-growing.html
content:
As the number of people using macOS keeps going up, so does the desire of hackers to take advantage of flaws in Apple's operating system. 
What Are the Rising Threats to macOS?
There is a common misconception among macOS fans that Apple devices are immune to hacking and malware infection. However, users have been facing more and more dangers recently. Inventive attackers are specifically


feed_id: https://thehackernews.com/2023/07/tetraburst-5-new-vulnerabilities.html
title: TETRA:BURST — 5 New Vulnerabilities Exposed in Widely Used Radio Communication System
uri: TETRA-BURST-5-New-Vulnerabilities-Exposed-in-Widely-Used-Radio-Com
url: https://thehackernews.com/2023/07/tetraburst-5-new-vulnerabilities.html
content:
A set of five security vulnerabilities have been disclosed in the Terrestrial Trunked Radio (TETRA) standard for radio communication used widely by government entities and critical infrastructure sectors, including what's believed to be an intentional backdoor that could have potentially exposed sensitive information.
The issues, discovered by Midnight Blue in 2021 and held back until now, have


feed_id: https://thehackernews.com/2023/07/how-mdr-helps-solve-cybersecurity.html
title: How MDR Helps Solve the Cybersecurity Talent Gap
uri: How-MDR-Helps-Solve-the-Cybersecurity-Talent-Gap
url: https://thehackernews.com/2023/07/how-mdr-helps-solve-cybersecurity.html
content:
How do you overcome today's talent gap in cybersecurity? This is a crucial issue — particularly when you find executive leadership or the board asking pointed questions about your security team's ability to defend the organization against new and current threats.
This is why many security leaders find themselves turning to managed security services like MDR (managed detection and response),


feed_id: https://thehackernews.com/2023/07/zenbleed-new-flaw-in-amd-zen-2.html
title: Zenbleed: New Flaw in AMD Zen 2 Processors Puts Encryption Keys and Passwords at Risk
uri: Zenbleed-New-Flaw-in-AMD-Zen-2-Processors-Puts-Encryption-Keys-and-Pa
url: https://thehackernews.com/2023/07/zenbleed-new-flaw-in-amd-zen-2.html
content:
A new security vulnerability has been discovered in AMD's Zen 2 architecture-based processors that could be exploited to extract sensitive data such as encryption keys and passwords.
Discovered by Google Project Zero researcher Tavis Ormandy, the flaw – codenamed Zenbleed and tracked as CVE-2023-20593 (CVSS score: 6.5) – allows data exfiltration at the rate of 30 kb per core, per second.
The


feed_id: https://thehackernews.com/2023/07/atlassian-releases-patches-for-critical.html
title: Atlassian Releases Patches for Critical Flaws in Confluence and Bamboo
uri: Atlassian-Releases-Patches-for-Critical-Flaws-in-Confluence-and-Bamboo
url: https://thehackernews.com/2023/07/atlassian-releases-patches-for-critical.html
content:
Atlassian has released updates to address three security flaws impacting its Confluence Server, Data Center, and Bamboo Data Center products that, if successfully exploited, could result in remote code execution on susceptible systems.
The list of the flaws is below -

CVE-2023-22505 (CVSS score: 8.0) - RCE (Remote Code Execution) in Confluence Data Center and Server (Fixed in versions 8.3.2 and


feed_id: https://thehackernews.com/2023/07/ivanti-releases-urgent-patch-for-epmm.html
title: Ivanti Releases Urgent Patch for EPMM Zero-Day Vulnerability Under Active Exploitation
uri: Ivanti-Releases-Urgent-Patch-for-EPMM-Zero-Day-Vulnerability-Under-Act
url: https://thehackernews.com/2023/07/ivanti-releases-urgent-patch-for-epmm.html
content:
Ivanti is warning users to update their Endpoint Manager Mobile (EPMM) mobile device management software (formerly MobileIron Core) to the latest version that fixes an actively exploited zero-day vulnerability.
Dubbed CVE-2023-35078, the issue has been described as a remote unauthenticated API access vulnerability that impacts currently supported version 11.4 releases 11.10, 11.9, and 11.8 as


feed_id: https://thehackernews.com/2023/07/apple-rolls-out-urgent-patches-for-zero.html
title: Apple Rolls Out Urgent Patches for Zero-Day Flaws Impacting iPhones, iPads and Macs
uri: Apple-Rolls-Out-Urgent-Patches-for-Zero-Day-Flaws-Impacting-iPhones-i
url: https://thehackernews.com/2023/07/apple-rolls-out-urgent-patches-for-zero.html
content:
Apple has rolled out security updates to iOS, iPadOS, macOS, tvOS, watchOS, and Safari to address several security vulnerabilities, including one actively exploited zero-day bug in the wild.
Tracked as CVE-2023-38606, the shortcoming resides in the kernel and permits a malicious app to modify sensitive kernel state potentially. The company said it was addressed with improved state management.
"


feed_id: https://thehackernews.com/2023/07/critical-zero-days-in-atera-windows.html
title: Critical Zero-Days in Atera Windows Installers Expose Users to Privilege Escalation Attacks
uri: 2023-07-26-Critical-Zero-Days-in-Atera-Windows-Installers-Expose-Users-to-Privile
url: https://thehackernews.com/2023/07/critical-zero-days-in-atera-windows.html
content:
Zero-day vulnerabilities in Windows Installers for the Atera remote monitoring and management software could act as a springboard to launch privilege escalation attacks.
The flaws, discovered by Mandiant on February 28, 2023, have been assigned the identifiers CVE-2023-26077 and CVE-2023-26078, with the issues remediated in versions 1.8.3.7 and 1.8.4.9 released by Atera on April 17, 2023, and


feed_id: https://thehackernews.com/2023/07/google-messages-getting-cross-platform.html
title: Google Messages Getting Cross-Platform End-to-End Encryption with MLS Protocol
uri: 2023-07-26-Google-Messages-Getting-Cross-Platform-End-to-End-Encryption-with-MLS
url: https://thehackernews.com/2023/07/google-messages-getting-cross-platform.html
content:
Google has announced that it intends to add support for Message Layer Security (MLS) to its Messages service for Android and open source an implementation of the specification.
"Most modern consumer messaging platforms (including Google Messages) support end-to-end encryption, but users today are limited to communicating with contacts who use the same platform," Giles Hogben, privacy engineering


feed_id: https://thehackernews.com/2023/07/how-to-protect-patients-and-their.html
title: How to Protect Patients and Their Privacy in Your SaaS Apps
uri: 2023-07-26-How-to-Protect-Patients-and-Their-Privacy-in-Your-SaaS-Apps
url: https://thehackernews.com/2023/07/how-to-protect-patients-and-their.html
content:
The healthcare industry is under a constant barrage of cyberattacks. It has traditionally been one of the most frequently targeted industries, and things haven’t changed in 2023. The U.S. Government’s Office for Civil Rights reported 145 data breaches in the United States during the first quarter of this year. That follows 707 incidents a year ago, during which over 50 million records were


feed_id: https://thehackernews.com/2023/07/new-openssh-vulnerability-exposes-linux.html
title: New OpenSSH Vulnerability Exposes Linux Systems to Remote Command Injection
uri: 2023-07-26-New-OpenSSH-Vulnerability-Exposes-Linux-Systems-to-Remote-Command-Inje
url: https://thehackernews.com/2023/07/new-openssh-vulnerability-exposes-linux.html
content:
Details have emerged about a now-patched flaw in OpenSSH that could be potentially exploited to run arbitrary commands remotely on compromised hosts under specific conditions.
"This vulnerability allows a remote attacker to potentially execute arbitrary commands on vulnerable OpenSSH's forwarded ssh-agent," Saeed Abbasi, manager of vulnerability research at Qualys, said in an analysis last week.


feed_id: https://thehackernews.com/2023/07/banking-sector-targeted-in-open-source.html
title: Banking Sector Targeted in Open-Source Software Supply Chain Attacks
uri: 2023-07-26-Banking-Sector-Targeted-in-Open-Source-Software-Supply-Chain-Attacks
url: https://thehackernews.com/2023/07/banking-sector-targeted-in-open-source.html
content:
Cybersecurity researchers said they have discovered what they say is the first open-source software supply chain attacks specifically targeting the banking sector.
"These attacks showcased advanced techniques, including targeting specific components in web assets of the victim bank by attaching malicious functionalities to it," Checkmarx said in a report published last week.
"The attackers


feed_id: https://thehackernews.com/2023/07/apple-threatens-to-pull-imessage-and.html
title: Apple Threatens to Pull iMessage and FaceTime from U.K. Amid Surveillance Demands
uri: 2023-07-26-Apple-Threatens-to-Pull-iMessage-and-FaceTime-from-U-K-Amid-Surveilla
url: https://thehackernews.com/2023/07/apple-threatens-to-pull-imessage-and.html
content:
Apple has warned that it would rather stop offering iMessage and FaceTime services in the U.K. than bowing down to government pressure in response to new proposals that seek to expand digital surveillance powers available to state intelligence agencies.
The development, first reported by BBC News, makes the iPhone maker the latest to join the chorus of voices protesting against forthcoming


feed_id: https://thehackernews.com/2023/07/azure-ad-token-forging-technique-in.html
title: Azure AD Token Forging Technique in Microsoft Attack Extends Beyond Outlook, Wiz Reports
uri: 2023-07-26-Azure-AD-Token-Forging-Technique-in-Microsoft-Attack-Extends-Beyond-Ou
url: https://thehackernews.com/2023/07/azure-ad-token-forging-technique-in.html
content:
The recent attack against Microsoft's email infrastructure by a Chinese nation-state actor referred to as Storm-0558 is said to have a broader scope than previously thought.
According to cloud security company Wiz, the inactive Microsoft account (MSA) consumer signing key used to forge Azure Active Directory (Azure AD or AAD) tokens to gain illicit access to Outlook Web Access (OWA) and


feed_id: https://thehackernews.com/2023/07/hotrat-new-variant-of-asyncrat-malware.html
title: HotRat: New Variant of AsyncRAT Malware Spreading Through Pirated Software
uri: 2023-07-26-HotRat-New-Variant-of-AsyncRAT-Malware-Spreading-Through-Pirated-Soft
url: https://thehackernews.com/2023/07/hotrat-new-variant-of-asyncrat-malware.html
content:
A new variant of AsyncRAT malware dubbed HotRat is being distributed via free, pirated versions of popular software and utilities such as video games, image and sound editing software, and Microsoft Office.
"HotRat malware equips attackers with a wide array of capabilities, such as stealing login credentials, cryptocurrency wallets, screen capturing, keylogging, installing more malware, and


feed_id: https://thehackernews.com/2023/07/sophisticated-bundlebot-malware.html
title: Sophisticated BundleBot Malware Disguised as Google AI Chatbot and Utilities
uri: 2023-07-26-Sophisticated-BundleBot-Malware-Disguised-as-Google-AI-Chatbot-and-Uti
url: https://thehackernews.com/2023/07/sophisticated-bundlebot-malware.html
content:
A new malware strain known as BundleBot has been stealthily operating under the radar by taking advantage of .NET single-file deployment techniques, enabling threat actors to capture sensitive information from compromised hosts.
"BundleBot is abusing the dotnet bundle (single-file), self-contained format that results in very low or no static detection at all," Check Point said in a report


feed_id: https://thehackernews.com/2023/07/local-governments-targeted-for.html
title: Local Governments Targeted for Ransomware – How to Prevent Falling Victim
uri: 2023-07-26-Local-Governments-Targeted-for-Ransomware-How-to-Prevent-Falling-V
url: https://thehackernews.com/2023/07/local-governments-targeted-for.html
content:
Regardless of the country, local government is essential in most citizens' lives. It provides many day-to-day services and handles various issues. Therefore, their effects can be far-reaching and deeply felt when security failures occur.
In early 2023, Oakland, California, fell victim to a ransomware attack. Although city officials have not disclosed how the attack occurred, experts suspect a


feed_id: https://thehackernews.com/2023/07/ddos-botnets-hijacking-zyxel-devices-to.html
title: DDoS Botnets Hijacking Zyxel Devices to Launch Devastating Attacks
uri: 2023-07-26-DDoS-Botnets-Hijacking-Zyxel-Devices-to-Launch-Devastating-Attacks
url: https://thehackernews.com/2023/07/ddos-botnets-hijacking-zyxel-devices-to.html
content:
Several distributed denial-of-service (DDoS) botnets have been observed exploiting a critical flaw in Zyxel devices that came to light in April 2023 to gain remote control of vulnerable systems.
"Through the capture of exploit traffic, the attacker's IP address was identified, and it was determined that the attacks were occurring in multiple regions, including Central America, North America,


feed_id: https://thehackernews.com/2023/07/citrix-netscaler-adc-and-gateway.html
title: Citrix NetScaler ADC and Gateway Devices Under Attack: CISA Urges Immediate Action
uri: 2023-07-26-Citrix-NetScaler-ADC-and-Gateway-Devices-Under-Attack-CISA-Urges-Imme
url: https://thehackernews.com/2023/07/citrix-netscaler-adc-and-gateway.html
content:
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued an advisory on Thursday warning that the newly disclosed critical security flaw in Citrix NetScaler Application Delivery Controller (ADC) and Gateway devices is being abused to drop web shells on vulnerable systems.
"In June 2023, threat actors exploited this vulnerability as a zero-day to drop a web shell on a critical


feed_id: https://thehackernews.com/2023/07/mallox-ransomware-exploits-weak-ms-sql.html
title: Mallox Ransomware Exploits Weak MS-SQL Servers to Breach Networks
uri: 2023-07-26-Mallox-Ransomware-Exploits-Weak-MS-SQL-Servers-to-Breach-Networks
url: https://thehackernews.com/2023/07/mallox-ransomware-exploits-weak-ms-sql.html
content:
Mallox ransomware activities in 2023 have witnessed a 174% increase when compared to the previous year, new findings from Palo Alto Networks Unit 42 reveal.
"Mallox ransomware, like many other ransomware threat actors, follows the double extortion trend: stealing data before encrypting an organization's files, and then threatening to publish the stolen data on a leak site as leverage to convince


feed_id: https://thehackernews.com/2023/07/critical-flaws-in-ami-megarac-bmc.html
title: Critical Flaws in AMI MegaRAC BMC Software Expose Servers to Remote Attacks
uri: 2023-07-26-Critical-Flaws-in-AMI-MegaRAC-BMC-Software-Expose-Servers-to-Remote-At
url: https://thehackernews.com/2023/07/critical-flaws-in-ami-megarac-bmc.html
content:
Two more security flaws have been disclosed in AMI MegaRAC Baseboard Management Controller (BMC) software that, if successfully exploited, could allow threat actors to remotely commandeer vulnerable servers and deploy malware.
"These new vulnerabilities range in severity from High to Critical, including unauthenticated remote code execution and unauthorized device access with superuser


feed_id: https://thehackernews.com/2023/07/apache-openmeetings-web-conferencing.html
title: Apache OpenMeetings Web Conferencing Tool Exposed to Critical Vulnerabilities
uri: 2023-07-26-Apache-OpenMeetings-Web-Conferencing-Tool-Exposed-to-Critical-Vulnerab
url: https://thehackernews.com/2023/07/apache-openmeetings-web-conferencing.html
content:
Multiple security flaws have been disclosed in Apache OpenMeetings, a web conferencing solution, that could be potentially exploited by malicious actors to seize control of admin accounts and run malicious code on susceptible servers.
"Attackers can bring the application into an unexpected state, which allows them to take over any user account, including the admin account," Sonar vulnerability


feed_id: https://thehackernews.com/2023/07/north-korean-state-sponsored-hackers.html
title: North Korean State-Sponsored Hackers Suspected in JumpCloud Supply Chain Attack
uri: 2023-07-26-North-Korean-State-Sponsored-Hackers-Suspected-in-JumpCloud-Supply-Cha
url: https://thehackernews.com/2023/07/north-korean-state-sponsored-hackers.html
content:
An analysis of the indicators of compromise (IoCs) associated with the JumpCloud hack has uncovered evidence pointing to the involvement of North Korean state-sponsored groups, in a style that's reminiscent of the supply chain attack targeting 3CX.
The findings come from SentinelOne, which mapped out the infrastructure pertaining to the intrusion to uncover underlying patterns. It's worth noting


feed_id: https://thehackernews.com/2023/07/a-few-more-reasons-why-rdp-is-insecure.html
title: A Few More Reasons Why RDP is Insecure (Surprise!)
uri: 2023-07-26-A-Few-More-Reasons-Why-RDP-is-Insecure-(Surprise-)
url: https://thehackernews.com/2023/07/a-few-more-reasons-why-rdp-is-insecure.html
content:
If it seems like Remote Desktop Protocol (RDP) has been around forever, it's because it has (at least compared to the many technologies that rise and fall within just a few years.) The initial version, known as "Remote Desktop Protocol 4.0," was released in 1996 as part of the Windows NT 4.0 Terminal Server edition and allowed users to remotely access and control Windows-based computers over a


feed_id: https://thehackernews.com/2023/07/turlas-new-deliverycheck-backdoor.html
title: Turla's New DeliveryCheck Backdoor Breaches Ukrainian Defense Sector
uri: 2023-07-26-Turla-s-New-DeliveryCheck-Backdoor-Breaches-Ukrainian-Defense-Sector
url: https://thehackernews.com/2023/07/turlas-new-deliverycheck-backdoor.html
content:
The defense sector in Ukraine and Eastern Europe has been targeted by a novel .NET-based backdoor called DeliveryCheck (aka CAPIBAR or GAMEDAY) that's capable of delivering next-stage payloads.
The Microsoft threat intelligence team, in collaboration with the Computer Emergency Response Team of Ukraine (CERT-UA), attributed the attacks to a Russian nation-state actor known as Turla, which is


feed_id: https://thehackernews.com/2023/07/new-p2pinfect-worm-targeting-redis.html
title: New P2PInfect Worm Targeting Redis Servers on Linux and Windows Systems
uri: 2023-07-26-New-P2PInfect-Worm-Targeting-Redis-Servers-on-Linux-and-Windows-System
url: https://thehackernews.com/2023/07/new-p2pinfect-worm-targeting-redis.html
content:
Cybersecurity researchers have uncovered a new cloud targeting, peer-to-peer (P2P) worm called P2PInfect that targets vulnerable Redis instances for follow-on exploitation.
"P2PInfect exploits Redis servers running on both Linux and Windows Operating Systems making it more scalable and potent than other worms," Palo Alto Networks Unit 42 researchers William Gamazo and Nathaniel Quist said. "This


feed_id: https://thehackernews.com/2023/07/microsoft-expands-cloud-logging-to.html
title: Microsoft Expands Cloud Logging to Counter Rising Nation-State Cyber Threats
uri: 2023-07-26-Microsoft-Expands-Cloud-Logging-to-Counter-Rising-Nation-State-Cyber-T
url: https://thehackernews.com/2023/07/microsoft-expands-cloud-logging-to.html
content:
Microsoft on Wednesday announced that it's expanding cloud logging capabilities to help organizations investigate cybersecurity incidents and gain more visibility after facing criticism in the wake of a recent espionage attack campaign aimed at its email infrastructure.
The tech giant said it's making the change in direct response to increasing frequency and evolution of nation-state cyber


feed_id: https://thehackernews.com/2023/07/adobe-rolls-out-new-patches-for.html
title: Adobe Rolls Out New Patches for Actively Exploited ColdFusion Vulnerability
uri: 2023-07-26-Adobe-Rolls-Out-New-Patches-for-Actively-Exploited-ColdFusion-Vulnerab
url: https://thehackernews.com/2023/07/adobe-rolls-out-new-patches-for.html
content:
Adobe has released a fresh round of updates to address an incomplete fix for a recently disclosed ColdFusion flaw that has come under active exploitation in the wild.
The critical shortcoming, tracked as CVE-2023-38205 (CVSS score: 7.5), has been described as an instance of improper access control that could result in a security bypass. It impacts the following versions:

ColdFusion 2023 (Update


feed_id: https://thehackernews.com/2023/07/how-to-manage-your-attack-surface.html
title: How to Manage Your Attack Surface?
uri: 2023-07-26-How-to-Manage-Your-Attack-Surface
url: https://thehackernews.com/2023/07/how-to-manage-your-attack-surface.html
content:
Attack surfaces are growing faster than security teams can keep up. To stay ahead, you need to know what's exposed and where attackers are most likely to strike. With cloud migration dramatically increasing the number of internal and external targets, prioritizing threats and managing your attack surface from an attacker's perspective has never been more important. Let's look at why it's growing


feed_id: https://thehackernews.com/2023/07/cisa-and-nsa-issue-new-guidance-to.html
title: CISA and NSA Issue New Guidance to Strengthen 5G Network Slicing Against Threats
uri: 2023-07-26-CISA-and-NSA-Issue-New-Guidance-to-Strengthen-5G-Network-Slicing-Again
url: https://thehackernews.com/2023/07/cisa-and-nsa-issue-new-guidance-to.html
content:
U.S. cybersecurity and intelligence agencies have released a set of recommendations to address security concerns with 5G standalone network slicing and harden them against possible threats.
"The threat landscape in 5G is dynamic; due to this, advanced monitoring, auditing, and other analytical capabilities are required to meet certain levels of network slicing service level requirements over


feed_id: https://thehackernews.com/2023/07/chinese-apt41-hackers-target-mobile.html
title: Chinese APT41 Hackers Target Mobile Devices with New WyrmSpy and DragonEgg Spyware
uri: 2023-07-26-Chinese-APT41-Hackers-Target-Mobile-Devices-with-New-WyrmSpy-and-Drago
url: https://thehackernews.com/2023/07/chinese-apt41-hackers-target-mobile.html
content:
The prolific China-linked nation-state actor known as APT41 has been linked to two previously undocumented strains of Android spyware called WyrmSpy and DragonEgg.
"Known for its exploitation of web-facing applications and infiltration of traditional endpoint devices, an established threat actor like APT 41 including mobile in its arsenal of malware shows how mobile endpoints are high-value


feed_id: https://thehackernews.com/2023/07/exploring-dark-side-osint-tools-and.html
title: Exploring the Dark Side: OSINT Tools and Techniques for Unmasking Dark Web Operations
uri: 2023-07-26-Exploring-the-Dark-Side-OSINT-Tools-and-Techniques-for-Unmasking-Dark
url: https://thehackernews.com/2023/07/exploring-dark-side-osint-tools-and.html
content:
On April 5, 2023, the FBI and Dutch National Police announced the takedown of Genesis Market, one of the largest dark web marketplaces. The operation, dubbed "Operation Cookie Monster," resulted in the arrest of 119 people and the seizure of over $1M in cryptocurrency. You can read the FBI's warrant here for details specific to this case. In light of these events, I'd like to discuss how OSINT


feed_id: https://thehackernews.com/2023/07/badbuild-flaw-in-google-cloud-build.html
title: Bad.Build Flaw in Google Cloud Build Raises Concerns of Privilege Escalation
uri: 2023-07-26-Bad-Build-Flaw-in-Google-Cloud-Build-Raises-Concerns-of-Privilege-Esca
url: https://thehackernews.com/2023/07/badbuild-flaw-in-google-cloud-build.html
content:
Cybersecurity researchers have uncovered a privilege escalation vulnerability in Google Cloud that could enable malicious actors tamper with application images and infect users, leading to supply chain attacks.
The issue, dubbed Bad.Build, is rooted in the Google Cloud Build service, according to cloud security firm Orca, which discovered and reported the issue.
"By abusing the flaw and enabling


feed_id: https://thehackernews.com/2023/07/us-government-blacklists-cytrox-and.html
title: U.S. Government Blacklists Cytrox and Intellexa Spyware Vendors for Cyber Espionage
uri: 2023-07-26-U-S-Government-Blacklists-Cytrox-and-Intellexa-Spyware-Vendors-for-Cy
url: https://thehackernews.com/2023/07/us-government-blacklists-cytrox-and.html
content:
The U.S. government on Tuesday added two foreign commercial spyware vendors, Cytrox and Intellexa, to an economic blocklist for weaponizing cyber exploits to gain unauthorized access to devices and "threatening the privacy and security of individuals and organizations worldwide."
This includes the companies' corporate holdings in Hungary (Cytrox Holdings Crt), North Macedonia (Cytrox AD), Greece


feed_id: https://thehackernews.com/2023/07/zero-day-attacks-exploited-critical.html
title: Zero-Day Attacks Exploited Critical Vulnerability in Citrix ADC and Gateway
uri: 2023-07-26-Zero-Day-Attacks-Exploited-Critical-Vulnerability-in-Citrix-ADC-and-Ga
url: https://thehackernews.com/2023/07/zero-day-attacks-exploited-critical.html
content:
Citrix is alerting users of a critical security flaw in NetScaler Application Delivery Controller (ADC) and Gateway that it said is being actively exploited in the wild.
Tracked as CVE-2023-3519 (CVSS score: 9.8), the issue relates to a case of code injection that could result in unauthenticated remote code execution. It impacts the following versions -

NetScaler ADC and NetScaler Gateway 13.1


feed_id: https://thehackernews.com/2023/07/pakistani-entities-targeted-in.html
title: Pakistani Entities Targeted in Sophisticated Attack Deploying ShadowPad Malware
uri: 2023-07-26-Pakistani-Entities-Targeted-in-Sophisticated-Attack-Deploying-ShadowPa
url: https://thehackernews.com/2023/07/pakistani-entities-targeted-in.html
content:
An unidentified threat actor compromised an application used by multiple entities in Pakistan to deliver ShadowPad, a successor to the PlugX backdoor that's commonly associated with Chinese hacking crews.
Targets included a Pakistan government entity, a public sector bank, and a telecommunications provider, according to Trend Micro. The infections took place between mid-February 2022 and


feed_id: https://thehackernews.com/2023/07/virustotal-data-leak-exposes-some.html
title: VirusTotal Data Leak Exposes Some Registered Customers' Details
uri: 2023-07-26-VirusTotal-Data-Leak-Exposes-Some-Registered-Customers-Details
url: https://thehackernews.com/2023/07/virustotal-data-leak-exposes-some.html
content:
Data associated with a subset of registered customers of VirusTotal, including their names and email addresses, were exposed after an employee inadvertently uploaded the information to the malware scanning platform.
The security incident, which comprises a database of 5,600 names in a 313KB file, was first disclosed by Der Spiegel and Der Standard yesterday.
Launched in 2004, VirusTotal is a


feed_id: https://thehackernews.com/2023/07/go-beyond-headlines-for-deeper-dives.html
title: Go Beyond the Headlines for Deeper Dives into the Cybercriminal Underground
uri: 2023-07-26-Go-Beyond-the-Headlines-for-Deeper-Dives-into-the-Cybercriminal-Underg
url: https://thehackernews.com/2023/07/go-beyond-headlines-for-deeper-dives.html
content:
Discover stories about threat actors’ latest tactics, techniques, and procedures from Cybersixgill’s threat experts each month. Each story brings you details on emerging underground threats, the threat actors involved, and how you can take action to mitigate risks. Learn about the top vulnerabilities and review the latest ransomware and malware trends from the deep and dark web.
Stolen ChatGPT


feed_id: https://thehackernews.com/2023/07/fin8-group-using-modified-sardonic.html
title: FIN8 Group Using Modified Sardonic Backdoor for BlackCat Ransomware Attacks
uri: 2023-07-26-FIN8-Group-Using-Modified-Sardonic-Backdoor-for-BlackCat-Ransomware-At
url: https://thehackernews.com/2023/07/fin8-group-using-modified-sardonic.html
content:
The financially motivated threat actor known as FIN8 has been observed using a "revamped" version of a backdoor called Sardonic to deliver the BlackCat ransomware.
According to the Symantec Threat Hunter Team, part of Broadcom, the development is an attempt on the part of the e-crime group to diversify its focus and maximize profits from infected entities. The intrusion attempt took place in


feed_id: https://thehackernews.com/2023/07/owner-of-breachforums-pleads-guilty-to.html
title: Owner of BreachForums Pleads Guilty to Cybercrime and Child Pornography Charges
uri: 2023-07-26-Owner-of-BreachForums-Pleads-Guilty-to-Cybercrime-and-Child-Pornograph
url: https://thehackernews.com/2023/07/owner-of-breachforums-pleads-guilty-to.html
content:
Conor Brian Fitzpatrick, the owner of the now-defunct BreachForums website, has pleaded guilty to charges related to his operation of the cybercrime forum as well as having child pornography images.
The development, first reported by DataBreaches.net last week, comes nearly four months after Fitzpatrick (aka pompompurin) was formally charged in the U.S. with conspiracy to commit access device


feed_id: https://thehackernews.com/2023/07/cybercriminals-exploiting-woocommerce.html
title: Cybercriminals Exploiting WooCommerce Payments Plugin Flaw to Hijack Websites
uri: 2023-07-26-Cybercriminals-Exploiting-WooCommerce-Payments-Plugin-Flaw-to-Hijack-W
url: https://thehackernews.com/2023/07/cybercriminals-exploiting-woocommerce.html
content:
Threat actors are actively exploiting a recently disclosed critical security flaw in the WooCommerce Payments WordPress plugin as part of a massive targeted campaign.
The flaw, tracked as CVE-2023-28121 (CVSS score: 9.8), is a case of authentication bypass that enables unauthenticated attackers to impersonate arbitrary users and perform some actions as the impersonated user, including an


feed_id: https://thehackernews.com/2023/07/jumpcloud-blames-sophisticated-nation.html
title: JumpCloud Blames 'Sophisticated Nation-State' Actor for Security Breach
uri: 2023-07-26-JumpCloud-Blames-Sophisticated-Nation-State-Actor-for-Security-Breac
url: https://thehackernews.com/2023/07/jumpcloud-blames-sophisticated-nation.html
content:
A little over a week after JumpCloud reset API keys of customers impacted by a security incident, the company said the intrusion was the work of a sophisticated nation-state actor.
The adversary "gained unauthorized access to our systems to target a small and specific set of our customers," Bob Phan, chief information security officer (CISO) at JumpCloud, said in a post-mortem report. "The


feed_id: https://thehackernews.com/2023/07/hackers-exploit-webapk-to-deceive.html
title: Hackers Exploit WebAPK to Deceive Android Users into Installing Malicious Apps
uri: 2023-07-26-Hackers-Exploit-WebAPK-to-Deceive-Android-Users-into-Installing-Malici
url: https://thehackernews.com/2023/07/hackers-exploit-webapk-to-deceive.html
content:
Threat actors are taking advantage of Android's WebAPK technology to trick unsuspecting users into installing malicious web apps on Android phones that are designed to capture sensitive personal information.
"The attack began with victims receiving SMS messages suggesting the need to update a mobile banking application," researchers from CSIRT KNF said in an analysis released last week. "The


feed_id: https://thehackernews.com/2023/07/these-6-questions-will-help-you-choose.html
title: These 6 Questions Will Help You Choose the Best Attack Surface Management Platform
uri: 2023-07-26-These-6-Questions-Will-Help-You-Choose-the-Best-Attack-Surface-Managem
url: https://thehackernews.com/2023/07/these-6-questions-will-help-you-choose.html
content:
The hype around different security categories can make it difficult to discern features and capabilities from bias when researching new platforms. You want to advance your security measures, but what steps actually make sense for your business? 
For anyone ready to find an attack surface management (ASM) vendor, review these six questions before getting started to understand the key features to


feed_id: https://thehackernews.com/2023/07/malicious-usb-drives-targetinging.html
title: Malicious USB Drives Targetinging Global Targets with SOGU and SNOWYDRIVE Malware
uri: 2023-07-26-Malicious-USB-Drives-Targetinging-Global-Targets-with-SOGU-and-SNOWYDR
url: https://thehackernews.com/2023/07/malicious-usb-drives-targetinging.html
content:
Cyber attacks using infected USB infection drives as an initial access vector have witnessed a three-fold increase in the first half of 2023, 
That's according to new findings from Mandiant, which detailed two such campaigns – SOGU and SNOWYDRIVE – targeting both public and private sector entities across the world.
SOGU is the "most prevalent USB-based cyber espionage attack using USB flash


feed_id: https://thehackernews.com/2023/07/cybercriminals-exploit-microsoft-word.html
title: Cybercriminals Exploit Microsoft Word Vulnerabilities to Deploy LokiBot Malware
uri: 2023-07-26-Cybercriminals-Exploit-Microsoft-Word-Vulnerabilities-to-Deploy-LokiBo
url: https://thehackernews.com/2023/07/cybercriminals-exploit-microsoft-word.html
content:
Microsoft Word documents exploiting known remote code execution flaws are being used as phishing lures to drop malware called LokiBot on compromised systems.
"LokiBot, also known as Loki PWS, has been a well-known information-stealing Trojan active since 2015," Fortinet FortiGuard Labs researcher Cara Lin said. "It primarily targets Windows systems and aims to gather sensitive information from


