# articles

feed_id: https://thehackernews.com/2024/02/fritzfrog-returns-with-log4shell-and.html
title: FritzFrog Returns with Log4Shell and PwnKit, Spreading Malware Inside Your Network
uri: FritzFrog-Returns-with-Log4Shell-and-PwnKit-Spreading-Malware-Inside
url: https://thehackernews.com/2024/02/fritzfrog-returns-with-log4shell-and.html
content:
The threat actor behind a peer-to-peer (P2P) botnet known as&nbsp;FritzFrog&nbsp;has made a return with a new variant that leverages the&nbsp;Log4Shell vulnerability&nbsp;to propagate internally within an already compromised network.
"The vulnerability is exploited in a brute-force manner that attempts to target as many vulnerable Java applications as possible," web infrastructure and security


feed_id: https://thehackernews.com/2024/02/exposed-docker-apis-under-attack-in.html
title: Exposed Docker APIs Under Attack in 'Commando Cat' Cryptojacking Campaign
uri: Exposed-Docker-APIs-Under-Attack-in-Commando-Cat-Cryptojacking-Campa
url: https://thehackernews.com/2024/02/exposed-docker-apis-under-attack-in.html
content:
Exposed Docker API endpoints over the internet are under assault from a sophisticated cryptojacking campaign called&nbsp;Commando Cat.
"The campaign deploys a benign container generated using the&nbsp;Commando project," Cado security researchers Nate Bill and Matt Muir&nbsp;said&nbsp;in a new report published today. "The attacker&nbsp;escapes this container&nbsp;and runs multiple payloads on the


feed_id: https://thehackernews.com/2024/02/why-right-metrics-matter-when-it-comes.html
title: Why the Right Metrics Matter When it Comes to Vulnerability Management
uri: Why-the-Right-Metrics-Matter-When-it-Comes-to-Vulnerability-Management
url: https://thehackernews.com/2024/02/why-right-metrics-matter-when-it-comes.html
content:
How’s your vulnerability management program doing? Is it effective? A success? Let’s be honest, without the right metrics or analytics, how can you tell how well you’re doing, progressing, or if you’re getting ROI? If you’re not measuring, how do you know it’s working? 
And even if you are measuring, faulty reporting or focusing on the wrong metrics can create blind spots and make it harder to


feed_id: https://thehackernews.com/2024/02/us-feds-shut-down-china-linked-kv.html
title: U.S. Feds Shut Down China-Linked "KV-Botnet" Targeting SOHO Routers
uri: U-S-Feds-Shut-Down-China-Linked-KV-Botnet-Targeting-SOHO-Routers
url: https://thehackernews.com/2024/02/us-feds-shut-down-china-linked-kv.html
content:
The U.S. government on Wednesday said it took steps to neutralize a botnet comprising hundreds of U.S.-based small office and home office (SOHO) routers hijacked by a China-linked state-sponsored threat actor called Volt Typhoon and blunt the impact posed by the hacking campaign.
The existence of the botnet, dubbed&nbsp;KV-botnet, was&nbsp;first disclosed&nbsp;by the Black Lotus Labs team at


feed_id: https://thehackernews.com/2024/02/headcrab-20-goes-fileless-targeting.html
title: HeadCrab 2.0 Goes Fileless, Targeting Redis Servers for Crypto Mining
uri: HeadCrab-2-0-Goes-Fileless-Targeting-Redis-Servers-for-Crypto-Mining
url: https://thehackernews.com/2024/02/headcrab-20-goes-fileless-targeting.html
content:
Cybersecurity researchers have detailed an updated version of the malware&nbsp;HeadCrab&nbsp;that's known to target Redis database servers across the world since early September 2021.
The development, which comes exactly a year after the malware was first&nbsp;publicly disclosed&nbsp;by Aqua, is a sign that the financially-motivated threat actor behind the campaign is actively adapting and


feed_id: https://thehackernews.com/2024/02/warning-new-malware-emerges-in-attacks.html
title: Warning: New Malware Emerges in Attacks Exploiting Ivanti VPN Vulnerabilities
uri: Warning-New-Malware-Emerges-in-Attacks-Exploiting-Ivanti-VPN-Vulnerab
url: https://thehackernews.com/2024/02/warning-new-malware-emerges-in-attacks.html
content:
Google-owned Mandiant said it identified new malware employed by a China-nexus espionage threat actor known as UNC5221 and other threat groups during post-exploitation activity targeting Ivanti Connect Secure VPN and Policy Secure devices.
This includes custom web shells such as BUSHWALK, CHAINLINE, FRAMESTING, and a variant of&nbsp;LIGHTWIRE.
"CHAINLINE is a Python web shell backdoor that is


feed_id: https://thehackernews.com/2024/02/cisa-warns-of-active-exploitation-of.html
title: CISA Warns of Active Exploitation Apple iOS and macOS Vulnerability
uri: CISA-Warns-of-Active-Exploitation-Apple-iOS-and-macOS-Vulnerability
url: https://thehackernews.com/2024/02/cisa-warns-of-active-exploitation-of.html
content:
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday&nbsp;added&nbsp;a high-severity flaw impacting iOS, iPadOS, macOS, tvOS, and watchOS to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation.
The vulnerability, tracked as&nbsp;CVE-2022-48618&nbsp;(CVSS score: 7.8), concerns a bug in the kernel component.
"An attacker with


feed_id: https://thehackernews.com/2024/02/runc-flaws-enable-container-escapes.html
title: RunC Flaws Enable Container Escapes, Granting Attackers Host Access
uri: RunC-Flaws-Enable-Container-Escapes-Granting-Attackers-Host-Access
url: https://thehackernews.com/2024/02/runc-flaws-enable-container-escapes.html
content:
Multiple security vulnerabilities have been disclosed in the runC command line tool that could be exploited by threat actors to escape the bounds of the container and stage follow-on attacks.
The vulnerabilities, tracked as CVE-2024-21626, CVE-2024-23651, CVE-2024-23652, and CVE-2024-23653, have been collectively dubbed&nbsp;Leaky Vessels&nbsp;by cybersecurity vendor Snyk.
"These container


feed_id: https://thehackernews.com/2024/01/alert-ivanti-discloses-2-new-zero-day.html
title: Alert: Ivanti Discloses 2 New Zero-Day Flaws, One Under Active Exploitation
uri: Alert-Ivanti-Discloses-2-New-Zero-Day-Flaws-One-Under-Active-Exploit
url: https://thehackernews.com/2024/01/alert-ivanti-discloses-2-new-zero-day.html
content:
Ivanti is alerting of two new high-severity flaws in its Connect Secure and Policy Secure products, one of which is said to have come under targeted exploitation in the wild.
The list of vulnerabilities is as follows -

CVE-2024-21888&nbsp;(CVSS score: 8.8) - A privilege escalation vulnerability in the web component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows


feed_id: https://thehackernews.com/2024/01/telegram-marketplaces-fuel-phishing.html
title: Telegram Marketplaces Fuel Phishing Attacks with Easy-to-Use Kits and Malware
uri: Telegram-Marketplaces-Fuel-Phishing-Attacks-with-Easy-to-Use-Kits-and
url: https://thehackernews.com/2024/01/telegram-marketplaces-fuel-phishing.html
content:
Cybersecurity researchers are calling attention to the "democratization" of the phishing ecosystem owing to the emergence of Telegram as an epicenter for cybercrime, enabling threat actors to mount a mass attack for as little as $230.
"This messaging app has transformed into a bustling hub where seasoned cybercriminals and newcomers alike exchange illicit tools and insights creating a dark and


feed_id: https://thehackernews.com/2024/01/the-sec-wont-let-cisos-be-understanding.html
title: The SEC Won't Let CISOs Be: Understanding New SaaS Cybersecurity Rules
uri: The-SEC-Won-t-Let-CISOs-Be-Understanding-New-SaaS-Cybersecurity-Rules
url: https://thehackernews.com/2024/01/the-sec-wont-let-cisos-be-understanding.html
content:
The SEC isn’t giving SaaS a free pass. Applicable public companies, known as “registrants,” are now subject to cyber incident disclosure and cybersecurity readiness requirements for data stored in SaaS systems, along with the 3rd and 4th party apps connected to them.&nbsp;
The new cybersecurity mandates&nbsp;make no distinction between data exposed in a breach that was stored on-premise, in the


feed_id: https://thehackernews.com/2024/01/italian-businesses-hit-by-weaponized.html
title: Italian Businesses Hit by Weaponized USBs Spreading Cryptojacking Malware
uri: Italian-Businesses-Hit-by-Weaponized-USBs-Spreading-Cryptojacking-Malw
url: https://thehackernews.com/2024/01/italian-businesses-hit-by-weaponized.html
content:
A financially motivated threat actor known as&nbsp;UNC4990&nbsp;is leveraging weaponized USB devices as an initial infection vector to target organizations in Italy.
Google-owned Mandiant said the attacks single out multiple industries, including health, transportation, construction, and logistics.
"UNC4990 operations generally involve widespread USB infection followed by the deployment of the


feed_id: https://thehackernews.com/2024/01/chinese-hackers-exploiting-critical-vpn.html
title: Hackers Exploiting Ivanti VPN Flaws to Deploy KrustyLoader Malware
uri: Hackers-Exploiting-Ivanti-VPN-Flaws-to-Deploy-KrustyLoader-Malware
url: https://thehackernews.com/2024/01/chinese-hackers-exploiting-critical-vpn.html
content:
A pair of recently disclosed zero-day flaws in Ivanti Connect Secure (ICS) virtual private network (VPN) devices have been exploited to deliver a Rust-based payload called&nbsp;KrustyLoader&nbsp;that's used to drop the open-source Sliver adversary simulation tool.
The&nbsp;security vulnerabilities, tracked as CVE-2023-46805 (CVSS score: 8.2) and CVE-2024-21887 (CVSS score: 9.1), could be abused


feed_id: https://thehackernews.com/2024/01/new-glibc-flaw-grants-attackers-root.html
title: New Glibc Flaw Grants Attackers Root Access on Major Linux Distros
uri: New-Glibc-Flaw-Grants-Attackers-Root-Access-on-Major-Linux-Distros
url: https://thehackernews.com/2024/01/new-glibc-flaw-grants-attackers-root.html
content:
Malicious local attackers can obtain full root access on Linux machines by taking advantage of a newly disclosed security flaw in the GNU C library (aka glibc).
Tracked as CVE-2023-6246 (CVSS score: 7.8), the heap-based buffer overflow vulnerability is rooted in glibc's __vsyslog_internal() function, which is used by&nbsp;syslog() and vsyslog()&nbsp;for system logging purposes. It's said to have


feed_id: https://thehackernews.com/2024/01/brazilian-feds-dismantle-grandoreiro.html
title: Brazilian Feds Dismantle Grandoreiro Banking Trojan, Arresting Top Operatives
uri: Brazilian-Feds-Dismantle-Grandoreiro-Banking-Trojan-Arresting-Top-Ope
url: https://thehackernews.com/2024/01/brazilian-feds-dismantle-grandoreiro.html
content:
A Brazilian law enforcement operation has led to the arrest of several Brazilian operators in charge of the&nbsp;Grandoreiro&nbsp;malware.
The Federal Police of Brazil&nbsp;said&nbsp;it served five temporary arrest warrants and 13 search and seizure warrants in the states of São Paulo, Santa Catarina, Pará, Goiás, and Mato Grosso.
Slovak cybersecurity firm ESET, which provided additional


feed_id: https://thehackernews.com/2024/01/urgent-upgrade-gitlab-critical.html
title: URGENT: Upgrade GitLab - Critical Workspace Creation Flaw Allows File Overwrite
uri: URGENT-Upgrade-GitLab-Critical-Workspace-Creation-Flaw-Allows-File
url: https://thehackernews.com/2024/01/urgent-upgrade-gitlab-critical.html
content:
GitLab once again released fixes to address a critical security flaw in its Community Edition (CE) and Enterprise Edition (EE) that could be exploited to write arbitrary files while creating a&nbsp;workspace.
Tracked as&nbsp;CVE-2024-0402, the vulnerability has a CVSS score of 9.9 out of a maximum of 10.
"An issue has been discovered in GitLab CE/EE affecting all versions from 16.0 prior to


feed_id: https://thehackernews.com/2024/01/china-linked-hackers-target-myanmars.html
title: China-Linked Hackers Target Myanmar's Top Ministries with Backdoor Blitz
uri: China-Linked-Hackers-Target-Myanmar-s-Top-Ministries-with-Backdoor-Bli
url: https://thehackernews.com/2024/01/china-linked-hackers-target-myanmars.html
content:
The China-based threat actor known as&nbsp;Mustang Panda&nbsp;is suspected to have targeted Myanmar's Ministry of Defence and Foreign Affairs as part of twin campaigns designed to deploy backdoors and remote access trojans.
The findings come from CSIRT-CTI, which said the activities took place in November 2023 and January 2024 after artifacts in connection with the attacks were uploaded to the


feed_id: https://thehackernews.com/2024/01/top-security-posture-vulnerabilities.html
title: Top Security Posture Vulnerabilities Revealed
uri: Top-Security-Posture-Vulnerabilities-Revealed
url: https://thehackernews.com/2024/01/top-security-posture-vulnerabilities.html
content:
Each New Year introduces a new set of challenges and opportunities for strengthening our cybersecurity posture. It's the nature of the field – the speed at which malicious actors carry out advanced persistent threats brings a constant, evolving battle for cyber resilience. The excitement in cybersecurity lies in this continuous adaptation and learning, always staying one step ahead of potential


feed_id: https://thehackernews.com/2024/01/italian-data-protection-watchdog.html
title: Italian Data Protection Watchdog Accuses ChatGPT of Privacy Violations
uri: Italian-Data-Protection-Watchdog-Accuses-ChatGPT-of-Privacy-Violations
url: https://thehackernews.com/2024/01/italian-data-protection-watchdog.html
content:
Italy's data protection authority (DPA) has notified ChatGPT-maker OpenAI of supposedly violating privacy laws in the region.
"The available evidence pointed to the existence of breaches of the provisions contained in the E.U. GDPR [General Data Protection Regulation]," the Garante per la protezione dei dati personali (aka the Garante)&nbsp;said&nbsp;in a statement on Monday.
It also said it


feed_id: https://thehackernews.com/2024/01/new-zloader-malware-variant-surfaces.html
title: New ZLoader Malware Variant Surfaces with 64-bit Windows Compatibility
uri: New-ZLoader-Malware-Variant-Surfaces-with-64-bit-Windows-Compatibility
url: https://thehackernews.com/2024/01/new-zloader-malware-variant-surfaces.html
content:
Threat hunters have identified a new campaign that delivers the&nbsp;ZLoader&nbsp;malware, resurfacing nearly two years after the botnet's infrastructure was dismantled in April 2022.
A new variant of the malware is said to have been in development since September 2023, Zscaler ThreatLabz said in an analysis published this month.
"The new version of ZLoader made significant changes to the loader


feed_id: https://thehackernews.com/2024/01/juniper-networks-releases-urgent-junos.html
title: Juniper Networks Releases Urgent Junos OS Updates for High-Severity Flaws
uri: Juniper-Networks-Releases-Urgent-Junos-OS-Updates-for-High-Severity-Fl
url: https://thehackernews.com/2024/01/juniper-networks-releases-urgent-junos.html
content:
Juniper Networks has released out-of-band updates to&nbsp;address high-severity flaws&nbsp;in SRX Series and EX Series that could be exploited by a threat actor to take control of susceptible systems.
The vulnerabilities, tracked as&nbsp;CVE-2024-21619 and CVE-2024-21620, are rooted in the J-Web component and impact all versions of Junos OS. Two other shortcomings, CVE-2023-36846 and


feed_id: https://thehackernews.com/2024/01/researchers-uncover-outlook.html
title: Researchers Uncover How Outlook Vulnerability Could Leak Your NTLM Passwords
uri: Researchers-Uncover-How-Outlook-Vulnerability-Could-Leak-Your-NTLM-Pas
url: https://thehackernews.com/2024/01/researchers-uncover-outlook.html
content:
A now-patched security flaw in Microsoft Outlook could be exploited by threat actors to access NT LAN Manager (NTLM) v2 hashed passwords when opening a specially crafted file.
The issue, tracked as CVE-2023-35636 (CVSS score: 6.5), was addressed by the tech giant as part of its&nbsp;Patch Tuesday updates&nbsp;for December 2023.
"In an email attack scenario, an attacker could exploit the


feed_id: https://thehackernews.com/2024/01/493-companies-share-their-saas-security.html
title: 493 Companies Share Their SaaS Security Battles – Get Insights in this Webinar
uri: 493-Companies-Share-Their-SaaS-Security-Battles-Get-Insights-in-th
url: https://thehackernews.com/2024/01/493-companies-share-their-saas-security.html
content:
In today's digital world, security risks are more prevalent than ever, especially when it comes to Software as a Service (SaaS) applications. Did you know that an alarming 97% of companies face serious risks from unsecured SaaS applications?Moreover, about 20% of these organizations are struggling with internal data threats. These statistics aren't just numbers; they're a wake-up call.
We're


feed_id: https://thehackernews.com/2024/01/riding-ai-waves-rise-of-artificial.html
title: Riding the AI Waves: The Rise of Artificial Intelligence to Combat Cyber Threats
uri: Riding-the-AI-Waves-The-Rise-of-Artificial-Intelligence-to-Combat-Cyb
url: https://thehackernews.com/2024/01/riding-ai-waves-rise-of-artificial.html
content:
In nearly every segment of our lives, AI (artificial intelligence) now makes a significant impact: It can deliver better healthcare diagnoses and treatments; detect and reduce the risk of financial fraud; improve inventory management; and serve up the right recommendation for a streaming movie on Friday night. However, one can also make a strong case that some of AI’s most significant impacts


feed_id: https://thehackernews.com/2024/01/albabat-kasseika-kuiper-new-ransomware.html
title: Albabat, Kasseika, Kuiper: New Ransomware Gangs Rise with Rust and Golang
uri: Albabat-Kasseika-Kuiper-New-Ransomware-Gangs-Rise-with-Rust-and-Gol
url: https://thehackernews.com/2024/01/albabat-kasseika-kuiper-new-ransomware.html
content:
Cybersecurity researchers have detected in the wild yet another variant of the Phobos ransomware family known as&nbsp;Faust.
Fortinet FortiGuard Labs, which detailed the latest iteration of the ransomware, said it's being propagated by means of an infection that delivers a Microsoft Excel document (.XLAM) containing a VBA script.
"The attackers utilized the Gitea service to store several files


feed_id: https://thehackernews.com/2024/01/nsa-admits-secretly-buying-your.html
title: NSA Admits Secretly Buying Your Internet Browsing Data without Warrants
uri: NSA-Admits-Secretly-Buying-Your-Internet-Browsing-Data-without-Warrant
url: https://thehackernews.com/2024/01/nsa-admits-secretly-buying-your.html
content:
The U.S. National Security Agency (NSA) has admitted to buying internet browsing records from data brokers to identify the websites and apps Americans use that would otherwise require a court order, U.S. Senator Ron Wyden said last week.
"The U.S. government should not be funding and legitimizing a shady industry whose flagrant violations of Americans' privacy are not just unethical, but illegal


feed_id: https://thehackernews.com/2024/01/malicious-pypi-packages-slip-whitesnake.html
title: Malicious PyPI Packages Slip WhiteSnake InfoStealer Malware onto Windows Machines
uri: Malicious-PyPI-Packages-Slip-WhiteSnake-InfoStealer-Malware-onto-Windo
url: https://thehackernews.com/2024/01/malicious-pypi-packages-slip-whitesnake.html
content:
Cybersecurity researchers have identified malicious packages on the open-source Python Package Index (PyPI) repository that deliver an information stealing malware called WhiteSnake Stealer on Windows systems.
The malware-laced packages are named nigpal, figflix, telerer, seGMM, fbdebug, sGMM, myGens, NewGends, and TestLibs111. They have been uploaded by a threat actor named "WS."
"These


feed_id: https://thehackernews.com/2024/01/allakore-rat-malware-targeting-mexican.html
title: AllaKore RAT Malware Targeting Mexican Firms with Financial Fraud Tricks
uri: AllaKore-RAT-Malware-Targeting-Mexican-Firms-with-Financial-Fraud-Tric
url: https://thehackernews.com/2024/01/allakore-rat-malware-targeting-mexican.html
content:
Mexican financial institutions are under the radar of a new spear-phishing campaign that delivers a modified version of an open-source remote access trojan called&nbsp;AllaKore RAT.
The BlackBerry Research and Intelligence Team attributed the activity to an unknown Latin America-based financially motivated threat actor. The campaign has been active since at least 2021.
"Lures use Mexican Social


feed_id: https://thehackernews.com/2024/01/perfecting-defense-in-depth-strategy.html
title: Perfecting the Defense-in-Depth Strategy with Automation
uri: Perfecting-the-Defense-in-Depth-Strategy-with-Automation
url: https://thehackernews.com/2024/01/perfecting-defense-in-depth-strategy.html
content:
Medieval castles stood as impregnable fortresses for centuries, thanks to their meticulous design. Fast forward to the digital age, and this medieval wisdom still echoes in cybersecurity. Like castles with strategic layouts to withstand attacks, the Defense-in-Depth strategy is the modern counterpart — a multi-layered approach with strategic redundancy and a blend of passive and active security


feed_id: https://thehackernews.com/2024/01/malicious-ads-on-google-target-chinese.html
title: Malicious Ads on Google Target Chinese Users with Fake Messaging Apps
uri: Malicious-Ads-on-Google-Target-Chinese-Users-with-Fake-Messaging-Apps
url: https://thehackernews.com/2024/01/malicious-ads-on-google-target-chinese.html
content:
Chinese-speaking users have been targeted by malicious Google ads for restricted messaging apps like Telegram as part of an ongoing malvertising campaign.
"The threat actor is abusing Google advertiser accounts to create malicious ads and pointing them to pages where unsuspecting users will download Remote Administration Trojan (RATs) instead," Malwarebytes' Jérôme Segura&nbsp;said&nbsp;in a


feed_id: https://thehackernews.com/2024/01/microsoft-warns-of-widening-apt29.html
title: Microsoft Warns of Widening APT29 Espionage Attacks Targeting Global Orgs
uri: Microsoft-Warns-of-Widening-APT29-Espionage-Attacks-Targeting-Global-O
url: https://thehackernews.com/2024/01/microsoft-warns-of-widening-apt29.html
content:
Microsoft on Thursday said the Russian state-sponsored threat actors responsible for a&nbsp;cyber attack on its systems&nbsp;in late November 2023 have been targeting other organizations and that it's currently beginning to notify them.
The development comes a day after Hewlett Packard Enterprise (HPE)&nbsp;revealed&nbsp;that it had been the victim of an attack perpetrated by a hacking crew


feed_id: https://thehackernews.com/2024/01/russian-trickbot-mastermind-gets-5-year.html
title: Russian TrickBot Mastermind Gets 5-Year Prison Sentence for Cybercrime Spree
uri: Russian-TrickBot-Mastermind-Gets-5-Year-Prison-Sentence-for-Cybercrime
url: https://thehackernews.com/2024/01/russian-trickbot-mastermind-gets-5-year.html
content:
40-year-old Russian national Vladimir Dunaev has been sentenced to five years and four months in prison for his role in creating and distributing the TrickBot malware, the U.S. Department of Justice (DoJ) said.
The development comes nearly two months after&nbsp;Dunaev pleaded guilty&nbsp;to committing computer fraud and identity theft and conspiracy to commit wire fraud and bank fraud.
"


feed_id: https://thehackernews.com/2024/01/critical-cisco-flaw-lets-hackers.html
title: Critical Cisco Flaw Lets Hackers Remotely Take Over Unified Comms Systems
uri: Critical-Cisco-Flaw-Lets-Hackers-Remotely-Take-Over-Unified-Comms-Syst
url: https://thehackernews.com/2024/01/critical-cisco-flaw-lets-hackers.html
content:
Cisco has released patches to address a critical security flaw impacting Unified Communications and Contact Center Solutions products that could permit an unauthenticated, remote attacker to execute arbitrary code on an affected device.
Tracked as&nbsp;CVE-2024-20253&nbsp;(CVSS score: 9.9), the issue stems from improper processing of user-provided data that a threat actor could abuse to send a


feed_id: https://thehackernews.com/2024/01/systembc-malwares-c2-server-analysis.html
title: SystemBC Malware's C2 Server Analysis Exposes Payload Delivery Tricks
uri: SystemBC-Malware-s-C2-Server-Analysis-Exposes-Payload-Delivery-Tricks
url: https://thehackernews.com/2024/01/systembc-malwares-c2-server-analysis.html
content:
Cybersecurity researchers have shed light on the command-and-control (C2) server workings of a known malware family called&nbsp;SystemBC.
"SystemBC can be purchased on underground marketplaces and is supplied in an archive containing the implant, a command-and-control (C2) server, and a web administration portal written in PHP," Kroll&nbsp;said&nbsp;in an analysis published last week.
The risk


feed_id: https://thehackernews.com/2024/02/glupteba-botnet-evades-detection-with.html
title: Glupteba Botnet Evades Detection with Undocumented UEFI Bootkit
uri: Glupteba-Botnet-Evades-Detection-with-Undocumented-UEFI-Bootkit
url: https://thehackernews.com/2024/02/glupteba-botnet-evades-detection-with.html
content:
The&nbsp;Glupteba&nbsp;botnet has been found to incorporate a previously undocumented Unified Extensible Firmware Interface (UEFI) bootkit feature, adding another layer of sophistication and stealth to the malware.
"This bootkit can intervene and control the [operating system] boot process, enabling Glupteba to hide itself and create a stealthy persistence that can be extremely difficult to


feed_id: https://thehackernews.com/2024/02/pikabot-resurfaces-with-streamlined.html
title: PikaBot Resurfaces with Streamlined Code and Deceptive Tactics
uri: PikaBot-Resurfaces-with-Streamlined-Code-and-Deceptive-Tactics
url: https://thehackernews.com/2024/02/pikabot-resurfaces-with-streamlined.html
content:
The threat actors behind the PikaBot malware have made significant changes to the malware in what has been described as a case of "devolution."
"Although it appears to be in a new development cycle and testing phase, the developers have reduced the complexity of the code by removing advanced obfuscation techniques and changing the network communications," Zscaler ThreatLabz researcher Nikolaos


feed_id: https://thehackernews.com/2024/02/midnight-blizzard-and-cloudflare.html
title: Midnight Blizzard and Cloudflare-Atlassian Cybersecurity Incidents: What to Know
uri: Midnight-Blizzard-and-Cloudflare-Atlassian-Cybersecurity-Incidents-Wh
url: https://thehackernews.com/2024/02/midnight-blizzard-and-cloudflare.html
content:
The Midnight Blizzard and Cloudflare-Atlassian cybersecurity incidents raised alarms about the vulnerabilities inherent in major SaaS platforms. These incidents illustrate the stakes involved in SaaS breaches — safeguarding the integrity of SaaS apps and their sensitive data is critical but is not easy. Common threat vectors such as sophisticated spear-phishing, misconfigurations and


feed_id: https://thehackernews.com/2024/02/ivanti-vulnerability-exploited-to.html
title: Ivanti Vulnerability Exploited to Install 'DSLog' Backdoor on 670+ IT Infrastructures
uri: Ivanti-Vulnerability-Exploited-to-Install-DSLog-Backdoor-on-670-IT
url: https://thehackernews.com/2024/02/ivanti-vulnerability-exploited-to.html
content:
Threat actors are leveraging a recently disclosed security flaw impacting Ivanti Connect Secure, Policy Secure, and ZTA gateways to deploy a backdoor codenamed&nbsp;DSLog&nbsp;on susceptible devices.
That's according to&nbsp;findings&nbsp;from Orange Cyberdefense, which said it observed the exploitation of CVE-2024-21893 within hours of the public release of the proof-the-concept (PoC) code.


feed_id: https://thehackernews.com/2024/02/alert-cisa-warns-of-active-roundcube.html
title: Alert: CISA Warns of Active 'Roundcube' Email Attacks - Patch Now
uri: Alert-CISA-Warns-of-Active-Roundcube-Email-Attacks-Patch-Now
url: https://thehackernews.com/2024/02/alert-cisa-warns-of-active-roundcube.html
content:
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday&nbsp;added&nbsp;a medium-severity security flaw impacting Roundcube email software to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation.
The issue, tracked as&nbsp;CVE-2023-43770&nbsp;(CVSS score: 6.1), relates to a cross-site scripting (XSS) flaw that stems from the handling of


feed_id: https://thehackernews.com/2024/02/rhysida-ransomware-cracked-free.html
title: Rhysida Ransomware Cracked, Free Decryption Tool Released
uri: Rhysida-Ransomware-Cracked-Free-Decryption-Tool-Released
url: https://thehackernews.com/2024/02/rhysida-ransomware-cracked-free.html
content:
Cybersecurity researchers have uncovered an "implementation vulnerability" that has made it possible to reconstruct encryption keys and decrypt data locked by Rhysida ransomware.
The findings were published last week by a group of researchers from Kookmin University and the Korea Internet and Security Agency (KISA).
"Through a comprehensive analysis of Rhysida Ransomware, we identified an


feed_id: https://thehackernews.com/2024/02/4-ways-hackers-use-social-engineering.html
title: 4 Ways Hackers use Social Engineering to Bypass MFA
uri: 4-Ways-Hackers-use-Social-Engineering-to-Bypass-MFA
url: https://thehackernews.com/2024/02/4-ways-hackers-use-social-engineering.html
content:
When it comes to access security, one recommendation stands out above the rest: multi-factor authentication (MFA). With passwords alone being simple work for hackers, MFA provides an essential layer of protection against breaches. However, it's important to remember that MFA isn't foolproof. It can be bypassed, and it often is.&nbsp;
If a password is compromised, there are several options


feed_id: https://thehackernews.com/2024/02/cisa-and-openssf-release-framework-for.html
title: CISA and OpenSSF Release Framework for Package Repository Security
uri: CISA-and-OpenSSF-Release-Framework-for-Package-Repository-Security
url: https://thehackernews.com/2024/02/cisa-and-openssf-release-framework-for.html
content:
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) announced that it's partnering with the Open Source Security Foundation (OpenSSF) Securing Software Repositories Working Group to publish a new framework to secure package repositories.
Called the&nbsp;Principles for Package Repository Security, the framework&nbsp;aims&nbsp;to establish a set of foundational rules for package


feed_id: https://thehackernews.com/2024/02/why-are-compromised-identities.html
title: Why Are Compromised Identities the Nightmare to IR Speed and Efficiency?
uri: Why-Are-Compromised-Identities-the-Nightmare-to-IR-Speed-and-Efficienc
url: https://thehackernews.com/2024/02/why-are-compromised-identities.html
content:
Incident response (IR) is a race against time. You engage your internal or external team because there's enough evidence that something bad is happening, but you’re still blind to the scope, the impact, and the root cause. The common set of IR tools and practices provides IR teams with the ability to discover malicious files and outbound network connections. However, the identity aspect - namely


feed_id: https://thehackernews.com/2024/02/microsoft-introduces-linux-like-sudo.html
title: Microsoft Introduces Linux-Like 'sudo' Command to Windows 11
uri: Microsoft-Introduces-Linux-Like-sudo-Command-to-Windows-11
url: https://thehackernews.com/2024/02/microsoft-introduces-linux-like-sudo.html
content:
Microsoft said it's introducing Sudo for Windows 11 as part of an early preview version to help users execute commands with administrator privileges.
"Sudo for Windows is a new way for users to run elevated commands directly from an unelevated console session," Microsoft Product Manager Jordi Adoumie&nbsp;said.
"It is an ergonomic and familiar solution for users who want to elevate a command


feed_id: https://thehackernews.com/2024/02/us-offers-10-million-bounty-for-info.html
title: U.S. Offers $10 Million Bounty for Info Leading to Arrest of Hive Ransomware Leaders
uri: U-S-Offers-10-Million-Bounty-for-Info-Leading-to-Arrest-of-Hive-Rans
url: https://thehackernews.com/2024/02/us-offers-10-million-bounty-for-info.html
content:
The U.S. Department of State has&nbsp;announced&nbsp;monetary rewards of up to $10 million for information about individuals holding key positions within the Hive ransomware operation.
It is also giving away an additional $5 million for specifics that could lead to the arrest and/or conviction of any person "conspiring to participate in or attempting to participate in Hive ransomware activity."


feed_id: https://thehackernews.com/2024/02/us-doj-dismantles-warzone-rat.html
title: U.S. DoJ Dismantles Warzone RAT Infrastructure, Arrests Key Operators
uri: U-S-DoJ-Dismantles-Warzone-RAT-Infrastructure-Arrests-Key-Operators
url: https://thehackernews.com/2024/02/us-doj-dismantles-warzone-rat.html
content:
The U.S. Justice Department (DoJ) on Friday announced the seizure of online infrastructure that was used to sell a remote access trojan (RAT) called&nbsp;Warzone RAT.
The domains –&nbsp;www.warzone[.]ws&nbsp;and three others – were "used to sell computer malware used by cybercriminals to secretly access and steal data from victims' computers," the DoJ&nbsp;said.
Alongside the takedown, the


feed_id: https://thehackernews.com/2024/02/alert-new-stealthy-rustdoor-backdoor.html
title: Alert: New Stealthy "RustDoor" Backdoor Targeting Apple macOS Devices
uri: Alert-New-Stealthy-RustDoor-Backdoor-Targeting-Apple-macOS-Devices
url: https://thehackernews.com/2024/02/alert-new-stealthy-rustdoor-backdoor.html
content:
Apple macOS users are the target of a new Rust-based backdoor that has been operating under the radar since November 2023.
The backdoor,&nbsp;codenamed&nbsp;RustDoor&nbsp;by Bitdefender, has been found to impersonate an update for Microsoft Visual Studio and target both Intel and Arm architectures.
The exact initial access pathway used to propagate the implant is currently not known, although


feed_id: https://thehackernews.com/2024/02/raspberry-robin-malware-upgrades-with.html
title: Raspberry Robin Malware Upgrades with Discord Spread and New Exploits
uri: Raspberry-Robin-Malware-Upgrades-with-Discord-Spread-and-New-Exploits
url: https://thehackernews.com/2024/02/raspberry-robin-malware-upgrades-with.html
content:
The operators of&nbsp;Raspberry Robin&nbsp;are now using two new one-day exploits to achieve local privilege escalation, even as the malware continues to be refined and improved to make it stealthier than before.
This means that "Raspberry Robin has access to an exploit seller or its authors develop the exploits themselves in a short period of time," Check Point&nbsp;said&nbsp;in a report this


feed_id: https://thehackernews.com/2024/02/new-variant-of-moqhao-android-malware.html
title: MoqHao Android Malware Evolves with Auto-Execution Capability
uri: MoqHao-Android-Malware-Evolves-with-Auto-Execution-Capability
url: https://thehackernews.com/2024/02/new-variant-of-moqhao-android-malware.html
content:
Threat hunters have identified a new variant of Android malware called&nbsp;MoqHao&nbsp;that automatically executes on infected devices without requiring any user interaction.
"Typical MoqHao requires users to install and launch the app to get their desired purpose, but this new variant requires no execution," McAfee Labs&nbsp;said&nbsp;in a report published this week. "While the app is


feed_id: https://thehackernews.com/2024/02/hands-on-review-myrror-security-code.html
title: Hands-on Review: Myrror Security Code-Aware and Attack-Aware SCA
uri: Hands-on-Review-Myrror-Security-Code-Aware-and-Attack-Aware-SCA
url: https://thehackernews.com/2024/02/hands-on-review-myrror-security-code.html
content:
Introduction
The modern software supply chain represents an ever-evolving threat landscape, with each package added to the manifest introducing new attack vectors. To meet industry requirements, organizations must maintain a fast-paced development process while staying up-to-date with the latest security patches. However, in practice, developers often face a large amount of security work


feed_id: https://thehackernews.com/2024/02/new-coyote-trojan-targets-61-brazilian.html
title: New Coyote Trojan Targets 61 Brazilian Banks with Nim-Powered Attack
uri: New-Coyote-Trojan-Targets-61-Brazilian-Banks-with-Nim-Powered-Attack
url: https://thehackernews.com/2024/02/new-coyote-trojan-targets-61-brazilian.html
content:
Sixty-one banking institutions, all of them originating from Brazil, are the target of a new banking trojan called&nbsp;Coyote.
"This malware utilizes the Squirrel installer for distribution, leveraging Node.js and a relatively new multi-platform programming language called Nim as a loader to complete its infection," Russian cybersecurity firm Kaspersky&nbsp;said&nbsp;in a Thursday report.
What


feed_id: https://thehackernews.com/2024/02/fortinet-warns-of-critical-fortios-ssl.html
title: Fortinet Warns of Critical FortiOS SSL VPN Flaw Likely Under Active Exploitation
uri: Fortinet-Warns-of-Critical-FortiOS-SSL-VPN-Flaw-Likely-Under-Active-Ex
url: https://thehackernews.com/2024/02/fortinet-warns-of-critical-fortios-ssl.html
content:
Fortinet has disclosed a new critical security flaw in FortiOS SSL VPN that it said is likely being exploited in the wild.
The vulnerability,&nbsp;CVE-2024-21762&nbsp;(CVSS score: 9.6), allows for the execution of arbitrary code and commands.
"An out-of-bounds write vulnerability [CWE-787] in FortiOS may allow a remote unauthenticated attacker to execute arbitrary code or command via specially


feed_id: https://thehackernews.com/2024/02/wazuh-in-cloud-era-navigating.html
title: Wazuh in the Cloud Era: Navigating the Challenges of Cybersecurity
uri: Wazuh-in-the-Cloud-Era-Navigating-the-Challenges-of-Cybersecurity
url: https://thehackernews.com/2024/02/wazuh-in-cloud-era-navigating.html
content:
Cloud computing has innovated how organizations operate and manage IT operations, such as data storage, application deployment, networking, and overall resource management. The cloud offers scalability, adaptability, and accessibility, enabling businesses to achieve sustainable growth. However, adopting cloud technologies into your infrastructure presents various cybersecurity risks and


feed_id: https://thehackernews.com/2024/02/warning-new-ivanti-auth-bypass-flaw.html
title: Warning: New Ivanti Auth Bypass Flaw Affects Connect Secure and ZTA Gateways
uri: Warning-New-Ivanti-Auth-Bypass-Flaw-Affects-Connect-Secure-and-ZTA-Ga
url: https://thehackernews.com/2024/02/warning-new-ivanti-auth-bypass-flaw.html
content:
Ivanti has alerted customers of yet another high-severity security flaw in its Connect Secure, Policy Secure, and ZTA gateway devices that could allow attackers to bypass authentication.
The issue, tracked as&nbsp;CVE-2024-22024, is rated 8.3 out of 10 on the CVSS scoring system.
"An XML external entity or XXE vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x), Ivanti


feed_id: https://thehackernews.com/2024/02/stealthy-zardoor-backdoor-targets-saudi.html
title: Stealthy Zardoor Backdoor Targets Saudi Islamic Charity Organization
uri: Stealthy-Zardoor-Backdoor-Targets-Saudi-Islamic-Charity-Organization
url: https://thehackernews.com/2024/02/stealthy-zardoor-backdoor-targets-saudi.html
content:
An unnamed Islamic non-profit organization in Saudi Arabia has been targeted as part of a stealthy cyber espionage campaign designed to drop a previously undocumented backdoor called&nbsp;Zardoor.
Cisco Talos, which discovered the activity in May 2023, said the campaign has likely persisted since at least March 2021, adding it has identified only one compromised target to date, although it's


feed_id: https://thehackernews.com/2024/02/chinese-hackers-operate-undetected-in.html
title: Chinese Hackers Operate Undetected in U.S. Critical Infrastructure for Half a Decade
uri: Chinese-Hackers-Operate-Undetected-in-U-S-Critical-Infrastructure-for
url: https://thehackernews.com/2024/02/chinese-hackers-operate-undetected-in.html
content:
The U.S. government on Wednesday said the Chinese state-sponsored hacking group known as&nbsp;Volt Typhoon&nbsp;had been embedded into some critical infrastructure networks in the country for at least five years.
Targets of the threat actor include communications, energy, transportation, and water and wastewater systems sectors in the U.S. and Guam.
"Volt Typhoon's choice of targets and pattern


feed_id: https://thehackernews.com/2024/02/unified-identity-look-for-meaning.html
title: Unified Identity – look for the meaning behind the hype!
uri: Unified-Identity-look-for-the-meaning-behind-the-hype
url: https://thehackernews.com/2024/02/unified-identity-look-for-meaning.html
content:
If you've listened to software vendors in the identity space lately, you will have noticed that “unified” has quickly become the buzzword that everyone is adopting to describe their portfolio. And this is great! Unified identity has some amazing benefits!&nbsp;
However (there is always a however, right?) not every “unified” “identity” “security” “platform” is made equal. Some vendors call the


feed_id: https://thehackernews.com/2024/02/hijackloader-evolves-researchers-decode.html
title: HijackLoader Evolves: Researchers Decode the Latest Evasion Methods
uri: HijackLoader-Evolves-Researchers-Decode-the-Latest-Evasion-Methods
url: https://thehackernews.com/2024/02/hijackloader-evolves-researchers-decode.html
content:
The threat actors behind a loader malware called&nbsp;HijackLoader&nbsp;have added new techniques for defense evasion, as the malware continues to be increasingly used by other threat actors to deliver additional payloads and tooling.
"The malware developer used a standard process hollowing technique coupled with an additional trigger that was activated by the parent process writing to a pipe,"


feed_id: https://thehackernews.com/2024/02/google-starts-blocking-sideloading-of.html
title: Google Starts Blocking Sideloading of Potentially Dangerous Android Apps in Singapore
uri: Google-Starts-Blocking-Sideloading-of-Potentially-Dangerous-Android-Ap
url: https://thehackernews.com/2024/02/google-starts-blocking-sideloading-of.html
content:
Google has unveiled a new pilot program in Singapore that aims to prevent users from sideloading certain apps that abuse Android app permissions to read one-time passwords and gather sensitive data.
"This enhanced fraud protection will analyze and automatically block the installation of apps that may use sensitive runtime permissions frequently abused for financial fraud when the user attempts


feed_id: https://thehackernews.com/2024/02/kimsukys-new-golang-stealer-troll-and.html
title: Kimsuky's New Golang Stealer 'Troll' and 'GoBear' Backdoor Target South Korea
uri: Kimsuky-s-New-Golang-Stealer-Troll-and-GoBear-Backdoor-Target-Sout
url: https://thehackernews.com/2024/02/kimsukys-new-golang-stealer-troll-and.html
content:
The North Korea-linked nation-state actor known as Kimsuky is suspected of using a previously undocumented Golang-based information stealer called&nbsp;Troll Stealer.
The malware steals "SSH, FileZilla, C drive files/directories, browsers, system information, [and] screen captures" from infected systems, South Korean cybersecurity company S2W&nbsp;said&nbsp;in a new technical report.
Troll


feed_id: https://thehackernews.com/2024/02/critical-patches-released-for-new-flaws.html
title: Critical Patches Released for New Flaws in Cisco, Fortinet, VMware Products
uri: Critical-Patches-Released-for-New-Flaws-in-Cisco-Fortinet-VMware-Pro
url: https://thehackernews.com/2024/02/critical-patches-released-for-new-flaws.html
content:
Cisco, Fortinet, and VMware have released security fixes for multiple security vulnerabilities, including critical weaknesses that could be exploited to perform arbitrary actions on affected devices.
The first set from Cisco consists of three flaws – CVE-2024-20252 and CVE-2024-20254 (CVSS score: 9.6) and CVE-2024-20255 (CVSS score: 8.2) – impacting Cisco Expressway Series that could allow an


feed_id: https://thehackernews.com/2024/02/after-fbi-takedown-kv-botnet-operators.html
title: After FBI Takedown, KV-Botnet Operators Shift Tactics in Attempt to Bounce Back
uri: After-FBI-Takedown-KV-Botnet-Operators-Shift-Tactics-in-Attempt-to-Bo
url: https://thehackernews.com/2024/02/after-fbi-takedown-kv-botnet-operators.html
content:
The threat actors behind the&nbsp;KV-botnet&nbsp;made "behavioral changes" to the malicious network as U.S. law enforcement began issuing commands to neutralize the activity.
KV-botnet is the name given to a network of compromised small office and home office (SOHO) routers and firewall devices across the world, with one specific cluster acting as a covert data transfer system for other Chinese


feed_id: https://thehackernews.com/2024/02/critical-bootloader-vulnerability-in.html
title: Critical Boot Loader Vulnerability in Shim Impacts Nearly All Linux Distros
uri: Critical-Boot-Loader-Vulnerability-in-Shim-Impacts-Nearly-All-Linux-Di
url: https://thehackernews.com/2024/02/critical-bootloader-vulnerability-in.html
content:
The maintainers of shim have released&nbsp;version 15.8&nbsp;to address six security flaws, including a critical bug that could pave the way for remote code execution under specific circumstances.
Tracked as&nbsp;CVE-2023-40547&nbsp;(CVSS score: 9.8), the vulnerability could be exploited to achieve a Secure Boot bypass. Bill Demirkapi of the Microsoft Security Response Center (MSRC) has been&


feed_id: https://thehackernews.com/2024/02/new-webinar-5-steps-to-vciso-success.html
title: New Webinar: 5 Steps to vCISO Success for MSPs and MSSPs
uri: New-Webinar-5-Steps-to-vCISO-Success-for-MSPs-and-MSSPs
url: https://thehackernews.com/2024/02/new-webinar-5-steps-to-vciso-success.html
content:
2024 will be the year of the vCISO. An incredible 45% of MSPs and MSSPs are&nbsp;planning to start offering&nbsp;vCISO services in 2024. As an MSP/MSSP providing vCISO services, you own the organization’s cybersecurity infrastructure and strategy. But you also need to position yourself as a reliable decision-maker, navigating professional responsibilities, business needs and leadership


feed_id: https://thehackernews.com/2024/02/global-coalition-and-tech-giants-unite.html
title: Global Coalition and Tech Giants Unite Against Commercial Spyware Abuse
uri: Global-Coalition-and-Tech-Giants-Unite-Against-Commercial-Spyware-Abus
url: https://thehackernews.com/2024/02/global-coalition-and-tech-giants-unite.html
content:
A coalition of dozens of countries, including France, the U.K., and the U.S., along with tech companies such as Google, MDSec, Meta, and Microsoft, have signed a joint agreement to curb the abuse of commercial spyware to commit human rights abuses.
The initiative, dubbed the&nbsp;Pall Mall Process, aims to tackle the proliferation and irresponsible use of commercial cyber intrusion tools by


feed_id: https://thehackernews.com/2024/02/chinese-hackers-exploited-fortigate.html
title: Chinese Hackers Exploited FortiGate Flaw to Breach Dutch Military Network
uri: Chinese-Hackers-Exploited-FortiGate-Flaw-to-Breach-Dutch-Military-Netw
url: https://thehackernews.com/2024/02/chinese-hackers-exploited-fortigate.html
content:
Chinese state-backed hackers broke into a computer network that's used by the Dutch armed forces by targeting Fortinet FortiGate devices.
"This [computer network] was used for unclassified research and development (R&amp;D)," the Dutch Military Intelligence and Security Service (MIVD)&nbsp;said&nbsp;in a statement. "Because this system was self-contained, it did not lead to any damage to the


feed_id: https://thehackernews.com/2024/02/critical-jetbrains-teamcity-on-premises.html
title: Critical JetBrains TeamCity On-Premises Flaw Exposes Servers to Takeover - Patch Now
uri: Critical-JetBrains-TeamCity-On-Premises-Flaw-Exposes-Servers-to-Takeov
url: https://thehackernews.com/2024/02/critical-jetbrains-teamcity-on-premises.html
content:
JetBrains is alerting customers of a critical security flaw in its TeamCity On-Premises continuous integration and continuous deployment (CI/CD) software that could be exploited by threat actors to take over susceptible instances.
The vulnerability, tracked as&nbsp;CVE-2024-23917, carries a CVSS rating of 9.8 out of 10, indicative of its severity.
"The vulnerability may enable an unauthenticated


feed_id: https://thehackernews.com/2024/02/beware-fake-facebook-job-ads-spreading.html
title: Beware: Fake Facebook Job Ads Spreading 'Ov3r_Stealer' to Steal Crypto and Credentials
uri: Beware-Fake-Facebook-Job-Ads-Spreading-Ov3r_Stealer-to-Steal-Crypto
url: https://thehackernews.com/2024/02/beware-fake-facebook-job-ads-spreading.html
content:
Threat actors are leveraging bogus Facebook job advertisements as a lure to trick prospective targets into installing a new Windows-based stealer malware codenamed&nbsp;Ov3r_Stealer.
"This malware is designed to steal credentials and crypto wallets and send those to a Telegram channel that the threat actor monitors," Trustwave SpiderLabs said in a report shared with The Hacker News.
Ov3r_Stealer


feed_id: https://thehackernews.com/2024/02/high-severity-flaws-found-in-azure.html
title: Experts Detail New Flaws in Azure HDInsight Spark, Kafka, and Hadoop Services
uri: Experts-Detail-New-Flaws-in-Azure-HDInsight-Spark-Kafka-and-Hadoop-S
url: https://thehackernews.com/2024/02/high-severity-flaws-found-in-azure.html
content:
Three new security vulnerabilities have been discovered in Azure HDInsight's Apache&nbsp;Hadoop,&nbsp;Kafka, and&nbsp;Spark&nbsp;services that could be exploited to achieve privilege escalation and a regular expression denial-of-service (ReDoS) condition.
"The new vulnerabilities affect any authenticated user of Azure HDInsight services such as Apache Ambari and Apache Oozie," Orca security


feed_id: https://thehackernews.com/2024/02/how-10b-enterprise-customer-drastically.html
uri: How-a-10B-Enterprise-Customer-Drastically-Increased-their-SaaS-Securi
url: https://thehackernews.com/2024/02/how-10b-enterprise-customer-drastically.html
title:
How a $10B Enterprise Customer Drastically Increased their SaaS Security Posture with 201% ROI by Using SSPM

content:
SaaS applications are the darlings of the software world. They enable work from anywhere, facilitate collaboration, and offer a cost-effective alternative to owning the software outright. At the same time, the very features that make SaaS apps so embraced – access from anywhere and collaboration – can also be exploited by threat actors.
Recently, Adaptive Shield commissioned a Total Economic


feed_id: https://thehackernews.com/2024/02/hackers-exploit-job-boards-in-apac.html
title: Hackers Exploit Job Boards, Stealing Millions of Resumes and Personal Data
uri: Hackers-Exploit-Job-Boards-Stealing-Millions-of-Resumes-and-Personal
url: https://thehackernews.com/2024/02/hackers-exploit-job-boards-in-apac.html
content:
Employment agencies and retail companies chiefly located in the Asia-Pacific (APAC) region have been targeted by a previously undocumented threat actor known as&nbsp;ResumeLooters&nbsp;since early 2023 with the goal of stealing sensitive data.
Singapore-headquartered Group-IB said the hacking crew's activities are geared towards job search platforms and the theft of resumes, with as many as 65


feed_id: https://thehackernews.com/2024/02/recently-disclosed-ssrf-flaw-in-ivanti.html
title: Recent SSRF Flaw in Ivanti VPN Products Undergoes Mass Exploitation
uri: Recent-SSRF-Flaw-in-Ivanti-VPN-Products-Undergoes-Mass-Exploitation
url: https://thehackernews.com/2024/02/recently-disclosed-ssrf-flaw-in-ivanti.html
content:
A recently disclosed server-side request forgery (SSRF) vulnerability impacting Ivanti Connect Secure and Policy Secure products has come under mass exploitation.
The Shadowserver Foundation&nbsp;said&nbsp;it observed exploitation attempts originating from more than 170 unique IP addresses that aim to establish a reverse shell, among others.
The attacks exploit&nbsp;CVE-2024-21893&nbsp;(CVSS


feed_id: https://thehackernews.com/2024/02/microsoft-openai-warn-of-nation-state.html
title: Microsoft, OpenAI Warn of Nation-State Hackers Weaponizing AI for Cyberattacks
uri: Microsoft-OpenAI-Warn-of-Nation-State-Hackers-Weaponizing-AI-for-Cybe
url: https://thehackernews.com/2024/02/microsoft-openai-warn-of-nation-state.html
content:
Nation-state actors associated with Russia, North Korea, Iran, and China are experimenting with artificial intelligence (AI) and large language models (LLMs) to complement their ongoing cyber attack operations.
The findings come from a report published by Microsoft in collaboration with OpenAI, both of which&nbsp;said&nbsp;they disrupted efforts made by five state-affiliated actors that used its


feed_id: https://thehackernews.com/2024/02/ubuntu-command-not-found-tool-could.html
title: Ubuntu 'command-not-found' Tool Could Trick Users into Installing Rogue Packages
uri: Ubuntu-command-not-found-Tool-Could-Trick-Users-into-Installing-Rogu
url: https://thehackernews.com/2024/02/ubuntu-command-not-found-tool-could.html
content:
Cybersecurity researchers have found that it's possible for threat actors to exploit a well-known utility called command-not-found to recommend their own rogue packages and compromise systems running Ubuntu operating system.
"While 'command-not-found' serves as a convenient tool for suggesting installations for uninstalled commands, it can be inadvertently manipulated by attackers through the


feed_id: https://thehackernews.com/2024/02/cybersecurity-tactics-finserv.html
title: Cybersecurity Tactics FinServ Institutions Can Bank On in 2024
uri: Cybersecurity-Tactics-FinServ-Institutions-Can-Bank-On-in-2024
url: https://thehackernews.com/2024/02/cybersecurity-tactics-finserv.html
content:
The landscape of cybersecurity in financial services is undergoing a rapid transformation. Cybercriminals are exploiting advanced technologies and methodologies, making traditional security measures obsolete. The challenges are compounded for community banks that must safeguard sensitive financial data against the same level of sophisticated threats as larger institutions, but often with more


feed_id: https://thehackernews.com/2024/02/bumblebee-malware-returns-with-new.html
title: Bumblebee Malware Returns with New Tricks, Targeting U.S. Businesses
uri: Bumblebee-Malware-Returns-with-New-Tricks-Targeting-U-S-Businesses
url: https://thehackernews.com/2024/02/bumblebee-malware-returns-with-new.html
content:
The infamous malware loader and initial access broker known as&nbsp;Bumblebee&nbsp;has resurfaced after a four-month absence as part of a new phishing campaign observed in February 2024.
Enterprise security firm Proofpoint said the activity targets organizations in the U.S. with voicemail-themed lures containing links to OneDrive URLs.
"The URLs led to a Word file with names such as "


feed_id: https://thehackernews.com/2024/02/darkme-malware-targets-traders-using.html
title: DarkMe Malware Targets Traders Using Microsoft SmartScreen Zero-Day Vulnerability
uri: DarkMe-Malware-Targets-Traders-Using-Microsoft-SmartScreen-Zero-Day-Vu
url: https://thehackernews.com/2024/02/darkme-malware-targets-traders-using.html
content:
A newly disclosed security flaw in the Microsoft Defender SmartScreen has been exploited as a zero-day by an advanced persistent threat actor called&nbsp;Water Hydra&nbsp;(aka DarkCasino) targeting financial market traders.
Trend Micro, which began tracking the campaign in late December 2023, said it entails the exploitation of CVE-2024-21412, a security bypass vulnerability related to Internet


feed_id: https://thehackernews.com/2024/02/microsoft-rolls-out-patches-for-73.html
title: Microsoft Rolls Out Patches for 73 Flaws, Including 2 Windows Zero-Days
uri: Microsoft-Rolls-Out-Patches-for-73-Flaws-Including-2-Windows-Zero-Day
url: https://thehackernews.com/2024/02/microsoft-rolls-out-patches-for-73.html
content:
Microsoft has released patches to address&nbsp;73 security flaws&nbsp;spanning its software lineup as part of its Patch Tuesday updates for February 2024, including two zero-days that have come under active exploitation.
Of the 73 vulnerabilities, 5 are rated Critical, 65 are rated Important, and three and rated Moderate in severity. This is in addition to&nbsp;24 flaws&nbsp;that have been fixed


feed_id: https://thehackernews.com/2024/02/russian-turla-hackers-target-polish.html
title: Russian Turla Hackers Target Polish NGOs with New TinyTurla-NG Backdoor
uri: Russian-Turla-Hackers-Target-Polish-NGOs-with-New-TinyTurla-NG-Backdoo
url: https://thehackernews.com/2024/02/russian-turla-hackers-target-polish.html
content:
The Russia-linked threat actor known as Turla has been observed using a new backdoor called&nbsp;TinyTurla-NG&nbsp;as part of a three-month-long campaign targeting Polish non-governmental organizations in December 2023.
"TinyTurla-NG, just like TinyTurla, is a small 'last chance' backdoor that is left behind to be used when all other unauthorized access/backdoor mechanisms have failed or been


feed_id: https://thehackernews.com/2024/02/ivanti-pulse-secure-found-using-11-year.html
title: Ivanti Pulse Secure Found Using 11-Year-Old Linux Version and Outdated Libraries
uri: Ivanti-Pulse-Secure-Found-Using-11-Year-Old-Linux-Version-and-Outdated
url: https://thehackernews.com/2024/02/ivanti-pulse-secure-found-using-11-year.html
content:
A reverse engineering of the firmware running on Ivanti Pulse Secure appliances has revealed numerous weaknesses, once again underscoring the challenge of securing software supply chains.
Eclypsiusm, which acquired firmware version 9.1.18.2-24467.1 as part of the process, said the base operating system used by the Utah-based software company for the device is CentOS 6.4.
"Pulse Secure runs an


feed_id: https://thehackernews.com/2024/02/how-nation-state-actors-target-your.html
title: How Nation-State Actors Target Your Business: New Research Exposes Major SaaS Vulnerabilities
uri: How-Nation-State-Actors-Target-Your-Business-New-Research-Exposes-Maj
url: https://thehackernews.com/2024/02/how-nation-state-actors-target-your.html
content:
With many of the highly publicized 2023 cyber attacks revolving around one or more SaaS applications, SaaS has become a cause for genuine concern in many boardroom discussions. More so than ever, considering that GenAI applications are, in fact, SaaS applications.
Wing Security (Wing), a SaaS security company, conducted an analysis of 493 SaaS-using companies in Q4 of 2023.&nbsp;Their study


feed_id: https://thehackernews.com/2024/02/chinese-hackers-using-deepfakes-in.html
title: Chinese Hackers Using Deepfakes in Advanced Mobile Banking Malware Attacks
uri: Chinese-Hackers-Using-Deepfakes-in-Advanced-Mobile-Banking-Malware-Att
url: https://thehackernews.com/2024/02/chinese-hackers-using-deepfakes-in.html
content:
A Chinese-speaking threat actor codenamed&nbsp;GoldFactory&nbsp;has been attributed to the development of highly sophisticated banking trojans, including a previously undocumented iOS malware called GoldPickaxe that's capable of harvesting identity documents, facial recognition data, and intercepting SMS.
"The GoldPickaxe family is available for both iOS and Android platforms,"


feed_id: https://thehackernews.com/2024/02/critical-exchange-server-flaw-cve-2024.html
title: Critical Exchange Server Flaw (CVE-2024-21410) Under Active Exploitation
uri: Critical-Exchange-Server-Flaw-(CVE-2024-21410)-Under-Active-Exploitati
url: https://thehackernews.com/2024/02/critical-exchange-server-flaw-cve-2024.html
content:
Microsoft on Wednesday acknowledged that a newly disclosed critical security flaw in Exchange Server has been actively exploited in the wild, a day after it released fixes for the vulnerability as part of its&nbsp;Patch Tuesday updates.
Tracked as&nbsp;CVE-2024-21410&nbsp;(CVSS score: 9.8), the issue has been described as a case of privilege escalation impacting the Exchange Server.
"An attacker


feed_id: https://thehackernews.com/2024/02/dormant-pypi-package-compromised-to.html
title: Dormant PyPI Package Compromised to Spread Nova Sentinel Malware
uri: Dormant-PyPI-Package-Compromised-to-Spread-Nova-Sentinel-Malware
url: https://thehackernews.com/2024/02/dormant-pypi-package-compromised-to.html
content:
A dormant package available on the Python Package Index (PyPI) repository was updated nearly after two years to propagate an information stealer malware called Nova Sentinel.
The package, named&nbsp;django-log-tracker, was first published to PyPI in April 2022, according to software supply chain security firm Phylum, which&nbsp;detected&nbsp;an anomalous update to the library on February 21,


feed_id: https://thehackernews.com/2024/02/microsoft-releases-pyrit-red-teaming.html
title: Microsoft Releases PyRIT - A Red Teaming Tool for Generative AI
uri: Microsoft-Releases-PyRIT-A-Red-Teaming-Tool-for-Generative-AI
url: https://thehackernews.com/2024/02/microsoft-releases-pyrit-red-teaming.html
content:
Microsoft has released an open access automation framework called&nbsp;PyRIT&nbsp;(short for Python Risk Identification Tool) to proactively identify risks in generative artificial intelligence (AI) systems.
The red teaming tool is designed to "enable every organization across the globe to innovate responsibly with the latest artificial intelligence advances," Ram Shankar Siva Kumar, AI red team


feed_id: https://thehackernews.com/2024/02/how-to-use-tiness-soc-automation.html
title: How to Use Tines's SOC Automation Capability Matrix
uri: How-to-Use-Tines-s-SOC-Automation-Capability-Matrix
url: https://thehackernews.com/2024/02/how-to-use-tiness-soc-automation.html
content:
Created by John Tuckner and the team at workflow and automation platform&nbsp;Tines, the&nbsp;SOC Automation Capability Matrix (SOC ACM)&nbsp;is a set of techniques designed to help security operations teams understand their automation capabilities and respond more effectively to incidents.&nbsp;
A customizable, vendor-agnostic tool featuring lists of automation opportunities, it's been shared


feed_id: https://thehackernews.com/2024/02/researchers-detail-apples-recent-zero.html
title: Researchers Detail Apple's Recent Zero-Click Shortcuts Vulnerability
uri: Researchers-Detail-Apple-s-Recent-Zero-Click-Shortcuts-Vulnerability
url: https://thehackernews.com/2024/02/researchers-detail-apples-recent-zero.html
content:
Details have emerged about a now-patched high-severity security flaw in Apple's Shortcuts app that could permit a shortcut to access sensitive information on the device without users' consent.
The vulnerability, tracked as&nbsp;CVE-2024-23204&nbsp;(CVSS score: 7.5), was addressed by Apple on January 22, 2024, with the release of&nbsp;iOS 17.3, iPadOS 17.3,&nbsp;macOS Sonoma 14.3, and&nbsp;


feed_id: https://thehackernews.com/2024/02/ftc-slams-avast-with-165-million-fine.html
title: FTC Slams Avast with $16.5 Million Fine for Selling Users' Browsing Data
uri: FTC-Slams-Avast-with-16-5-Million-Fine-for-Selling-Users-Browsing-Da
url: https://thehackernews.com/2024/02/ftc-slams-avast-with-165-million-fine.html
content:
The U.S. Federal Trade Commission (FTC) has hit antivirus vendor Avast with a $16.5 million fine over charges that the firm sold users' browsing data to advertisers after claiming its products would block online tracking.
In addition, the company has been banned from selling or licensing any web browsing data for advertising purposes. It will also have to notify users whose browsing data was


feed_id: https://thehackernews.com/2024/02/apple-unveils-pq3-protocol-post-quantum.html
title: Apple Unveils PQ3 Protocol - Post-Quantum Encryption for iMessage
uri: Apple-Unveils-PQ3-Protocol-Post-Quantum-Encryption-for-iMessage
url: https://thehackernews.com/2024/02/apple-unveils-pq3-protocol-post-quantum.html
content:
Apple has announced a new post-quantum cryptographic protocol called&nbsp;PQ3&nbsp;that it said will be integrated into iMessage to secure the messaging platform against future attacks arising from the threat of a practical quantum computer.
"With compromise-resilient encryption and extensive defenses against even highly sophisticated quantum attacks, PQ3 is the first messaging protocol to reach


feed_id: https://thehackernews.com/2024/02/cybercriminals-weaponizing-open-source.html
title: Cybercriminals Weaponizing Open-Source SSH-Snake Tool for Network Attacks
uri: Cybercriminals-Weaponizing-Open-Source-SSH-Snake-Tool-for-Network-Atta
url: https://thehackernews.com/2024/02/cybercriminals-weaponizing-open-source.html
content:
A recently open-sourced network mapping tool called&nbsp;SSH-Snake&nbsp;has been repurposed by threat actors to conduct malicious activities.
"SSH-Snake is a self-modifying worm that leverages SSH credentials discovered on a compromised system to start spreading itself throughout the network," Sysdig researcher Miguel Hernández&nbsp;said.
"The worm automatically searches through known credential


feed_id: https://thehackernews.com/2024/02/a-new-age-of-hacktivism.html
title: A New Age of Hacktivism
uri: A-New-Age-of-Hacktivism
url: https://thehackernews.com/2024/02/a-new-age-of-hacktivism.html
content:
In the past 2 years, we have observed a significant surge in hacktivism activity due to ongoing wars and geopolitical conflicts in various regions. Since the war against Ukraine began, we have witnessed a notable mobilization of non-state and state-backed actors alike, forming new groups or joining existing hacker collectives.&nbsp;
We understand hacktivism as a form of computer hacking that is


feed_id: https://thehackernews.com/2024/02/russian-government-software-backdoored.html
title: Russian Government Software Backdoored to Deploy Konni RAT Malware
uri: Russian-Government-Software-Backdoored-to-Deploy-Konni-RAT-Malware
url: https://thehackernews.com/2024/02/russian-government-software-backdoored.html
content:
An installer for a tool likely used by the Russian Consular Department of the Ministry of Foreign Affairs (MID) has been backdoored to deliver a remote access trojan called&nbsp;Konni RAT&nbsp;(aka&nbsp;UpDog).
The findings come from German cybersecurity company DCSO, which linked the activity as originating from the Democratic People's Republic of Korea (DPRK)-nexus actors targeting Russia.
The


feed_id: https://thehackernews.com/2024/02/us-offers-15-million-bounty-to-hunt.html
title: U.S. Offers $15 Million Bounty to Hunt Down LockBit Ransomware Leaders
uri: U-S-Offers-15-Million-Bounty-to-Hunt-Down-LockBit-Ransomware-Leaders
url: https://thehackernews.com/2024/02/us-offers-15-million-bounty-to-hunt.html
content:
The U.S. State Department has announced monetary rewards of up to $15 million for information that could lead to the identification of key leaders within the LockBit ransomware group and the arrest of any individual participating in the operation.
"Since January 2020, LockBit actors have executed over 2,000 attacks against victims in the United States, and around the world, causing costly


feed_id: https://thehackernews.com/2024/02/new-wi-fi-vulnerabilities-expose.html
title: New Wi-Fi Vulnerabilities Expose Android and Linux Devices to Hackers
uri: New-Wi-Fi-Vulnerabilities-Expose-Android-and-Linux-Devices-to-Hackers
url: https://thehackernews.com/2024/02/new-wi-fi-vulnerabilities-expose.html
content:
Cybersecurity researchers have identified two authentication bypass flaws in open-source Wi-Fi software found in Android, Linux, and ChromeOS devices that could trick users into joining a malicious clone of a legitimate network or allow an attacker to join a trusted network without a password.
The vulnerabilities, tracked as CVE-2023-52160 and CVE-2023-52161, have been discovered following a


feed_id: https://thehackernews.com/2024/02/mustang-panda-targets-asia-with.html
title: Mustang Panda Targets Asia with Advanced PlugX Variant DOPLUGS
uri: Mustang-Panda-Targets-Asia-with-Advanced-PlugX-Variant-DOPLUGS
url: https://thehackernews.com/2024/02/mustang-panda-targets-asia-with.html
content:
The China-linked threat actor known as Mustang Panda has targeted various Asian countries using a variant of the PlugX (aka Korplug) backdoor dubbed DOPLUGS.
"The piece of customized PlugX malware is dissimilar to the general type of the PlugX malware that contains a completed backdoor command module, and that the former is only used for downloading the latter," Trend Micro researchers Sunny Lu


feed_id: https://thehackernews.com/2024/02/6-ways-to-simplify-saas-identity.html
title: 6 Ways to Simplify SaaS Identity Governance
uri: 6-Ways-to-Simplify-SaaS-Identity-Governance
url: https://thehackernews.com/2024/02/6-ways-to-simplify-saas-identity.html
content:
With SaaS applications now making up the vast majority of technology used by employees in most organizations, tasks related to identity governance need to happen across a myriad of individual SaaS apps. This presents a huge challenge for centralized IT teams who are ultimately held responsible for managing and securing app access, but can’t possibly become experts in the nuances of the native


feed_id: https://thehackernews.com/2024/02/new-vietcredcare-stealer-targeting.html
title: New 'VietCredCare' Stealer Targeting Facebook Advertisers in Vietnam
uri: New-VietCredCare-Stealer-Targeting-Facebook-Advertisers-in-Vietnam
url: https://thehackernews.com/2024/02/new-vietcredcare-stealer-targeting.html
content:
Facebook advertisers in Vietnam are the target of a previously unknown information stealer dubbed&nbsp;VietCredCare&nbsp;at least since August 2022.
The malware is “notable for its ability to automatically filter out Facebook session cookies and credentials stolen from compromised devices, and assess whether these accounts manage business profiles and if they maintain a positive Meta ad credit


feed_id: https://thehackernews.com/2024/02/cybersecurity-for-healthcarediagnosing.html
title: Cybersecurity for Healthcare—Diagnosing the Threat Landscape and Prescribing Solutions for Recovery
uri: Cybersecurity-for-Healthcare-Diagnosing-the-Threat-Landscape-and-Pre
url: https://thehackernews.com/2024/02/cybersecurity-for-healthcarediagnosing.html
content:
On Thanksgiving Day 2023, while many Americans were celebrating, hospitals across the U.S. were doing quite the opposite. Systems were failing. Ambulances were diverted. Care was impaired. Hospitals in three states were&nbsp;hit by a ransomware attack, and in that moment, the real-world repercussions came to light—it wasn’t just computer networks that were brought to a halt, but actual patient


feed_id: https://thehackernews.com/2024/02/signal-introduces-usernames-allowing.html
title: Signal Introduces Usernames, Allowing Users to Keep Their Phone Numbers Private
uri: Signal-Introduces-Usernames-Allowing-Users-to-Keep-Their-Phone-Number
url: https://thehackernews.com/2024/02/signal-introduces-usernames-allowing.html
content:
End-to-end encrypted (E2EE) messaging app Signal said it’s piloting a new feature that allows users to create unique usernames (not to be confused with profile names) and keep the phone numbers away from prying eyes.
“If you use Signal, your phone number will no longer be visible to everyone you chat with by default,” Signal’s Randall Sarafa&nbsp;said. “People who have your number saved in their


feed_id: https://thehackernews.com/2024/02/russian-hackers-target-ukraine-with.html
title: Russian Hackers Target Ukraine with Disinformation and Credential-Harvesting Attacks
uri: Russian-Hackers-Target-Ukraine-with-Disinformation-and-Credential-Harv
url: https://thehackernews.com/2024/02/russian-hackers-target-ukraine-with.html
content:
Cybersecurity researchers have unearthed a new influence operation targeting Ukraine that leverages spam emails to propagate war-related disinformation.
The activity has been linked to Russia-aligned threat actors by Slovak cybersecurity company ESET, which also identified a spear-phishing campaign aimed at a Ukrainian defense company in October 2023 and a European Union agency in November 2023


feed_id: https://thehackernews.com/2024/02/vmware-alert-uninstall-eap-now-critical.html
title: VMware Alert: Uninstall EAP Now - Critical Flaw Puts Active Directory at Risk
uri: VMware-Alert-Uninstall-EAP-Now-Critical-Flaw-Puts-Active-Directory
url: https://thehackernews.com/2024/02/vmware-alert-uninstall-eap-now-critical.html
content:
VMware is urging users to uninstall the deprecated Enhanced Authentication Plugin (EAP) following the discovery of a critical security flaw.
Tracked as&nbsp;CVE-2024-22245&nbsp;(CVSS score: 9.6), the vulnerability has been described as an arbitrary authentication relay bug.
"A malicious actor could trick a target domain user with EAP installed in their web browser into requesting and relaying


feed_id: https://thehackernews.com/2024/02/new-migo-malware-targeting-redis.html
title: New Migo Malware Targeting Redis Servers for Cryptocurrency Mining
uri: New-Migo-Malware-Targeting-Redis-Servers-for-Cryptocurrency-Mining
url: https://thehackernews.com/2024/02/new-migo-malware-targeting-redis.html
content:
A novel malware campaign has been observed targeting Redis servers for initial access with the ultimate goal of mining cryptocurrency on compromised Linux hosts.
"This particular campaign involves the use of a number of novel system weakening techniques against the data store itself," Cado security researcher Matt Muir&nbsp;said&nbsp;in a technical report.
The cryptojacking attack is facilitated


feed_id: https://thehackernews.com/2024/02/lockbit-ransomware-operation-shut-down.html
title: LockBit Ransomware Operation Shut Down; Criminals Arrested; Decryption Keys Released
uri: LockBit-Ransomware-Operation-Shut-Down-Criminals-Arrested-Decryption
url: https://thehackernews.com/2024/02/lockbit-ransomware-operation-shut-down.html
content:
The U.K. National Crime Agency (NCA) on Tuesday confirmed that it obtained LockBit's source code as well as a wealth of intelligence pertaining to its activities and their affiliates as part of a dedicated task force called&nbsp;Operation Cronos.
"Some of the data on LockBit's systems belonged to victims who had paid a ransom to the threat actors, evidencing that even when a ransom is paid, it


feed_id: https://thehackernews.com/2024/02/new-malicious-pypi-packages-caught.html
title: New Malicious PyPI Packages Caught Using Covert Side-Loading Tactics
uri: New-Malicious-PyPI-Packages-Caught-Using-Covert-Side-Loading-Tactics
url: https://thehackernews.com/2024/02/new-malicious-pypi-packages-caught.html
content:
Cybersecurity researchers have discovered two malicious packages on the Python Package Index (PyPI) repository that were found leveraging a technique called&nbsp;DLL side-loading&nbsp;to circumvent detection by security software and run malicious code.
The packages, named&nbsp;NP6HelperHttptest&nbsp;and&nbsp;NP6HelperHttper, were each downloaded&nbsp;537&nbsp;and&nbsp;166 times, respectively,


feed_id: https://thehackernews.com/2024/02/new-report-reveals-north-korean-hackers.html
title: New Report Reveals North Korean Hackers Targeting Defense Firms Worldwide
uri: New-Report-Reveals-North-Korean-Hackers-Targeting-Defense-Firms-Worldw
url: https://thehackernews.com/2024/02/new-report-reveals-north-korean-hackers.html
content:
North Korean state-sponsored threat actors have been attributed to a cyber espionage campaign targeting the defense sector across the world.
In a joint advisory published by Germany's Federal Office for the Protection of the Constitution (BfV) and South Korea's National Intelligence Service (NIS), the agencies said the goal of the attacks is to plunder advanced defense technologies in a "


feed_id: https://thehackernews.com/2024/02/saas-compliance-through-nist.html
title: SaaS Compliance through the NIST Cybersecurity Framework
uri: SaaS-Compliance-through-the-NIST-Cybersecurity-Framework
url: https://thehackernews.com/2024/02/saas-compliance-through-nist.html
content:
The US National Institute of Standards and Technology (NIST) cybersecurity framework is one of the world's most important guidelines for securing networks. It can be applied to any number of applications, including SaaS.&nbsp;
One of the challenges facing those tasked with securing SaaS applications is the different settings found in each application. It makes it difficult to develop a


feed_id: https://thehackernews.com/2024/02/learn-how-to-build-incident-response.html
title: Learn How to Build an Incident Response Playbook Against Scattered Spider in Real-Time
uri: Learn-How-to-Build-an-Incident-Response-Playbook-Against-Scattered-Spi
url: https://thehackernews.com/2024/02/learn-how-to-build-incident-response.html
content:
In the tumultuous landscape of cybersecurity, the year 2023 left an indelible mark with the brazen exploits of the Scattered Spider threat group. Their attacks targeted the nerve centers of major financial and insurance institutions, culminating in what stands as one of the most impactful ransomware assaults in recent memory.&nbsp;
When organizations have no response plan in place for such an


feed_id: https://thehackernews.com/2024/02/critical-flaws-found-in-connectwise.html
title: Critical Flaws Found in ConnectWise ScreenConnect Software - Patch Now
uri: Critical-Flaws-Found-in-ConnectWise-ScreenConnect-Software-Patch-No
url: https://thehackernews.com/2024/02/critical-flaws-found-in-connectwise.html
content:
ConnectWise has released software updates to address two security flaws in its ScreenConnect remote desktop and access software, including a critical bug that could enable remote code execution on affected systems.
The vulnerabilities are listed below -

CVE-2024-1708 (CVSS score: 8.4) - Improper limitation of a pathname to a restricted directory aka "path traversal"
CVE-2024-1709 (CVSS score:


feed_id: https://thehackernews.com/2024/02/wordpress-bricks-theme-under-active.html
title: WordPress Bricks Theme Under Active Attack: Critical Flaw Impacts 25,000+ Sites
uri: WordPress-Bricks-Theme-Under-Active-Attack-Critical-Flaw-Impacts-25-0
url: https://thehackernews.com/2024/02/wordpress-bricks-theme-under-active.html
content:
A critical security flaw in the Bricks theme for WordPress is being actively exploited by threat actors to run arbitrary PHP code on susceptible installations.
The flaw, tracked as CVE-2024-25600 (CVSS score: 9.8), enables unauthenticated attackers to achieve remote code execution. It impacts all versions of the Bricks up to and including 1.9.6.
It has been addressed by the theme developers in&


feed_id: https://thehackernews.com/2024/02/iran-and-hezbollah-hackers-launch.html
title: Iran and Hezbollah Hackers Launch Attacks to Influence Israel-Hamas Narrative
uri: Iran-and-Hezbollah-Hackers-Launch-Attacks-to-Influence-Israel-Hamas-Na
url: https://thehackernews.com/2024/02/iran-and-hezbollah-hackers-launch.html
content:
Hackers backed by Iran and Hezbollah staged cyber attacks designed to undercut public support for the Israel-Hamas war after October 2023.
This includes destructive attacks against key Israeli organizations, hack-and-leak operations targeting entities in Israel and the U.S., phishing campaigns designed to steal intelligence, and information operations to turn public opinion against Israel.
Iran


feed_id: https://thehackernews.com/2024/02/lockbit-ransomwares-darknet-domains.html
title: LockBit Ransomware's Darknet Domains Seized in Global Law Enforcement Raid
uri: LockBit-Ransomware-s-Darknet-Domains-Seized-in-Global-Law-Enforcement
url: https://thehackernews.com/2024/02/lockbit-ransomwares-darknet-domains.html
content:
Update: The U.K. National Crime Agency (NCA) has confirmed the takedown of LockBit infrastructure. Read here for more details.An international law enforcement operation has led to the seizure of multiple darknet domains operated by&nbsp;LockBit, one of the most prolific ransomware groups, marking the latest in a long list of digital takedowns.
While the full extent of the effort, codenamed&nbsp;


feed_id: https://thehackernews.com/2024/02/meta-warns-of-8-spyware-firms-targeting.html
title: Meta Warns of 8 Spyware Firms Targeting iOS, Android, and Windows Devices
uri: Meta-Warns-of-8-Spyware-Firms-Targeting-iOS-Android-and-Windows-Devi
url: https://thehackernews.com/2024/02/meta-warns-of-8-spyware-firms-targeting.html
content:
Meta Platforms said it took a series of steps to curtail malicious activity from eight different firms based in Italy, Spain, and the United Arab Emirates (U.A.E.) operating in the surveillance-for-hire industry.
The findings are part of its&nbsp;Adversarial Threat Report&nbsp;for the fourth quarter of 2023. The spyware targeted iOS, Android, and Windows devices.
"Their various malware included


feed_id: https://thehackernews.com/2024/02/bye-bye-siem-hello-risk-based-alerting.html
title: How to Achieve the Best Risk-Based Alerting (Bye-Bye SIEM)
uri: How-to-Achieve-the-Best-Risk-Based-Alerting-(Bye-Bye-SIEM)
url: https://thehackernews.com/2024/02/bye-bye-siem-hello-risk-based-alerting.html
content:
Did you know that Network Detection and Response (NDR) has become the most effective technology to detect cyber threats? In contrast to SIEM, NDR offers adaptive cybersecurity with reduced false alerts and efficient threat response.
Are you aware of&nbsp;Network Detection and Response (NDR)&nbsp;and how it’s become the most effective technology to detect cyber threats?&nbsp;
NDR massively


feed_id: https://thehackernews.com/2024/02/anatsa-android-trojan-bypasses-google.html
title: Anatsa Android Trojan Bypasses Google Play Security, Expands Reach to New Countries
uri: Anatsa-Android-Trojan-Bypasses-Google-Play-Security-Expands-Reach-to
url: https://thehackernews.com/2024/02/anatsa-android-trojan-bypasses-google.html
content:
The Android banking trojan known as&nbsp;Anatsa&nbsp;has expanded its focus to include Slovakia, Slovenia, and Czechia as part of a new campaign observed in November 2023.
"Some of the droppers in the campaign successfully exploited the accessibility service, despite Google Play's enhanced detection and protection mechanisms," ThreatFabric&nbsp;said&nbsp;in a report shared with The Hacker News.


feed_id: https://thehackernews.com/2024/02/russian-linked-hackers-breach-80.html
title: Russian-Linked Hackers Target 80+ Organizations via Roundcube Flaws
uri: Russian-Linked-Hackers-Target-80-Organizations-via-Roundcube-Flaws
url: https://thehackernews.com/2024/02/russian-linked-hackers-breach-80.html
content:
Threat actors operating with interests aligned to Belarus and Russia have been linked to a new cyber espionage campaign that likely exploited cross-site scripting (XSS) vulnerabilities in Roundcube webmail servers to target over 80 organizations.
These entities are primarily located in Georgia, Poland, and Ukraine, according to Recorded Future, which attributed the intrusion set to a threat


feed_id: https://thehackernews.com/2024/02/iranian-hackers-target-middle-east.html
title: Iranian Hackers Target Middle East Policy Experts with New BASICSTAR Backdoor
uri: Iranian-Hackers-Target-Middle-East-Policy-Experts-with-New-BASICSTAR-B
url: https://thehackernews.com/2024/02/iranian-hackers-target-middle-east.html
content:
The Iranian-origin threat actor known as Charming Kitten has been linked to a new set of attacks aimed at Middle East policy experts with a new backdoor called&nbsp;BASICSTAR&nbsp;by creating a fake webinar portal.
Charming Kitten, also called APT35, CharmingCypress, Mint Sandstorm, TA453, and Yellow Garuda, has a history of orchestrating a wide range of social engineering campaigns that cast a


feed_id: https://thehackernews.com/2024/02/fbis-most-wanted-zeus-and-icedid.html
title: FBI's Most-Wanted Zeus and IcedID Malware Mastermind Pleads Guilty
uri: FBI-s-Most-Wanted-Zeus-and-IcedID-Malware-Mastermind-Pleads-Guilty
url: https://thehackernews.com/2024/02/fbis-most-wanted-zeus-and-icedid.html
content:
A Ukrainian national has pleaded guilty in the U.S. to his role in two different malware schemes, Zeus and IcedID, between May 2009 and February 2021.
Vyacheslav Igorevich Penchukov (aka Vyacheslav Igoravich Andreev, father, and tank), 37, was&nbsp;arrested&nbsp;by Swiss authorities in October 2022 and extradited to the U.S. last year. He was added to the FBI's most-wanted list in 2012.
The U.S.


feed_id: https://thehackernews.com/2024/02/how-businesses-can-safeguard-their.html
title: How Businesses Can Safeguard Their Communication Channels Against Hackers
uri: How-Businesses-Can-Safeguard-Their-Communication-Channels-Against-Hack
url: https://thehackernews.com/2024/02/how-businesses-can-safeguard-their.html
content:
Efficient communication is a cornerstone of business success. Internally, making sure your team communicates seamlessly helps you avoid friction losses, misunderstandings, delays, and overlaps. Externally, frustration-free customer communication is directly correlated to a positive customer experience and higher satisfaction.&nbsp;
However, business communication channels are also a major target


feed_id: https://thehackernews.com/2024/02/google-open-sources-magika-ai-powered.html
title: Google Open Sources Magika: AI-Powered File Identification Tool
uri: Google-Open-Sources-Magika-AI-Powered-File-Identification-Tool
url: https://thehackernews.com/2024/02/google-open-sources-magika-ai-powered.html
content:
Google has announced that it's open-sourcing&nbsp;Magika, an artificial intelligence (AI)-powered tool to identify file types, to help defenders accurately detect binary and textual file types.
"Magika outperforms conventional file identification methods providing an overall 30% accuracy boost and up to 95% higher precision on traditionally hard to identify, but potentially problematic content


feed_id: https://thehackernews.com/2024/02/cisa-warning-akira-ransomware.html
title: CISA Warning: Akira Ransomware Exploiting Cisco ASA/FTD Vulnerability
uri: CISA-Warning-Akira-Ransomware-Exploiting-Cisco-ASA-FTD-Vulnerability
url: https://thehackernews.com/2024/02/cisa-warning-akira-ransomware.html
content:
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday&nbsp;added&nbsp;a now-patched security flaw impacting Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) software to its Known Exploited Vulnerabilities (KEV) catalog, following reports that it's being likely exploited in Akira ransomware attacks.
The vulnerability in question is&nbsp;


feed_id: https://thehackernews.com/2024/02/rustdoor-macos-backdoor-targets.html
title: RustDoor macOS Backdoor Targets Cryptocurrency Firms with Fake Job Offers
uri: RustDoor-macOS-Backdoor-Targets-Cryptocurrency-Firms-with-Fake-Job-Off
url: https://thehackernews.com/2024/02/rustdoor-macos-backdoor-targets.html
content:
Multiple companies operating in the cryptocurrency sector are the target of an ongoing malware campaign that involves a newly discovered Apple macOS backdoor codenamed RustDoor.
RustDoor was&nbsp;first documented&nbsp;by Bitdefender last week, describing it as a Rust-based malware capable of harvesting and uploading files, as well as gathering information about the infected machines. It's


feed_id: https://thehackernews.com/2024/02/why-we-must-democratize-cybersecurity.html
title: Why We Must Democratize Cybersecurity
uri: Why-We-Must-Democratize-Cybersecurity
url: https://thehackernews.com/2024/02/why-we-must-democratize-cybersecurity.html
content:
With breaches making the headlines on an almost weekly basis, the cybersecurity challenges we face are becoming visible not only to large enterprises, who have built security capabilities over the years, but also to small to medium businesses and the broader public. While this is creating greater awareness among smaller businesses of the need to improve their security posture, SMBs are often


feed_id: https://thehackernews.com/2024/02/malicious-sns-sender-script-abuses-aws.html
title: Malicious 'SNS Sender' Script Abuses AWS for Bulk Smishing Attacks
uri: Malicious-SNS-Sender-Script-Abuses-AWS-for-Bulk-Smishing-Attacks
url: https://thehackernews.com/2024/02/malicious-sns-sender-script-abuses-aws.html
content:
A malicious Python script known as&nbsp;SNS Sender&nbsp;is being advertised as a way for threat actors to send bulk smishing messages by abusing Amazon Web Services (AWS) Simple Notification Service (SNS).
The SMS phishing messages are designed to propagate malicious links that are designed to capture victims' personally identifiable information (PII) and payment card details, SentinelOne&nbsp;


feed_id: https://thehackernews.com/2024/02/us-state-government-network-breached.html
title: U.S. State Government Network Breached via Former Employee's Account
uri: U-S-State-Government-Network-Breached-via-Former-Employee-s-Account
url: https://thehackernews.com/2024/02/us-state-government-network-breached.html
content:
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has revealed that an unnamed state government organization's network environment was compromised via an administrator account belonging to a former employee.
"This allowed the threat actor to successfully authenticate to an internal virtual private network (VPN) access point," the agency&nbsp;said&nbsp;in a joint advisory published


feed_id: https://thehackernews.com/2024/02/us-government-disrupts-russian-linked.html
title: U.S. Government Disrupts Russia-Linked Botnet Engaged in Cyber Espionage
uri: U-S-Government-Disrupts-Russia-Linked-Botnet-Engaged-in-Cyber-Espiona
url: https://thehackernews.com/2024/02/us-government-disrupts-russian-linked.html
content:
The U.S. government on Thursday said it disrupted a botnet comprising hundreds of small office and home office (SOHO) routers in the country that was put to use by the Russia-linked APT28 actor to conceal its malicious activities.
"These crimes included vast spear-phishing and similar credential harvesting campaigns against targets of intelligence interest to the Russian government, such as U.S.


feed_id: https://thehackernews.com/2024/02/chinese-hackers-exploiting-ivanti-vpn.html
title: Chinese Hackers Exploiting Ivanti VPN Flaws to Deploy New Malware
uri: Chinese-Hackers-Exploiting-Ivanti-VPN-Flaws-to-Deploy-New-Malware
url: https://thehackernews.com/2024/02/chinese-hackers-exploiting-ivanti-vpn.html
content:
At least two different suspected China-linked cyber espionage clusters, tracked as&nbsp;UNC5325&nbsp;and&nbsp;UNC3886, have been attributed to the exploitation of security flaws in Ivanti Connect Secure VPN appliances.
UNC5325 abused&nbsp;CVE-2024-21893&nbsp;to deliver a wide range of new malware called LITTLELAMB.WOOLTEA, PITSTOP, PITDOG, PITJET, and PITHOOK, as well as maintain persistent


feed_id: https://thehackernews.com/2024/02/president-biden-blocks-mass-transfer-of.html
title: President Biden Blocks Mass Transfer of Personal Data to High-Risk Nations
uri: President-Biden-Blocks-Mass-Transfer-of-Personal-Data-to-High-Risk-Nat
url: https://thehackernews.com/2024/02/president-biden-blocks-mass-transfer-of.html
content:
U.S. President Joe Biden has&nbsp;issued&nbsp;an Executive Order that prohibits the mass transfer of citizens' personal data to countries of concern.
The Executive Order also "provides safeguards around other activities that can give those countries access to Americans' sensitive data," the White House said in a statement.
This includes sensitive information such as genomic data, biometric data,


feed_id: https://thehackernews.com/2024/02/iran-linked-unc1549-hackers-target.html
title: Iran-Linked UNC1549 Hackers Target Middle East Aerospace & Defense Sectors
uri: Iran-Linked-UNC1549-Hackers-Target-Middle-East-Aerospace-Defense-Sec
url: https://thehackernews.com/2024/02/iran-linked-unc1549-hackers-target.html
content:
An Iran-nexus threat actor known as&nbsp;UNC1549&nbsp;has been attributed with medium confidence to a new set of attacks targeting aerospace, aviation, and defense industries in the Middle East, including Israel and the U.A.E.
Other targets of the cyber espionage activity likely include Turkey, India, and Albania, Google-owned Mandiant said in a new analysis.
UNC1549 is said to overlap with&nbsp


feed_id: https://thehackernews.com/2024/02/fbi-warns-us-healthcare-sector-of.html
title: FBI Warns U.S. Healthcare Sector of Targeted BlackCat Ransomware Attacks
uri: FBI-Warns-U-S-Healthcare-Sector-of-Targeted-BlackCat-Ransomware-Attac
url: https://thehackernews.com/2024/02/fbi-warns-us-healthcare-sector-of.html
content:
The U.S. government is warning about the resurgence of BlackCat (aka ALPHV) ransomware attacks targeting the healthcare sector as recently as this month.
"Since mid-December 2023, of the nearly 70 leaked victims, the healthcare sector has been the most commonly victimized," the government&nbsp;said&nbsp;in an updated advisory.
"This is likely in response to the ALPHV/BlackCat administrator's


feed_id: https://thehackernews.com/2024/02/building-your-privacy-compliant.html
title: Building Your Privacy-Compliant Customer Data Platform (CDP) with First-Party Data
uri: Building-Your-Privacy-Compliant-Customer-Data-Platform-(CDP)-with-Firs
url: https://thehackernews.com/2024/02/building-your-privacy-compliant.html
content:
In today's digital era, data privacy isn't just a concern; it's a consumer demand. Businesses are grappling with the dual challenge of leveraging customer data for personalized experiences while navigating a maze of privacy regulations. The answer? A privacy-compliant Customer Data Platform (CDP).
Join us for a transformative webinar where we unveil Twilio Segment's state-of-the-art CDP.


feed_id: https://thehackernews.com/2024/02/superusers-need-super-protection-how-to.html
uri: Superusers-Need-Super-Protection-How-to-Bridge-Privileged-Access-Mana
url: https://thehackernews.com/2024/02/superusers-need-super-protection-how-to.html
title:
Superusers Need Super Protection: How to Bridge Privileged Access Management and Identity Management

content:
Traditional perimeter-based security has become costly and ineffective. As a result, communications security between people, systems, and networks is more important than blocking access with firewalls.&nbsp;On top of that, most cybersecurity risks are caused by just a few superusers – typically one out of 200 users.&nbsp;There’s a company aiming to fix the gap between traditional PAM and IdM


feed_id: https://thehackernews.com/2024/02/timbrestealer-malware-spreading-via-tax.html
title: TimbreStealer Malware Spreading via Tax-themed Phishing Scam Targets IT Users
uri: TimbreStealer-Malware-Spreading-via-Tax-themed-Phishing-Scam-Targets-I
url: https://thehackernews.com/2024/02/timbrestealer-malware-spreading-via-tax.html
content:
Mexican users have been targeted with tax-themed phishing lures at least since November 2023 to distribute a previously undocumented Windows malware called&nbsp;TimbreStealer.
Cisco Talos, which&nbsp;discovered&nbsp;the activity, described the authors as skilled and that the "threat actor has previously used similar tactics, techniques and procedures (TTPs) to distribute a banking trojan known


feed_id: https://thehackernews.com/2024/02/cybersecurity-agencies-warn-ubiquiti.html
title: Cybersecurity Agencies Warn Ubiquiti EdgeRouter Users of APT28's MooBot Threat
uri: Cybersecurity-Agencies-Warn-Ubiquiti-EdgeRouter-Users-of-APT28-s-MooBo
url: https://thehackernews.com/2024/02/cybersecurity-agencies-warn-ubiquiti.html
content:
In a new joint advisory, cybersecurity and intelligence agencies from the U.S. and other countries are urging users of Ubiquiti EdgeRouter to take protective measures, weeks after a botnet comprising infected routers was&nbsp;felled by law enforcement&nbsp;as part of an operation codenamed Dying Ember.
The botnet, named MooBot, is said to have been used by a Russia-linked threat actor known as


feed_id: https://thehackernews.com/2024/02/wordpress-litespeed-plugin.html
title: WordPress LiteSpeed Plugin Vulnerability Puts 5 Million Sites at Risk
uri: WordPress-LiteSpeed-Plugin-Vulnerability-Puts-5-Million-Sites-at-Risk
url: https://thehackernews.com/2024/02/wordpress-litespeed-plugin.html
content:
A security vulnerability has been disclosed in the LiteSpeed Cache plugin for WordPress that could enable unauthenticated users to escalate their privileges.
Tracked as&nbsp;CVE-2023-40000, the vulnerability was addressed in October 2023 in version 5.7.0.1.
"This plugin suffers from unauthenticated site-wide stored [cross-site scripting] vulnerability and could allow any unauthenticated user


feed_id: https://thehackernews.com/2024/02/open-source-xeno-rat-trojan-emerges-as.html
title: Open-Source Xeno RAT Trojan Emerges as a Potent Threat on GitHub
uri: Open-Source-Xeno-RAT-Trojan-Emerges-as-a-Potent-Threat-on-GitHub
url: https://thehackernews.com/2024/02/open-source-xeno-rat-trojan-emerges-as.html
content:
An "intricately designed" remote access trojan (RAT) called&nbsp;Xeno RAT&nbsp;has been made available on GitHub, making it easily accessible to other actors at no extra cost.
Written in C# and compatible with Windows 10 and Windows 11 operating systems, the open-source RAT comes with a "comprehensive set of features for remote system management," according to its developer, who goes by the name


feed_id: https://thehackernews.com/2024/02/from-alert-to-action-how-to-speed-up.html
title: From Alert to Action: How to Speed Up Your SOC Investigations
uri: From-Alert-to-Action-How-to-Speed-Up-Your-SOC-Investigations
url: https://thehackernews.com/2024/02/from-alert-to-action-how-to-speed-up.html
content:
Processing alerts quickly and efficiently is the cornerstone of a Security Operations Center (SOC) professional's role. Threat intelligence platforms can significantly enhance their ability to do so. Let's find out what these platforms are and how they can empower analysts.
The Challenge: Alert Overload
The modern SOC faces a relentless barrage of security alerts generated by SIEMs and EDRs.


feed_id: https://thehackernews.com/2024/02/five-eyes-agencies-expose-apt29s.html
title: Five Eyes Agencies Expose APT29's Evolving Cloud Attack Tactics
uri: Five-Eyes-Agencies-Expose-APT29-s-Evolving-Cloud-Attack-Tactics
url: https://thehackernews.com/2024/02/five-eyes-agencies-expose-apt29s.html
content:
Cybersecurity and intelligence agencies from the Five Eyes nations have released a joint advisory detailing the evolving tactics of the Russian state-sponsored threat actor known as&nbsp;APT29.
The hacking outfit, also known as BlueBravo, Cloaked Ursa, Cozy Bear, Midnight Blizzard (formerly Nobelium), and The Dukes, is assessed to be affiliated with the Foreign Intelligence Service (SVR) of the


feed_id: https://thehackernews.com/2024/02/new-hugging-face-vulnerability-exposes.html
title: New Hugging Face Vulnerability Exposes AI Models to Supply Chain Attacks
uri: New-Hugging-Face-Vulnerability-Exposes-AI-Models-to-Supply-Chain-Attac
url: https://thehackernews.com/2024/02/new-hugging-face-vulnerability-exposes.html
content:
Cybersecurity researchers have found that it's possible to compromise the Hugging Face Safetensors conversion service to ultimately hijack the models submitted by users and result in supply chain attacks.
"It's possible to send malicious pull requests with attacker-controlled data from the Hugging Face service to any repository on the platform, as well as hijack any models that are submitted


feed_id: https://thehackernews.com/2024/02/wordpress-plugin-alert-critical-sqli.html
title: WordPress Plugin Alert - Critical SQLi Vulnerability Threatens 200K+ Websites
uri: WordPress-Plugin-Alert-Critical-SQLi-Vulnerability-Threatens-200K-W
url: https://thehackernews.com/2024/02/wordpress-plugin-alert-critical-sqli.html
content:
A critical security flaw has been disclosed in a popular WordPress plugin called&nbsp;Ultimate Member&nbsp;that has more than 200,000 active installations.
The vulnerability, tracked as CVE-2024-1071, carries a CVSS score of 9.8 out of a maximum of 10. Security researcher Christiaan Swiers has been credited with discovering and reporting the flaw.
In an advisory published last week, WordPress


feed_id: https://thehackernews.com/2024/02/new-idat-loader-attacks-using.html
title: New IDAT Loader Attacks Using Steganography to Deploy Remcos RAT
uri: New-IDAT-Loader-Attacks-Using-Steganography-to-Deploy-Remcos-RAT
url: https://thehackernews.com/2024/02/new-idat-loader-attacks-using.html
content:
Ukrainian entities based in Finland have been targeted as part of a malicious campaign distributing a commercial remote access trojan known as Remcos RAT using a malware loader called IDAT Loader.
The attack has been attributed to a threat actor tracked by the Computer Emergency Response Team of Ukraine (CERT-UA) under the moniker UAC-0184.
"The attack, as part of the IDAT Loader, used


feed_id: https://thehackernews.com/2024/02/8000-subdomains-of-trusted-brands.html
title: 8,000+ Domains of Trusted Brands Hijacked for Massive Spam Operation
uri: 8-000-Domains-of-Trusted-Brands-Hijacked-for-Massive-Spam-Operation
url: https://thehackernews.com/2024/02/8000-subdomains-of-trusted-brands.html
content:
More than 8,000 domains and 13,000 subdomains belonging to legitimate brands and institutions have been hijacked as part of a sophisticated distribution architecture for spam proliferation and click monetization.
Guardio Labs is tracking the coordinated malicious activity, which has been ongoing since at least September 2022, under the name SubdoMailing. The emails range from "counterfeit


feed_id: https://thehackernews.com/2024/02/north-korean-hackers-targeting.html
title: North Korean Hackers Targeting Developers with Malicious npm Packages
uri: North-Korean-Hackers-Targeting-Developers-with-Malicious-npm-Packages
url: https://thehackernews.com/2024/02/north-korean-hackers-targeting.html
content:
A set of fake npm packages discovered on the Node.js repository has been found to share ties with North Korean state-sponsored actors, new findings from Phylum show.
The packages are named execution-time-async, data-time-utils, login-time-utils, mongodb-connection-utils, and mongodb-execution-utils.
One of the packages in question,&nbsp;execution-time-async, masquerades as its legitimate


feed_id: https://thehackernews.com/2024/02/three-tips-to-protect-your-secrets-from.html
title: Three Tips to Protect Your Secrets from AI Accidents
uri: Three-Tips-to-Protect-Your-Secrets-from-AI-Accidents
url: https://thehackernews.com/2024/02/three-tips-to-protect-your-secrets-from.html
content:
Last year, the Open Worldwide Application Security Project (OWASP) published multiple versions of the "OWASP Top 10 For Large Language Models," reaching a 1.0 document in August and a 1.1 document in October. These documents not only demonstrate the rapidly evolving nature of Large Language Models, but the evolving ways in which they can be attacked and defended. We're going to talk in this


feed_id: https://thehackernews.com/2024/02/banking-trojans-target-latin-america.html
title: Banking Trojans Target Latin America and Europe Through Google Cloud Run
uri: Banking-Trojans-Target-Latin-America-and-Europe-Through-Google-Cloud-R
url: https://thehackernews.com/2024/02/banking-trojans-target-latin-america.html
content:
Cybersecurity researchers are warning about a spike in email phishing campaigns that are weaponizing the Google Cloud Run service to deliver various banking trojans such as&nbsp;Astaroth&nbsp;(aka Guildma),&nbsp;Mekotio, and&nbsp;Ousaban&nbsp;(aka Javali) to targets across Latin America (LATAM) and Europe.
"The infection chains associated with these malware families feature the use of malicious


feed_id: https://thehackernews.com/2024/02/lockbit-ransomware-group-resurfaces.html
title: LockBit Ransomware Group Resurfaces After Law Enforcement Takedown
uri: LockBit-Ransomware-Group-Resurfaces-After-Law-Enforcement-Takedown
url: https://thehackernews.com/2024/02/lockbit-ransomware-group-resurfaces.html
content:
The threat actors behind the LockBit ransomware operation have resurfaced on the dark web using new infrastructure, days after an international law enforcement exercise&nbsp;seized control&nbsp;of its servers.
To that end, the notorious group has moved its data leak portal to a new .onion address on the TOR network, listing 12 new victims as of writing.
The administrator behind LockBit, in a&


feed_id: https://thehackernews.com/2024/02/authorities-claim-lockbit-admin.html
title: Authorities Claim LockBit Admin "LockBitSupp" Has Engaged with Law Enforcement
uri: Authorities-Claim-LockBit-Admin-LockBitSupp-Has-Engaged-with-Law-Enf
url: https://thehackernews.com/2024/02/authorities-claim-lockbit-admin.html
content:
LockBitSupp, the individual(s) behind the persona representing the LockBit ransomware service on cybercrime forums such as Exploit and XSS, "has engaged with law enforcement," authorities said.
The development comes following the&nbsp;takedown&nbsp;of the prolific ransomware-as-a-service (RaaS) operation as part of a coordinated international operation codenamed Cronos. Over 14,000 rogue


feed_id: https://thehackernews.com/2024/02/microsoft-expands-free-logging.html
title: Microsoft Expands Free Logging Capabilities for all U.S. Federal Agencies
uri: Microsoft-Expands-Free-Logging-Capabilities-for-all-U-S-Federal-Agenc
url: https://thehackernews.com/2024/02/microsoft-expands-free-logging.html
content:
Microsoft has expanded free logging capabilities to all U.S. federal agencies using Microsoft Purview Audit irrespective of the license tier, more than six months after a China-linked cyber espionage campaign targeting two dozen organizations came to light.
"Microsoft will automatically enable the logs in customer accounts and increase the default log retention period from 90 days to 180 days,"


feed_id: https://thehackernews.com/2024/03/how-cybercriminals-are-exploiting.html
title: How Cybercriminals are Exploiting India's UPI for Money Laundering Operations
uri: How-Cybercriminals-are-Exploiting-India-s-UPI-for-Money-Laundering-Ope
url: https://thehackernews.com/2024/03/how-cybercriminals-are-exploiting.html
content:
Cybercriminals are using a network of hired money mules in India using an Android-based application to orchestrate a massive money laundering scheme.
The malicious application, called&nbsp;XHelper, is a "key tool for onboarding and managing these money mules," CloudSEK researchers Sparsh Kulshrestha, Abhishek Mathew, and Santripti Bhujel&nbsp;said&nbsp;in a report.
Details about the scam&nbsp;


feed_id: https://thehackernews.com/2024/03/from-500-to-5000-employees-securing-3rd.html
title: From 500 to 5000 Employees - Securing 3rd Party App-Usage in Mid-Market Companies
uri: From-500-to-5000-Employees-Securing-3rd-Party-App-Usage-in-Mid-Marke
url: https://thehackernews.com/2024/03/from-500-to-5000-employees-securing-3rd.html
content:
A company’s lifecycle stage, size, and state have a significant impact on its security needs, policies, and priorities. This is particularly true for modern mid-market companies that are either experiencing or have experienced rapid growth. As requirements and tasks continue to accumulate and malicious actors remain active around the clock, budgets are often stagnant at best. Yet, it is crucial


feed_id: https://thehackernews.com/2024/03/over-100-malicious-aiml-models-found-on.html
title: Over 100 Malicious AI/ML Models Found on Hugging Face Platform
uri: Over-100-Malicious-AI-ML-Models-Found-on-Hugging-Face-Platform
url: https://thehackernews.com/2024/03/over-100-malicious-aiml-models-found-on.html
content:
As many as 100 malicious artificial intelligence (AI)/machine learning (ML) models have been discovered in the Hugging Face platform.
These include instances where loading a&nbsp;pickle file&nbsp;leads to code execution, software supply chain security firm JFrog said.
"The model's payload grants the attacker a shell on the compromised machine, enabling them to gain full control over victims'


feed_id: https://thehackernews.com/2024/03/phobos-ransomware-aggressively.html
title: Phobos Ransomware Aggressively Targeting U.S. Critical Infrastructure
uri: Phobos-Ransomware-Aggressively-Targeting-U-S-Critical-Infrastructure
url: https://thehackernews.com/2024/03/phobos-ransomware-aggressively.html
content:
U.S. cybersecurity and intelligence agencies have warned of&nbsp;Phobos ransomware&nbsp;attacks targeting government and critical infrastructure entities, outlining the various tactics and techniques the threat actors have adopted to deploy the file-encrypting malware.
“Structured as a ransomware as a service (RaaS) model, Phobos ransomware actors have targeted entities including municipal and


feed_id: https://thehackernews.com/2024/03/us-court-orders-nso-group-to-hand-over.html
title: U.S. Court Orders NSO Group to Hand Over Pegasus Spyware Code to WhatsApp
uri: U-S-Court-Orders-NSO-Group-to-Hand-Over-Pegasus-Spyware-Code-to-Whats
url: https://thehackernews.com/2024/03/us-court-orders-nso-group-to-hand-over.html
content:
A U.S. judge has ordered NSO Group to hand over its source code for&nbsp;Pegasus&nbsp;and other remote access trojans to Meta as part of the social media giant's ongoing litigation against the Israeli spyware vendor.
The decision marks a major legal victory for Meta, which&nbsp;filed the lawsuit&nbsp;in October 2019 for using its infrastructure to&nbsp;distribute the spyware&nbsp;to


feed_id: https://thehackernews.com/2024/03/us-charges-iranian-hacker-offers-10.html
title: U.S. Charges Iranian Hacker, Offers $10 Million Reward for Capture
uri: U-S-Charges-Iranian-Hacker-Offers-10-Million-Reward-for-Capture
url: https://thehackernews.com/2024/03/us-charges-iranian-hacker-offers-10.html
content:
The U.S. Department of Justice (DoJ) on Friday unsealed an indictment against an Iranian national for his alleged involvement in a multi-year cyber-enabled campaign designed to compromise U.S. governmental and private entities.
More than a dozen entities are said to have been targeted, including the U.S. Departments of the Treasury and State, defense contractors that support U.S. Department of


feed_id: https://thehackernews.com/2024/03/new-phishing-kit-leverages-sms-voice.html
title: New Phishing Kit Leverages SMS, Voice Calls to Target Cryptocurrency Users
uri: New-Phishing-Kit-Leverages-SMS-Voice-Calls-to-Target-Cryptocurrency-U
url: https://thehackernews.com/2024/03/new-phishing-kit-leverages-sms-voice.html
content:
A novel phishing kit has been observed impersonating the login pages of well-known cryptocurrency services as part of an&nbsp;attack cluster codenamed CryptoChameleon that’s designed to primarily target mobile devices.
“This kit enables attackers to build carbon copies of single sign-on (SSO) pages, then use a combination of email, SMS, and voice phishing to trick the target into sharing


feed_id: https://thehackernews.com/2024/03/4-instructive-postmortems-on-data.html
title: 4 Instructive Postmortems on Data Downtime and Loss
uri: 4-Instructive-Postmortems-on-Data-Downtime-and-Loss
url: https://thehackernews.com/2024/03/4-instructive-postmortems-on-data.html
content:
More than a decade ago, the concept of the&nbsp;‘blameless’&nbsp;postmortem changed how tech companies recognize failures at scale.
John Allspaw, who coined the term during his tenure at Etsy, argued postmortems were all about controlling our natural reaction to an incident, which is to point fingers: “One option is to assume the single cause is incompetence and scream at engineers to make them


feed_id: https://thehackernews.com/2024/03/new-bifrose-linux-malware-variant-using.html
title: New BIFROSE Linux Malware Variant Using Deceptive VMware Domain for Evasion
uri: New-BIFROSE-Linux-Malware-Variant-Using-Deceptive-VMware-Domain-for-Ev
url: https://thehackernews.com/2024/03/new-bifrose-linux-malware-variant-using.html
content:
Cybersecurity researchers have discovered a new Linux variant of a remote access trojan (RAT) called BIFROSE (aka Bifrost) that uses a deceptive domain mimicking VMware.
"This latest version of Bifrost aims to bypass security measures and compromise targeted systems," Palo Alto Networks Unit 42 researchers Anmol Maurya and Siddharth Sharma&nbsp;said.
BIFROSE&nbsp;is one of the long-standing


feed_id: https://thehackernews.com/2024/03/five-eyes-agencies-warn-of-active.html
title: Five Eyes Agencies Warn of Active Exploitation of Ivanti Gateway Vulnerabilities
uri: Five-Eyes-Agencies-Warn-of-Active-Exploitation-of-Ivanti-Gateway-Vulne
url: https://thehackernews.com/2024/03/five-eyes-agencies-warn-of-active.html
content:
The Five Eyes (FVEY) intelligence alliance has issued a new cybersecurity advisory warning of cyber threat actors exploiting known security flaws in Ivanti Connect Secure and Ivanti Policy Secure gateways, noting that the Integrity Checker Tool (ICT) can be deceived to provide a false sense of security.
"Ivanti ICT is not sufficient to detect compromise and that a cyber threat actor may be able


feed_id: https://thehackernews.com/2024/03/github-rolls-out-default-secret.html
title: GitHub Rolls Out Default Secret Scanning Push Protection for Public Repositories
uri: GitHub-Rolls-Out-Default-Secret-Scanning-Push-Protection-for-Public-Re
url: https://thehackernews.com/2024/03/github-rolls-out-default-secret.html
content:
GitHub on Thursday announced that it’s enabling secret scanning push protection by default for all pushes to public repositories.
“This means that when a supported secret is detected in any push to a public repository, you will have the option to remove the secret from your commits or, if you deem the secret safe, bypass the block,” Eric Tooley and Courtney Claessens&nbsp;said.
Push protection&


feed_id: https://thehackernews.com/2024/02/new-silver-saml-attack-evades-golden.html
title: New Silver SAML Attack Evades Golden SAML Defenses in Identity Systems
uri: New-Silver-SAML-Attack-Evades-Golden-SAML-Defenses-in-Identity-Systems
url: https://thehackernews.com/2024/02/new-silver-saml-attack-evades-golden.html
content:
Cybersecurity researchers have disclosed a new attack technique called&nbsp;Silver SAML&nbsp;that can be successful even in cases where mitigations have been applied against Golden SAML attacks.
Silver SAML “enables the exploitation of SAML to launch attacks from an identity provider like Entra ID against applications configured to use it for authentication, such as Salesforce,” Semperis


feed_id: https://thehackernews.com/2024/02/gtpdoor-linux-malware-targets-telecoms.html
title: GTPDOOR Linux Malware Targets Telecoms, Exploiting GPRS Roaming Networks
uri: GTPDOOR-Linux-Malware-Targets-Telecoms-Exploiting-GPRS-Roaming-Networ
url: https://thehackernews.com/2024/02/gtpdoor-linux-malware-targets-telecoms.html
content:
Threat hunters have discovered a new Linux malware called&nbsp;GTPDOOR&nbsp;that’s designed to be deployed in telecom networks that are adjacent to GPRS roaming exchanges (GRX)
The&nbsp;malware&nbsp;is novel in the fact that it leverages the GPRS Tunnelling Protocol (GTP) for command-and-control (C2) communications.
GPRS roaming allows subscribers to access their GPRS services while they are


feed_id: https://thehackernews.com/2024/02/lazarus-hackers-exploited-windows.html
title: Lazarus Hackers Exploited Windows Kernel Flaw as Zero-Day in Recent Attacks
uri: Lazarus-Hackers-Exploited-Windows-Kernel-Flaw-as-Zero-Day-in-Recent-At
url: https://thehackernews.com/2024/02/lazarus-hackers-exploited-windows.html
content:
The notorious Lazarus Group actors exploited a recently patched privilege escalation flaw in the Windows Kernel as a zero-day to obtain kernel-level access and disable security software on compromised hosts.
The vulnerability in question is&nbsp;CVE-2024-21338&nbsp;(CVSS score: 7.8), which can permit an attacker to gain SYSTEM privileges. It was resolved by Microsoft earlier this month as part


feed_id: https://thehackernews.com/2024/02/why-risk-based-approach-to.html
title: How to Prioritize Cybersecurity Spending: A Risk-Based Strategy for the Highest ROI
uri: How-to-Prioritize-Cybersecurity-Spending-A-Risk-Based-Strategy-for-th
url: https://thehackernews.com/2024/02/why-risk-based-approach-to.html
content:
As an IT leader, staying on top of the latest cybersecurity developments is essential to keeping your organization safe. But with threats coming from all around — and hackers dreaming up new exploits every day — how do you create proactive, agile cybersecurity strategies? And what cybersecurity approach gives you the most bang for your buck, mitigating your risks and maximizing the value of your


feed_id: https://thehackernews.com/2024/02/new-backdoor-targeting-european.html
title: New Backdoor Targeting European Officials Linked to Indian Diplomatic Events
uri: New-Backdoor-Targeting-European-Officials-Linked-to-Indian-Diplomatic
url: https://thehackernews.com/2024/02/new-backdoor-targeting-european.html
content:
A previously undocumented threat actor dubbed&nbsp;SPIKEDWINE&nbsp;has been observed targeting officials in European countries with Indian diplomatic missions using a new backdoor called WINELOADER.
The adversary, according to a&nbsp;report&nbsp;from Zscaler ThreatLabz, used a PDF file in emails that purported to come from the Ambassador of India, inviting diplomatic staff to a wine-tasting


feed_id: https://thehackernews.com/2024/02/lazarus-exploits-typos-to-sneak-pypi.html
title: Lazarus Exploits Typos to Sneak PyPI Malware into Dev Systems
uri: Lazarus-Exploits-Typos-to-Sneak-PyPI-Malware-into-Dev-Systems
url: https://thehackernews.com/2024/02/lazarus-exploits-typos-to-sneak-pypi.html
content:
The notorious North Korean state-backed hacking group Lazarus uploaded four packages to the Python Package Index (PyPI) repository with the goal of infecting developer systems with malware.
The packages, now taken down, are&nbsp;pycryptoenv,&nbsp;pycryptoconf,&nbsp;quasarlib, and&nbsp;swapmempool. They have been collectively downloaded 3,269 times, with pycryptoconf accounting for the most


feed_id: https://thehackernews.com/2024/03/microsoft-confirms-russian-hackers.html
title: Microsoft Confirms Russian Hackers Stole Source Code, Some Customer Secrets
uri: Microsoft-Confirms-Russian-Hackers-Stole-Source-Code-Some-Customer-Se
url: https://thehackernews.com/2024/03/microsoft-confirms-russian-hackers.html
content:
Microsoft on Friday revealed that the Kremlin-backed threat actor known as&nbsp;Midnight Blizzard&nbsp;(aka APT29 or Cozy Bear) managed to gain access to some of its source code repositories and internal systems following a&nbsp;hack that came to light&nbsp;in January 2024.
"In recent weeks, we have seen evidence that Midnight Blizzard is using information initially exfiltrated from our


feed_id: https://thehackernews.com/2024/03/meta-details-whatsapp-and-messenger.html
title: Meta Details WhatsApp and Messenger Interoperability to Comply with EU's DMA Regulations
uri: Meta-Details-WhatsApp-and-Messenger-Interoperability-to-Comply-with-EU
url: https://thehackernews.com/2024/03/meta-details-whatsapp-and-messenger.html
content:
Meta has offered details on how it intends to implement interoperability in WhatsApp and Messenger with third-party messaging services as the Digital Markets Act (DMA) went into effect in the European Union.
“This allows users of third-party providers who choose to enable interoperability (interop) to send and receive messages with opted-in users of either Messenger or WhatsApp – both designated


feed_id: https://thehackernews.com/2024/03/secrets-sensei-conquering-secrets.html
title: Secrets Sensei: Conquering Secrets Management Challenges
uri: Secrets-Sensei-Conquering-Secrets-Management-Challenges
url: https://thehackernews.com/2024/03/secrets-sensei-conquering-secrets.html
content:
In the realm of cybersecurity, the stakes are sky-high, and at its core lies secrets management — the foundational pillar upon which your security infrastructure rests. We're all familiar with the routine: safeguarding those API keys, connection strings, and certificates is non-negotiable. However, let's dispense with the pleasantries; this isn't a simple 'set it and forget it' scenario. It's


feed_id: https://thehackernews.com/2024/03/cisco-issues-patch-for-high-severity.html
title: Cisco Issues Patch for High-Severity VPN Hijacking Bug in Secure Client
uri: Cisco-Issues-Patch-for-High-Severity-VPN-Hijacking-Bug-in-Secure-Clien
url: https://thehackernews.com/2024/03/cisco-issues-patch-for-high-severity.html
content:
Cisco has released patches to address a high-severity security flaw impacting its Secure Client software that could be exploited by a threat actor to open a VPN session with that of a targeted user.
The networking equipment company described the vulnerability, tracked as CVE-2024-20337 (CVSS score: 8.2), as allowing an unauthenticated, remote attacker to conduct a carriage return line feed (CRLF


feed_id: https://thehackernews.com/2024/03/cybercriminals-utilize-qemu-emulator-as.html
title: QEMU Emulator Exploited as Tunneling Tool to Breach Company Network
uri: QEMU-Emulator-Exploited-as-Tunneling-Tool-to-Breach-Company-Network
url: https://thehackernews.com/2024/03/cybercriminals-utilize-qemu-emulator-as.html
content:
Threat actors have been observed leveraging the&nbsp;QEMU&nbsp;open-source hardware emulator as tunneling software during a cyber attack targeting an unnamed "large company" to connect to their infrastructure.
While a number of legitimate tunneling tools like Chisel, FRP, ligolo, ngrok, and Plink have been used by adversaries to their advantage, the development marks the first QEMU that has been


feed_id: https://thehackernews.com/2024/03/cisa-warns-of-actively-exploited.html
title: CISA Warns of Actively Exploited JetBrains TeamCity Vulnerability
uri: CISA-Warns-of-Actively-Exploited-JetBrains-TeamCity-Vulnerability
url: https://thehackernews.com/2024/03/cisa-warns-of-actively-exploited.html
content:
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday&nbsp;added&nbsp;a critical security flaw impacting JetBrains TeamCity On-Premises software to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation.
The vulnerability, tracked as CVE-2024-27198 (CVSS score: 9.8), refers to an authentication bypass bug that allows for a&nbsp;complete


feed_id: https://thehackernews.com/2024/03/hacked-wordpress-sites-abusing-visitors.html
title: Hacked WordPress Sites Abusing Visitors' Browsers for Distributed Brute-Force Attacks
uri: Hacked-WordPress-Sites-Abusing-Visitors-Browsers-for-Distributed-Brut
url: https://thehackernews.com/2024/03/hacked-wordpress-sites-abusing-visitors.html
content:
Threat actors are conducting brute-force attacks against WordPress sites by leveraging malicious JavaScript injections, new findings from Sucuri reveal.
The attacks, which take the form of distributed brute-force attacks, “target WordPress websites from the browsers of completely innocent and unsuspecting site visitors,” security researcher Denis Sinegubko&nbsp;said.
The activity is part of a&


feed_id: https://thehackernews.com/2024/03/chinese-state-hackers-target-tibetans.html
title: Chinese State Hackers Target Tibetans with Supply Chain, Watering Hole Attacks
uri: Chinese-State-Hackers-Target-Tibetans-with-Supply-Chain-Watering-Hole
url: https://thehackernews.com/2024/03/chinese-state-hackers-target-tibetans.html
content:
The China-linked threat actor known as&nbsp;Evasive Panda&nbsp;orchestrated both watering hole and supply chain attacks targeting Tibetan users at least since September 2023.
The end goal of the attacks is to deliver malicious downloaders for Windows and macOS that deploy a known backdoor called MgBot and a previously undocumented Windows implant known as Nightdoor.
The findings come from ESET,


feed_id: https://thehackernews.com/2024/03/human-vs-non-human-identity-in-saas.html
title: Human vs. Non-Human Identity in SaaS
uri: Human-vs-Non-Human-Identity-in-SaaS
url: https://thehackernews.com/2024/03/human-vs-non-human-identity-in-saas.html
content:
In today's rapidly evolving SaaS environment, the focus is on human users. This is one of the most compromised areas in SaaS security management and requires strict governance of user roles and permissions, monitoring of privileged users, their level of activity (dormant, active, hyperactive), their type (internal/ external), whether they are joiners, movers, or leavers, and more.&nbsp;
Not


feed_id: https://thehackernews.com/2024/03/ex-google-engineer-arrested-for.html
title: Ex-Google Engineer Arrested for Stealing AI Technology Secrets for China
uri: Ex-Google-Engineer-Arrested-for-Stealing-AI-Technology-Secrets-for-Chi
url: https://thehackernews.com/2024/03/ex-google-engineer-arrested-for.html
content:
The U.S. Department of Justice (DoJ) announced the indictment of a 38-year-old Chinese national and a California resident for allegedly stealing proprietary information from Google while covertly working for two China-based tech companies.
Linwei Ding (aka Leon Ding), a former Google engineer who was arrested on March 6, 2024, "transferred sensitive Google trade secrets and other confidential


feed_id: https://thehackernews.com/2024/03/new-python-based-snake-info-stealer.html
title: New Python-Based Snake Info Stealer Spreading Through Facebook Messages
uri: New-Python-Based-Snake-Info-Stealer-Spreading-Through-Facebook-Message
url: https://thehackernews.com/2024/03/new-python-based-snake-info-stealer.html
content:
Facebook messages are being used by threat actors to distribute a Python-based information stealer dubbed Snake that’s designed to capture credentials and other sensitive data.
“The credentials harvested from unsuspecting users are transmitted to different platforms such as Discord, GitHub, and Telegram,” Cybereason researcher Kotaro Ogino&nbsp;said&nbsp;in a technical report.
Details about the


feed_id: https://thehackernews.com/2024/03/watch-out-for-spoofed-zoom-skype-google.html
title: Watch Out for Spoofed Zoom, Skype, Google Meet Sites Delivering Malware
uri: Watch-Out-for-Spoofed-Zoom-Skype-Google-Meet-Sites-Delivering-Malwar
url: https://thehackernews.com/2024/03/watch-out-for-spoofed-zoom-skype-google.html
content:
Threat actors have been leveraging fake websites advertising popular video conferencing software such as Google Meet, Skype, and Zoom to deliver a variety of malware targeting both Android and Windows users since December 2023.
“The threat actor is distributing Remote Access Trojans (RATs) including&nbsp;SpyNote RAT&nbsp;for Android platforms, and&nbsp;NjRAT&nbsp;and&nbsp;DCRat&nbsp;for Windows


feed_id: https://thehackernews.com/2024/03/hackers-exploit-misconfigured-yarn.html
title: Hackers Exploit Misconfigured YARN, Docker, Confluence, Redis Servers for Crypto Mining
uri: Hackers-Exploit-Misconfigured-YARN-Docker-Confluence-Redis-Servers
url: https://thehackernews.com/2024/03/hackers-exploit-misconfigured-yarn.html
content:
Threat actors are targeting misconfigured and vulnerable servers running Apache Hadoop YARN, Docker, Atlassian Confluence, and Redis services as part of an emerging malware campaign designed to deliver a cryptocurrency miner and spawn a reverse shell for persistent remote access.
“The attackers leverage these tools to issue exploit code, taking advantage of common misconfigurations and


feed_id: https://thehackernews.com/2024/03/exit-scam-blackcat-ransomware-group.html
title: Exit Scam: BlackCat Ransomware Group Vanishes After $22 Million Payout
uri: Exit-Scam-BlackCat-Ransomware-Group-Vanishes-After-22-Million-Payout
url: https://thehackernews.com/2024/03/exit-scam-blackcat-ransomware-group.html
content:
The threat actors behind the&nbsp;BlackCat ransomware&nbsp;have shut down their darknet website and likely pulled an exit scam after uploading a bogus law enforcement seizure banner.
"ALPHV/BlackCat did not get seized. They are exit scamming their affiliates," security researcher Fabian Wosar&nbsp;said. "It is blatantly obvious when you check the source code of the new takedown notice."
"There


feed_id: https://thehackernews.com/2024/03/a-new-way-to-manage-your-web-exposure.html
title: A New Way To Manage Your Web Exposure: The Reflectiz Product Explained
uri: A-New-Way-To-Manage-Your-Web-Exposure-The-Reflectiz-Product-Explained
url: https://thehackernews.com/2024/03/a-new-way-to-manage-your-web-exposure.html
content:
An in-depth look into a proactive website security solution that continuously detects, prioritizes, and validates web threats, helping to mitigate security, privacy, and compliance risks.&nbsp;
Reflectiz&nbsp;shields websites from client-side attacks, supply chain risks, data breaches, privacy violations, and compliance issues.
You Can’t Protect What You Can’t See
Today’s websites are connected


feed_id: https://thehackernews.com/2024/03/how-to-find-and-fix-risky-sharing-in.html
title: How to Find and Fix Risky Sharing in Google Drive
uri: How-to-Find-and-Fix-Risky-Sharing-in-Google-Drive
url: https://thehackernews.com/2024/03/how-to-find-and-fix-risky-sharing-in.html
content:
Every Google Workspace administrator knows how quickly Google Drive becomes a messy sprawl of loosely shared confidential information. This isn't anyone's fault; it’s inevitable as your productivity suite is purposefully designed to enable real-time collaboration – both internally and externally.&nbsp;
For Security &amp; Risk Management teams, the untenable risk of any Google Drive footprint


feed_id: https://thehackernews.com/2024/03/us-cracks-down-on-predatory-spyware.html
title: U.S. Cracks Down on Predatory Spyware Firm for Targeting Officials and Journalists
uri: U-S-Cracks-Down-on-Predatory-Spyware-Firm-for-Targeting-Officials-and
url: https://thehackernews.com/2024/03/us-cracks-down-on-predatory-spyware.html
content:
The U.S. Department of Treasury’s Office of Foreign Assets Control (OFAC) sanctioned two individuals and five entities associated with the Intellexa Alliance for their role in “developing, operating, and distributing” commercial spyware designed to target government officials, journalists, and policy experts in the country.
“The proliferation of commercial spyware poses distinct and growing


feed_id: https://thehackernews.com/2024/03/vmware-issues-security-patches-for-esxi.html
title: VMware Issues Security Patches for ESXi, Workstation, and Fusion Flaws
uri: VMware-Issues-Security-Patches-for-ESXi-Workstation-and-Fusion-Flaws
url: https://thehackernews.com/2024/03/vmware-issues-security-patches-for-esxi.html
content:
VMware has released patches to address four security flaws impacting ESXi, Workstation, and Fusion, including two critical flaws that could lead to code execution.
Tracked as&nbsp;CVE-2024-22252 and CVE-2024-22253, the vulnerabilities have been described as use-after-free bugs in the XHCI USB controller. They carry a CVSS score of 9.3 for Workstation and Fusion, and 8.4 for ESXi systems.
"A


feed_id: https://thehackernews.com/2024/03/alert-ghostsec-and-stormous-launch.html
title: Alert: GhostSec and Stormous Launch Joint Ransomware Attacks in Over 15 Countries
uri: Alert-GhostSec-and-Stormous-Launch-Joint-Ransomware-Attacks-in-Over-1
url: https://thehackernews.com/2024/03/alert-ghostsec-and-stormous-launch.html
content:
The cybercrime group called GhostSec has been linked to a Golang variant of a ransomware family called&nbsp;GhostLocker.
“TheGhostSec and Stormous ransomware groups are jointly conducting double extortion ransomware attacks on various business verticals in multiple countries,” Cisco Talos researcher Chetan Raghuprasad&nbsp;said&nbsp;in a report shared with The Hacker News.
“GhostLocker and


feed_id: https://thehackernews.com/2024/03/new-apt-group-lotus-bane-behind-recent.html
title: New APT Group 'Lotus Bane' Behind Recent Attacks on Vietnam's Financial Entities
uri: New-APT-Group-Lotus-Bane-Behind-Recent-Attacks-on-Vietnam-s-Financia
url: https://thehackernews.com/2024/03/new-apt-group-lotus-bane-behind-recent.html
content:
A financial entity in Vietnam was the target of a previously undocumented threat actor called&nbsp;Lotus Bane&nbsp;as part of a cyber attack that was first detected in March 2023.
Singapore-headquartered Group-IB described the hacking outfit as an advanced persistent threat group that's believed to have been active since at least 2022.
The exact specifics of the infection chain remain unknown


feed_id: https://thehackernews.com/2024/03/urgent-apple-issues-critical-updates.html
title: Urgent: Apple Issues Critical Updates for Actively Exploited Zero-Day Flaws
uri: Urgent-Apple-Issues-Critical-Updates-for-Actively-Exploited-Zero-Day
url: https://thehackernews.com/2024/03/urgent-apple-issues-critical-updates.html
content:
Apple has released security updates to address several security flaws, including two vulnerabilities that it said have been actively exploited in the wild.
The shortcomings are listed below -

CVE-2024-23225&nbsp;- A memory corruption issue in Kernel that an attacker with arbitrary kernel read and write capability can exploit to bypass kernel memory protections


CVE-2024-23296&nbsp;- A memory


feed_id: https://thehackernews.com/2024/03/hackers-exploit-connectwise.html
title: Hackers Exploit ConnectWise ScreenConnect Flaws to Deploy TODDLERSHARK Malware
uri: Hackers-Exploit-ConnectWise-ScreenConnect-Flaws-to-Deploy-TODDLERSHARK
url: https://thehackernews.com/2024/03/hackers-exploit-connectwise.html
content:
North Korean threat actors have exploited the recently disclosed security flaws in ConnectWise ScreenConnect to deploy a new malware called&nbsp;TODDLERSHARK.
According to a report shared by Kroll with The Hacker News, TODDLERSHARK overlaps with known Kimsuky malware such as BabyShark and ReconShark.
“The threat actor gained access to the victim workstation by exploiting the exposed setup wizard


feed_id: https://thehackernews.com/2024/03/what-is-exposure-management-and-how.html
title: What is Exposure Management and How Does it Differ from ASM?
uri: What-is-Exposure-Management-and-How-Does-it-Differ-from-ASM
url: https://thehackernews.com/2024/03/what-is-exposure-management-and-how.html
content:
Startups and scales-ups are often cloud-first organizations and rarely have sprawling legacy on-prem environments. Likewise, knowing the agility and flexibility that cloud environments provide, the mid-market is predominantly running in a hybrid state, partly in the cloud but with some on-prem assets.
While there has been a bit of a backswing against the pricing and lock-in presented when using


feed_id: https://thehackernews.com/2024/03/cybercriminals-using-novel-dns.html
title: Cybercriminals Using Novel DNS Hijacking Technique for Investment Scams
uri: Cybercriminals-Using-Novel-DNS-Hijacking-Technique-for-Investment-Scam
url: https://thehackernews.com/2024/03/cybercriminals-using-novel-dns.html
content:
A new DNS threat actor dubbed&nbsp;Savvy Seahorse&nbsp;is leveraging sophisticated techniques to entice targets into fake investment platforms and steal funds.
“Savvy Seahorse is a DNS threat actor who convinces victims to create accounts on fake investment platforms, make deposits to a personal account, and then transfers those deposits to a bank in Russia,” Infoblox&nbsp;said&nbsp;in a report


feed_id: https://thehackernews.com/2024/03/over-225000-compromised-chatgpt.html
title: Over 225,000 Compromised ChatGPT Credentials Up for Sale on Dark Web Markets
uri: Over-225-000-Compromised-ChatGPT-Credentials-Up-for-Sale-on-Dark-Web-M
url: https://thehackernews.com/2024/03/over-225000-compromised-chatgpt.html
content:
More than 225,000 logs containing compromised OpenAI ChatGPT credentials were made available for sale on underground markets between January and October 2023, new findings from Group-IB show.
These credentials were found within&nbsp;information stealer logs&nbsp;associated with LummaC2, Raccoon, and RedLine stealer malware.
“The number of infected devices decreased slightly in mid- and late


feed_id: https://thehackernews.com/2024/03/warning-thread-hijacking-attack-targets.html
title: Warning: Thread Hijacking Attack Targets IT Networks, Stealing NTLM Hashes
uri: Warning-Thread-Hijacking-Attack-Targets-IT-Networks-Stealing-NTLM-Ha
url: https://thehackernews.com/2024/03/warning-thread-hijacking-attack-targets.html
content:
The threat actor known as&nbsp;TA577&nbsp;has been observed using ZIP archive attachments in phishing emails with an aim to steal NT LAN Manager (NTLM) hashes.
The new attack chain “can be used for sensitive information gathering purposes and to enable follow-on activity,” enterprise security firm Proofpoint&nbsp;said&nbsp;in a Monday report.
At least two campaigns taking advantage of this


feed_id: https://thehackernews.com/2024/03/critical-jetbrains-teamcity-on-premises.html
title: Critical JetBrains TeamCity On-Premises Flaws Could Lead to Server Takeovers
uri: Critical-JetBrains-TeamCity-On-Premises-Flaws-Could-Lead-to-Server-Tak
url: https://thehackernews.com/2024/03/critical-jetbrains-teamcity-on-premises.html
content:
A new pair of security vulnerabilities have been disclosed in JetBrains TeamCity On-Premises software that could be exploited by a threat actor to take control of affected systems.
The flaws, tracked as CVE-2024-27198 (CVSS score: 9.8) and CVE-2024-27199 (CVSS score: 7.3), have been addressed in version 2023.11.4. They impact all TeamCity On-Premises versions through 2023.11.3.
“The


feed_id: https://thehackernews.com/2024/03/demystifying-common-cybersecurity-myth.html
title: Demystifying a Common Cybersecurity Myth
uri: Demystifying-a-Common-Cybersecurity-Myth
url: https://thehackernews.com/2024/03/demystifying-common-cybersecurity-myth.html
content:
One of the most common misconceptions in file upload cybersecurity is that certain tools are “enough” on their own—this is simply not the case. In our latest&nbsp;whitepaper&nbsp;OPSWAT CEO and Founder, Benny Czarny, takes a comprehensive look at what it takes to prevent malware threats in today’s ever-evolving file upload security landscape, and a big part of that is understanding where the


feed_id: https://thehackernews.com/2024/03/pixpirate-android-banking-trojan-using.html
title: PixPirate Android Banking Trojan Using New Evasion Tactic to Target Brazilian Users
uri: PixPirate-Android-Banking-Trojan-Using-New-Evasion-Tactic-to-Target-Br
url: https://thehackernews.com/2024/03/pixpirate-android-banking-trojan-using.html
content:
The threat actors behind the PixPirate Android banking trojan are leveraging a new trick to evade detection on compromised devices and harvest sensitive information from users in Brazil.
The approach allows it to hide the malicious app’s icon from the home screen of the victim’s device, IBM said in a technical report published today.
“Thanks to this new technique, during PixPirate reconnaissance


feed_id: https://thehackernews.com/2024/03/join-our-webinar-on-protecting-human.html
title: Join Our Webinar on Protecting Human and Non-Human Identities in SaaS Platforms
uri: Join-Our-Webinar-on-Protecting-Human-and-Non-Human-Identities-in-SaaS
url: https://thehackernews.com/2024/03/join-our-webinar-on-protecting-human.html
content:
Identities are the latest sweet spot for cybercriminals, now heavily targeting SaaS applications that are especially vulnerable in this attack vector. 
The use of SaaS applications involves a wide range of identities, including human and non-human, such as service accounts, API keys, and OAuth authorizations. Consequently, any identity in a SaaS app can create an opening for cybercriminals to


feed_id: https://thehackernews.com/2024/03/researchers-highlight-googles-gemini-ai.html
title: Researchers Highlight Google's Gemini AI Susceptibility to LLM Threats
uri: Researchers-Highlight-Google-s-Gemini-AI-Susceptibility-to-LLM-Threats
url: https://thehackernews.com/2024/03/researchers-highlight-googles-gemini-ai.html
content:
Google's&nbsp;Gemini&nbsp;large language model (LLM) is susceptible to security threats that could cause it to divulge system prompts, generate harmful content, and carry out indirect injection attacks.
The findings come from HiddenLayer, which said the issues impact consumers using Gemini Advanced with Google Workspace as well as companies using the LLM API.
The first vulnerability involves


feed_id: https://thehackernews.com/2024/03/alert-cybercriminals-deploying-vcurms.html
title: Alert: Cybercriminals Deploying VCURMS and STRRAT Trojans via AWS and GitHub
uri: Alert-Cybercriminals-Deploying-VCURMS-and-STRRAT-Trojans-via-AWS-and
url: https://thehackernews.com/2024/03/alert-cybercriminals-deploying-vcurms.html
content:
A new phishing campaign has been observed delivering remote access trojans (RAT) such as VCURMS and STRRAT by means of a malicious Java-based downloader.
“The attackers stored malware on public services like Amazon Web Services (AWS) and GitHub, employing a commercial protector to avoid detection of the malware,” Fortinet FortiGuard Labs researcher Yurren Wan&nbsp;said.
An unusual aspect of the


feed_id: https://thehackernews.com/2024/03/microsofts-march-updates-fix-61.html
title: Microsoft's March Updates Fix 61 Vulnerabilities, Including Critical Hyper-V Flaws
uri: Microsoft-s-March-Updates-Fix-61-Vulnerabilities-Including-Critical-H
url: https://thehackernews.com/2024/03/microsofts-march-updates-fix-61.html
content:
Microsoft on Tuesday released its monthly security update,&nbsp;addressing 61 different security flaws&nbsp;spanning its software, including two critical issues impacting Windows Hyper-V that could lead to denial-of-service (DoS) and remote code execution.
Of the 61 vulnerabilities, two are rated Critical, 58 are rated Important, and one is rated Low in severity. None of the flaws are listed as


feed_id: https://thehackernews.com/2024/03/watch-out-these-pypi-python-packages.html
title: Watch Out: These PyPI Python Packages Can Drain Your Crypto Wallets
uri: Watch-Out-These-PyPI-Python-Packages-Can-Drain-Your-Crypto-Wallets
url: https://thehackernews.com/2024/03/watch-out-these-pypi-python-packages.html
content:
Threat hunters have discovered a set of seven packages on the Python Package Index (PyPI) repository that are designed to steal&nbsp;BIP39 mnemonic phrases&nbsp;used for recovering private keys of a cryptocurrency wallet.
The software supply chain attack campaign has been codenamed BIPClip by ReversingLabs. The packages were collectively downloaded 7,451 times prior to them being removed from


feed_id: https://thehackernews.com/2024/03/ctem-101-go-beyond-vulnerability.html
title: CTEM 101 - Go Beyond Vulnerability Management with Continuous Threat Exposure Management
uri: CTEM-101-Go-Beyond-Vulnerability-Management-with-Continuous-Threat-E
url: https://thehackernews.com/2024/03/ctem-101-go-beyond-vulnerability.html
content:
In a world of ever-expanding jargon, adding another FLA (Four-Letter Acronym) to your glossary might seem like the last thing you’d want to do. But if you are looking for ways to continuously reduce risk across your environment while making significant and consistent improvements to security posture, in our opinion, you probably want to consider establishing a&nbsp;Continuous Threat Exposure


feed_id: https://thehackernews.com/2024/03/malware-campaign-exploits-popup-builder.html
title: Malware Campaign Exploits Popup Builder WordPress Plugin to Infect 3,900+ Sites
uri: Malware-Campaign-Exploits-Popup-Builder-WordPress-Plugin-to-Infect-3-9
url: https://thehackernews.com/2024/03/malware-campaign-exploits-popup-builder.html
content:
A new malware campaign is leveraging a high-severity security flaw in the Popup Builder plugin for WordPress to inject malicious JavaScript code.
According to Sucuri, the campaign has&nbsp;infected more than 3,900 sites&nbsp;over the past three weeks.
"These attacks are orchestrated from domains less than a month old, with registrations dating back to February 12th, 2024," security researcher


feed_id: https://thehackernews.com/2024/03/south-korean-citizen-detained-in-russia.html
title: South Korean Citizen Detained in Russia on Cyber Espionage Charges
uri: South-Korean-Citizen-Detained-in-Russia-on-Cyber-Espionage-Charges
url: https://thehackernews.com/2024/03/south-korean-citizen-detained-in-russia.html
content:
Russia has detained a South Korean national for the first time on cyber espionage charges and transferred from Vladivostok to Moscow for further investigation.
The development was&nbsp;first reported&nbsp;by Russian news agency TASS.
“During the investigation of an espionage case, a South Korean citizen Baek Won-soon was identified and detained in Vladivostok, and put into custody under a court


feed_id: https://thehackernews.com/2024/03/new-banking-trojan-chavecloak-targets.html
title: New Banking Trojan CHAVECLOAK Targets Brazilian Users via Phishing Tactics
uri: New-Banking-Trojan-CHAVECLOAK-Targets-Brazilian-Users-via-Phishing-Tac
url: https://thehackernews.com/2024/03/new-banking-trojan-chavecloak-targets.html
content:
Users in Brazil are the target of a new banking trojan known as&nbsp;CHAVECLOAK&nbsp;that's propagated via phishing emails bearing PDF attachments.
"This intricate attack involves the PDF downloading a ZIP file and subsequently utilizing DLL side-loading techniques to execute the final malware," Fortinet FortiGuard Labs researcher Cara Lin&nbsp;said.
The attack chain involves the use of


feed_id: https://thehackernews.com/2024/03/data-leakage-prevention-in-age-of-cloud.html
title: Guide: On-Prem is Dead. Have You Adjusted Your Web DLP Plan?
uri: Guide-On-Prem-is-Dead-Have-You-Adjusted-Your-Web-DLP-Plan
url: https://thehackernews.com/2024/03/data-leakage-prevention-in-age-of-cloud.html
content:
As the shift of IT infrastructure to cloud-based solutions celebrates its 10-year anniversary, it becomes clear that traditional on-premises approaches to data security are becoming obsolete. Rather than protecting the endpoint, DLP solutions need to refocus their efforts to where corporate data resides - in the browser.
A new guide by LayerX titled "On-Prem is Dead. Have You Adjusted Your Web


feed_id: https://thehackernews.com/2024/03/bianlian-threat-actors-exploiting.html
title: BianLian Threat Actors Exploiting JetBrains TeamCity Flaws in Ransomware Attacks
uri: BianLian-Threat-Actors-Exploiting-JetBrains-TeamCity-Flaws-in-Ransomwa
url: https://thehackernews.com/2024/03/bianlian-threat-actors-exploiting.html
content:
The threat actors behind the BianLian ransomware have been observed exploiting security flaws in JetBrains TeamCity software to conduct their extortion-only attacks.
According to a&nbsp;new report&nbsp;from GuidePoint Security, which responded to a recent intrusion, the incident "began with the exploitation of a TeamCity server which resulted in the deployment of a PowerShell implementation of


feed_id: https://thehackernews.com/2024/03/proof-of-concept-exploit-released-for.html
title: Proof-of-Concept Exploit Released for Progress Software OpenEdge Vulnerability
uri: Proof-of-Concept-Exploit-Released-for-Progress-Software-OpenEdge-Vulne
url: https://thehackernews.com/2024/03/proof-of-concept-exploit-released-for.html
content:
Technical specifics and a proof-of-concept (PoC) exploit have been made available for a recently disclosed critical security flaw in Progress Software OpenEdge Authentication Gateway and AdminServer, which could be potentially exploited to bypass authentication protections.
Tracked as&nbsp;CVE-2024-1403, the vulnerability has a maximum severity rating of 10.0 on the CVSS scoring system. It


feed_id: https://thehackernews.com/2024/03/magnet-goblin-hacker-group-leveraging-1.html
title: Magnet Goblin Hacker Group Leveraging 1-Day Exploits to Deploy Nerbian RAT
uri: Magnet-Goblin-Hacker-Group-Leveraging-1-Day-Exploits-to-Deploy-Nerbian
url: https://thehackernews.com/2024/03/magnet-goblin-hacker-group-leveraging-1.html
content:
A financially motivated threat actor called&nbsp;Magnet Goblin&nbsp;is swiftly adopting one-day security vulnerabilities into its arsenal in order to opportunistically breach edge devices and public-facing services and deploy malware on compromised hosts.
“Threat actor group Magnet Goblin’s hallmark is its ability to swiftly leverage newly disclosed vulnerabilities, particularly targeting


feed_id: https://thehackernews.com/2024/03/lockbit-ransomware-hacker-ordered-to.html
title: LockBit Ransomware Hacker Ordered to Pay $860,000 After Guilty Plea in Canada
uri: LockBit-Ransomware-Hacker-Ordered-to-Pay-860-000-After-Guilty-Plea-in
url: https://thehackernews.com/2024/03/lockbit-ransomware-hacker-ordered-to.html
content:
A 34-year-old Russian-Canadian national has been sentenced to nearly four years in jail in Canada for his participation in the LockBit global ransomware operation.
Mikhail Vasiliev, an Ontario resident, was&nbsp;originally arrested&nbsp;in November 2022 and charged by the U.S. Department of Justice (DoJ) with "conspiring with others to intentionally damage protected computers and to transmit


feed_id: https://thehackernews.com/2024/03/researchers-detail-kubernetes.html
title: Researchers Detail Kubernetes Vulnerability That Enables Windows Node Takeover
uri: Researchers-Detail-Kubernetes-Vulnerability-That-Enables-Windows-Node
url: https://thehackernews.com/2024/03/researchers-detail-kubernetes.html
content:
Details have been made public about a now-patched high-severity flaw in Kubernetes that could allow a malicious attacker to achieve remote code execution with elevated privileges under specific circumstances.
“The vulnerability allows remote code execution with SYSTEM privileges on all Windows endpoints within a Kubernetes cluster,” Akamai security researcher Tomer Peled&nbsp;said. “To exploit


feed_id: https://thehackernews.com/2024/03/3-things-cisos-achieve-with-cato.html
title: 3 Things CISOs Achieve with Cato
uri: 3-Things-CISOs-Achieve-with-Cato
url: https://thehackernews.com/2024/03/3-things-cisos-achieve-with-cato.html
content:
Being a CISO is a balancing act: ensuring organizations are secure without compromising users’ productivity. This requires taking multiple elements into consideration, like cost, complexity, performance and user experience. CISOs around the globe use Cato SSE 360, as part of the&nbsp;Cato SASE Cloud platform&nbsp;to balance these factors without compromise.
This article details how CISOs are


feed_id: https://thehackernews.com/2024/03/redcurl-cybercrime-group-abuses-windows.html
title: RedCurl Cybercrime Group Abuses Windows PCA Tool for Corporate Espionage
uri: RedCurl-Cybercrime-Group-Abuses-Windows-PCA-Tool-for-Corporate-Espiona
url: https://thehackernews.com/2024/03/redcurl-cybercrime-group-abuses-windows.html
content:
The Russian-speaking cybercrime group called&nbsp;RedCurl&nbsp;is leveraging a legitimate Microsoft Windows component called the Program Compatibility Assistant (PCA) to execute malicious commands.

“The Program Compatibility Assistant Service (pcalua.exe) is a Windows service designed to identify and address compatibility issues with older programs,” Trend Micro&nbsp;said&nbsp;in an analysis


feed_id: https://thehackernews.com/2024/03/ande-loader-malware-targets.html
title: Ande Loader Malware Targets Manufacturing Sector in North America
uri: Ande-Loader-Malware-Targets-Manufacturing-Sector-in-North-America
url: https://thehackernews.com/2024/03/ande-loader-malware-targets.html
content:
The threat actor known as Blind Eagle has been observed using a loader malware called Ande Loader to deliver remote access trojans (RATs) like Remcos RAT and NjRAT.

The attacks, which take the form of phishing emails, targeted Spanish-speaking users in the manufacturing industry based in North America, eSentire&nbsp;said.

Blind Eagle (aka APT-C-36) is a&nbsp;financially motivated threat actor&


feed_id: https://thehackernews.com/2024/03/darkgate-malware-exploits-recently.html
title: DarkGate Malware Exploited Recently Patched Microsoft Flaw in Zero-Day Attack
uri: DarkGate-Malware-Exploited-Recently-Patched-Microsoft-Flaw-in-Zero-Day
url: https://thehackernews.com/2024/03/darkgate-malware-exploits-recently.html
content:
A DarkGate malware campaign observed in mid-January 2024 leveraged a recently patched security flaw in Microsoft Windows as a zero-day using bogus software installers.
“During this campaign, users were lured using PDFs that contained Google DoubleClick Digital Marketing (DDM) open redirects that led unsuspecting victims to compromised sites hosting the Microsoft Windows SmartScreen bypass


feed_id: https://thehackernews.com/2024/03/fortinet-warns-of-severe-sqli.html
title: Fortinet Warns of Severe SQLi Vulnerability in FortiClientEMS Software
uri: Fortinet-Warns-of-Severe-SQLi-Vulnerability-in-FortiClientEMS-Software
url: https://thehackernews.com/2024/03/fortinet-warns-of-severe-sqli.html
content:
Fortinet has warned of a critical security flaw impacting its FortiClientEMS software that could allow attackers to achieve code execution on affected systems.
"An improper neutralization of special elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] in FortiClientEMS may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted


feed_id: https://thehackernews.com/2024/03/new-strelastealer-phishing-attacks-hit.html
title: New StrelaStealer Phishing Attacks Hit Over 100 Organizations in E.U. and U.S.
uri: New-StrelaStealer-Phishing-Attacks-Hit-Over-100-Organizations-in-E-U
url: https://thehackernews.com/2024/03/new-strelastealer-phishing-attacks-hit.html
content:
Cybersecurity researchers have detected a new wave of phishing attacks that aim to deliver an ever-evolving information stealer referred to as&nbsp;StrelaStealer.
The campaigns impact more than 100 organizations in the E.U. and the U.S., Palo Alto Networks Unit 42 researchers said in a new report published today.
"These campaigns come in the form of spam emails with attachments that eventually


feed_id: https://thehackernews.com/2024/03/aws-patches-critical-flowfixation-bug.html
title: AWS Patches Critical 'FlowFixation' Bug in Airflow Service to Prevent Session Hijacking
uri: AWS-Patches-Critical-FlowFixation-Bug-in-Airflow-Service-to-Prevent
url: https://thehackernews.com/2024/03/aws-patches-critical-flowfixation-bug.html
content:
Cybersecurity researchers have shared details of a now-patched security vulnerability in Amazon Web Services (AWS) Managed Workflows for Apache Airflow (MWAA) that could be potentially exploited by a malicious actor to hijack victims' sessions and achieve remote code execution on underlying instances.
The vulnerability, now addressed by AWS, has been codenamed&nbsp;FlowFixation&nbsp;by Tenable.


feed_id: https://thehackernews.com/2024/03/china-linked-group-breaches-networks.html
title: China-Linked Group Breaches Networks via Connectwise, F5 Software Flaws
uri: China-Linked-Group-Breaches-Networks-via-Connectwise-F5-Software-Flaw
url: https://thehackernews.com/2024/03/china-linked-group-breaches-networks.html
content:
A China-linked threat cluster leveraged security flaws in Connectwise ScreenConnect and F5 BIG-IP software to deliver custom malware capable of delivering additional backdoors on compromised Linux hosts as part of an "aggressive" campaign.
Google-owned Mandiant is&nbsp;tracking&nbsp;the activity under its uncategorized moniker&nbsp;UNC5174&nbsp;(aka Uteus or Uetus), describing it as a "former


feed_id: https://thehackernews.com/2024/03/implementing-zero-trust-controls-for.html
title: Implementing Zero Trust Controls for Compliance
uri: Implementing-Zero-Trust-Controls-for-Compliance
url: https://thehackernews.com/2024/03/implementing-zero-trust-controls-for.html
content:
The&nbsp;ThreatLocker® Zero Trust Endpoint Protection Platform&nbsp;implements a strict deny-by-default, allow-by-exception security posture to give organizations the ability to set policy-based controls within their environment and mitigate countless cyber threats, including zero-days, unseen network footholds, and malware attacks as a direct result of user error.
With the capabilities of the


feed_id: https://thehackernews.com/2024/03/massive-sign1-campaign-infects-39000.html
title: Massive Sign1 Campaign Infects 39,000+ WordPress Sites with Scam Redirects
uri: Massive-Sign1-Campaign-Infects-39-000-WordPress-Sites-with-Scam-Redir
url: https://thehackernews.com/2024/03/massive-sign1-campaign-infects-39000.html
content:
A massive malware campaign dubbed&nbsp;Sign1&nbsp;has compromised over 39,000 WordPress sites in the last six months, using malicious JavaScript injections to redirect users to scam sites.
The most recent variant of the malware is estimated to have infected no less than 2,500 sites over the past two months alone, Sucuri said in a report published this week.
The attacks entail injecting rogue


feed_id: https://thehackernews.com/2024/03/us-justice-department-sues-apple-over.html
title: U.S. Justice Department Sues Apple Over Monopoly and Messaging Security
uri: U-S-Justice-Department-Sues-Apple-Over-Monopoly-and-Messaging-Securit
url: https://thehackernews.com/2024/03/us-justice-department-sues-apple-over.html
content:
The U.S. Department of Justice (DoJ), along with 16 other state and district attorneys general, on Thursday&nbsp;accused&nbsp;Apple of illegally maintaining a monopoly over smartphones, thereby undermining, among other things, the security and privacy of users when messaging non-iPhone users.
"Apple wraps itself in a cloak of privacy, security, and consumer preferences to justify its


feed_id: https://thehackernews.com/2024/03/russian-hackers-target-ukrainian.html
title: Russian Hackers May Have Targeted Ukrainian Telecoms with Upgraded 'AcidPour' Malware
uri: Russian-Hackers-May-Have-Targeted-Ukrainian-Telecoms-with-Upgraded-Ac
url: https://thehackernews.com/2024/03/russian-hackers-target-ukrainian.html
content:
The data wiping malware called&nbsp;AcidPour&nbsp;may have been deployed in attacks targeting four telecom providers in Ukraine, new findings from SentinelOne show.
The cybersecurity firm also confirmed connections between the malware and AcidRain, tying it to threat activity clusters associated with Russian military intelligence.
"AcidPour's expanded capabilities would enable it to better


feed_id: https://thehackernews.com/2024/03/russia-hackers-using-tinyturla-ng-to.html
title: Russia Hackers Using TinyTurla-NG to Breach European NGO's Systems
uri: Russia-Hackers-Using-TinyTurla-NG-to-Breach-European-NGO-s-Systems
url: https://thehackernews.com/2024/03/russia-hackers-using-tinyturla-ng-to.html
content:
The Russia-linked threat actor known as Turla infected several systems belonging to an unnamed European non-governmental organization (NGO) in order to deploy a backdoor called TinyTurla-NG (TTNG).
"The attackers compromised the first system, established persistence and added exclusions to antivirus products running on these endpoints as part of their preliminary post-compromise actions," Cisco


feed_id: https://thehackernews.com/2024/03/over-800-npm-packages-found-with.html
title: Over 800 npm Packages Found with Discrepancies, 18 Exploitable to 'Manifest Confusion'
uri: Over-800-npm-Packages-Found-with-Discrepancies-18-Exploitable-to-Man
url: https://thehackernews.com/2024/03/over-800-npm-packages-found-with.html
content:
New research has discovered over 800 packages in the npm registry which have discrepancies from their registry entries, out of which 18 have been found to exploit a technique called&nbsp;manifest confusion.
The findings come from cybersecurity firm JFrog, which said the issue could be exploited by threat actors to trick developers into running malicious code.
"It's an actual threat since


feed_id: https://thehackernews.com/2024/03/androxgh0st-malware-targets-laravel.html
title: AndroxGh0st Malware Targets Laravel Apps to Steal Cloud Credentials
uri: AndroxGh0st-Malware-Targets-Laravel-Apps-to-Steal-Cloud-Credentials
url: https://thehackernews.com/2024/03/androxgh0st-malware-targets-laravel.html
content:
Cybersecurity researchers have shed light on a tool referred to as&nbsp;AndroxGh0st&nbsp;that's used to target Laravel applications and steal sensitive data.
"It works by scanning and taking out important information from .env files, revealing login details linked to AWS and Twilio," Juniper Threat Labs researcher Kashinath T Pattan&nbsp;said.
"Classified as an SMTP cracker, it exploits SMTP


feed_id: https://thehackernews.com/2024/03/how-to-accelerate-vendor-risk.html
title: How to Accelerate Vendor Risk Assessments in the Age of SaaS Sprawl
uri: How-to-Accelerate-Vendor-Risk-Assessments-in-the-Age-of-SaaS-Sprawl
url: https://thehackernews.com/2024/03/how-to-accelerate-vendor-risk.html
content:
In today's digital-first business environment dominated by SaaS applications, organizations increasingly depend on third-party vendors for essential cloud services and software solutions. As more vendors and services are added to the mix, the complexity and potential vulnerabilities within the&nbsp;SaaS supply chain&nbsp;snowball quickly. That’s why effective vendor risk management (VRM) is a


feed_id: https://thehackernews.com/2024/03/github-launches-ai-powered-autofix-tool.html
title: GitHub Launches AI-Powered Autofix Tool to Assist Devs in Patching Security Flaws
uri: GitHub-Launches-AI-Powered-Autofix-Tool-to-Assist-Devs-in-Patching-Sec
url: https://thehackernews.com/2024/03/github-launches-ai-powered-autofix-tool.html
content:
GitHub on Wednesday announced that it's making available a feature called code scanning autofix in public beta for all&nbsp;Advanced Security customers&nbsp;to provide targeted recommendations in an effort to avoid introducing new security issues.
"Powered by&nbsp;GitHub Copilot&nbsp;and&nbsp;CodeQL, code scanning autofix covers more than 90% of alert types in JavaScript, Typescript, Java, and


feed_id: https://thehackernews.com/2024/03/making-sense-of-operational-technology.html
title: Making Sense of Operational Technology Attacks: The Past, Present, and Future
uri: Making-Sense-of-Operational-Technology-Attacks-The-Past-Present-and
url: https://thehackernews.com/2024/03/making-sense-of-operational-technology.html
content:
When you read reports about cyber-attacks affecting operational technology (OT), it’s easy to get caught up in the hype and assume every single one is sophisticated. But are OT environments all over the world really besieged by a constant barrage of complex cyber-attacks? Answering that would require breaking down the different types of OT cyber-attacks and then looking back on all the


feed_id: https://thehackernews.com/2024/03/us-sanctions-russians-behind.html
title: U.S. Sanctions Russians Behind 'Doppelganger' Cyber Influence Campaign
uri: U-S-Sanctions-Russians-Behind-Doppelganger-Cyber-Influence-Campaign
url: https://thehackernews.com/2024/03/us-sanctions-russians-behind.html
content:
The U.S. Treasury Department's Office of Foreign Assets Control (OFAC) on Wednesday announced sanctions against two 46-year-old Russian nationals and the respective companies they own for engaging in cyber influence operations.
Ilya Andreevich Gambashidze (Gambashidze), the founder of the Moscow-based company Social Design Agency (SDA), and Nikolai Aleksandrovich Tupikin (Tupikin), the CEO and


feed_id: https://thehackernews.com/2024/03/ivanti-releases-urgent-fix-for-critical.html
title: Ivanti Releases Urgent Fix for Critical Sentry RCE Vulnerability
uri: Ivanti-Releases-Urgent-Fix-for-Critical-Sentry-RCE-Vulnerability
url: https://thehackernews.com/2024/03/ivanti-releases-urgent-fix-for-critical.html
content:
Ivanti has disclosed details of a critical remote code execution flaw impacting Standalone Sentry, urging customers to apply the fixes immediately to stay protected against potential cyber threats.
Tracked as&nbsp;CVE-2023-41724, the vulnerability carries a CVSS score of 9.6.
"An unauthenticated threat actor can execute arbitrary commands on the underlying operating system of the appliance


feed_id: https://thehackernews.com/2024/03/atlassian-releases-fixes-for-over-2.html
title: Atlassian Releases Fixes for Over 2 Dozen Flaws, Including Critical Bamboo Bug
uri: Atlassian-Releases-Fixes-for-Over-2-Dozen-Flaws-Including-Critical-Ba
url: https://thehackernews.com/2024/03/atlassian-releases-fixes-for-over-2.html
content:
Atlassian has released patches for&nbsp;more than two dozen security flaws, including a critical bug impacting Bamboo Data Center and Server that could be exploited without requiring user interaction.
Tracked as&nbsp;CVE-2024-1597, the vulnerability carries a CVSS score of 10.0, indicating maximum severity.
Described as an SQL injection flaw, it's rooted in a dependency called org.postgresql:


feed_id: https://thehackernews.com/2024/03/new-loop-dos-attack-impacts-hundreds-of.html
title: New 'Loop DoS' Attack Impacts Hundreds of Thousands of Systems
uri: New-Loop-DoS-Attack-Impacts-Hundreds-of-Thousands-of-Systems
url: https://thehackernews.com/2024/03/new-loop-dos-attack-impacts-hundreds-of.html
content:
A novel denial-of-service (DoS) attack vector has been found to target application-layer protocols based on User Datagram Protocol (UDP), putting hundreds of thousands of hosts likely at risk.
Called&nbsp;Loop DoS attacks, the&nbsp;approach&nbsp;pairs "servers of these protocols in such a way that they communicate with each other indefinitely," researchers from the CISPA Helmholtz-Center for


feed_id: https://thehackernews.com/2024/03/generative-ai-security-secure-your.html
title: Generative AI Security - Secure Your Business in a World Powered by LLMs
uri: Generative-AI-Security-Secure-Your-Business-in-a-World-Powered-by-LL
url: https://thehackernews.com/2024/03/generative-ai-security-secure-your.html
content:
Did you know that 79% of organizations are already leveraging Generative AI technologies? Much like the internet defined the 90s and the cloud revolutionized the 2010s, we are now in the era of Large Language Models (LLMs) and Generative AI.
The potential of Generative AI is immense, yet it brings significant challenges, especially in security integration. Despite their powerful capabilities,


feed_id: https://thehackernews.com/2024/03/teamcity-flaw-leads-to-surge-in.html
title: TeamCity Flaw Leads to Surge in Ransomware, Cryptomining, and RAT Attacks
uri: TeamCity-Flaw-Leads-to-Surge-in-Ransomware-Cryptomining-and-RAT-Atta
url: https://thehackernews.com/2024/03/teamcity-flaw-leads-to-surge-in.html
content:
Multiple threat actors are exploiting the recently disclosed security flaws in JetBrains TeamCity software to deploy ransomware, cryptocurrency miners, Cobalt Strike beacons, and a Golang-based remote access trojan called Spark RAT.
The attacks entail the exploitation of&nbsp;CVE-2024-27198&nbsp;(CVSS score: 9.8) that enables an adversary to bypass authentication measures and gain administrative


feed_id: https://thehackernews.com/2024/03/new-bunnyloader-malware-variant.html
title: New BunnyLoader Malware Variant Surfaces with Modular Attack Features
uri: New-BunnyLoader-Malware-Variant-Surfaces-with-Modular-Attack-Features
url: https://thehackernews.com/2024/03/new-bunnyloader-malware-variant.html
content:
Cybersecurity researchers have discovered an updated variant of a stealer and malware loader called&nbsp;BunnyLoader&nbsp;that modularizes its various functions as well as allow it to evade detection.
"BunnyLoader is dynamically developing malware with the capability to steal information, credentials and cryptocurrency, as well as deliver additional malware to its victims," Palo Alto Networks


feed_id: https://thehackernews.com/2024/03/ukraine-arrests-trio-for-hijacking-over.html
title: Ukraine Arrests Trio for Hijacking Over 100 Million Email and Instagram Accounts
uri: Ukraine-Arrests-Trio-for-Hijacking-Over-100-Million-Email-and-Instagra
url: https://thehackernews.com/2024/03/ukraine-arrests-trio-for-hijacking-over.html
content:
The Cyber Police of Ukraine has&nbsp;arrested&nbsp;three individuals on suspicion of hijacking more than 100 million emails and Instagram accounts from users across the world.
The suspects, aged between 20 and 40, are said to be part of an organized criminal group living in different parts of the country. If convicted, they face up to 15 years in prison.
The accounts, authorities said, were


feed_id: https://thehackernews.com/2024/03/us-epa-forms-task-force-to-protect.html
title: U.S. EPA Forms Task Force to Protect Water Systems from Cyberattacks
uri: U-S-EPA-Forms-Task-Force-to-Protect-Water-Systems-from-Cyberattacks
url: https://thehackernews.com/2024/03/us-epa-forms-task-force-to-protect.html
content:
The U.S. Environmental Protection Agency (EPA) said it's forming a new "Water Sector Cybersecurity Task Force" to devise methods to counter the threats faced by the water sector in the country.
"In addition to considering the prevalent vulnerabilities of water systems to cyberattacks and the challenges experienced by some systems in adopting best practices, this Task Force in its deliberations


feed_id: https://thehackernews.com/2024/03/apis-drive-majority-of-internet-traffic.html
title: APIs Drive the Majority of Internet Traffic and Cybercriminals are Taking Advantage
uri: APIs-Drive-the-Majority-of-Internet-Traffic-and-Cybercriminals-are-Tak
url: https://thehackernews.com/2024/03/apis-drive-majority-of-internet-traffic.html
content:
Application programming interfaces (APIs) are the connective tissue behind digital modernization, helping applications and databases exchange data more effectively.&nbsp;The State of API Security in 2024 Report&nbsp;from Imperva, a Thales company, found that the majority of internet traffic (71%) in 2023 was API calls. What’s more, a typical enterprise site saw an average of 1.5 billion API


feed_id: https://thehackernews.com/2024/03/from-deepfakes-to-malware-ais-expanding.html
title: From Deepfakes to Malware: AI's Expanding Role in Cyber Attacks
uri: From-Deepfakes-to-Malware-AI-s-Expanding-Role-in-Cyber-Attacks
url: https://thehackernews.com/2024/03/from-deepfakes-to-malware-ais-expanding.html
content:
Large language models (LLMs) powering artificial intelligence (AI) tools today could be exploited to develop self-augmenting malware capable of bypassing YARA rules.
"Generative AI can be used to evade string-based YARA rules by augmenting the source code of small malware variants, effectively lowering detection rates," Recorded Future&nbsp;said&nbsp;in a new report shared with The Hacker News.


feed_id: https://thehackernews.com/2024/03/crafting-and-communicating-your.html
title: Crafting and Communicating Your Cybersecurity Strategy for Board Buy-In
uri: Crafting-and-Communicating-Your-Cybersecurity-Strategy-for-Board-Buy-I
url: https://thehackernews.com/2024/03/crafting-and-communicating-your.html
content:
In an era where digital transformation drives business across sectors, cybersecurity has transcended its traditional operational role to become a cornerstone of corporate strategy and risk management. This evolution demands a shift in how cybersecurity leaders—particularly Chief Information Security Officers (CISOs)—articulate the value and urgency of cybersecurity investments to their boards.&


feed_id: https://thehackernews.com/2024/03/hackers-exploiting-popular-document.html
title: Hackers Exploiting Popular Document Publishing Sites for Phishing Attacks
uri: Hackers-Exploiting-Popular-Document-Publishing-Sites-for-Phishing-Atta
url: https://thehackernews.com/2024/03/hackers-exploiting-popular-document.html
content:
Threat actors are leveraging digital document publishing (DDP) sites hosted on platforms like FlipSnack, Issuu, Marq, Publuu, RelayTo, and Simplebooklet for carrying out phishing, credential harvesting, and session token theft, once again underscoring how threat actors are&nbsp;repurposing legitimate services&nbsp;for malicious ends.
"Hosting phishing lures on DDP sites increases the likelihood


feed_id: https://thehackernews.com/2024/03/suspected-russian-data-wiping-acidpour.html
title: Suspected Russian Data-Wiping 'AcidPour' Malware Targeting Linux x86 Devices
uri: Suspected-Russian-Data-Wiping-AcidPour-Malware-Targeting-Linux-x86-D
url: https://thehackernews.com/2024/03/suspected-russian-data-wiping-acidpour.html
content:
A new variant of a data wiping malware called AcidRain has been detected in the wild that's specifically designed for targeting Linux x86 devices.
The malware, dubbed AcidPour, is compiled for Linux x86 devices, SentinelOne's Juan Andres Guerrero-Saade said in a series of posts on X.
"The new variant [...] is an ELF binary compiled for x86 (not MIPS) and while it refers to similar devices/


feed_id: https://thehackernews.com/2024/03/new-phishing-attack-uses-clever.html
title: New Phishing Attack Uses Clever Microsoft Office Trick to Deploy NetSupport RAT
uri: New-Phishing-Attack-Uses-Clever-Microsoft-Office-Trick-to-Deploy-NetSu
url: https://thehackernews.com/2024/03/new-phishing-attack-uses-clever.html
content:
A new phishing campaign is targeting U.S. organizations with the intent to deploy a remote access trojan called NetSupport RAT.
Israeli cybersecurity company Perception Point is tracking the activity under the moniker&nbsp;Operation PhantomBlu.
"The PhantomBlu operation introduces a nuanced exploitation method, diverging from NetSupport RAT’s typical delivery mechanism by leveraging OLE (Object


feed_id: https://thehackernews.com/2024/03/e-root-marketplace-admin-sentenced-to.html
title: E-Root Marketplace Admin Sentenced to 42 Months for Selling 350K Stolen Credentials
uri: E-Root-Marketplace-Admin-Sentenced-to-42-Months-for-Selling-350K-Stole
url: https://thehackernews.com/2024/03/e-root-marketplace-admin-sentenced-to.html
content:
A 31-year-old Moldovan national has been sentenced to 42 months in prison in the U.S. for operating an illicit marketplace called E-Root Marketplace that offered for sale hundreds of thousands of compromised credentials, the Department of Justice (DoJ) announced.
Sandu Boris Diaconu was charged with conspiracy to commit access device and computer fraud and possession of 15 or more unauthorized


feed_id: https://thehackernews.com/2024/03/new-deepgosu-malware-campaign-targets.html
title: New DEEP#GOSU Malware Campaign Targets Windows Users with Advanced Tactics
uri: New-DEEP-GOSU-Malware-Campaign-Targets-Windows-Users-with-Advanced-Tac
url: https://thehackernews.com/2024/03/new-deepgosu-malware-campaign-targets.html
content:
A new elaborate attack campaign has been observed employing PowerShell and VBScript malware to infect Windows systems and harvest sensitive information.
Cybersecurity company Securonix, which dubbed the campaign DEEP#GOSU, said it's likely associated with the North Korean state-sponsored group tracked as Kimsuky (aka Emerald Sleet, Springtail, or Velvet Chollima).
"The malware payloads used in


feed_id: https://thehackernews.com/2024/03/fortra-patches-critical-rce.html
title: Fortra Patches Critical RCE Vulnerability in FileCatalyst Transfer Tool
uri: Fortra-Patches-Critical-RCE-Vulnerability-in-FileCatalyst-Transfer-Too
url: https://thehackernews.com/2024/03/fortra-patches-critical-rce.html
content:
Fortra has released details of a now-patched critical security flaw impacting its&nbsp;FileCatalyst&nbsp;file transfer solution that could allow unauthenticated attackers to gain remote code execution on susceptible servers.
Tracked as CVE-2024-25153, the shortcoming carries a CVSS score of 9.8 out of a maximum of 10.
"A directory traversal within the 'ftpservlet' of the FileCatalyst Workflow


feed_id: https://thehackernews.com/2024/03/hackers-using-sneaky-html-smuggling-to.html
title: Hackers Using Sneaky HTML Smuggling to Deliver Malware via Fake Google Sites
uri: Hackers-Using-Sneaky-HTML-Smuggling-to-Deliver-Malware-via-Fake-Google
url: https://thehackernews.com/2024/03/hackers-using-sneaky-html-smuggling-to.html
content:
Cybersecurity researchers have discovered a new malware campaign that leverages bogus Google Sites pages and HTML smuggling to distribute a commercial malware called&nbsp;AZORult&nbsp;in order to facilitate information theft.
"It uses an unorthodox HTML smuggling technique where the malicious payload is embedded in a separate JSON file hosted on an external website," Netskope Threat Labs


feed_id: https://thehackernews.com/2024/03/wordpress-admins-urged-to-remove.html
title: WordPress Admins Urged to Remove miniOrange Plugins Due to Critical Flaw
uri: WordPress-Admins-Urged-to-Remove-miniOrange-Plugins-Due-to-Critical-Fl
url: https://thehackernews.com/2024/03/wordpress-admins-urged-to-remove.html
content:
WordPress users of miniOrange's Malware Scanner and Web Application Firewall plugins are being urged to delete them from their websites following the discovery of a critical security flaw.
The flaw, tracked as&nbsp;CVE-2024-2172, is rated 9.8 out of a maximum of 10 on the CVSS scoring system and discovered by Stiofan. It impacts the following versions of the two plugins -

Malware Scanner&nbsp;(


feed_id: https://thehackernews.com/2024/03/apt28-hacker-group-targeting-europe.html
title: APT28 Hacker Group Targeting Europe, Americas, Asia in Widespread Phishing Scheme
uri: APT28-Hacker-Group-Targeting-Europe-Americas-Asia-in-Widespread-Phis
url: https://thehackernews.com/2024/03/apt28-hacker-group-targeting-europe.html
content:
The Russia-linked threat actor known as&nbsp;APT28&nbsp;has been linked to multiple ongoing phishing campaigns that employ lure documents imitating government and non-governmental organizations (NGOs) in Europe, the South Caucasus, Central Asia, and North and South America.
"The uncovered lures include a mixture of internal and publicly available documents, as well as possible actor-generated


feed_id: https://thehackernews.com/2024/03/hackers-using-cracked-software-on.html
title: Hackers Using Cracked Software on GitHub to Spread RisePro Info Stealer
uri: Hackers-Using-Cracked-Software-on-GitHub-to-Spread-RisePro-Info-Steale
url: https://thehackernews.com/2024/03/hackers-using-cracked-software-on.html
content:
Cybersecurity researchers have found a number of GitHub repositories offering cracked software that are used to deliver an information stealer called RisePro.
The campaign, codenamed&nbsp;gitgub, includes 17 repositories associated with 11 different accounts, according to G DATA. The repositories in question have since been taken down by the Microsoft-owned subsidiary.
"The repositories look


feed_id: https://thehackernews.com/2024/03/ghostrace-new-data-leak-vulnerability.html
title: GhostRace – New Data Leak Vulnerability Affects Modern CPUs
uri: GhostRace-New-Data-Leak-Vulnerability-Affects-Modern-CPUs
url: https://thehackernews.com/2024/03/ghostrace-new-data-leak-vulnerability.html
content:
A group of researchers has discovered a new data leakage attack impacting modern CPU architectures supporting speculative execution.
Dubbed&nbsp;GhostRace&nbsp;(CVE-2024-2193), it is a variation of the transient execution CPU vulnerability known as Spectre v1 (CVE-2017-5753). The approach combines speculative execution and race conditions.
"All the common synchronization primitives implemented


feed_id: https://thehackernews.com/2024/03/third-party-chatgpt-plugins-could-lead.html
title: Third-Party ChatGPT Plugins Could Lead to Account Takeovers
uri: Third-Party-ChatGPT-Plugins-Could-Lead-to-Account-Takeovers
url: https://thehackernews.com/2024/03/third-party-chatgpt-plugins-could-lead.html
content:
Cybersecurity researchers have found that third-party plugins available for OpenAI ChatGPT could act as a new attack surface for threat actors looking to gain unauthorized access to sensitive data.
According to&nbsp;new research&nbsp;published by Salt Labs, security flaws found directly in ChatGPT and within the ecosystem could allow attackers to install malicious plugins without users' consent


feed_id: https://thehackernews.com/2024/03/google-introduces-enhanced-real-time.html
title: Google Introduces Enhanced Real-Time URL Protection for Chrome Users
uri: Google-Introduces-Enhanced-Real-Time-URL-Protection-for-Chrome-Users
url: https://thehackernews.com/2024/03/google-introduces-enhanced-real-time.html
content:
Google on Thursday announced an enhanced version of Safe Browsing to provide real-time, privacy-preserving URL protection and safeguard users from visiting potentially malicious sites.
“The&nbsp;Standard protection mode for Chrome&nbsp;on desktop and iOS will check sites against Google’s server-side list of known bad sites in real-time,” Google’s Jonathan Li and Jasika Bawa&nbsp;said.
“If we


feed_id: https://thehackernews.com/2024/03/malicious-ads-targeting-chinese-users.html
title: Malicious Ads Targeting Chinese Users with Fake Notepad++ and VNote Installers
uri: Malicious-Ads-Targeting-Chinese-Users-with-Fake-Notepad-and-VNote-In
url: https://thehackernews.com/2024/03/malicious-ads-targeting-chinese-users.html
content:
Chinese users looking for legitimate software such as Notepad++ and VNote on search engines like Baidu are being targeted with malicious ads and bogus links to distribute trojanized versions of the software and ultimately deploy&nbsp;Geacon, a Golang-based implementation of Cobalt Strike.
“The malicious site found in the notepad++ search is distributed through an advertisement block,” Kaspersky


feed_id: https://thehackernews.com/2024/03/hackers-target-indian-defense-and.html
title: Hackers Hit Indian Defense, Energy Sectors with Malware Posing as Air Force Invite
uri: Hackers-Hit-Indian-Defense-Energy-Sectors-with-Malware-Posing-as-Air
url: https://thehackernews.com/2024/03/hackers-target-indian-defense-and.html
content:
Indian government entities and energy companies have been targeted by unknown threat actors with an aim to deliver a modified version of an open-source information stealer malware called HackBrowserData and exfiltrate sensitive information in some cases by using Slack as command-and-control (C2).
"The information stealer was delivered via a phishing email, masquerading as an invitation letter


feed_id: https://thehackernews.com/2024/03/cisa-warns-hackers-actively-attacking.html
title: CISA Warns: Hackers Actively Attacking Microsoft SharePoint Vulnerability
uri: CISA-Warns-Hackers-Actively-Attacking-Microsoft-SharePoint-Vulnerabil
url: https://thehackernews.com/2024/03/cisa-warns-hackers-actively-attacking.html
content:
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has&nbsp;added&nbsp;a security flaw impacting Microsoft Sharepoint Server to its Known Exploited Vulnerabilities (KEV) catalog based on evidence of active exploitation in the wild.
The vulnerability, tracked as CVE-2023-24955 (CVSS score: 7.2), is a critical remote code execution flaw that allows an authenticated attacker with Site


feed_id: https://thehackernews.com/2024/03/microsoft-edge-bug-could-have-allowed.html
title: Microsoft Edge Bug Could Have Allowed Attackers to Silently Install Malicious Extensions
uri: Microsoft-Edge-Bug-Could-Have-Allowed-Attackers-to-Silently-Install-Ma
url: https://thehackernews.com/2024/03/microsoft-edge-bug-could-have-allowed.html
content:
A now-patched security flaw in the Microsoft Edge web browser could have been abused to install arbitrary extensions on users' systems and carry out malicious actions.&nbsp;
"This flaw could have allowed an attacker to exploit a private API, initially intended for marketing purposes, to covertly install additional browser extensions with broad permissions without the user's knowledge," Guardio


feed_id: https://thehackernews.com/2024/03/sase-solutions-fall-short-without.html
title: SASE Solutions Fall Short Without Enterprise Browser Extensions, New Report Reveals
uri: SASE-Solutions-Fall-Short-Without-Enterprise-Browser-Extensions-New-R
url: https://thehackernews.com/2024/03/sase-solutions-fall-short-without.html
content:
As SaaS applications dominate the business landscape, organizations need optimized network speed and robust security measures. Many of them have been turning to SASE, a product category that offers cloud-based network protection while enhancing network infrastructure performance.
However, a new report: "Better Together: SASE and Enterprise Browser Extension for the SaaS-First Enterprise" (


feed_id: https://thehackernews.com/2024/03/critical-unpatched-ray-ai-platform.html
title: Critical Unpatched Ray AI Platform Vulnerability Exploited for Cryptocurrency Mining
uri: Critical-Unpatched-Ray-AI-Platform-Vulnerability-Exploited-for-Cryptoc
url: https://thehackernews.com/2024/03/critical-unpatched-ray-ai-platform.html
content:
Cybersecurity researchers are warning that threat actors are actively exploiting a "disputed" and unpatched vulnerability in an open-source artificial intelligence (AI) platform called Anyscale Ray to hijack computing power for illicit cryptocurrency mining.
"This vulnerability allows attackers to take over the companies' computing power and leak sensitive data," Oligo Security researchers Avi


feed_id: https://thehackernews.com/2024/03/alert-new-phishing-attack-delivers.html
title: Alert: New Phishing Attack Delivers Keylogger Disguised as Bank Payment Notice
uri: Alert-New-Phishing-Attack-Delivers-Keylogger-Disguised-as-Bank-Paymen
url: https://thehackernews.com/2024/03/alert-new-phishing-attack-delivers.html
content:
A new phishing campaign has been observed leveraging a novel loader malware to deliver an information stealer and keylogger called&nbsp;Agent Tesla.
Trustwave SpiderLabs said it identified a phishing email bearing this attack chain on March 8, 2024. The message masquerades as a bank payment notification, urging the user to open an archive file attachment.
The archive ("Bank Handlowy w Warszawie


feed_id: https://thehackernews.com/2024/03/two-chinese-apt-groups-ramp-up-cyber.html
title: Two Chinese APT Groups Ramp Up Cyber Espionage Against ASEAN Countries
uri: Two-Chinese-APT-Groups-Ramp-Up-Cyber-Espionage-Against-ASEAN-Countries
url: https://thehackernews.com/2024/03/two-chinese-apt-groups-ramp-up-cyber.html
content:
Two China-linked advanced persistent threat (APT) groups have been observed targeting entities and member countries affiliated with the Association of Southeast Asian Nations (ASEAN) as part of a cyber espionage campaign over the past three months.
This includes the threat actor known as&nbsp;Mustang Panda, which has been recently linked to&nbsp;cyber attacks against Myanmar&nbsp;as well as


feed_id: https://thehackernews.com/2024/03/malicious-nuget-package-linked-to.html
title: Sketchy NuGet Package Likely Linked to Industrial Espionage Targets Developers
uri: Sketchy-NuGet-Package-Likely-Linked-to-Industrial-Espionage-Targets-De
url: https://thehackernews.com/2024/03/malicious-nuget-package-linked-to.html
content:
Threat hunters have identified a suspicious package in the&nbsp;NuGet package manager&nbsp;that's likely designed to target developers working with tools made by a Chinese firm that specializes in industrial- and digital equipment manufacturing.
The package in question is&nbsp;SqzrFramework480, which ReversingLabs said was first published on January 24, 2024. It has been&nbsp;downloaded&nbsp;


feed_id: https://thehackernews.com/2024/03/us-charges-7-chinese-nationals-in-major.html
title: U.S. Charges 7 Chinese Nationals in Major 14-Year Cyber Espionage Operation
uri: U-S-Charges-7-Chinese-Nationals-in-Major-14-Year-Cyber-Espionage-Oper
url: https://thehackernews.com/2024/03/us-charges-7-chinese-nationals-in-major.html
content:
The U.S. Department of Justice (DoJ) on Monday unsealed indictments against seven Chinese nationals for their involvement in a hacking group that targeted U.S. and foreign critics, journalists, businesses, and political officials for about 14 years.
The defendants include Ni Gaobin (倪高彬), Weng Ming (翁明), Cheng Feng (程锋), Peng Yaowen (彭耀文), Sun Xiaohui (孙小辉), Xiong Wang (熊旺), and Zhao Guangzong (


feed_id: https://thehackernews.com/2024/03/crafting-shields-defending-minecraft.html
title: Crafting Shields: Defending Minecraft Servers Against DDoS Attacks
uri: Crafting-Shields-Defending-Minecraft-Servers-Against-DDoS-Attacks
url: https://thehackernews.com/2024/03/crafting-shields-defending-minecraft.html
content:
Minecraft, with over 500 million registered users and 166 million monthly players, faces significant risks from distributed denial-of-service (DDoS) attacks, threatening server functionality, player experience, and the game’s reputation. Despite the prevalence of DDoS attacks on the game, the majority of incidents go unreported, leaving a gap in awareness and protection. This article explains


feed_id: https://thehackernews.com/2024/03/us-sanctions-3-cryptocurrency-exchanges.html
title: U.S. Sanctions 3 Cryptocurrency Exchanges for Helping Russia Evade Sanctions
uri: U-S-Sanctions-3-Cryptocurrency-Exchanges-for-Helping-Russia-Evade-San
url: https://thehackernews.com/2024/03/us-sanctions-3-cryptocurrency-exchanges.html
content:
The U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC) sanctioned three cryptocurrency exchanges for offering services used to evade economic restrictions imposed on Russia following its invasion of Ukraine in early 2022.
This includes Bitpapa IC FZC LLC, Crypto Explorer DMCC (AWEX), and Obshchestvo S Ogranichennoy Otvetstvennostyu Tsentr Obrabotki Elektronnykh Platezhey (


feed_id: https://thehackernews.com/2024/03/cisa-alerts-on-active-exploitation-of.html
title: CISA Alerts on Active Exploitation of Flaws in Fortinet, Ivanti, and Nice Products
uri: CISA-Alerts-on-Active-Exploitation-of-Flaws-in-Fortinet-Ivanti-and-N
url: https://thehackernews.com/2024/03/cisa-alerts-on-active-exploitation-of.html
content:
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday&nbsp;placed&nbsp;three security flaws to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation.
The vulnerabilities added are as follows -

CVE-2023-48788&nbsp;(CVSS score: 9.3) - Fortinet FortiClient EMS SQL Injection Vulnerability
CVE-2021-44529&nbsp;(CVSS score: 9.8) - Ivanti


feed_id: https://thehackernews.com/2024/03/hackers-hijack-github-accounts-in.html
title: Hackers Hijack GitHub Accounts in Supply Chain Attack Affecting Top-gg and Others
uri: Hackers-Hijack-GitHub-Accounts-in-Supply-Chain-Attack-Affecting-Top-gg
url: https://thehackernews.com/2024/03/hackers-hijack-github-accounts-in.html
content:
Unidentified adversaries orchestrated a sophisticated attack campaign that has impacted several individual developers as well as the GitHub organization account associated with Top.gg, a Discord bot discovery site.
"The threat actors used multiple TTPs in this attack, including account takeover via stolen browser cookies, contributing malicious code with verified commits, setting up a custom


feed_id: https://thehackernews.com/2024/03/key-lesson-from-microsofts-password.html
title: Key Lesson from Microsoft’s Password Spray Hack: Secure Every Account
uri: Key-Lesson-from-Microsoft-s-Password-Spray-Hack-Secure-Every-Accoun
url: https://thehackernews.com/2024/03/key-lesson-from-microsofts-password.html
content:
In January 2024, Microsoft discovered they’d been the&nbsp;victim of a hack&nbsp;orchestrated by Russian-state hackers Midnight Blizzard (sometimes known as Nobelium). The concerning detail about this case is how easy it was to breach the software giant. It wasn’t a highly technical hack that exploited a zero-day vulnerability – the hackers used a simple password spray attack to take control of


feed_id: https://thehackernews.com/2024/03/new-gofetch-vulnerability-in-apple-m.html
title: New "GoFetch" Vulnerability in Apple M-Series Chips Leaks Secret Encryption Keys
uri: New-GoFetch-Vulnerability-in-Apple-M-Series-Chips-Leaks-Secret-Encry
url: https://thehackernews.com/2024/03/new-gofetch-vulnerability-in-apple-m.html
content:
A new security shortcoming discovered in Apple M-series chips could be exploited to extract secret keys used during cryptographic operations.
Dubbed&nbsp;GoFetch, the vulnerability relates to a microarchitectural side-channel attack that takes advantage of a feature known as data memory-dependent prefetcher (DMP) to target constant-time cryptographic implementations and capture sensitive data


feed_id: https://thehackernews.com/2024/03/iran-linked-muddywater-deploys-atera.html
title: Iran-Linked MuddyWater Deploys Atera for Surveillance in Phishing Attacks
uri: Iran-Linked-MuddyWater-Deploys-Atera-for-Surveillance-in-Phishing-Atta
url: https://thehackernews.com/2024/03/iran-linked-muddywater-deploys-atera.html
content:
The Iran-affiliated threat actor tracked as&nbsp;MuddyWater&nbsp;(aka Mango Sandstorm or TA450) has been linked to a new phishing campaign in March 2024 that aims to deliver a legitimate Remote Monitoring and Management (RMM) solution called Atera.
The activity, which took place from March 7 through the week of March 11, targeted Israeli entities spanning global manufacturing, technology, and


feed_id: https://thehackernews.com/2024/03/n-korea-linked-kimsuky-shifts-to.html
title: N. Korea-linked Kimsuky Shifts to Compiled HTML Help Files in Ongoing Cyberattacks
uri: N-Korea-linked-Kimsuky-Shifts-to-Compiled-HTML-Help-Files-in-Ongoing
url: https://thehackernews.com/2024/03/n-korea-linked-kimsuky-shifts-to.html
content:
The North Korea-linked threat actor known as&nbsp;Kimsuky&nbsp;(aka Black Banshee, Emerald Sleet, or Springtail) has been observed shifting its tactics, leveraging Compiled HTML Help (CHM) files as vectors to deliver malware for harvesting sensitive data.
Kimsuky, active since at least 2012, is known to target entities located in South Korea as well as North America, Asia, and Europe.
According


feed_id: https://thehackernews.com/2024/03/german-police-seize-nemesis-market-in.html
title: German Police Seize 'Nemesis Market' in Major International Darknet Raid
uri: German-Police-Seize-Nemesis-Market-in-Major-International-Darknet-Ra
url: https://thehackernews.com/2024/03/german-police-seize-nemesis-market-in.html
content:
German authorities have announced the takedown of an illicit underground marketplace called&nbsp;Nemesis Market&nbsp;that peddled narcotics, stolen data, and various cybercrime services.
The Federal Criminal Police Office (aka Bundeskriminalamt or BKA) said it seized the digital infrastructure associated with the darknet service located in Germany and Lithuania and confiscated €94,000 ($102,107)


feed_id: https://thehackernews.com/2024/03/russian-hackers-use-wineloader-malware.html
title: Russian Hackers Use 'WINELOADER' Malware to Target German Political Parties
uri: Russian-Hackers-Use-WINELOADER-Malware-to-Target-German-Political-Pa
url: https://thehackernews.com/2024/03/russian-hackers-use-wineloader-malware.html
content:
The WINELOADER backdoor used in recent cyber attacks targeting diplomatic entities with wine-tasting phishing lures has been attributed as the handiwork of a hacking group with links to Russia's Foreign Intelligence Service (SVR), which was responsible for&nbsp;breaching SolarWinds and Microsoft.
The findings come from Mandiant, which said&nbsp;Midnight Blizzard&nbsp;(aka APT29, BlueBravo, or


feed_id: https://thehackernews.com/2024/03/dormakaba-locks-used-in-millions-of.html
title: Dormakaba Locks Used in Millions of Hotel Rooms Could Be Cracked in Seconds
uri: Dormakaba-Locks-Used-in-Millions-of-Hotel-Rooms-Could-Be-Cracked-in-Se
url: https://thehackernews.com/2024/03/dormakaba-locks-used-in-millions-of.html
content:
Security vulnerabilities discovered in Dormakaba's Saflok electronic RFID locks used in hotels could be weaponized by threat actors to forge keycards and stealthily slip into locked rooms.
The shortcomings have been collectively named&nbsp;Unsaflok&nbsp;by researchers Lennert Wouters, Ian Carroll, rqu, BusesCanFly, Sam Curry, sshell, and Will Caruana. They were reported to the Zurich-based


feed_id: https://thehackernews.com/2024/03/themoon-botnet-resurfaces-exploiting.html
title: TheMoon Botnet Resurfaces, Exploiting EoL Devices to Power Criminal Proxy
uri: TheMoon-Botnet-Resurfaces-Exploiting-EoL-Devices-to-Power-Criminal-Pr
url: https://thehackernews.com/2024/03/themoon-botnet-resurfaces-exploiting.html
content:
A botnet previously considered to be rendered inert has been observed enslaving end-of-life (EoL) small home/small office (SOHO) routers and IoT devices to fuel a criminal proxy service called Faceless.
"TheMoon, which&nbsp;emerged&nbsp;in&nbsp;2014, has been operating quietly while growing to over 40,000 bots from 88 countries in January and February of 2024," the Black Lotus Labs team at Lumen


feed_id: https://thehackernews.com/2024/03/the-golden-age-of-automated-penetration.html
title: The Golden Age of Automated Penetration Testing is Here
uri: The-Golden-Age-of-Automated-Penetration-Testing-is-Here
url: https://thehackernews.com/2024/03/the-golden-age-of-automated-penetration.html
content:
Network penetration testing plays a vital role in detecting vulnerabilities that can be exploited. The current method of performing pen testing is pricey, leading many companies to undertake it only when necessary, usually once a year for their compliance requirements. This manual approach often misses opportunities to find and fix security issues early on, leaving businesses vulnerable to


feed_id: https://thehackernews.com/2024/03/new-linux-bug-could-lead-to-user.html
title: New Linux Bug Could Lead to User Password Leaks and Clipboard Hijacking
uri: New-Linux-Bug-Could-Lead-to-User-Password-Leaks-and-Clipboard-Hijackin
url: https://thehackernews.com/2024/03/new-linux-bug-could-lead-to-user.html
content:
Details have emerged about a vulnerability impacting the "wall" command of the util-linux package that could be potentially exploited by a bad actor to leak a user's password or alter the clipboard on certain Linux distributions.
The bug, tracked as CVE-2024-28085, has been codenamed&nbsp;WallEscape&nbsp;by security researcher Skyler Ferrante. It has been described as a case of improper


feed_id: https://thehackernews.com/2024/03/pypi-halts-sign-ups-amid-surge-of.html
title: PyPI Halts Sign-Ups Amid Surge of Malicious Package Uploads Targeting Developers
uri: PyPI-Halts-Sign-Ups-Amid-Surge-of-Malicious-Package-Uploads-Targeting
url: https://thehackernews.com/2024/03/pypi-halts-sign-ups-amid-surge-of.html
content:
The maintainers of the Python Package Index (PyPI) repository briefly suspended new user sign-ups following an influx of malicious projects uploaded as part of a typosquatting campaign.
PyPI said "new project creation and new user registration" was temporarily halted to mitigate what it said was a "malware upload campaign." The incident was resolved 10 hours later, on March 28, 2024, at 12:56


feed_id: https://thehackernews.com/2024/03/linux-version-of-dinodasrat-spotted-in.html
title: Linux Version of DinodasRAT Spotted in Cyber Attacks Across Several Countries
uri: Linux-Version-of-DinodasRAT-Spotted-in-Cyber-Attacks-Across-Several-Co
url: https://thehackernews.com/2024/03/linux-version-of-dinodasrat-spotted-in.html
content:
A Linux version of a multi-platform backdoor called&nbsp;DinodasRAT&nbsp;has been detected in the wild targeting China, Taiwan, Turkey, and Uzbekistan,&nbsp;new findings&nbsp;from Kaspersky reveal.
DinodasRAT, also known as XDealer, is a C++-based malware that offers the ability to harvest a wide range of sensitive data from compromised hosts.
In October 2023, Slovak cybersecurity firm ESET&nbsp


feed_id: https://thehackernews.com/2024/03/finland-blames-chinese-hacking-group.html
title: Finland Blames Chinese Hacking Group APT31 for Parliament Cyber Attack
uri: Finland-Blames-Chinese-Hacking-Group-APT31-for-Parliament-Cyber-Attack
url: https://thehackernews.com/2024/03/finland-blames-chinese-hacking-group.html
content:
The Police of Finland (aka Poliisi) has formally accused a Chinese nation-state actor tracked as APT31 for orchestrating a cyber attack targeting the country's Parliament in 2020.
The intrusion, per the authorities, is said to have occurred between fall 2020 and early 2021. The agency described the ongoing criminal probe as both demanding and time-consuming, involving extensive analysis of a "


feed_id: https://thehackernews.com/2024/03/new-zenhammer-attack-bypasses-rowhammer.html
title: New ZenHammer Attack Bypasses RowHammer Defenses on AMD CPUs
uri: New-ZenHammer-Attack-Bypasses-RowHammer-Defenses-on-AMD-CPUs
url: https://thehackernews.com/2024/03/new-zenhammer-attack-bypasses-rowhammer.html
content:
Cybersecurity researchers from ETH Zurich have developed a new variant of the RowHammer DRAM (dynamic random-access memory) attack that, for the first time, successfully works against AMD Zen 2 and Zen 3 systems despite mitigations such as Target Row Refresh (TRR).
"This result proves that AMD systems are equally vulnerable to Rowhammer as Intel systems, which greatly increases the attack


feed_id: https://thehackernews.com/2024/03/new-webinar-avoiding-application.html
title: New Webinar: Avoiding Application Security Blind Spots with OPSWAT and F5
uri: New-Webinar-Avoiding-Application-Security-Blind-Spots-with-OPSWAT-and
url: https://thehackernews.com/2024/03/new-webinar-avoiding-application.html
content:
Considering the ever-changing state of cybersecurity, it's never too late to ask yourself, "am I doing what's necessary to keep my organization's web applications secure?"
The continuous evolution of technology introduces new and increasingly sophisticated threats daily, posing challenges to organizations all over the world and across the broader spectrum of industries striving to maintain


feed_id: https://thehackernews.com/2024/03/behind-scenes-art-of-safeguarding-non.html
title: Behind the Scenes: The Art of Safeguarding Non-Human Identities
uri: Behind-the-Scenes-The-Art-of-Safeguarding-Non-Human-Identities
url: https://thehackernews.com/2024/03/behind-scenes-art-of-safeguarding-non.html
content:
In the whirlwind of modern software development, teams race against time, constantly pushing the boundaries of innovation and efficiency. This relentless pace is fueled by an evolving tech landscape, where SaaS domination, the proliferation of microservices, and the ubiquity of CI/CD pipelines are not just trends but the new norm.
Amidst this backdrop, a critical aspect subtly weaves into the


feed_id: https://thehackernews.com/2024/03/darcula-phishing-network-leveraging-rcs.html
title: Darcula Phishing Network Leveraging RCS and iMessage to Evade Detection
uri: Darcula-Phishing-Network-Leveraging-RCS-and-iMessage-to-Evade-Detectio
url: https://thehackernews.com/2024/03/darcula-phishing-network-leveraging-rcs.html
content:
A sophisticated phishing-as-a-service (PhaaS) platform called&nbsp;Darcula&nbsp;has set its sights on organizations in over 100 countries by leveraging a massive network of more than 20,000 counterfeit domains to help cyber criminals launch attacks at scale.
"Using iMessage and RCS rather than SMS to send text messages has the side effect of bypassing SMS firewalls, which is being used to great


feed_id: https://thehackernews.com/2024/03/telegram-offers-premium-subscription-in.html
title: Telegram Offers Premium Subscription in Exchange for Using Your Number to Send OTPs
uri: Telegram-Offers-Premium-Subscription-in-Exchange-for-Using-Your-Number
url: https://thehackernews.com/2024/03/telegram-offers-premium-subscription-in.html
content:
In June 2017, a&nbsp;study&nbsp;of more than 3,000 Massachusetts Institute of Technology (MIT) students&nbsp;published&nbsp;by the National Bureau for Economic Research (NBER) found that 98% of them were willing to give away their friends' email addresses in exchange for free pizza.
"Whereas people say they care about privacy, they are willing to relinquish private data quite easily when


feed_id: https://thehackernews.com/2024/04/indian-government-rescues-250-citizens.html
title: Indian Government Rescues 250 Citizens Forced into Cybercrime in Cambodia
uri: Indian-Government-Rescues-250-Citizens-Forced-into-Cybercrime-in-Cambo
url: https://thehackernews.com/2024/04/indian-government-rescues-250-citizens.html
content:
The Indian government said it has rescued and repatriated about 250 citizens in Cambodia who were held captive and coerced into running cyber scams.
The Indian nationals "were lured with employment opportunities to that country but were forced to undertake illegal cyber work," the Ministry of External Affairs (MEA)&nbsp;said&nbsp;in a statement, adding it had rescued 75 people in the past three


feed_id: https://thehackernews.com/2024/04/detecting-windows-based-malware-through.html
title: Detecting Windows-based Malware Through Better Visibility
uri: Detecting-Windows-based-Malware-Through-Better-Visibility
url: https://thehackernews.com/2024/04/detecting-windows-based-malware-through.html
content:
Despite a plethora of available security solutions, more and more organizations fall victim to Ransomware and other threats. These continued threats aren't just an inconvenience that hurt businesses and end users - they damage the economy, endanger lives, destroy businesses and put national security at risk. But if that wasn’t enough – North Korea appears to be&nbsp;using revenue from cyber


feed_id: https://thehackernews.com/2024/04/malicious-apps-caught-secretly-turning.html
title: Malicious Apps Caught Secretly Turning Android Phones into Proxies for Cybercriminals
uri: Malicious-Apps-Caught-Secretly-Turning-Android-Phones-into-Proxies-for
url: https://thehackernews.com/2024/04/malicious-apps-caught-secretly-turning.html
content:
Several malicious Android apps that turn mobile devices running the operating system into residential proxies (RESIPs) for other threat actors have been observed on the Google Play Store.
The findings come from HUMAN's Satori Threat Intelligence team, which said the cluster of VPN apps came fitted with a Golang library that transformed the user's device into a proxy node without their knowledge.


feed_id: https://thehackernews.com/2024/04/vultur-android-banking-trojan-returns.html
title: Vultur Android Banking Trojan Returns with Upgraded Remote Control Capabilities
uri: Vultur-Android-Banking-Trojan-Returns-with-Upgraded-Remote-Control-Cap
url: https://thehackernews.com/2024/04/vultur-android-banking-trojan-returns.html
content:
The Android banking trojan known as Vultur has resurfaced with a suite of new features and improved anti-analysis and detection evasion techniques, enabling its operators to remotely interact with a mobile device and harvest sensitive data.
"Vultur has also started masquerading more of its malicious activity by encrypting its C2 communication, using multiple encrypted payloads that are decrypted


feed_id: https://thehackernews.com/2024/03/hackers-target-macos-users-with.html
title: Hackers Target macOS Users with Malicious Ads Spreading Stealer Malware
uri: Hackers-Target-macOS-Users-with-Malicious-Ads-Spreading-Stealer-Malwar
url: https://thehackernews.com/2024/03/hackers-target-macos-users-with.html
content:
Malicious ads and bogus websites are acting as a conduit to deliver two different stealer malware, including Atomic Stealer, targeting Apple macOS users.
The ongoing infostealer attacks targeting macOS users may have adopted different methods to compromise victims' Macs, but operate with the end goal of stealing sensitive data, Jamf Threat Labs&nbsp;said&nbsp;in a report published Friday.
One


feed_id: https://thehackernews.com/2024/03/urgent-secret-backdoor-found-in-xz.html
title: Urgent: Secret Backdoor Found in XZ Utils Library, Impacts Major Linux Distros
uri: Urgent-Secret-Backdoor-Found-in-XZ-Utils-Library-Impacts-Major-Linux
url: https://thehackernews.com/2024/03/urgent-secret-backdoor-found-in-xz.html
content:
Red Hat on Friday released an "urgent security alert" warning that two versions of a popular data compression library called&nbsp;XZ Utils&nbsp;(previously LZMA Utils) have been backdoored with malicious code designed to allow unauthorized remote access.
The software supply chain compromise, tracked as&nbsp;CVE-2024-3094, has a CVSS score of 10.0, indicating maximum severity. It impacts XZ Utils


feed_id: https://thehackernews.com/2024/04/ivanti-rushes-patches-for-4-new-flaw-in.html
title: Ivanti Rushes Patches for 4 New Flaws in Connect Secure and Policy Secure
uri: Ivanti-Rushes-Patches-for-4-New-Flaws-in-Connect-Secure-and-Policy-Sec
url: https://thehackernews.com/2024/04/ivanti-rushes-patches-for-4-new-flaw-in.html
content:
Ivanti has released security updates to address four security flaws impacting Connect Secure and Policy Secure Gateways that could result in code execution and denial-of-service (DoS).
The list of flaws is as follows -

CVE-2024-21894&nbsp;(CVSS score: 8.2) - A heap overflow vulnerability in the IPSec component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure allows an


feed_id: https://thehackernews.com/2024/04/google-warns-android-zero-day-flaws-in.html
title: Google Warns: Android Zero-Day Flaws in Pixel Phones Exploited by Forensic Companies
uri: Google-Warns-Android-Zero-Day-Flaws-in-Pixel-Phones-Exploited-by-Fore
url: https://thehackernews.com/2024/04/google-warns-android-zero-day-flaws-in.html
content:
Google has disclosed that two Android security flaws impacting its Pixel smartphones have been exploited in the wild by forensic companies.
The high-severity zero-day vulnerabilities are as follows -

CVE-2024-29745&nbsp;- An information disclosure flaw in the bootloader component
CVE-2024-29748&nbsp;- A privilege escalation flaw in the firmware component

"There are indications that the [


feed_id: https://thehackernews.com/2024/04/us-cyber-safety-board-slams-microsoft.html
title: U.S. Cyber Safety Board Slams Microsoft Over Breach by China-Based Hackers
uri: U-S-Cyber-Safety-Board-Slams-Microsoft-Over-Breach-by-China-Based-Hac
url: https://thehackernews.com/2024/04/us-cyber-safety-board-slams-microsoft.html
content:
The U.S. Cyber Safety Review Board (CSRB) has criticized Microsoft for a series of security lapses that led to the breach of nearly two dozen companies across Europe and the U.S. by a China-based nation-state group called Storm-0558 last year.
The findings, released by the Department of Homeland Security (DHS) on Tuesday, found that the intrusion was preventable, and that it became successful


feed_id: https://thehackernews.com/2024/04/google-chrome-beta-tests-new-dbsc.html
title: Google Chrome Beta Tests New DBSC Protection Against Cookie-Stealing Attacks
uri: Google-Chrome-Beta-Tests-New-DBSC-Protection-Against-Cookie-Stealing-A
url: https://thehackernews.com/2024/04/google-chrome-beta-tests-new-dbsc.html
content:
Google on Tuesday said it's piloting a new feature in Chrome called Device Bound Session Credentials (DBSC) to help protect users against session cookie theft by malware.
The prototype – currently tested against "some" Google Account users running Chrome Beta – is built with an aim to make it an open web standard, the tech giant's Chromium team said.
"By binding authentication sessions to the


feed_id: https://thehackernews.com/2024/04/attack-surface-management-vs.html
title: Attack Surface Management vs. Vulnerability Management
uri: Attack-Surface-Management-vs-Vulnerability-Management
url: https://thehackernews.com/2024/04/attack-surface-management-vs.html
content:
Attack surface management (ASM) and vulnerability management (VM) are often confused, and while they overlap, they’re not the same. The main difference between attack surface management and vulnerability management is in their scope: vulnerability management checks a list of known assets, while attack surface management assumes you have unknown assets and so begins with discovery. Let’s look at


feed_id: https://thehackernews.com/2024/04/mispadu-trojan-targets-europe-thousands.html
title: Mispadu Trojan Targets Europe, Thousands of Credentials Compromised
uri: Mispadu-Trojan-Targets-Europe-Thousands-of-Credentials-Compromised
url: https://thehackernews.com/2024/04/mispadu-trojan-targets-europe-thousands.html
content:
The banking trojan known as&nbsp;Mispadu&nbsp;has expanded its focus beyond Latin America (LATAM) and Spanish-speaking individuals to target users in Italy, Poland, and Sweden.
Targets of the ongoing campaign include entities spanning finance, services, motor vehicle manufacturing, law firms, and commercial facilities, according to Morphisec.
"Despite the geographic expansion, Mexico remains the


feed_id: https://thehackernews.com/2024/04/critical-security-flaw-found-in-popular.html
title: Critical Security Flaw Found in Popular LayerSlider WordPress Plugin
uri: Critical-Security-Flaw-Found-in-Popular-LayerSlider-WordPress-Plugin
url: https://thehackernews.com/2024/04/critical-security-flaw-found-in-popular.html
content:
A critical security flaw impacting the LayerSlider plugin for WordPress could be abused to extract sensitive information from databases, such as password hashes.
The flaw, designated as&nbsp;CVE-2024-2879, carries a CVSS score of 9.8 out of a maximum of 10.0. It has been described as a case of SQL injection impacting versions from 7.9.11 through 7.10.0.
The issue has been addressed in version


feed_id: https://thehackernews.com/2024/04/malicious-code-in-xz-utils-for-linux.html
title: Malicious Code in XZ Utils for Linux Systems Enables Remote Code Execution
uri: Malicious-Code-in-XZ-Utils-for-Linux-Systems-Enables-Remote-Code-Execu
url: https://thehackernews.com/2024/04/malicious-code-in-xz-utils-for-linux.html
content:
The malicious code inserted into the open-source library XZ Utils, a widely used package present in major Linux distributions, is also capable of facilitating remote code execution, a new analysis has revealed.
The audacious supply chain compromise, tracked as&nbsp;CVE-2024-3094&nbsp;(CVSS score: 10.0), came to light last week when Microsoft engineer and PostgreSQL developer Andres Freund


feed_id: https://thehackernews.com/2024/04/harnessing-power-of-ctem-for-cloud.html
title: Harnessing the Power of CTEM for Cloud Security
uri: Harnessing-the-Power-of-CTEM-for-Cloud-Security
url: https://thehackernews.com/2024/04/harnessing-power-of-ctem-for-cloud.html
content:
Cloud solutions are more mainstream – and therefore more exposed – than ever before.
In 2023 alone, a staggering 82% of data breaches were against public, private, or hybrid cloud environments. What’s more, nearly 40% of breaches spanned multiple cloud environments. The average cost of a cloud breach was above the overall average, at $4.75 million. In a time where cloud has become the de facto


feed_id: https://thehackernews.com/2024/04/china-linked-hackers-deploy-new.html
title: China-linked Hackers Deploy New 'UNAPIMON' Malware for Stealthy Operations
uri: China-linked-Hackers-Deploy-New-UNAPIMON-Malware-for-Stealthy-Operat
url: https://thehackernews.com/2024/04/china-linked-hackers-deploy-new.html
content:
A threat activity cluster tracked as&nbsp;Earth Freybug&nbsp;has been observed using a new malware called UNAPIMON to fly under the radar.
"Earth Freybug is a cyberthreat group that has been active since at least 2012 that focuses on espionage and financially motivated activities," Trend Micro security researcher Christopher So&nbsp;said&nbsp;in a report published today.
"It has been observed to


feed_id: https://thehackernews.com/2024/04/google-to-delete-billions-of-browsing.html
title: Google to Delete Billions of Browsing Records in 'Incognito Mode' Privacy Lawsuit Settlement
uri: Google-to-Delete-Billions-of-Browsing-Records-in-Incognito-Mode-Priv
url: https://thehackernews.com/2024/04/google-to-delete-billions-of-browsing.html
content:
Google has agreed to purge billions of data records reflecting users' browsing activities to settle a class action lawsuit that claimed the search giant tracked them without their knowledge or consent in its Chrome browser.
The&nbsp;class action, filed in 2020, alleged the company misled users by tracking their internet browsing activity who thought that it remained private when using the "


feed_id: https://thehackernews.com/2024/04/massive-phishing-campaign-strikes-latin.html
title: Massive Phishing Campaign Strikes Latin America: Venom RAT Targeting Multiple Sectors
uri: Massive-Phishing-Campaign-Strikes-Latin-America-Venom-RAT-Targeting-M
url: https://thehackernews.com/2024/04/massive-phishing-campaign-strikes-latin.html
content:
The threat actor known as&nbsp;TA558&nbsp;has been attributed to a new massive phishing campaign that targets a wide range of sectors in Latin America with the goal of deploying Venom RAT.
The attacks primarily singled out hotel, travel, trading, financial, manufacturing, industrial, and government verticals in Spain, Mexico, the United States, Colombia, Portugal, Brazil, Dominican Republic, and


feed_id: https://thehackernews.com/2024/04/google-chrome-adds-v8-sandbox-new.html
title: Google Chrome Adds V8 Sandbox - A New Defense Against Browser Attacks
uri: Google-Chrome-Adds-V8-Sandbox-A-New-Defense-Against-Browser-Attacks
url: https://thehackernews.com/2024/04/google-chrome-adds-v8-sandbox-new.html
content:
Google has announced support for what's called a&nbsp;V8 Sandbox&nbsp;in the Chrome web browser in an effort to address memory corruption issues.
The sandbox, according to V8 Security technical lead Samuel Groß,&nbsp;aims&nbsp;to prevent "memory corruption in V8 from spreading within the host process."
The search behemoth has&nbsp;described&nbsp;V8 Sandbox as a lightweight, in-process sandbox


feed_id: https://thehackernews.com/2024/04/watch-out-for-latrodectus-this-malware.html
title: Watch Out for 'Latrodectus' - This Malware Could Be In Your Inbox
uri: Watch-Out-for-Latrodectus-This-Malware-Could-Be-In-Your-Inbox
url: https://thehackernews.com/2024/04/watch-out-for-latrodectus-this-malware.html
content:
Threat hunters have discovered a new malware called&nbsp;Latrodectus&nbsp;that has been distributed as part of email phishing campaigns since at least late November 2023.
"Latrodectus is an up-and-coming downloader with various sandbox evasion functionality," researchers from Proofpoint and Team Cymru&nbsp;said&nbsp;in a joint analysis published last week, adding it's designed to retrieve


feed_id: https://thehackernews.com/2024/04/the-drop-in-ransomware-attacks-in-2024.html
title: The Drop in Ransomware Attacks in 2024 and What it Means
uri: The-Drop-in-Ransomware-Attacks-in-2024-and-What-it-Means
url: https://thehackernews.com/2024/04/the-drop-in-ransomware-attacks-in-2024.html
content:
The&nbsp;ransomware industry surged in 2023&nbsp;as it saw an alarming 55.5% increase in victims worldwide, reaching a staggering 5,070.&nbsp;But 2024 is starting off showing a very different picture.&nbsp;While the numbers skyrocketed in Q4 2023 with 1309 cases, in Q1 2024, the ransomware industry was down to 1,048 cases. This is a 22% decrease in ransomware attacks compared to Q4 2023.
Figure


feed_id: https://thehackernews.com/2024/04/cybercriminals-targeting-latin-america.html
title: Cybercriminals Targeting Latin America with Sophisticated Phishing Scheme
uri: Cybercriminals-Targeting-Latin-America-with-Sophisticated-Phishing-Sch
url: https://thehackernews.com/2024/04/cybercriminals-targeting-latin-america.html
content:
A new phishing campaign has set its eyes on the Latin American region to deliver malicious payloads to Windows systems.
"The phishing email contained a ZIP file attachment that when extracted reveals an HTML file that leads to a malicious file download posing as an invoice," Trustwave SpiderLabs researcher Karla Agregado&nbsp;said.
The email message, the company said, originates from an email


feed_id: https://thehackernews.com/2024/04/google-sues-app-developers-over-fake.html
title: Google Sues App Developers Over Fake Crypto Investment App Scam
uri: Google-Sues-App-Developers-Over-Fake-Crypto-Investment-App-Scam
url: https://thehackernews.com/2024/04/google-sues-app-developers-over-fake.html
content:
Google has filed a lawsuit&nbsp;against&nbsp;two app developers for engaging in an "international online consumer investment fraud scheme" that tricked users into downloading bogus Android apps from the Google Play Store and other sources and stealing their funds under the guise of promising higher returns.
The individuals in question are Yunfeng Sun (aka Alphonse Sun) and Hongnam Cheung (aka


feed_id: https://thehackernews.com/2024/04/hackers-exploit-magento-bug-to-steal.html
title: Hackers Exploit Magento Bug to Steal Payment Data from E-commerce Websites
uri: Hackers-Exploit-Magento-Bug-to-Steal-Payment-Data-from-E-commerce-Webs
url: https://thehackernews.com/2024/04/hackers-exploit-magento-bug-to-steal.html
content:
Threat actors have been found exploiting a critical flaw in Magento to inject a persistent backdoor into e-commerce websites.
The attack leverages&nbsp;CVE-2024-20720&nbsp;(CVSS score: 9.1), which has been described by Adobe as a case of "improper neutralization of special elements" that could pave the way for arbitrary code execution.
It was&nbsp;addressed&nbsp;by the company as part of


feed_id: https://thehackernews.com/2024/04/ai-as-service-providers-vulnerable-to.html
title: AI-as-a-Service Providers Vulnerable to PrivEsc and Cross-Tenant Attacks
uri: AI-as-a-Service-Providers-Vulnerable-to-PrivEsc-and-Cross-Tenant-Attac
url: https://thehackernews.com/2024/04/ai-as-service-providers-vulnerable-to.html
content:
New research has found that artificial intelligence (AI)-as-a-service providers such as Hugging Face are susceptible to two critical risks that could allow threat actors to escalate privileges, gain cross-tenant access to other customers' models, and even take over the continuous integration and continuous deployment (CI/CD) pipelines.
"Malicious models represent a major risk to AI systems,


feed_id: https://thehackernews.com/2024/04/ciso-perspectives-on-complying-with.html
title: CISO Perspectives on Complying with Cybersecurity Regulations
uri: CISO-Perspectives-on-Complying-with-Cybersecurity-Regulations
url: https://thehackernews.com/2024/04/ciso-perspectives-on-complying-with.html
content:
Compliance requirements are meant to increase cybersecurity transparency and accountability. As cyber threats increase, so do the number of&nbsp;compliance frameworks&nbsp;and the specificity of the security controls, policies, and activities they include.
For CISOs and their teams, that means compliance is a time-consuming, high-stakes process that demands strong organizational and


feed_id: https://thehackernews.com/2024/04/from-pdfs-to-payload-bogus-adobe.html
title: From PDFs to Payload: Bogus Adobe Acrobat Reader Installers Distribute Byakugan Malware
uri: From-PDFs-to-Payload-Bogus-Adobe-Acrobat-Reader-Installers-Distribute
url: https://thehackernews.com/2024/04/from-pdfs-to-payload-bogus-adobe.html
content:
Bogus installers for Adobe Acrobat Reader are being used to&nbsp;distribute&nbsp;a new multi-functional malware dubbed&nbsp;Byakugan.
The starting point of the attack is a PDF file written in Portuguese that, when opened, shows a blurred image and asks the victim to click on a link to download the Reader application to view the content.
According to Fortinet FortiGuard Labs, clicking the URL


feed_id: https://thehackernews.com/2024/04/new-wave-of-jsoutprox-malware-targeting.html
title: New Wave of JSOutProx Malware Targeting Financial Firms in APAC and MENA
uri: New-Wave-of-JSOutProx-Malware-Targeting-Financial-Firms-in-APAC-and-ME
url: https://thehackernews.com/2024/04/new-wave-of-jsoutprox-malware-targeting.html
content:
Financial organizations in the Asia-Pacific (APAC) and Middle East and North Africa (MENA) are being targeted by a new version of an "evolving threat" called&nbsp;JSOutProx.
"JSOutProx is a sophisticated attack framework utilizing both JavaScript and .NET," Resecurity&nbsp;said&nbsp;in a technical report published this week.
"It employs the .NET (de)serialization feature to interact with a core


feed_id: https://thehackernews.com/2024/04/researchers-identify-multiple-china.html
title: Researchers Identify Multiple China Hacker Groups Exploiting Ivanti Security Flaws
uri: Researchers-Identify-Multiple-China-Hacker-Groups-Exploiting-Ivanti-Se
url: https://thehackernews.com/2024/04/researchers-identify-multiple-china.html
content:
Multiple China-nexus threat actors have been linked to the zero-day exploitation of three security flaws impacting Ivanti appliances (CVE-2023-46805, CVE-2024-21887, and CVE-2024-21893).
The clusters are being tracked by Mandiant under the uncategorized monikers&nbsp;UNC5221, UNC5266, UNC5291,&nbsp;UNC5325, UNC5330, and UNC5337. Also previously linked to the exploitation spree is a Chinese


feed_id: https://thehackernews.com/2024/04/vietnam-based-hackers-steal-financial.html
title: Vietnam-Based Hackers Steal Financial Data Across Asia with Malware
uri: Vietnam-Based-Hackers-Steal-Financial-Data-Across-Asia-with-Malware
url: https://thehackernews.com/2024/04/vietnam-based-hackers-steal-financial.html
content:
A suspected Vietnamese-origin threat actor has been observed targeting victims in several Asian and Southeast Asian countries with malware designed to harvest valuable data since at least May 2023.
Cisco Talos is tracking the cluster under the name&nbsp;CoralRaider, describing it as financially motivated. Targets of the campaign include India, China, South Korea, Bangladesh, Pakistan, Indonesia,


feed_id: https://thehackernews.com/2024/04/new-phishing-campaign-targets-oil-gas.html
title: New Phishing Campaign Targets Oil & Gas with Evolved Data-Stealing Malware
uri: New-Phishing-Campaign-Targets-Oil-Gas-with-Evolved-Data-Stealing-Mal
url: https://thehackernews.com/2024/04/new-phishing-campaign-targets-oil-gas.html
content:
An updated version of an information-stealing malware called Rhadamanthys is being used in phishing campaigns targeting the oil and gas sector.
"The phishing emails use a unique vehicle incident lure and, in later stages of the infection chain, spoof the Federal Bureau of Transportation in a PDF that mentions a significant fine for the incident," Cofense researcher Dylan Duncan&nbsp;said.
The


feed_id: https://thehackernews.com/2024/04/considerations-for-operational.html
title: Considerations for Operational Technology Cybersecurity
uri: Considerations-for-Operational-Technology-Cybersecurity
url: https://thehackernews.com/2024/04/considerations-for-operational.html
content:
Operational Technology (OT)&nbsp;refers to the hardware and software used to change, monitor, or control the enterprise's physical devices, processes, and events. Unlike traditional Information Technology (IT) systems, OT systems directly impact the physical world. This unique characteristic of OT brings additional cybersecurity considerations not typically present in conventional IT security


feed_id: https://thehackernews.com/2024/04/new-http2-vulnerability-exposes-web.html
title: New HTTP/2 Vulnerability Exposes Web Servers to DoS Attacks
uri: New-HTTP-2-Vulnerability-Exposes-Web-Servers-to-DoS-Attacks
url: https://thehackernews.com/2024/04/new-http2-vulnerability-exposes-web.html
content:
New research has found that the CONTINUATION frame in the HTTP/2 protocol can be exploited to conduct denial-of-service (DoS) attacks.
The technique has been codenamed&nbsp;HTTP/2 CONTINUATION Flood&nbsp;by security researcher Bartek Nowotarski, who reported the issue to the CERT Coordination Center (CERT/CC) on January 25, 2024.
"Many HTTP/2 implementations do not properly limit or sanitize the


feed_id: https://thehackernews.com/2024/04/intel-and-lenovo-bmcs-contain-unpatched.html
title: Intel and Lenovo BMCs Contain Unpatched Lighttpd Server Flaw
uri: Intel-and-Lenovo-BMCs-Contain-Unpatched-Lighttpd-Server-Flaw
url: https://thehackernews.com/2024/04/intel-and-lenovo-bmcs-contain-unpatched.html
content:
A security flaw impacting the Lighttpd web server used in baseboard management controllers (BMCs) has remained unpatched by device vendors like Intel and Lenovo, new findings from Binarly reveal.
While the original shortcoming was&nbsp;discovered and patched&nbsp;by the Lighttpd maintainers way back in August 2018 with&nbsp;version 1.4.51, the lack of a CVE identifier or an advisory meant that


feed_id: https://thehackernews.com/2024/04/ai-copilot-launching-innovation-rockets.html
title: AI Copilot: Launching Innovation Rockets, But Beware of the Darkness Ahead
uri: AI-Copilot-Launching-Innovation-Rockets-But-Beware-of-the-Darkness-A
url: https://thehackernews.com/2024/04/ai-copilot-launching-innovation-rockets.html
content:
Imagine a world where the software that powers your favorite apps, secures your online transactions, and keeps your digital life could be outsmarted and taken over by a cleverly disguised piece of code. This isn't a plot from the latest cyber-thriller; it's actually been a reality for years now. How this will change – in a positive or negative direction – as artificial intelligence (AI) takes on


feed_id: https://thehackernews.com/2024/04/muddled-libra-shifts-focus-to-saas-and.html
title: Muddled Libra Shifts Focus to SaaS and Cloud for Extortion and Data Theft Attacks
uri: Muddled-Libra-Shifts-Focus-to-SaaS-and-Cloud-for-Extortion-and-Data-Th
url: https://thehackernews.com/2024/04/muddled-libra-shifts-focus-to-saas-and.html
content:
The threat actor known as&nbsp;Muddled Libra&nbsp;has been observed actively targeting software-as-a-service (SaaS) applications and cloud service provider (CSP) environments in a bid to exfiltrate sensitive data.
"Organizations often store a variety of data in SaaS applications and use services from CSPs," Palo Alto Networks Unit 42&nbsp;said&nbsp;in a report published last week.
"The threat


feed_id: https://thehackernews.com/2024/04/timing-is-everything-role-of-just-in.html
title: Timing is Everything: The Role of Just-in-Time Privileged Access in Security Evolution
uri: Timing-is-Everything-The-Role-of-Just-in-Time-Privileged-Access-in-Se
url: https://thehackernews.com/2024/04/timing-is-everything-role-of-just-in.html
content:
To minimize the risk of privilege misuse, a trend in the privileged access management (PAM) solution market involves implementing just-in-time (JIT) privileged access. This approach to&nbsp;privileged identity management&nbsp;aims to mitigate the risks associated with prolonged high-level access by granting privileges temporarily and only when necessary, rather than providing users with


feed_id: https://thehackernews.com/2024/04/chinese-linked-lightspy-ios-spyware.html
title: Chinese-Linked LightSpy iOS Spyware Targets South Asian iPhone Users
uri: Chinese-Linked-LightSpy-iOS-Spyware-Targets-South-Asian-iPhone-Users
url: https://thehackernews.com/2024/04/chinese-linked-lightspy-ios-spyware.html
content:
Cybersecurity researchers have discovered a "renewed" cyber espionage campaign targeting users in South Asia with the aim of delivering an Apple iOS spyware implant called&nbsp;LightSpy.
"The latest iteration of LightSpy, dubbed 'F_Warehouse,' boasts a modular framework with extensive spying features," the BlackBerry Threat Research and Intelligence Team&nbsp;said&nbsp;in a report published last


feed_id: https://thehackernews.com/2024/04/palo-alto-networks-releases-urgent.html
title: Palo Alto Networks Releases Urgent Fixes for Exploited PAN-OS Vulnerability
uri: Palo-Alto-Networks-Releases-Urgent-Fixes-for-Exploited-PAN-OS-Vulnerab
url: https://thehackernews.com/2024/04/palo-alto-networks-releases-urgent.html
content:
Palo Alto Networks has released hotfixes to address a maximum-severity security flaw impacting PAN-OS software that has come under active exploitation in the wild.
Tracked as&nbsp;CVE-2024-3400&nbsp;(CVSS score: 10.0), the critical vulnerability is a case of command injection in the GlobalProtect feature that an unauthenticated attacker could weaponize to execute arbitrary code with root


feed_id: https://thehackernews.com/2024/04/ex-security-engineer-jailed-3-years-for.html
title: Ex-Security Engineer Jailed 3 Years for $12.3 Million Crypto Exchange Thefts
uri: Ex-Security-Engineer-Jailed-3-Years-for-12-3-Million-Crypto-Exchange
url: https://thehackernews.com/2024/04/ex-security-engineer-jailed-3-years-for.html
content:
A former security engineer has been&nbsp;sentenced&nbsp;to three years in prison in the U.S. for charges relating to hacking two decentralized cryptocurrency exchanges in July 2022 and stealing over $12.3 million.
Shakeeb Ahmed, the defendant in question,&nbsp;pled guilty&nbsp;to one count of computer fraud in December 2023&nbsp;following his arrest&nbsp;in July.
"At the time of both attacks,


feed_id: https://thehackernews.com/2024/04/us-treasury-hamas-spokesperson-for.html
title: U.S. Treasury Hamas Spokesperson for Cyber Influence Operations
uri: U-S-Treasury-Hamas-Spokesperson-for-Cyber-Influence-Operations
url: https://thehackernews.com/2024/04/us-treasury-hamas-spokesperson-for.html
content:
The U.S. Treasury Department's Office of Foreign Assets Control (OFAC) on Friday announced sanctions against an official associated with Hamas for his involvement in cyber influence operations.
Hudhayfa Samir ‘Abdallah al-Kahlut, 39, also known as Abu Ubaida, has served as the public spokesperson of Izz al-Din al-Qassam Brigades, the military wing of Hamas, since at least 2007.
"He publicly


feed_id: https://thehackernews.com/2024/04/hackers-deploy-python-backdoor-in-palo.html
title: Hackers Deploy Python Backdoor in Palo Alto Zero-Day Attack
uri: Hackers-Deploy-Python-Backdoor-in-Palo-Alto-Zero-Day-Attack
url: https://thehackernews.com/2024/04/hackers-deploy-python-backdoor-in-palo.html
content:
Threat actors have been exploiting the newly disclosed zero-day flaw in Palo
  Alto Networks PAN-OS software dating back to March 26, 2024, nearly three
  weeks before it came to light yesterday.



  The network security company's Unit 42 division is&nbsp;tracking&nbsp;the activity under the name&nbsp;Operation MidnightEclipse, attributing it as the work of a single threat actor of


feed_id: https://thehackernews.com/2024/04/popular-rust-crate-liblzma-sys.html
title: Popular Rust Crate liblzma-sys Compromised with XZ Utils Backdoor Files
uri: Popular-Rust-Crate-liblzma-sys-Compromised-with-XZ-Utils-Backdoor-File
url: https://thehackernews.com/2024/04/popular-rust-crate-liblzma-sys.html
content:
"Test files" associated with the&nbsp;XZ Utils backdoor&nbsp;have made their way to a Rust crate known as&nbsp;liblzma-sys, new&nbsp;findings&nbsp;from Phylum reveal.
liblzma-sys, which has been downloaded over 21,000 times to date, provides Rust developers with bindings to the liblzma implementation, an underlying library that is part of the&nbsp;XZ Utils&nbsp;data compression software. The


feed_id: https://thehackernews.com/2024/04/code-keepers-mastering-non-human.html
title: Code Keepers: Mastering Non-Human Identity Management
uri: Code-Keepers-Mastering-Non-Human-Identity-Management
url: https://thehackernews.com/2024/04/code-keepers-mastering-non-human.html
content:
Identities now transcend human boundaries. Within each line of code and every API call lies a non-human identity. These entities act as programmatic access keys, enabling authentication and facilitating interactions among systems and services, which are essential for every API call, database query, or storage account access. As we depend on multi-factor authentication and passwords to safeguard


feed_id: https://thehackernews.com/2024/04/iranian-muddywater-hackers-adopt-new-c2.html
title: Iranian MuddyWater Hackers Adopt New C2 Tool 'DarkBeatC2' in Latest Campaign
uri: Iranian-MuddyWater-Hackers-Adopt-New-C2-Tool-DarkBeatC2-in-Latest-Ca
url: https://thehackernews.com/2024/04/iranian-muddywater-hackers-adopt-new-c2.html
content:
The Iranian threat actor known as MuddyWater has been attributed to a new command-and-control (C2) infrastructure called&nbsp;DarkBeatC2, becoming the latest such tool in its arsenal after&nbsp;SimpleHarm,&nbsp;MuddyC3, PhonyC2, and&nbsp;MuddyC2Go.
"While occasionally switching to a new remote administration tool or changing their C2 framework, MuddyWater’s methods remain constant," Deep


feed_id: https://thehackernews.com/2024/04/zero-day-alert-critical-palo-alto.html
title: Zero-Day Alert: Critical Palo Alto Networks PAN-OS Flaw Under Active Attack
uri: Zero-Day-Alert-Critical-Palo-Alto-Networks-PAN-OS-Flaw-Under-Active-A
url: https://thehackernews.com/2024/04/zero-day-alert-critical-palo-alto.html
content:
Palo Alto Networks is warning that a critical flaw impacting PAN-OS software used in its GlobalProtect gateways is being actively exploited in the wild.
Tracked as&nbsp;CVE-2024-3400, the issue has a CVSS score of 10.0, indicating maximum severity.
"A command injection vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct


feed_id: https://thehackernews.com/2024/04/sneaky-credit-card-skimmer-disguised-as.html
title: Sneaky Credit Card Skimmer Disguised as Harmless Facebook Tracker
uri: Sneaky-Credit-Card-Skimmer-Disguised-as-Harmless-Facebook-Tracker
url: https://thehackernews.com/2024/04/sneaky-credit-card-skimmer-disguised-as.html
content:
Cybersecurity researchers have discovered a credit card skimmer that's concealed within a fake&nbsp;Meta Pixel tracker script&nbsp;in an attempt to evade detection.
Sucuri said that the malware is injected into websites through tools that allow for custom code, such as WordPress plugins like&nbsp;Simple Custom CSS and JS&nbsp;or the "Miscellaneous Scripts" section of the Magento admin panel.
"


feed_id: https://thehackernews.com/2024/04/us-federal-agencies-ordered-to-hunt-for.html
title: U.S. Federal Agencies Ordered to Hunt for Signs of Microsoft Breach and Mitigate Risks
uri: U-S-Federal-Agencies-Ordered-to-Hunt-for-Signs-of-Microsoft-Breach-an
url: https://thehackernews.com/2024/04/us-federal-agencies-ordered-to-hunt-for.html
content:
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday issued an emergency directive (ED 24-02) urging federal agencies to hunt for signs of compromise and enact preventive measures following the recent compromise of Microsoft's systems that led to the theft of email correspondence with the company.
The attack, which&nbsp;came to light&nbsp;earlier this year, has been


feed_id: https://thehackernews.com/2024/04/gitguardian-report-pypi-secrets.html
title: Python's PyPI Reveals Its Secrets
uri: Python-s-PyPI-Reveals-Its-Secrets
url: https://thehackernews.com/2024/04/gitguardian-report-pypi-secrets.html
content:
GitGuardian is famous for its annual&nbsp;State of Secrets Sprawl&nbsp;report. In their 2023 report, they found over 10 million exposed passwords, API keys, and other credentials exposed in public GitHub commits. The takeaways in their 2024 report did not just highlight 12.8 million&nbsp;new&nbsp;exposed secrets in GitHub, but a number in the popular Python package repository&nbsp;PyPI.
PyPI,


feed_id: https://thehackernews.com/2024/04/ta547-phishing-attack-hits-german-firms.html
title: TA547 Phishing Attack Hits German Firms with Rhadamanthys Stealer
uri: TA547-Phishing-Attack-Hits-German-Firms-with-Rhadamanthys-Stealer
url: https://thehackernews.com/2024/04/ta547-phishing-attack-hits-german-firms.html
content:
A threat actor tracked as&nbsp;TA547&nbsp;has targeted dozens of German organizations with an information stealer called&nbsp;Rhadamanthys&nbsp;as part of an invoice-themed phishing campaign.
"This is the first time researchers observed TA547 use Rhadamanthys, an information stealer that is used by multiple cybercriminal threat actors," Proofpoint&nbsp;said. "Additionally, the actor appeared to


feed_id: https://thehackernews.com/2024/04/apple-expands-spyware-alert-system-to.html
title: Apple Updates Spyware Alert System to Warn Victims of Mercenary Attacks
uri: Apple-Updates-Spyware-Alert-System-to-Warn-Victims-of-Mercenary-Attack
url: https://thehackernews.com/2024/04/apple-expands-spyware-alert-system-to.html
content:
Apple on Wednesday&nbsp;revised&nbsp;its documentation pertaining to its mercenary spyware threat notification system to mention that it alerts users when they may have been individually targeted by such attacks.
It also specifically called out companies like NSO Group for developing commercial surveillance tools such as Pegasus that are used by state actors to pull off "individually targeted


feed_id: https://thehackernews.com/2024/04/fortinet-has-released-patches-to.html
title: Fortinet Rolls Out Critical Security Patches for FortiClientLinux Vulnerability
uri: Fortinet-Rolls-Out-Critical-Security-Patches-for-FortiClientLinux-Vuln
url: https://thehackernews.com/2024/04/fortinet-has-released-patches-to.html
content:
Fortinet has released patches to address a critical security flaw impacting FortiClientLinux that could be exploited to achieve arbitrary code execution.
Tracked as CVE-2023-45590, the vulnerability carries a CVSS score of 9.4 out of a maximum of 10.
"An Improper Control of Generation of Code ('Code Injection') vulnerability [CWE-94] in FortiClientLinux may allow an unauthenticated attacker to


feed_id: https://thehackernews.com/2024/04/exotic-visit-spyware-campaign-targets.html
title: 'eXotic Visit' Spyware Campaign Targets Android Users in India and Pakistan
uri: eXotic-Visit-Spyware-Campaign-Targets-Android-Users-in-India-and-Pak
url: https://thehackernews.com/2024/04/exotic-visit-spyware-campaign-targets.html
content:
An active Android malware campaign dubbed eXotic Visit has been primarily targeting users in South Asia, particularly those in India and Pakistan, with malware distributed via dedicated websites and Google Play Store.
Slovak cybersecurity firm said the activity, ongoing since November 2021, is not linked to any known threat actor or group. It's tracking the group behind the operation under the


feed_id: https://thehackernews.com/2024/04/raspberry-robin-returns-new-malware.html
title: Raspberry Robin Returns: New Malware Campaign Spreading Through WSF Files
uri: Raspberry-Robin-Returns-New-Malware-Campaign-Spreading-Through-WSF-Fi
url: https://thehackernews.com/2024/04/raspberry-robin-returns-new-malware.html
content:
Cybersecurity researchers have discovered a new Raspberry Robin campaign wave that has been propagating the malware through malicious Windows Script Files (WSFs) since March 2024.
"Historically, Raspberry Robin was known to spread through removable media like USB drives, but over time its distributors have experimented with other initial infection vectors," HP Wolf Security researcher Patrick


feed_id: https://thehackernews.com/2024/04/beware-githubs-fake-popularity-scam.html
title: Beware: GitHub's Fake Popularity Scam Tricking Developers into Downloading Malware
uri: Beware-GitHub-s-Fake-Popularity-Scam-Tricking-Developers-into-Downloa
url: https://thehackernews.com/2024/04/beware-githubs-fake-popularity-scam.html
content:
Threat actors are now taking advantage of GitHub's search functionality to trick unsuspecting users looking for popular repositories into downloading spurious counterparts that serve malware.
The latest assault on the open-source software supply chain involves concealing malicious code within Microsoft Visual Code project files that's designed to download next-stage payloads from a remote URL,


feed_id: https://thehackernews.com/2024/04/hands-on-review-cynomi-ai-powered-vciso.html
title: Hands-on Review: Cynomi AI-powered vCISO Platform
uri: Hands-on-Review-Cynomi-AI-powered-vCISO-Platform
url: https://thehackernews.com/2024/04/hands-on-review-cynomi-ai-powered-vciso.html
content:
The need for vCISO services is growing. SMBs and SMEs are dealing with more third-party risks, tightening regulatory demands and stringent cyber insurance requirements than ever before. However, they often lack the resources and expertise to hire an in-house security executive team. By outsourcing security and compliance leadership to a vCISO, these organizations can more easily obtain


feed_id: https://thehackernews.com/2024/04/researchers-uncover-first-native.html
title: Researchers Uncover First Native Spectre v2 Exploit Against Linux Kernel
uri: Researchers-Uncover-First-Native-Spectre-v2-Exploit-Against-Linux-Kern
url: https://thehackernews.com/2024/04/researchers-uncover-first-native.html
content:
Cybersecurity researchers have disclosed what they say is the "first native Spectre v2 exploit" against the Linux kernel on Intel systems that could be exploited to read sensitive data from the memory.
The exploit, called Native Branch History Injection (BHI), can be used to leak arbitrary kernel memory at 3.5 kB/sec by bypassing existing Spectre v2/BHI mitigations, researchers from Systems and


feed_id: https://thehackernews.com/2024/04/webinar-learn-how-to-stop-hackers-from.html
title: Webinar: Learn How to Stop Hackers from Exploiting Hidden Identity Weaknesses
uri: Webinar-Learn-How-to-Stop-Hackers-from-Exploiting-Hidden-Identity-Wea
url: https://thehackernews.com/2024/04/webinar-learn-how-to-stop-hackers-from.html
content:
We all know passwords and firewalls are important, but what about the invisible threats lurking beneath the surface of your systems?
Identity Threat Exposures (ITEs) are like secret tunnels for hackers – they make your security way more vulnerable than you think.
Think of it like this: misconfigurations, forgotten accounts, and old settings are like cracks in your digital fortress walls. Hackers


feed_id: https://thehackernews.com/2024/04/microsoft-fixes-149-flaws-in-huge-april.html
title: Microsoft Fixes 149 Flaws in Huge April Patch Release, Zero-Days Included
uri: Microsoft-Fixes-149-Flaws-in-Huge-April-Patch-Release-Zero-Days-Inclu
url: https://thehackernews.com/2024/04/microsoft-fixes-149-flaws-in-huge-april.html
content:
Microsoft has released security updates for the month of April 2024 to remediate a record&nbsp;149 flaws, two of which have come under active exploitation in the wild.
Of the 149 flaws, three are rated Critical, 142 are rated Important, three are rated Moderate, and one is rated Low in severity. The update is aside from&nbsp;21 vulnerabilities&nbsp;that the company addressed in its


feed_id: https://thehackernews.com/2024/04/critical-batbadbut-rust-vulnerability.html
title: Critical 'BatBadBut' Rust Vulnerability Exposes Windows Systems to Attacks
uri: Critical-BatBadBut-Rust-Vulnerability-Exposes-Windows-Systems-to-Att
url: https://thehackernews.com/2024/04/critical-batbadbut-rust-vulnerability.html
content:
A critical security flaw in the Rust standard library could be exploited to target Windows users and stage command injection attacks.
The vulnerability, tracked as&nbsp;CVE-2024-24576, has a CVSS score of 10.0, indicating maximum severity. That said, it only impacts scenarios where batch files are invoked on Windows with untrusted arguments.
"The Rust standard library did not properly escape


feed_id: https://thehackernews.com/2024/04/10-year-old-rubycarp-romanian-hacker.html
title: 10-Year-Old 'RUBYCARP' Romanian Hacker Group Surfaces with Botnet
uri: 10-Year-Old-RUBYCARP-Romanian-Hacker-Group-Surfaces-with-Botnet
url: https://thehackernews.com/2024/04/10-year-old-rubycarp-romanian-hacker.html
content:
A threat group of suspected Romanian origin called&nbsp;RUBYCARP&nbsp;has been observed maintaining a long-running botnet for carrying out crypto mining, distributed denial-of-service (DDoS), and phishing attacks.
The group, believed to be active for at least 10 years, employs the botnet for financial gain, Sysdig said in a report shared with The Hacker News.
"Its primary method of operation


feed_id: https://thehackernews.com/2024/04/hackers-targeting-human-rights.html
title: Hackers Targeting Human Rights Activists in Morocco and Western Sahara
uri: Hackers-Targeting-Human-Rights-Activists-in-Morocco-and-Western-Sahara
url: https://thehackernews.com/2024/04/hackers-targeting-human-rights.html
content:
Human rights activists in Morocco and the Western Sahara region are the targets of a new threat actor that leverages phishing attacks to trick victims into installing bogus Android apps and serve credential harvesting pages for Windows users.
Cisco Talos is&nbsp;tracking&nbsp;the activity cluster under the name&nbsp;Starry Addax, describing it as primarily singling out activists associated with


feed_id: https://thehackernews.com/2024/04/researchers-discover-lg-smart-tv.html
title: Researchers Discover LG Smart TV Vulnerabilities Allowing Root Access
uri: Researchers-Discover-LG-Smart-TV-Vulnerabilities-Allowing-Root-Access
url: https://thehackernews.com/2024/04/researchers-discover-lg-smart-tv.html
content:
Multiple security vulnerabilities have been disclosed in LG webOS running on its smart televisions that could be exploited to bypass authorization and gain root access on the devices.
The findings come from Romanian cybersecurity firm Bitdefender, which discovered and reported the flaws in November 2023. The issues were fixed by LG as part of updates released on March 22, 2024.
The


feed_id: https://thehackernews.com/2024/04/cl0ps-ransomware-rampage-security.html
title: CL0P's Ransomware Rampage - Security Measures for 2024
uri: CL0P-s-Ransomware-Rampage-Security-Measures-for-2024
url: https://thehackernews.com/2024/04/cl0ps-ransomware-rampage-security.html
content:
2023 CL0P Growth&nbsp;
Emerging in early 2019, CL0P was first introduced as a more advanced version of its predecessor the ‘CryptoMix’ ransomware, brought about by its owner CL0P ransomware, a cybercrime organisation. Over the years the group remained active with significant campaigns throughout 2020 to 2022. But in 2023 the CL0P ransomware gang took itself to new heights and became one of the


feed_id: https://thehackernews.com/2024/04/attackers-using-obfuscation-tools-to.html
title: Attackers Using Obfuscation Tools to Deliver Multi-Stage Malware via Invoice Phishing
uri: Attackers-Using-Obfuscation-Tools-to-Deliver-Multi-Stage-Malware-via-I
url: https://thehackernews.com/2024/04/attackers-using-obfuscation-tools-to.html
content:
Cybersecurity researchers have discovered an intricate multi-stage attack that leverages invoice-themed phishing decoys to deliver a wide range of malware such as&nbsp;Venom RAT, Remcos RAT, XWorm, NanoCore RAT, and a stealer that targets crypto wallets.
The email messages come with Scalable Vector Graphics (SVG) file attachments that, when clicked, activate the infection sequence, Fortinet


feed_id: https://thehackernews.com/2024/04/critical-flaws-leave-92000-d-link-nas.html
title: Critical Flaws Leave 92,000 D-Link NAS Devices Vulnerable to Malware Attacks
uri: Critical-Flaws-Leave-92-000-D-Link-NAS-Devices-Vulnerable-to-Malware-A
url: https://thehackernews.com/2024/04/critical-flaws-leave-92000-d-link-nas.html
content:
Threat actors are actively scanning and exploiting a pair of security flaws that are said to affect as many as 92,000 internet-exposed D-Link network-attached storage (NAS) devices.
Tracked as&nbsp;CVE-2024-3272&nbsp;(CVSS score: 9.8) and&nbsp;CVE-2024-3273&nbsp;(CVSS score: 7.3), the vulnerabilities impact&nbsp;legacy D-Link products&nbsp;that have reached end-of-life (EoL) status. D-Link, in


feed_id: https://thehackernews.com/2024/03/embracing-cloud-revolutionizing.html
uri: Embracing-the-Cloud-Revolutionizing-Privileged-Access-Management-with
url: https://thehackernews.com/2024/03/embracing-cloud-revolutionizing.html
title:
Embracing the Cloud: Revolutionizing Privileged Access Management with One Identity Cloud PAM Essentials

content:
As cyber threats loom around every corner and privileged accounts become prime targets, the significance of implementing a robust&nbsp;Privileged Access Management (PAM)&nbsp;solution can't be overstated. With organizations increasingly migrating to cloud environments, the PAM Solution Market is experiencing a transformative shift toward cloud-based offerings. One Identity PAM Essentials stands


feed_id: https://thehackernews.com/2024/04/openjs-foundation-targeted-in-potential.html
title: OpenJS Foundation Targeted in Potential JavaScript Project Takeover Attempt
uri: OpenJS-Foundation-Targeted-in-Potential-JavaScript-Project-Takeover-At
url: https://thehackernews.com/2024/04/openjs-foundation-targeted-in-potential.html
content:
Security researchers have uncovered a "credible" takeover attempt targeting the OpenJS Foundation in a manner that evokes similarities to the recently uncovered incident aimed at the open-source XZ Utils project.
"The OpenJS Foundation Cross Project Council received a suspicious series of emails with similar messages, bearing different names and overlapping GitHub-associated emails," OpenJS


feed_id: https://thehackernews.com/2024/04/ta558-hackers-weaponize-images-for-wide.html
title: TA558 Hackers Weaponize Images for Wide-Scale Malware Attacks
uri: TA558-Hackers-Weaponize-Images-for-Wide-Scale-Malware-Attacks
url: https://thehackernews.com/2024/04/ta558-hackers-weaponize-images-for-wide.html
content:
The threat actor tracked as&nbsp;TA558&nbsp;has been observed leveraging steganography as an obfuscation technique to deliver a wide range of malware such as Agent Tesla, FormBook, Remcos RAT, LokiBot, GuLoader, Snake Keylogger, and XWorm, among others.
"The group made extensive use of steganography by sending VBSs, PowerShell code, as well as RTF documents with an embedded exploit, inside


feed_id: https://thehackernews.com/2024/04/aws-google-and-azure-cli-tools-could.html
title: AWS, Google, and Azure CLI Tools Could Leak Credentials in Build Logs
uri: AWS-Google-and-Azure-CLI-Tools-Could-Leak-Credentials-in-Build-Logs
url: https://thehackernews.com/2024/04/aws-google-and-azure-cli-tools-could.html
content:
New cybersecurity research has found that command-line interface (CLI) tools from Amazon Web Services (AWS) and Google Cloud can expose sensitive credentials in build logs, posing significant risks to organizations.
The vulnerability has been codenamed&nbsp;LeakyCLI&nbsp;by cloud security firm Orca.
"Some commands on Azure CLI, AWS CLI, and Google Cloud CLI can expose sensitive information in


feed_id: https://thehackernews.com/2024/04/widely-used-putty-ssh-client-found.html
title: Widely-Used PuTTY SSH Client Found Vulnerable to Key Recovery Attack
uri: Widely-Used-PuTTY-SSH-Client-Found-Vulnerable-to-Key-Recovery-Attack
url: https://thehackernews.com/2024/04/widely-used-putty-ssh-client-found.html
content:
The maintainers of the&nbsp;PuTTY Secure Shell (SSH) and Telnet client&nbsp;are alerting users of a critical vulnerability impacting versions from 0.68 through 0.80 that could be exploited to achieve full recovery of NIST P-521 (ecdsa-sha2-nistp521) private keys.
The flaw has been assigned the CVE identifier&nbsp;CVE-2024-31497, with the discovery credited to researchers Fabian Bäumer and Marcus


feed_id: https://thehackernews.com/2024/04/identity-in-shadows-shedding-light-on.html
title: Identity in the Shadows: Shedding Light on Cybersecurity's Unseen Threats
uri: Identity-in-the-Shadows-Shedding-Light-on-Cybersecurity-s-Unseen-Thre
url: https://thehackernews.com/2024/04/identity-in-shadows-shedding-light-on.html
content:
In today's rapidly evolving digital landscape, organizations face an increasingly complex array of cybersecurity threats. The proliferation of cloud services and remote work arrangements has heightened the vulnerability of digital identities to exploitation, making it imperative for businesses to fortify their identity security measures.
Our recent research report,&nbsp;The Identity Underground


feed_id: https://thehackernews.com/2024/04/ftc-fines-mental-health-startup.html
title: FTC Fines Mental Health Startup Cerebral $7 Million for Major Privacy Violations
uri: FTC-Fines-Mental-Health-Startup-Cerebral-7-Million-for-Major-Privacy
url: https://thehackernews.com/2024/04/ftc-fines-mental-health-startup.html
content:
The U.S. Federal Trade Commission (FTC) has ordered the mental telehealth company Cerebral from using or disclosing personal data for advertising purposes.
It has also been fined more than $7 million over charges that it revealed users' sensitive personal health information and other data to third-parties for advertising purposes and failed to honor its easy cancellation policies.
"Cerebral and


feed_id: https://thehackernews.com/2024/04/hive-rat-creators-and-35m-cryptojacking.html
title: Hive RAT Creators and $3.5M Cryptojacking Mastermind Arrested in Global Crackdown
uri: Hive-RAT-Creators-and-3-5M-Cryptojacking-Mastermind-Arrested-in-Globa
url: https://thehackernews.com/2024/04/hive-rat-creators-and-35m-cryptojacking.html
content:
Two individuals have been arrested in Australia and the U.S. in connection with an alleged scheme to develop and distribute a remote access trojan called Hive RAT (previously Firebird).
The U.S. Justice Department (DoJ)&nbsp;said&nbsp;the malware "gave the malware purchasers control over victim computers and enabled them to access victims' private communications, their login credentials, and


feed_id: https://thehackernews.com/2024/04/offlrouter-malware-evades-detection-in.html
title: OfflRouter Malware Evades Detection in Ukraine for Almost a Decade
uri: OfflRouter-Malware-Evades-Detection-in-Ukraine-for-Almost-a-Decade
url: https://thehackernews.com/2024/04/offlrouter-malware-evades-detection-in.html
content:
Select Ukrainian government networks have remained infected with a malware called OfflRouter since 2015.
Cisco Talos said its findings are based on an analysis of over 100 confidential documents that were infected with the VBA macro virus and uploaded to the VirusTotal malware scanning platform.
"The documents contained VBA code to drop and run an executable with the name 'ctrlpanel.exe,'"


feed_id: https://thehackernews.com/2024/04/fin7-cybercrime-group-targeting-us-auto.html
title: FIN7 Cybercrime Group Targeting U.S. Auto Industry with Carbanak Backdoor
uri: FIN7-Cybercrime-Group-Targeting-U-S-Auto-Industry-with-Carbanak-Backd
url: https://thehackernews.com/2024/04/fin7-cybercrime-group-targeting-us-auto.html
content:
The infamous cybercrime syndicate known as FIN7 has been linked to a spear-phishing campaign targeting the U.S. automotive industry to deliver a known backdoor called Carbanak (aka Anunak).
"FIN7 identified employees at the company who worked in the IT department and had higher levels of administrative rights," the BlackBerry research and intelligence team&nbsp;said&nbsp;in a new write-up.
"They


feed_id: https://thehackernews.com/2024/04/recover-from-ransomware-in-5-minuteswe.html
title: Recover from Ransomware in 5 Minutes—We will Teach You How!
uri: Recover-from-Ransomware-in-5-Minutes-We-will-Teach-You-How
url: https://thehackernews.com/2024/04/recover-from-ransomware-in-5-minuteswe.html
content:
Super Low RPO with Continuous Data Protection:Dial Back to Just Seconds Before an Attack
Zerto, a Hewlett Packard Enterprise company, can help you detect and recover from ransomware in near real-time. This solution leverages continuous data protection (CDP) to ensure all workloads have the lowest recovery point objective (RPO) possible. The most valuable thing about CDP is that it does not use


feed_id: https://thehackernews.com/2024/04/new-android-trojan-soumnibot-evades.html
title: New Android Trojan 'SoumniBot' Evades Detection with Clever Tricks
uri: New-Android-Trojan-SoumniBot-Evades-Detection-with-Clever-Tricks
url: https://thehackernews.com/2024/04/new-android-trojan-soumnibot-evades.html
content:
A new Android trojan called&nbsp;SoumniBot&nbsp;has been detected in the wild targeting users in South Korea by leveraging weaknesses in the manifest extraction and parsing procedure.
The malware is "notable for an unconventional approach to evading analysis and detection, namely obfuscation of the Android manifest," Kaspersky researcher Dmitry Kalinin&nbsp;said&nbsp;in a technical analysis.


feed_id: https://thehackernews.com/2024/04/how-to-conduct-advanced-static-analysis.html
title: How to Conduct Advanced Static Analysis in a Malware Sandbox
uri: How-to-Conduct-Advanced-Static-Analysis-in-a-Malware-Sandbox
url: https://thehackernews.com/2024/04/how-to-conduct-advanced-static-analysis.html
content:
Sandboxes are synonymous with dynamic malware analysis. They help to execute malicious files in a safe virtual environment and observe their behavior. However, they also offer plenty of value in terms of static analysis. See these five scenarios where a sandbox can prove to be a useful tool in your investigations.
Detecting Threats in PDFs
PDF files are frequently exploited by threat actors to


feed_id: https://thehackernews.com/2024/04/global-police-operation-disrupts.html
title: Global Police Operation Disrupts 'LabHost' Phishing Service, Over 30 Arrested Worldwide
uri: Global-Police-Operation-Disrupts-LabHost-Phishing-Service-Over-30-A
url: https://thehackernews.com/2024/04/global-police-operation-disrupts.html
content:
As many as 37 individuals have been arrested as part of an international crackdown on a cybercrime service called&nbsp;LabHost&nbsp;that has been used by criminal actors to steal personal credentials from victims around the world.
Described as one of the largest Phishing-as-a-Service (PhaaS) providers, LabHost offered phishing pages targeting banks, high-profile organizations, and other service


feed_id: https://thehackernews.com/2024/04/hackers-exploit-openmetadata-flaws-to.html
title: Hackers Exploit OpenMetadata Flaws to Mine Crypto on Kubernetes
uri: Hackers-Exploit-OpenMetadata-Flaws-to-Mine-Crypto-on-Kubernetes
url: https://thehackernews.com/2024/04/hackers-exploit-openmetadata-flaws-to.html
content:
Threat actors are actively exploiting critical vulnerabilities in OpenMetadata to gain unauthorized access to Kubernetes workloads and leverage them for cryptocurrency mining activity.
That's according to the Microsoft Threat Intelligence team, which&nbsp;said&nbsp;the flaws have been weaponized since the start of April 2024.
OpenMetadata is an&nbsp;open-source platform&nbsp;that operates as a


feed_id: https://thehackernews.com/2024/04/malicious-google-ads-pushing-fake-ip.html
title: Malicious Google Ads Pushing Fake IP Scanner Software with Hidden Backdoor
uri: Malicious-Google-Ads-Pushing-Fake-IP-Scanner-Software-with-Hidden-Back
url: https://thehackernews.com/2024/04/malicious-google-ads-pushing-fake-ip.html
content:
A new Google malvertising campaign is leveraging a cluster of domains mimicking a legitimate IP scanner software to deliver a previously unknown backdoor dubbed&nbsp;MadMxShell.
"The threat actor registered multiple look-alike domains using a typosquatting technique and leveraged Google Ads to push these domains to the top of search engine results targeting specific search keywords, thereby


feed_id: https://thehackernews.com/2024/04/russian-apt-deploys-new-kapeka-backdoor.html
title: Russian APT Deploys New 'Kapeka' Backdoor in Eastern European Attacks
uri: Russian-APT-Deploys-New-Kapeka-Backdoor-in-Eastern-European-Attacks
url: https://thehackernews.com/2024/04/russian-apt-deploys-new-kapeka-backdoor.html
content:
A previously undocumented "flexible" backdoor called&nbsp;Kapeka&nbsp;has been "sporadically" observed in cyber attacks targeting Eastern Europe, including Estonia and Ukraine, since at least mid-2022.
The findings come from Finnish cybersecurity firm WithSecure, which attributed the malware to the Russia-linked advanced persistent threat (APT) group tracked as&nbsp;Sandworm&nbsp;(aka APT44 or


feed_id: https://thehackernews.com/2024/04/genai-new-headache-for-saas-security.html
title: GenAI: A New Headache for SaaS Security Teams
uri: GenAI-A-New-Headache-for-SaaS-Security-Teams
url: https://thehackernews.com/2024/04/genai-new-headache-for-saas-security.html
content:
The introduction of Open AI’s ChatGPT was a defining moment for the software industry, touching off a GenAI race with its November 2022 release. SaaS vendors are now rushing to upgrade tools with enhanced productivity capabilities that are driven by generative AI.
Among a wide range of uses, GenAI tools make it easier for developers to build software, assist sales teams in mundane email writing,


feed_id: https://thehackernews.com/2024/04/critical-atlassian-flaw-exploited-to.html
title: Critical Atlassian Flaw Exploited to Deploy Linux Variant of Cerber Ransomware
uri: Critical-Atlassian-Flaw-Exploited-to-Deploy-Linux-Variant-of-Cerber-Ra
url: https://thehackernews.com/2024/04/critical-atlassian-flaw-exploited-to.html
content:
Threat actors are exploiting unpatched Atlassian servers to deploy a Linux variant of Cerber (aka C3RB3R) ransomware.
The attacks leverage&nbsp;CVE-2023-22518&nbsp;(CVSS score: 9.1), a critical security vulnerability impacting the Atlassian Confluence Data Center and Server that allows an unauthenticated attacker to reset Confluence and create an administrator account.
Armed with this access, a


feed_id: https://thehackernews.com/2024/04/hackers-exploit-fortinet-flaw-deploy.html
title: Hackers Exploit Fortinet Flaw, Deploy ScreenConnect, Metasploit in New Campaign
uri: Hackers-Exploit-Fortinet-Flaw-Deploy-ScreenConnect-Metasploit-in-New
url: https://thehackernews.com/2024/04/hackers-exploit-fortinet-flaw-deploy.html
content:
Cybersecurity researchers have discovered a new campaign that's exploiting a recently disclosed security flaw in Fortinet FortiClient EMS devices to deliver ScreenConnect and Metasploit Powerfun payloads.
The activity entails the exploitation of&nbsp;CVE-2023-48788&nbsp;(CVSS score: 9.3), a critical SQL injection flaw that could permit an unauthenticated attacker to execute unauthorized code or


feed_id: https://thehackernews.com/2024/04/cisco-warns-of-global-surge-in-brute.html
title: Cisco Warns of Global Surge in Brute-Force Attacks Targeting VPN and SSH Services
uri: Cisco-Warns-of-Global-Surge-in-Brute-Force-Attacks-Targeting-VPN-and-S
url: https://thehackernews.com/2024/04/cisco-warns-of-global-surge-in-brute.html
content:
Cisco is warning about a global surge in brute-force attacks targeting various devices, including Virtual Private Network (VPN) services, web application authentication interfaces, and SSH services, since at least March 18, 2024.
"These attacks all appear to be originating from TOR exit nodes and a range of other anonymizing tunnels and proxies," Cisco Talos&nbsp;said.
Successful attacks could


feed_id: https://thehackernews.com/2024/04/blacktech-targets-tech-research-and-gov.html
title: BlackTech Targets Tech, Research, and Gov Sectors New 'Deuterbear' Tool
uri: BlackTech-Targets-Tech-Research-and-Gov-Sectors-New-Deuterbear-Too
url: https://thehackernews.com/2024/04/blacktech-targets-tech-research-and-gov.html
content:
Technology, research, and government sectors in the Asia-Pacific region&nbsp;have been targeted by a threat actor called&nbsp;BlackTech&nbsp;as part of a recent cyber attack wave.
The intrusions pave the way for an updated version of&nbsp;modular backdoor dubbed&nbsp;Waterbear as well as its enhanced successor&nbsp;referred to as&nbsp;Deuterbear.
"Waterbear is known for its complexity, as it


feed_id: https://thehackernews.com/2024/04/showcasing-networkless-identity-attacks.html
title: How Attackers Can Own a Business Without Touching the Endpoint
uri: How-Attackers-Can-Own-a-Business-Without-Touching-the-Endpoint
url: https://thehackernews.com/2024/04/showcasing-networkless-identity-attacks.html
content:
Attackers are increasingly&nbsp;making use of&nbsp;“networkless”&nbsp;attack techniques targeting&nbsp;cloud apps and identities. Here’s how attackers can (and are)&nbsp;compromising organizations –&nbsp;without ever needing to touch the endpoint or conventional networked systems and services.&nbsp;
Before getting into the details of the attack techniques&nbsp;being&nbsp;used, let’s discuss why


feed_id: https://thehackernews.com/2024/04/akira-ransomware-gang-extorts-42.html
title: Akira Ransomware Gang Extorts $42 Million; Now Targets Linux Servers
uri: Akira-Ransomware-Gang-Extorts-42-Million-Now-Targets-Linux-Servers
url: https://thehackernews.com/2024/04/akira-ransomware-gang-extorts-42.html
content:
Threat actors behind the Akira ransomware group have extorted approximately $42 million in illicit proceeds after breaching the networks of more than 250 victims as of January 1, 2024.
"Since March 2023, Akira ransomware has impacted a wide range of businesses and critical infrastructure entities in North America, Europe, and Australia," cybersecurity agencies from the Netherlands and the U.S.,


feed_id: https://thehackernews.com/2024/04/hackers-target-middle-east-governments.html
title: Hackers Target Middle East Governments with Evasive "CR4T" Backdoor
uri: Hackers-Target-Middle-East-Governments-with-Evasive-CR4T-Backdoor
url: https://thehackernews.com/2024/04/hackers-target-middle-east-governments.html
content:
Government entities in the Middle East have&nbsp;been targeted&nbsp;as part of a previously undocumented campaign to deliver a new backdoor dubbed CR4T.
Russian cybersecurity company Kaspersky said it discovered the activity in February 2024,&nbsp;with evidence suggesting&nbsp;that it may have been active&nbsp;since&nbsp;at least a year prior.&nbsp;The campaign has&nbsp;been codenamed&nbsp;


feed_id: https://thehackernews.com/2024/04/russian-hacker-group-toddycat-uses.html
title: ToddyCat Hacker Group Uses Advanced Tools for Industrial-Scale Data Theft
uri: ToddyCat-Hacker-Group-Uses-Advanced-Tools-for-Industrial-Scale-Data-Th
url: https://thehackernews.com/2024/04/russian-hacker-group-toddycat-uses.html
content:
The threat actor&nbsp;known as&nbsp;ToddyCat&nbsp;has&nbsp;been observed&nbsp;using a wide range of tools to retain access to compromised environments and steal valuable data.
Russian cybersecurity firm Kaspersky characterized the adversary as relying on various programs to harvest data on an "industrial scale" from primarily governmental organizations, some of them defense related, located in


feed_id: https://thehackernews.com/2024/04/penteras-2024-report-reveals-hundreds.html
uri: Pentera-s-2024-Report-Reveals-Hundreds-of-Security-Events-per-Week-Hi
url: https://thehackernews.com/2024/04/penteras-2024-report-reveals-hundreds.html
title:
Pentera's 2024 Report Reveals Hundreds of Security Events per Week, Highlighting the Criticality of Continuous Validation

content:
Over the past two years, a shocking&nbsp;51% of organizations surveyed in a leading industry report have been compromised by a cyberattack.&nbsp;Yes, over half.&nbsp;
And this, in a world where enterprises deploy&nbsp;an average of 53 different security solutions&nbsp;to safeguard their digital domain.&nbsp;
Alarming? Absolutely.
A recent survey of CISOs and CIOs, commissioned by Pentera and


feed_id: https://thehackernews.com/2024/04/mitre-corporation-breached-by-nation.html
title: MITRE Corporation Breached by Nation-State Hackers Exploiting Ivanti Flaws
uri: MITRE-Corporation-Breached-by-Nation-State-Hackers-Exploiting-Ivanti-F
url: https://thehackernews.com/2024/04/mitre-corporation-breached-by-nation.html
content:
The MITRE Corporation revealed that it was the target of a nation-state cyber attack that exploited two zero-day flaws in Ivanti Connect Secure appliances starting in January 2024.
The intrusion led to the compromise of its Networked Experimentation, Research, and Virtualization Environment (NERVE), an unclassified research and prototyping network.
The unknown adversary "performed reconnaissance


feed_id: https://thehackernews.com/2024/04/ransomware-double-dip-re-victimization.html
title: Ransomware Double-Dip: Re-Victimization in Cyber Extortion
uri: Ransomware-Double-Dip-Re-Victimization-in-Cyber-Extortion
url: https://thehackernews.com/2024/04/ransomware-double-dip-re-victimization.html
content:
Between crossovers - Do threat actors play dirty or desperate? 
In our dataset of over 11,000 victim organizations that have experienced a Cyber Extortion / Ransomware attack, we noticed that some victims re-occur. Consequently, the question arises why we observe a re-victimization and whether or not this is an actual second attack, an affiliate crossover (meaning an affiliate has gone to


feed_id: https://thehackernews.com/2024/04/researchers-uncover-windows-flaws.html
title: Researchers Uncover Windows Flaws Granting Hackers Rootkit-Like Powers
uri: Researchers-Uncover-Windows-Flaws-Granting-Hackers-Rootkit-Like-Powers
url: https://thehackernews.com/2024/04/researchers-uncover-windows-flaws.html
content:
New research has found that the DOS-to-NT path conversion process could be exploited by threat actors to achieve rootkit-like capabilities to conceal and impersonate files, directories, and processes.
"When a user executes a function that has a path argument in Windows, the DOS path at which the file or folder exists is converted to an NT path," SafeBreach security researcher Or Yair&nbsp;said&


feed_id: https://thehackernews.com/2024/04/microsoft-warns-north-korean-hackers.html
title: Microsoft Warns: North Korean Hackers Turn to AI-Fueled Cyber Espionage
uri: Microsoft-Warns-North-Korean-Hackers-Turn-to-AI-Fueled-Cyber-Espionag
url: https://thehackernews.com/2024/04/microsoft-warns-north-korean-hackers.html
content:
Microsoft has revealed that North Korea-linked state-sponsored cyber actors has begun to use artificial intelligence (AI) to make its operations more effective and efficient.
"They are learning to use tools powered by AI large language models (LLM) to make their operations more efficient and effective," the tech giant&nbsp;said&nbsp;in its latest report on East Asia hacking groups.
The company


feed_id: https://thehackernews.com/2024/04/new-redline-stealer-variant-disguised.html
title: New RedLine Stealer Variant Disguised as Game Cheats Using Lua Bytecode for Stealth
uri: New-RedLine-Stealer-Variant-Disguised-as-Game-Cheats-Using-Lua-Bytecod
url: https://thehackernews.com/2024/04/new-redline-stealer-variant-disguised.html
content:
A new information stealer has been found leveraging Lua bytecode for added stealth and sophistication, findings from McAfee Labs reveal.
The cybersecurity firm has assessed it to be a variant of a known malware called RedLine Stealer owing to the fact that the command-and-control (C2) server&nbsp;IP address&nbsp;has been previously identified as associated with the malware.
RedLine Stealer,&nbsp


feed_id: https://thehackernews.com/2024/04/palo-alto-networks-discloses-more.html
title: Palo Alto Networks Discloses More Details on Critical PAN-OS Flaw Under Attack
uri: Palo-Alto-Networks-Discloses-More-Details-on-Critical-PAN-OS-Flaw-Unde
url: https://thehackernews.com/2024/04/palo-alto-networks-discloses-more.html
content:
Palo Alto Networks has shared more details of a critical security flaw impacting PAN-OS that&nbsp;has come under active exploitation&nbsp;in the wild&nbsp;by malicious actors.
The company described the vulnerability, tracked as&nbsp;CVE-2024-3400&nbsp;(CVSS score: 10.0), as "intricate" and a combination of two bugs in versions PAN-OS 10.2, PAN-OS 11.0, and PAN-OS 11.1&nbsp;of the software.
"In


feed_id: https://thehackernews.com/2024/04/critical-update-crushftp-zero-day-flaw.html
title: Critical Update: CrushFTP Zero-Day Flaw Exploited in Targeted Attacks
uri: Critical-Update-CrushFTP-Zero-Day-Flaw-Exploited-in-Targeted-Attacks
url: https://thehackernews.com/2024/04/critical-update-crushftp-zero-day-flaw.html
content:
Users of the CrushFTP enterprise file transfer software are&nbsp;being&nbsp;urged&nbsp;to update to the latest version&nbsp;following the discovery of&nbsp;a security flaw that has come under targeted exploitation in the wild.
"CrushFTP v11 versions below 11.1 have a vulnerability where users can escape their VFS and download system files," CrushFTP&nbsp;said&nbsp;in an advisory released Friday.


feed_id: https://thehackernews.com/2024/04/webinar-learn-proactive-supply-chain.html
title: Webinar: Learn Proactive Supply Chain Threat Hunting Techniques
uri: Webinar-Learn-Proactive-Supply-Chain-Threat-Hunting-Techniques
url: https://thehackernews.com/2024/04/webinar-learn-proactive-supply-chain.html
content:
In the high-stakes world of cybersecurity, the battleground has shifted. Supply chain attacks have emerged as a potent threat, exploiting the intricate web of interconnected systems and third-party dependencies to breach even the most formidable defenses. But what if you could turn the tables and proactively hunt these threats before they wreak havoc?
We invite you to&nbsp;join us for&nbsp;an


feed_id: https://thehackernews.com/2024/04/police-chiefs-call-for-solutions-to.html
title: Police Chiefs Call for Solutions to Access Encrypted Data in Serious Crime Cases
uri: Police-Chiefs-Call-for-Solutions-to-Access-Encrypted-Data-in-Serious-C
url: https://thehackernews.com/2024/04/police-chiefs-call-for-solutions-to.html
content:
European Police Chiefs said that the complementary partnership between law enforcement agencies and the technology industry is at risk due to end-to-end encryption (E2EE).
They called on the industry and governments to take urgent action to ensure public safety across social media platforms.
"Privacy measures currently being rolled out, such as end-to-end encryption, will stop tech companies


feed_id: https://thehackernews.com/2024/04/unmasking-true-cost-of-cyberattacks.html
title: Unmasking the True Cost of Cyberattacks: Beyond Ransom and Recovery
uri: Unmasking-the-True-Cost-of-Cyberattacks-Beyond-Ransom-and-Recovery
url: https://thehackernews.com/2024/04/unmasking-true-cost-of-cyberattacks.html
content:
Cybersecurity breaches can be devastating for both individuals and businesses alike. While many people&nbsp;tend to&nbsp;focus on understanding how and why they were targeted by such breaches, there's a larger, more pressing question: What is the true financial impact of a cyberattack? According to research by Cybersecurity Ventures, the global cost of cybercrime&nbsp;is projected&nbsp;to reach


feed_id: https://thehackernews.com/2024/04/german-authorities-issue-arrest.html
title: German Authorities Issue Arrest Warrants for Three Suspected Chinese Spies
uri: German-Authorities-Issue-Arrest-Warrants-for-Three-Suspected-Chinese-S
url: https://thehackernews.com/2024/04/german-authorities-issue-arrest.html
content:
German authorities said they have issued arrest warrants against three citizens on suspicion of spying for China.
The full names of the defendants&nbsp;were not disclosed&nbsp;by the Office of the Federal Prosecutor (aka Generalbundesanwalt), but it&nbsp;includes Herwig F., Ina F., and Thomas R.
"The suspects are strongly suspected of working for a Chinese secret service since an unspecified


feed_id: https://thehackernews.com/2024/04/us-imposes-visa-restrictions-on-13.html
title: U.S. Imposes Visa Restrictions on 13 Linked to Commercial Spyware Misuse
uri: U-S-Imposes-Visa-Restrictions-on-13-Linked-to-Commercial-Spyware-Misu
url: https://thehackernews.com/2024/04/us-imposes-visa-restrictions-on-13.html
content:
The U.S. Department of State&nbsp;on Monday&nbsp;said it's taking steps to impose visa restrictions on 13 individuals&nbsp;who are&nbsp;allegedly involved in the development and sale of&nbsp;commercial spyware&nbsp;or who are immediately family members of those involved in such businesses.
"These individuals have facilitated or derived financial benefit from the misuse of this technology, which


feed_id: https://thehackernews.com/2024/04/russias-apt28-exploited-windows-print.html
title: Russia's APT28 Exploited Windows Print Spooler Flaw to Deploy 'GooseEgg' Malware
uri: Russia-s-APT28-Exploited-Windows-Print-Spooler-Flaw-to-Deploy-GooseEg
url: https://thehackernews.com/2024/04/russias-apt28-exploited-windows-print.html
content:
The Russia-linked nation-state threat actor tracked as&nbsp;APT28&nbsp;weaponized a security flaw in the Microsoft Windows Print Spooler component to deliver a previously unknown custom malware called GooseEgg.
The post-compromise tool,&nbsp;which is&nbsp;said to have&nbsp;been used&nbsp;since at least June 2020 and possibly as early as April 2019, leveraged a now-patched flaw that allowed for


feed_id: https://thehackernews.com/2024/04/apache-cordova-app-harness-targeted-in.html
title: Apache Cordova App Harness Targeted in Dependency Confusion Attack
uri: Apache-Cordova-App-Harness-Targeted-in-Dependency-Confusion-Attack
url: https://thehackernews.com/2024/04/apache-cordova-app-harness-targeted-in.html
content:
Researchers have identified a dependency confusion vulnerability impacting an archived Apache project called Cordova App Harness.
Dependency confusion attacks&nbsp;take place&nbsp;owing to the fact that&nbsp;package managers check the public repositories before private registries, thus allowing a threat actor to publish a malicious package with the same name to a public package repository.
This&


feed_id: https://thehackernews.com/2024/04/google-prevented-228-million-malicious.html
title: Google Prevented 2.28 Million Malicious Apps from Reaching Play Store in 2023
uri: Google-Prevented-2-28-Million-Malicious-Apps-from-Reaching-Play-Store
url: https://thehackernews.com/2024/04/google-prevented-228-million-malicious.html
content:
Google on Monday revealed that almost 200,000 app submissions to its Play Store for Android were either rejected or remediated to address issues with access to sensitive data such as location or SMS messages over the past year.
The tech giant also said it blocked 333,000 bad accounts from the app storefront in 2023 for attempting to distribute malware or for repeated policy violations.
"In 2023,


feed_id: https://thehackernews.com/2024/04/china-linked-muddling-meerkat-hijacks.html
title: China-Linked 'Muddling Meerkat' Hijacks DNS to Map Internet on Global Scale
uri: China-Linked-Muddling-Meerkat-Hijacks-DNS-to-Map-Internet-on-Global
url: https://thehackernews.com/2024/04/china-linked-muddling-meerkat-hijacks.html
content:
A previously undocumented cyber threat dubbed&nbsp;Muddling Meerkat&nbsp;has&nbsp;been observed&nbsp;undertaking sophisticated domain name system (DNS) activities in a likely effort to evade security measures and conduct&nbsp;reconnaissance&nbsp;of networks&nbsp;across the world&nbsp;since October 2019.
Cloud security firm Infoblox described the threat actor as likely affiliated with the


feed_id: https://thehackernews.com/2024/04/navigating-threat-landscape.html
uri: Navigating-the-Threat-Landscape-Understanding-Exposure-Management-Pe
url: https://thehackernews.com/2024/04/navigating-threat-landscape.html
title:
Navigating the Threat Landscape: Understanding Exposure Management, Pentesting, Red Teaming and RBVM

content:
It&nbsp;comes as&nbsp;no surprise that today's cyber threats are orders of magnitude more complex than those of the past.&nbsp;And the&nbsp;ever-evolving tactics that attackers use demand the adoption of better, more holistic and consolidated ways to meet this&nbsp;non-stop&nbsp;challenge. Security teams constantly look for ways to reduce risk while improving security posture, but many


feed_id: https://thehackernews.com/2024/04/new-r-programming-vulnerability-exposes.html
title: New R Programming Vulnerability Exposes Projects to Supply Chain Attacks
uri: New-R-Programming-Vulnerability-Exposes-Projects-to-Supply-Chain-Attac
url: https://thehackernews.com/2024/04/new-r-programming-vulnerability-exposes.html
content:
A security vulnerability has&nbsp;been discovered&nbsp;in the R programming language that could be exploited by a threat actor to create a malicious RDS (R Data Serialization) file such that it results in code execution when loaded and referenced.
The flaw, assigned the CVE identifier CVE-2024-27322 (CVSS score: 8.8), "involves the use of promise objects and lazy evaluation in R," AI application


feed_id: https://thehackernews.com/2024/04/sandbox-escape-vulnerabilities-in.html
title: Sandbox Escape Vulnerabilities in Judge0 Expose Systems to Complete Takeover
uri: Sandbox-Escape-Vulnerabilities-in-Judge0-Expose-Systems-to-Complete-Ta
url: https://thehackernews.com/2024/04/sandbox-escape-vulnerabilities-in.html
content:
Multiple critical security flaws have been disclosed in the Judge0 open-source online code execution system&nbsp;that&nbsp;could be exploited to&nbsp;obtain code execution&nbsp;on the target system.
The three&nbsp;flaws, all critical&nbsp;in nature,&nbsp;allow an "adversary with sufficient access to perform a sandbox escape and obtain root permissions on the host machine," Australian


feed_id: https://thehackernews.com/2024/04/okta-warns-of-unprecedented-surge-in.html
title: Okta Warns of Unprecedented Surge in Proxy-Driven Credential Stuffing Attacks
uri: Okta-Warns-of-Unprecedented-Surge-in-Proxy-Driven-Credential-Stuffing
url: https://thehackernews.com/2024/04/okta-warns-of-unprecedented-surge-in.html
content:
Identity and access management (IAM) services provider Okta has warned of a spike in the "frequency and scale" of credential stuffing attacks aimed at online services.
These unprecedented attacks, observed over the last month, are said to be facilitated by "the broad availability of residential proxy services, lists of previously stolen credentials ('combo lists'), and scripting tools," the


feed_id: https://thehackernews.com/2024/04/ukraine-targeted-in-cyberattack.html
title: Ukraine Targeted in Cyberattack Exploiting 7-Year-Old Microsoft Office Flaw
uri: Ukraine-Targeted-in-Cyberattack-Exploiting-7-Year-Old-Microsoft-Office
url: https://thehackernews.com/2024/04/ukraine-targeted-in-cyberattack.html
content:
Cybersecurity researchers have discovered a targeted operation against Ukraine that has&nbsp;been found&nbsp;leveraging a nearly seven-year-old flaw in Microsoft Office to deliver Cobalt Strike on compromised systems.
The attack chain, which took place at the end of 2023 according to Deep Instinct, employs a PowerPoint slideshow file ("signal-2023-12-20-160512.ppsx") as the starting point, with


feed_id: https://thehackernews.com/2024/04/bogus-npm-packages-used-to-trick.html
title: Bogus npm Packages Used to Trick Software Developers into Installing Malware
uri: Bogus-npm-Packages-Used-to-Trick-Software-Developers-into-Installing-M
url: https://thehackernews.com/2024/04/bogus-npm-packages-used-to-trick.html
content:
An ongoing social engineering campaign&nbsp;is targeting&nbsp;software developers with bogus npm packages under the guise of a job interview to trick them into downloading a Python backdoor.
Cybersecurity firm Securonix is tracking the activity under&nbsp;the name&nbsp;DEV#POPPER,&nbsp;linking it to North Korean threat actors.
"During these fraudulent interviews, the developers are often asked


feed_id: https://thehackernews.com/2024/04/severe-flaws-disclosed-in-brocade.html
title: Severe Flaws Disclosed in Brocade SANnav SAN Management Software
uri: Severe-Flaws-Disclosed-in-Brocade-SANnav-SAN-Management-Software
url: https://thehackernews.com/2024/04/severe-flaws-disclosed-in-brocade.html
content:
Several security vulnerabilities disclosed in Brocade SANnav storage area network (SAN) management&nbsp;application&nbsp;could be exploited&nbsp;to compromise susceptible appliances.
The&nbsp;18 flaws&nbsp;impact&nbsp;all versions up to and including 2.3.0, according to independent security researcher Pierre Barre, who discovered and reported them.
The issues range from incorrect firewall rules,


feed_id: https://thehackernews.com/2024/04/10-critical-endpoint-security-tips-you.html
title: 10 Critical Endpoint Security Tips You Should Know
uri: 10-Critical-Endpoint-Security-Tips-You-Should-Know
url: https://thehackernews.com/2024/04/10-critical-endpoint-security-tips-you.html
content:
In today's digital world, where connectivity&nbsp;is rules all, endpoints serve as the gateway to a business’s digital kingdom.&nbsp;And because&nbsp;of this,&nbsp;endpoints&nbsp;are one of hackers' favorite targets.&nbsp;
According to the IDC,&nbsp;70% of successful breaches start at the endpoint. Unprotected endpoints provide vulnerable entry points to launch devastating cyberattacks. With IT


feed_id: https://thehackernews.com/2024/04/new-brokewell-android-malware-spread.html
title: New 'Brokewell' Android Malware Spread Through Fake Browser Updates
uri: New-Brokewell-Android-Malware-Spread-Through-Fake-Browser-Updates
url: https://thehackernews.com/2024/04/new-brokewell-android-malware-spread.html
content:
Fake browser updates are&nbsp;being used&nbsp;to push a previously undocumented Android malware called&nbsp;Brokewell.
"Brokewell is a typical modern banking malware equipped with both data-stealing and remote-control capabilities built into the malware," Dutch security firm ThreatFabric&nbsp;said&nbsp;in an analysis published Thursday.
The malware is&nbsp;said to be&nbsp;in active development,


feed_id: https://thehackernews.com/2024/04/palo-alto-networks-outlines-remediation.html
title: Palo Alto Networks Outlines Remediation for Critical PAN-OS Flaw Under Attack
uri: Palo-Alto-Networks-Outlines-Remediation-for-Critical-PAN-OS-Flaw-Under
url: https://thehackernews.com/2024/04/palo-alto-networks-outlines-remediation.html
content:
Palo Alto Networks has&nbsp;shared&nbsp;remediation guidance for a recently disclosed critical security flaw&nbsp;impacting PAN-OS that has come under active exploitation.
The&nbsp;vulnerability,&nbsp;tracked as&nbsp;CVE-2024-3400&nbsp;(CVSS score: 10.0), could be weaponized to obtain unauthenticated remote shell command execution on susceptible devices. It has&nbsp;been addressed&nbsp;in


feed_id: https://thehackernews.com/2024/04/hackers-exploiting-wp-automatic-plugin.html
title: Hackers Exploiting WP-Automatic Plugin Bug to Create Admin Accounts on WordPress Sites
uri: Hackers-Exploiting-WP-Automatic-Plugin-Bug-to-Create-Admin-Accounts-on
url: https://thehackernews.com/2024/04/hackers-exploiting-wp-automatic-plugin.html
content:
Threat actors are attempting to actively exploit a critical security flaw in the ValvePress Automatic plugin for WordPress that could allow site takeovers.
The shortcoming, tracked as&nbsp;CVE-2024-27956, carries a CVSS score of 9.9 out of a maximum of 10. It impacts all versions of the&nbsp;plugin prior to 3.92.0. The issue has been resolved in version 3.92.1 released on February 27, 2024,


feed_id: https://thehackernews.com/2024/04/north-koreas-lazarus-group-deploys-new.html
title: North Korea's Lazarus Group Deploys New Kaolin RAT via Fake Job Lures
uri: North-Korea-s-Lazarus-Group-Deploys-New-Kaolin-RAT-via-Fake-Job-Lures
url: https://thehackernews.com/2024/04/north-koreas-lazarus-group-deploys-new.html
content:
The North Korea-linked threat actor&nbsp;known as Lazarus&nbsp;Group employed its time-tested fabricated job lures to deliver a new remote access trojan called Kaolin RAT as part of attacks targeting specific individuals in the Asia region in summer 2023.
The malware could, "aside from standard RAT functionality,&nbsp;change the last write timestamp of a selected file and load any received DLL


feed_id: https://thehackernews.com/2024/04/network-threats-step-by-step-attack.html
title: Network Threats: A Step-by-Step Attack Demonstration
uri: Network-Threats-A-Step-by-Step-Attack-Demonstration
url: https://thehackernews.com/2024/04/network-threats-step-by-step-attack.html
content:
Follow this real-life network attack simulation, covering&nbsp;6&nbsp;steps from Initial Access to Data Exfiltration. See how attackers remain undetected with the&nbsp;simplest&nbsp;tools and why you need multiple choke points in your defense strategy.
Surprisingly, most network attacks are not exceptionally sophisticated, technologically advanced, or reliant on zero-day tools that exploit


feed_id: https://thehackernews.com/2024/04/doj-arrests-founders-of-crypto-mixer.html
title: DOJ Arrests Founders of Crypto Mixer Samourai for $2 Billion in Illegal Transactions
uri: DOJ-Arrests-Founders-of-Crypto-Mixer-Samourai-for-2-Billion-in-Illega
url: https://thehackernews.com/2024/04/doj-arrests-founders-of-crypto-mixer.html
content:
The U.S. Department of Justice (DoJ)&nbsp;on Wednesday&nbsp;announced&nbsp;the arrest of two co-founders of a cryptocurrency mixer called Samourai and seized the service for allegedly facilitating over $2 billion in illegal transactions and&nbsp;for&nbsp;laundering more than $100 million in criminal proceeds.
To that end, Keonne Rodriguez, 35, and William Lonergan Hill, 65, have been charged


feed_id: https://thehackernews.com/2024/04/google-postpones-third-party-cookie.html
title: Google Postpones Third-Party Cookie Deprecation Amid U.K. Regulatory Scrutiny
uri: Google-Postpones-Third-Party-Cookie-Deprecation-Amid-U-K-Regulatory-S
url: https://thehackernews.com/2024/04/google-postpones-third-party-cookie.html
content:
Google has once again&nbsp;pushed its plans&nbsp;to deprecate third-party tracking cookies in its Chrome web browser as it works to address outstanding competition concerns from U.K. regulators over its Privacy Sandbox initiative.
The tech giant said it's working closely with the U.K. Competition and Markets Authority (CMA) and hopes to achieve an agreement by the end of the year.
As part of the


feed_id: https://thehackernews.com/2024/04/state-sponsored-hackers-exploit-two.html
title: State-Sponsored Hackers Exploit Two Cisco Zero-Day Vulnerabilities for Espionage
uri: State-Sponsored-Hackers-Exploit-Two-Cisco-Zero-Day-Vulnerabilities-for
url: https://thehackernews.com/2024/04/state-sponsored-hackers-exploit-two.html
content:
A new malware campaign leveraged two zero-day flaws in Cisco networking gear to deliver custom malware and facilitate covert data collection on target environments.
Cisco Talos, which dubbed the&nbsp;activity&nbsp;ArcaneDoor, attributed it as the handiwork of a previously undocumented sophisticated state-sponsored actor it tracks under the name UAT4356 (aka Storm-1849 by Microsoft).
"UAT4356


feed_id: https://thehackernews.com/2024/04/us-treasury-sanctions-iranian-firms-and.html
title: U.S. Treasury Sanctions Iranian Firms and Individuals Tied to Cyber Attacks
uri: U-S-Treasury-Sanctions-Iranian-Firms-and-Individuals-Tied-to-Cyber-At
url: https://thehackernews.com/2024/04/us-treasury-sanctions-iranian-firms-and.html
content:
The U.S. Treasury Department's Office of Foreign Assets Control (OFAC)&nbsp;on Monday&nbsp;sanctioned two firms and four individuals for their involvement in malicious cyber activities on behalf of the Iranian Islamic Revolutionary Guard Corps Cyber Electronic Command (IRGC-CEC) from at least 2016 to April 2021.
This&nbsp;includes the front companies Mehrsam Andisheh Saz Nik (MASN) and Dadeh


feed_id: https://thehackernews.com/2024/04/researchers-detail-multistage-attack.html
title: Researchers Detail Multistage Attack Hijacking Systems with SSLoad, Cobalt Strike
uri: Researchers-Detail-Multistage-Attack-Hijacking-Systems-with-SSLoad-Co
url: https://thehackernews.com/2024/04/researchers-detail-multistage-attack.html
content:
Cybersecurity researchers have discovered an ongoing attack campaign&nbsp;that's&nbsp;leveraging phishing emails to deliver a malware called SSLoad.
The campaign, codenamed&nbsp;FROZEN#SHADOW&nbsp;by Securonix, also involves&nbsp;the deployment of&nbsp;Cobalt Strike and the ConnectWise ScreenConnect remote desktop software.
"SSLoad is designed to stealthily infiltrate systems, gather sensitive


feed_id: https://thehackernews.com/2024/04/major-security-flaws-expose-keystrokes.html
title: Major Security Flaws Expose Keystrokes of Over 1 Billion Chinese Keyboard App Users
uri: Major-Security-Flaws-Expose-Keystrokes-of-Over-1-Billion-Chinese-Keybo
url: https://thehackernews.com/2024/04/major-security-flaws-expose-keystrokes.html
content:
Security vulnerabilities uncovered in cloud-based pinyin keyboard apps could be exploited&nbsp;to reveal users' keystrokes to nefarious actors.
The findings come from the Citizen Lab, which discovered weaknesses in eight of nine apps from vendors like Baidu, Honor, iFlytek, OPPO, Samsung, Tencent, Vivo, and Xiaomi.&nbsp;The only vendor whose keyboard app&nbsp;did not have any&nbsp;security


feed_id: https://thehackernews.com/2024/04/escan-antivirus-update-mechanism.html
title: eScan Antivirus Update Mechanism Exploited to Spread Backdoors and Miners
uri: eScan-Antivirus-Update-Mechanism-Exploited-to-Spread-Backdoors-and-Min
url: https://thehackernews.com/2024/04/escan-antivirus-update-mechanism.html
content:
A new malware campaign has been exploiting the updating mechanism of the eScan antivirus software to distribute backdoors and cryptocurrency miners like XMRig through a long-standing threat codenamed GuptiMiner targeting large corporate networks.
Cybersecurity firm Avast said the activity is the work of a threat actor with possible connections to a North Korean hacking group&nbsp;dubbed&nbsp;


feed_id: https://thehackernews.com/2024/04/coralraider-malware-campaign-exploits.html
title: CoralRaider Malware Campaign Exploits CDN Cache to Spread Info-Stealers
uri: CoralRaider-Malware-Campaign-Exploits-CDN-Cache-to-Spread-Info-Stealer
url: https://thehackernews.com/2024/04/coralraider-malware-campaign-exploits.html
content:
A new ongoing malware campaign has&nbsp;been observed&nbsp;distributing three different stealers,&nbsp;such as&nbsp;CryptBot,&nbsp;LummaC2, and&nbsp;Rhadamanthys&nbsp;hosted on Content Delivery Network (CDN) cache domains since at least February 2024.
Cisco Talos has attributed the activity with moderate confidence to a threat actor tracked as&nbsp;CoralRaider, a suspected Vietnamese-origin


