# articles

feed_id: https://thehackernews.com/2023/07/cert-ua-uncovers-gamaredons-rapid-data.html
title: CERT-UA Uncovers Gamaredon's Rapid Data Exfiltration Tactics Following Initial Compromise
uri: 2023-07-26-CERT-UA-Uncovers-Gamaredon-s-Rapid-Data-Exfiltration-Tactics-Following
url: https://thehackernews.com/2023/07/cert-ua-uncovers-gamaredons-rapid-data.html
content:
The Russia-linked threat actor known as Gamaredon has been observed conducting data exfiltration activities within an hour of the initial compromise.
"As a vector of primary compromise, for the most part, emails and messages in messengers (Telegram, WhatsApp, Signal) are used, in most cases, using previously compromised accounts," the Computer Emergency Response Team of Ukraine (CERT-UA) said in


feed_id: https://thehackernews.com/2023/08/mdr-empowering-organizations-with.html
title: MDR: Empowering Organizations with Enhanced Security
uri: MDR-Empowering-Organizations-with-Enhanced-Security
url: https://thehackernews.com/2023/08/mdr-empowering-organizations-with.html
content:
Managed Detection and Response (MDR) has emerged as a crucial solution for organizations looking to bolster their security measures. MDR allows businesses to outsource the management of Endpoint Detection and Response (EDR) products deployed across their network domain. With real-time threat-hunting capabilities, MDR services detect and mitigate malicious activities on individual endpoints while


feed_id: https://thehackernews.com/2023/08/reptile-rootkit-advanced-linux-malware.html
title: Reptile Rootkit: Advanced Linux Malware Targeting South Korean Systems
uri: Reptile-Rootkit-Advanced-Linux-Malware-Targeting-South-Korean-Systems
url: https://thehackernews.com/2023/08/reptile-rootkit-advanced-linux-malware.html
content:
Threat actors are using an open-source rootkit called Reptile to target Linux systems in South Korea.
"Unlike other rootkit malware that typically only provide concealment capabilities, Reptile goes a step further by offering a reverse shell, allowing threat actors to easily take control of systems," the AhnLab Security Emergency Response Center (ASEC) said in a report published this week.
"Port


feed_id: https://thehackernews.com/2023/08/microsoft-addresses-critical-power.html
title: Microsoft Addresses Critical Power Platform Flaw After Delays and Criticism
uri: Microsoft-Addresses-Critical-Power-Platform-Flaw-After-Delays-and-Crit
url: https://thehackernews.com/2023/08/microsoft-addresses-critical-power.html
content:
Microsoft on Friday disclosed that it has addressed a critical security flaw impacting Power Platform, but not before it came under criticism for its failure to swiftly act on it.
"The vulnerability could lead to unauthorized access to Custom Code functions used for Power Platform custom connectors," the tech giant said. "The potential impact could be unintended information disclosure if secrets


feed_id: https://thehackernews.com/2023/08/researchers-uncover-new-high-severity.html
title: Researchers Uncover New High-Severity Vulnerability in PaperCut Software
uri: Researchers-Uncover-New-High-Severity-Vulnerability-in-PaperCut-Softwa
url: https://thehackernews.com/2023/08/researchers-uncover-new-high-severity.html
content:
Cybersecurity researchers have discovered a new high-severity security flaw in PaperCut print management software for Windows that could result in remote code execution under specific circumstances.
Tracked as CVE-2023-39143 (CVSS score: 8.4), the flaw impacts PaperCut NG/MF prior to version 22.1.3. It has been described as a combination of a path traversal and file upload vulnerability.
"


feed_id: https://thehackernews.com/2023/08/nyc-couple-pleads-guilty-to-money.html
title: NYC Couple Pleads Guilty to Money Laundering in $3.6 Billion Bitfinex Hack
uri: NYC-Couple-Pleads-Guilty-to-Money-Laundering-in-3-6-Billion-Bitfinex
url: https://thehackernews.com/2023/08/nyc-couple-pleads-guilty-to-money.html
content:
A married couple from New York City has pleaded guilty to money laundering charges in connection with the 2016 hack of cryptocurrency stock exchange Bitfinex, resulting in the theft of about 120,000 bitcoin.
The development comes more than a year after Ilya Lichtenstein, 35, and his wife, Heather Morgan, 33, were arrested in February 2022, following the seizure of roughly 95,000 of the stolen


feed_id: https://thehackernews.com/2023/08/webinar-making-pam-great-again-solving.html
title: Webinar - Making PAM Great Again: Solving the Top 5 Identity Team PAM Challenges
uri: Webinar-Making-PAM-Great-Again-Solving-the-Top-5-Identity-Team-PAM
url: https://thehackernews.com/2023/08/webinar-making-pam-great-again-solving.html
content:
Privileged Access Management (PAM) solutions are widely acknowledged as the gold standard for securing critical privileged accounts. However, many security and identity teams face inherent obstacles during the PAM journey, hindering these solutions from reaching their full potential. These challenges deprive organizations of the resilience they seek, making it essential to address them


feed_id: https://thehackernews.com/2023/08/malicious-npm-packages-found.html
title: Malicious npm Packages Found Exfiltrating Sensitive Data from Developers
uri: Malicious-npm-Packages-Found-Exfiltrating-Sensitive-Data-from-Develope
url: https://thehackernews.com/2023/08/malicious-npm-packages-found.html
content:
Cybersecurity researchers have discovered a new bunch of malicious packages on the npm package registry that are designed to exfiltrate sensitive developer information.
Software supply chain firm Phylum, which first identified the "test" packages on July 31, 2023, said they "demonstrated increasing functionality and refinement," hours after which they were removed and re-uploaded under different


feed_id: https://thehackernews.com/2023/08/major-cybersecurity-agencies.html
title: Major Cybersecurity Agencies Collaborate to Unveil 2022's Most Exploited Vulnerabilities
uri: Major-Cybersecurity-Agencies-Collaborate-to-Unveil-2022-s-Most-Exploit
url: https://thehackernews.com/2023/08/major-cybersecurity-agencies.html
content:
A four-year-old critical security flaw impacting Fortinet FortiOS SSL has emerged as one of the most routinely and frequently exploited vulnerabilities in 2022.
"In 2022, malicious cyber actors exploited older software vulnerabilities more frequently than recently disclosed vulnerabilities and targeted unpatched, internet-facing systems," cybersecurity and intelligence agencies from the Five


feed_id: https://thehackernews.com/2023/08/malicious-apps-use-sneaky-versioning.html
title: Malicious Apps Use Sneaky Versioning Technique to Bypass Google Play Store Scanners
uri: Malicious-Apps-Use-Sneaky-Versioning-Technique-to-Bypass-Google-Play-S
url: https://thehackernews.com/2023/08/malicious-apps-use-sneaky-versioning.html
content:
Threat actors are leveraging a technique called versioning to evade Google Play Store's malware detections and target Android users.
"Campaigns using versioning commonly target users' credentials, data, and finances," Google Cybersecurity Action Team (GCAT) said in its August 2023 Threat Horizons Report shared with The Hacker News.
While versioning is not a new phenomenon, it's sneaky and hard


feed_id: https://thehackernews.com/2023/07/rfp-template-for-browser-security.html
title: RFP Template for Browser Security
uri: RFP-Template-for-Browser-Security
url: https://thehackernews.com/2023/07/rfp-template-for-browser-security.html
content:
Increasing cyber threats and attacks have made protecting organizational data a paramount concern for businesses of all sizes. A group of experts have recognized the pressing need for comprehensive browser security solutions and collaborated to develop "The Definitive Browser Security RFP Template." This resource helps streamline the process of evaluating and procuring browser security platforms


feed_id: https://thehackernews.com/2023/08/new-version-of-rilide-data-theft.html
title: New Version of Rilide Data Theft Malware Adapts to Chrome Extension Manifest V3
uri: New-Version-of-Rilide-Data-Theft-Malware-Adapts-to-Chrome-Extension-Ma
url: https://thehackernews.com/2023/08/new-version-of-rilide-data-theft.html
content:
Cybersecurity researchers have discovered a new version of malware called Rilide that targets Chromium-based web browsers to steal sensitive data and steal cryptocurrency.
"It exhibits a higher level of sophistication through modular design, code obfuscation, adoption to the Chrome Extension Manifest V3, and additional features such as the ability to exfiltrate stolen data to a Telegram channel


feed_id: https://thehackernews.com/2023/08/hundreds-of-citrix-netscaler-adc-and.html
title: Hundreds of Citrix NetScaler ADC and Gateway Servers Hacked in Major Cyber Attack
uri: Hundreds-of-Citrix-NetScaler-ADC-and-Gateway-Servers-Hacked-in-Major-C
url: https://thehackernews.com/2023/08/hundreds-of-citrix-netscaler-adc-and.html
content:
Hundreds of Citrix NetScaler ADC and Gateway servers have been breached by malicious actors to deploy web shells, according to the Shadowserver Foundation.
The non-profit said the attacks take advantage of CVE-2023-3519, a critical code injection vulnerability that could lead to unauthenticated remote code execution.
The flaw, patched by Citrix last month, carries a CVSS score of 9.8.
The 


feed_id: https://thehackernews.com/2023/08/a-penetration-testing-buyers-guide-for.html
title: A Penetration Testing Buyer's Guide for IT Security Teams
uri: A-Penetration-Testing-Buyer-s-Guide-for-IT-Security-Teams
url: https://thehackernews.com/2023/08/a-penetration-testing-buyers-guide-for.html
content:
The frequency and complexity of cyber threats are constantly evolving. At the same time, organizations are now collecting sensitive data that, if compromised, could result in severe financial and reputational damage. According to Cybersecurity Ventures, the cost of cybercrime is predicted to hit $8 trillion in 2023 and will grow to $10.5 trillion by 2025.
There is also increasing public and


feed_id: https://thehackernews.com/2023/08/microsoft-flags-growing-cybersecurity.html
title: Microsoft Flags Growing Cybersecurity Concerns for Major Sporting Events
uri: Microsoft-Flags-Growing-Cybersecurity-Concerns-for-Major-Sporting-Even
url: https://thehackernews.com/2023/08/microsoft-flags-growing-cybersecurity.html
content:
Microsoft is warning of the threat malicious cyber actors pose to stadium operations, warning that the cyber risk surface of live sporting events is "rapidly expanding."
"Information on athletic performance, competitive advantage, and personal information is a lucrative target," the company said in a Cyber Signals report shared with The Hacker News. "Sports teams, major league and global


feed_id: https://thehackernews.com/2023/08/mysterious-team-bangladesh-targeting.html
title: "Mysterious Team Bangladesh" Targeting India with DDoS Attacks and Data Breaches
uri: Mysterious-Team-Bangladesh-Targeting-India-with-DDoS-Attacks-and-Dat
url: https://thehackernews.com/2023/08/mysterious-team-bangladesh-targeting.html
content:
A hacktivist group known as Mysterious Team Bangladesh has been linked to over 750 distributed denial-of-service (DDoS) attacks and 78 website defacements since June 2022.
"The group most frequently attacks logistics, government, and financial sector organizations in India and Israel," Singapore-headquartered cybersecurity firm Group-IB said in a report shared with The Hacker News. "The group is


feed_id: https://thehackernews.com/2023/08/microsoft-exposes-russian-hackers.html
title: Microsoft Exposes Russian Hackers' Sneaky Phishing Tactics via Microsoft Teams Chats
uri: Microsoft-Exposes-Russian-Hackers-Sneaky-Phishing-Tactics-via-Microso
url: https://thehackernews.com/2023/08/microsoft-exposes-russian-hackers.html
content:
Microsoft on Wednesday disclosed that it identified a set of highly targeted social engineering attacks mounted by a Russian nation-state threat actor using credential theft phishing lures sent as Microsoft Teams chats.
The tech giant attributed the attacks to a group it tracks as Midnight Blizzard (previously Nobelium). It's also called APT29, BlueBravo, Cozy Bear, Iron Hemlock, and The Dukes.


feed_id: https://thehackernews.com/2023/08/researchers-discover-bypass-for.html
title: Researchers Discover Bypass for Recently Patched Critical Ivanti EPMM Vulnerability
uri: Researchers-Discover-Bypass-for-Recently-Patched-Critical-Ivanti-EPMM
url: https://thehackernews.com/2023/08/researchers-discover-bypass-for.html
content:
Cybersecurity researchers have discovered a bypass for a recently fixed actively exploited vulnerability in some versions of Ivanti Endpoint Manager Mobile (EPMM), prompting Ivanti to urge users to update to the latest version of the software.
Tracked as CVE-2023-35082 (CVSS score: 10.0) and discovered by Rapid7, the issue "allows unauthenticated attackers to access the API in older unsupported


feed_id: https://thehackernews.com/2023/08/russian-cyber-adversary-bluecharlie.html
title: Russian Cyber Adversary BlueCharlie Alters Infrastructure in Response to Disclosures
uri: Russian-Cyber-Adversary-BlueCharlie-Alters-Infrastructure-in-Response
url: https://thehackernews.com/2023/08/russian-cyber-adversary-bluecharlie.html
content:
A Russia-nexus adversary has been linked to 94 new domains starting March 2023, suggesting that the group is actively modifying its infrastructure in response to public disclosures about its activities.
Cybersecurity firm Recorded Future linked the revamped infrastructure to a threat actor it tracks under the name BlueCharlie, a hacking crew that's broadly known by the names Blue Callisto,


feed_id: https://thehackernews.com/2023/08/phishers-exploit-salesforces-email.html
title: Phishers Exploit Salesforce's Email Services Zero-Day in Targeted Facebook Campaign
uri: Phishers-Exploit-Salesforce-s-Email-Services-Zero-Day-in-Targeted-Face
url: https://thehackernews.com/2023/08/phishers-exploit-salesforces-email.html
content:
A sophisticated Facebook phishing campaign has been observed exploiting a zero-day flaw in Salesforce's email services, allowing threat actors to craft targeted phishing messages using the company's domain and infrastructure.
"Those phishing campaigns cleverly evade conventional detection methods by chaining the Salesforce vulnerability and legacy quirks in Facebook's Web Games platform,"


feed_id: https://thehackernews.com/2023/08/industrial-control-systems.html
title: Industrial Control Systems Vulnerabilities Soar: Over One-Third Unpatched in 2023
uri: Industrial-Control-Systems-Vulnerabilities-Soar-Over-One-Third-Unpatc
url: https://thehackernews.com/2023/08/industrial-control-systems.html
content:
About 34% of security vulnerabilities impacting industrial control systems (ICSs) that were reported in the first half of 2023 have no patch or remediation, registering a significant increase from 13% the previous year.
According to data compiled by SynSaber, a total of 670 ICS product flaws were reported via the U.S. Cybersecurity and Infrastructure Security Agency (CISA) in the first half of


feed_id: https://thehackernews.com/2023/08/top-industries-significantly-impacted.html
title: Top Industries Significantly Impacted by Illicit Telegram Networks
uri: Top-Industries-Significantly-Impacted-by-Illicit-Telegram-Networks
url: https://thehackernews.com/2023/08/top-industries-significantly-impacted.html
content:
In recent years the rise of illicit activities conducted within online messaging platforms has become a growing concern for countless industries. One of the most notable platforms that has been host to many malicious actors and nefarious activities has been Telegram. Thanks to its accessibility, popularity, and user anonymity, Telegram has attracted a large number of threat actors driven by


feed_id: https://thehackernews.com/2023/08/researchers-uncover-aws-ssm-agent.html
title: Researchers Uncover AWS SSM Agent Misuse as a Covert Remote Access Trojan
uri: Researchers-Uncover-AWS-SSM-Agent-Misuse-as-a-Covert-Remote-Access-Tro
url: https://thehackernews.com/2023/08/researchers-uncover-aws-ssm-agent.html
content:
Cybersecurity researchers have discovered a new post-exploitation technique in Amazon Web Services (AWS) that allows the AWS Systems Manager Agent (SSM Agent) to be run as a remote access trojan on Windows and Linux environments
"The SSM agent, a legitimate tool used by admins to manage their instances, can be re-purposed by an attacker who has achieved high privilege access on an endpoint with


feed_id: https://thehackernews.com/2023/08/iranian-company-cloudzy-accused-of.html
title: Iranian Company Cloudzy Accused of Aiding Cybercriminals and Nation-State Hackers
uri: Iranian-Company-Cloudzy-Accused-of-Aiding-Cybercriminals-and-Nation-St
url: https://thehackernews.com/2023/08/iranian-company-cloudzy-accused-of.html
content:
Services offered by an obscure Iranian company known as Cloudzy are being leveraged by multiple threat actors, including cybercrime groups and nation-state crews.
"Although Cloudzy is incorporated in the United States, it almost certainly operates out of Tehran, Iran – in possible violation of U.S. sanctions – under the direction of someone going by the name Hassan Nozari," Halcyon said in a new


feed_id: https://thehackernews.com/2023/08/norwegian-entities-targeted-in-ongoing.html
title: Norwegian Entities Targeted in Ongoing Attacks Exploiting Ivanti EPMM Vulnerability
uri: Norwegian-Entities-Targeted-in-Ongoing-Attacks-Exploiting-Ivanti-EPMM
url: https://thehackernews.com/2023/08/norwegian-entities-targeted-in-ongoing.html
content:
Advanced persistent threat (APT) actors exploited a recently disclosed critical flaw impacting Ivanti Endpoint Manager Mobile (EPMM) as a zero-day since at least April 2023 in attacks directed against Norwegian entities, including a government network.
The disclosure comes as part of a new joint advisory released by the Cybersecurity and Infrastructure Security Agency (CISA) and the Norwegian


feed_id: https://thehackernews.com/2023/08/new-nodestealer-targeting-facebook.html
title: New NodeStealer Variant Targeting Facebook Business Accounts and Crypto Wallets
uri: New-NodeStealer-Variant-Targeting-Facebook-Business-Accounts-and-Crypt
url: https://thehackernews.com/2023/08/new-nodestealer-targeting-facebook.html
content:
Cybersecurity researchers have unearthed a Python variant of a stealer malware NodeStealer that's equipped to fully take over Facebook business accounts as well as siphon cryptocurrency.
Palo Alto Networks Unit 42 said it detected the previously undocumented strain as part of a campaign that commenced in December 2022. There is no evidence to suggest that the cyber offensive is currently active.


feed_id: https://thehackernews.com/2023/08/european-bank-customers-targeted-in.html
title: European Bank Customers Targeted in SpyNote Android Trojan Campaign
uri: European-Bank-Customers-Targeted-in-SpyNote-Android-Trojan-Campaign
url: https://thehackernews.com/2023/08/european-bank-customers-targeted-in.html
content:
Various European customers of different banks are being targeted by an Android banking trojan called SpyNote as part of an aggressive campaign detected in June and July 2023.
"The spyware is distributed through email phishing or smishing campaigns and the fraudulent activities are executed with a combination of remote access trojan (RAT) capabilities and vishing attack," Italian cybersecurity


feed_id: https://thehackernews.com/2023/08/what-is-data-security-posture.html
title: What is Data Security Posture Management (DSPM)?
uri: What-is-Data-Security-Posture-Management-(DSPM)
url: https://thehackernews.com/2023/08/what-is-data-security-posture.html
content:
Data Security Posture Management is an approach to securing cloud data by ensuring that sensitive data always has the correct security posture - regardless of where it's been duplicated or moved to.
So, what is DSPM? Here's a quick example:
Let's say you've built an excellent security posture for your cloud data. For the sake of this example, your data is in production, it's protected behind a


feed_id: https://thehackernews.com/2023/08/researchers-expose-space-pirate-cyber.html
title: Researchers Expose Space Pirates' Cyber Campaign Across Russia and Serbia
uri: Researchers-Expose-Space-Pirates-Cyber-Campaign-Across-Russia-and-Ser
url: https://thehackernews.com/2023/08/researchers-expose-space-pirate-cyber.html
content:
The threat actor known as Space Pirates has been linked to attacks against at least 16 organizations in Russia and Serbia over the past year by employing novel tactics and adding new cyber weapons to its arsenal.
"The cybercriminals' main goals are still espionage and theft of confidential information, but the group has expanded its interests and the geography of its attacks," Positive


feed_id: https://thehackernews.com/2023/08/chinas-apt31-suspected-in-attacks-on.html
title: China's APT31 Suspected in Attacks on Air-Gapped Systems in Eastern Europe
uri: China-s-APT31-Suspected-in-Attacks-on-Air-Gapped-Systems-in-Eastern-Eu
url: https://thehackernews.com/2023/08/chinas-apt31-suspected-in-attacks-on.html
content:
A nation-state actor with links to China is suspected of being behind a series of attacks against industrial organizations in Eastern Europe that took place last year to siphon data stored on air-gapped systems.
Cybersecurity company Kaspersky attributed the intrusions with medium to high confidence to a hacking crew called APT31, which is also tracked under the monikers Bronze Vinewood,


feed_id: https://thehackernews.com/2023/08/cybercriminals-renting-wikiloader-to.html
title: Cybercriminals Renting WikiLoader to Target Italian Organizations with Banking Trojan
uri: Cybercriminals-Renting-WikiLoader-to-Target-Italian-Organizations-with
url: https://thehackernews.com/2023/08/cybercriminals-renting-wikiloader-to.html
content:
Organizations in Italy are the target of a new phishing campaign that leverages a new strain of malware called WikiLoader with an ultimate aim to install a banking trojan, stealer, and spyware referred to as Ursnif (aka Gozi).
"It is a sophisticated downloader with the objective of installing a second malware payload," Proofpoint said in a technical report. "The malware uses multiple mechanisms


feed_id: https://thehackernews.com/2023/07/new-p2pinfect-worm-targets-redis.html
title: New P2PInfect Worm Targets Redis Servers with Undocumented Breach Methods
uri: New-P2PInfect-Worm-Targets-Redis-Servers-with-Undocumented-Breach-Meth
url: https://thehackernews.com/2023/07/new-p2pinfect-worm-targets-redis.html
content:
The P2PInfect peer-to-peer (P2) worm has been observed employing previously undocumented initial access methods to breach susceptible Redis servers and rope them into a botnet.
"The malware compromises exposed instances of the Redis data store by exploiting the replication feature," Cado Security researchers Nate Bill and Matt Muir said in a report shared with The Hacker News.
"A common attack


feed_id: https://thehackernews.com/2023/07/patchwork-hackers-target-chinese.html
title: Patchwork Hackers Target Chinese Research Organizations Using EyeShell Backdoor
uri: Patchwork-Hackers-Target-Chinese-Research-Organizations-Using-EyeShell
url: https://thehackernews.com/2023/07/patchwork-hackers-target-chinese.html
content:
Threat actors associated with the hacking crew known as Patchwork have been spotted targeting universities and research organizations in China as part of a recently observed campaign.
The activity, according to KnownSec 404 Team, entailed the use of a backdoor codenamed EyeShell.
Patchwork, also known by the names Operation Hangover and Zinc Emerson, is suspected to be a threat group that


feed_id: https://thehackernews.com/2023/07/webinar-riding-vciso-wave-how-to.html
title: Webinar: Riding the vCISO Wave: How to Provide vCISO Services
uri: Webinar-Riding-the-vCISO-Wave-How-to-Provide-vCISO-Services
url: https://thehackernews.com/2023/07/webinar-riding-vciso-wave-how-to.html
content:
Demand for Virtual CISO services is soaring. According to Gartner, the use of vCISO services among small and mid-size businesses and non-regulated enterprises was expected to grow by a whopping 1900% in just one year, from only 1% in 2021 to 20% in 2022!
Offering vCISO services can be especially attractive for MSPs and MSSPs. By addressing their customers’ needs for proactive cyber resilience,


feed_id: https://thehackernews.com/2023/07/avrecon-botnet-leveraging-compromised.html
title: AVRecon Botnet Leveraging Compromised Routers to Fuel Illegal Proxy Service
uri: AVRecon-Botnet-Leveraging-Compromised-Routers-to-Fuel-Illegal-Proxy-Se
url: https://thehackernews.com/2023/07/avrecon-botnet-leveraging-compromised.html
content:
More details have emerged about a botnet called AVRecon, which has been observed making use of compromised small office/home office (SOHO) routers as part of a multi-year campaign active since at least May 2021.
AVRecon was first disclosed by Lumen Black Lotus Labs earlier this month as malware capable of executing additional commands and stealing victim's bandwidth for what appears to be an


feed_id: https://thehackernews.com/2023/07/fruity-trojan-uses-deceptive-software.html
title: Fruity Trojan Uses Deceptive Software Installers to Spread Remcos RAT
uri: Fruity-Trojan-Uses-Deceptive-Software-Installers-to-Spread-Remcos-RAT
url: https://thehackernews.com/2023/07/fruity-trojan-uses-deceptive-software.html
content:
Threat actors are creating fake websites hosting trojanized software installers to trick unsuspecting users into downloading a downloader malware called Fruity with the goal of installing remote trojans tools like Remcos RAT.
"Among the software in question are various instruments for fine-tuning CPUs, graphic cards, and BIOS; PC hardware-monitoring tools; and some other apps," cybersecurity


feed_id: https://thehackernews.com/2023/07/multiple-flaws-found-in-ninja-forms.html
title: Multiple Flaws Found in Ninja Forms Plugin Leave 800,000 Sites Vulnerable
uri: Multiple-Flaws-Found-in-Ninja-Forms-Plugin-Leave-800-000-Sites-Vulnera
url: https://thehackernews.com/2023/07/multiple-flaws-found-in-ninja-forms.html
content:
Multiple security vulnerabilities have been disclosed in the Ninja Forms plugin for WordPress that could be exploited by threat actors to escalate privileges and steal sensitive data.
The flaws, tracked as CVE-2023-37979, CVE-2023-38386, and CVE-2023-38393, impact versions 3.6.25 and below, Patchstack said in a report last week. Ninja Forms is installed on over 800,000 sites.
A brief description


feed_id: https://thehackernews.com/2023/07/new-android-malware-cherryblos.html
title: New Android Malware CherryBlos Utilizing OCR to Steal Sensitive Data
uri: New-Android-Malware-CherryBlos-Utilizing-OCR-to-Steal-Sensitive-Data
url: https://thehackernews.com/2023/07/new-android-malware-cherryblos.html
content:
A new Android malware strain called CherryBlos has been observed making use of optical character recognition (OCR) techniques to gather sensitive data stored in pictures.
CherryBlos, per Trend Micro, is distributed via bogus posts on social media platforms and comes with capabilities to steal cryptocurrency wallet-related credentials and act as a clipper to substitute wallet addresses when a


feed_id: https://thehackernews.com/2023/07/apple-sets-new-rules-for-developers-to.html
title: Apple Sets New Rules for Developers to Prevent Fingerprinting and Data Misuse
uri: Apple-Sets-New-Rules-for-Developers-to-Prevent-Fingerprinting-and-Data
url: https://thehackernews.com/2023/07/apple-sets-new-rules-for-developers-to.html
content:
Apple has announced plans to require developers to submit reasons to use certain APIs in their apps starting later this year with the release of iOS 17, iPadOS 17, macOS Sonoma, tvOS 17, and watchOS 10 to prevent their abuse for data collection.
"This will help ensure that apps only use these APIs for their intended purpose," the company said in a statement. "As part of this process, you'll need


feed_id: https://thehackernews.com/2023/07/hackers-deploy-submarine-backdoor-in.html
title: Hackers Deploy "SUBMARINE" Backdoor in Barracuda Email Security Gateway Attacks
uri: Hackers-Deploy-SUBMARINE-Backdoor-in-Barracuda-Email-Security-Gatewa
url: https://thehackernews.com/2023/07/hackers-deploy-submarine-backdoor-in.html
content:
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday disclosed details of a "novel persistent backdoor" called SUBMARINE deployed by threat actors in connection with the hack on Barracuda Email Security Gateway (ESG) appliances.
"SUBMARINE comprises multiple artifacts — including a SQL trigger, shell scripts, and a loaded library for a Linux daemon — that together enable


feed_id: https://thehackernews.com/2023/07/ivanti-warns-of-another-endpoint.html
title: Ivanti Warns of Another Endpoint Manager Mobile Vulnerability Under Active Attack
uri: Ivanti-Warns-of-Another-Endpoint-Manager-Mobile-Vulnerability-Under-Ac
url: https://thehackernews.com/2023/07/ivanti-warns-of-another-endpoint.html
content:
Ivanti has disclosed yet another security flaw impacting Endpoint Manager Mobile (EPMM), formerly known as MobileIron Core, that it said has been weaponized as part of an exploit chain by malicious actors in the wild.
The new vulnerability, tracked as CVE-2023-35081 (CVSS score: 7.8), impacts supported versions 11.10, 11.9, and 11.8, as well as those that are currently end-of-life (EoL).
"


feed_id: https://thehackernews.com/2023/07/icedid-malware-adapts-and-expands.html
title: IcedID Malware Adapts and Expands Threat with Updated BackConnect Module
uri: IcedID-Malware-Adapts-and-Expands-Threat-with-Updated-BackConnect-Modu
url: https://thehackernews.com/2023/07/icedid-malware-adapts-and-expands.html
content:
The threat actors linked to the malware loader known as IcedID have made updates to the BackConnect (BC) module that's used for post-compromise activity on hacked systems, new findings from Team Cymru reveal.
IcedID, also called BokBot, is a strain of malware similar to Emotet and QakBot that started off as a banking trojan in 2017, before switching to the role of an initial access facilitator


feed_id: https://thehackernews.com/2023/07/starkmule-targets-koreans-with-us.html
title: STARK#MULE Targets Koreans with U.S. Military-themed Document Lures
uri: STARK-MULE-Targets-Koreans-with-U-S-Military-themed-Document-Lures
url: https://thehackernews.com/2023/07/starkmule-targets-koreans-with-us.html
content:
An ongoing cyber attack campaign has set its sights on Korean-speaking individuals by employing U.S. Military-themed document lures to trick them into running malware on compromised systems.
Cybersecurity firm Securonix is tracking the activity under the name STARK#MULE. The scale of the attacks is currently not known, and it's not clear if any of these attack attempts turned out to be


feed_id: https://thehackernews.com/2023/07/a-data-exfiltration-attack-scenario.html
title: A Data Exfiltration Attack Scenario: The Porsche Experience
uri: A-Data-Exfiltration-Attack-Scenario-The-Porsche-Experience
url: https://thehackernews.com/2023/07/a-data-exfiltration-attack-scenario.html
content:
As part of Checkmarx's mission to help organizations develop and deploy secure software, the Security Research team started looking at the security posture of major car manufacturers. Porsche has a well-established Vulnerability Reporting Policy (Disclosure Policy)[1], it was considered in scope for our research, so we decided to start there, and see what we could find.
What we found is an


feed_id: https://thehackernews.com/2023/07/hackers-abusing-windows-search-feature.html
title: Hackers Abusing Windows Search Feature to Install Remote Access Trojans
uri: Hackers-Abusing-Windows-Search-Feature-to-Install-Remote-Access-Trojan
url: https://thehackernews.com/2023/07/hackers-abusing-windows-search-feature.html
content:
A legitimate Windows search feature is being exploited by unknown malicious actors to download arbitrary payloads from remote servers and compromise targeted systems with remote access trojans such as AsyncRAT and Remcos RAT.
The novel attack technique, per Trellix, takes advantage of the "search-ms:" URI protocol handler, which offers the ability for applications and HTML links to launch custom


feed_id: https://thehackernews.com/2023/07/bluebravo-deploys-graphicalproton.html
title: BlueBravo Deploys GraphicalProton Backdoor Against European Diplomatic Entities
uri: BlueBravo-Deploys-GraphicalProton-Backdoor-Against-European-Diplomatic
url: https://thehackernews.com/2023/07/bluebravo-deploys-graphicalproton.html
content:
The Russian nation-state actor known as BlueBravo has been observed targeting diplomatic entities throughout Eastern Europe with the goal of delivering a new backdoor called GraphicalProton, exemplifying the continuous evolution of the threat.
The phishing campaign is characterized by the use of legitimate internet services (LIS) for command-and-control (C2) obfuscation, Recorded Future said in


feed_id: https://thehackernews.com/2023/07/major-security-flaw-discovered-in.html
title: Major Security Flaw Discovered in Metabase BI Software – Urgent Update Required
uri: Major-Security-Flaw-Discovered-in-Metabase-BI-Software-Urgent-Upda
url: https://thehackernews.com/2023/07/major-security-flaw-discovered-in.html
content:
Users of Metabase, a popular business intelligence and data visualization software package, are being advised to update to the latest version following the discovery of an "extremely severe" flaw that could result in pre-authenticated remote code execution on affected installations.
Tracked as CVE-2023-38646, the issue impacts open-source editions prior to 0.46.6.1 and Metabase Enterprise


feed_id: https://thehackernews.com/2023/07/cybersecurity-agencies-warn-against.html
title: Cybersecurity Agencies Warn Against IDOR Bugs Exploited for Data Breaches
uri: Cybersecurity-Agencies-Warn-Against-IDOR-Bugs-Exploited-for-Data-Breac
url: https://thehackernews.com/2023/07/cybersecurity-agencies-warn-against.html
content:
Cybersecurity agencies in Australia and the U.S. have published a joint cybersecurity advisory warning against security flaws in web applications that could be exploited by malicious actors to orchestrate data breach incidents and steal confidential data.
This includes a specific class of bugs called Insecure Direct Object Reference (IDOR), a type of access control flaw that occurs when an


feed_id: https://thehackernews.com/2023/07/gameoverlay-two-severe-linux.html
title: GameOver(lay): Two Severe Linux Vulnerabilities Impact 40% of Ubuntu Users
uri: GameOver(lay)-Two-Severe-Linux-Vulnerabilities-Impact-40-of-Ubuntu-U
url: https://thehackernews.com/2023/07/gameoverlay-two-severe-linux.html
content:
Cybersecurity researchers have disclosed two high-severity security flaws in the Ubuntu kernel that could pave the way for local privilege escalation attacks.
Cloud security firm Wiz, in a report shared with The Hacker News, said the easy-to-exploit shortcomings have the potential to impact 40% of Ubuntu users.
"The impacted Ubuntu versions are prevalent in the cloud as they serve as the default


feed_id: https://thehackernews.com/2023/07/new-malvertising-campaign-distributing.html
title: New Malvertising Campaign Distributing Trojanized IT Tools via Google and Bing Search Ads
uri: New-Malvertising-Campaign-Distributing-Trojanized-IT-Tools-via-Google
url: https://thehackernews.com/2023/07/new-malvertising-campaign-distributing.html
content:
A new malvertising campaign has been observed leveraging ads on Google Search and Bing to target users seeking IT tools like AnyDesk, Cisco AnyConnect VPN, and WinSCP, and trick them into downloading trojanized installers with an aim to breach enterprise networks and likely carry out future ransomware attacks.
Dubbed Nitrogen, the "opportunistic" activity is designed to deploy second-stage


feed_id: https://thehackernews.com/2023/07/the-4-keys-to-building-cloud-security.html
title: The 4 Keys to Building Cloud Security Programs That Can Actually Shift Left
uri: The-4-Keys-to-Building-Cloud-Security-Programs-That-Can-Actually-Shift
url: https://thehackernews.com/2023/07/the-4-keys-to-building-cloud-security.html
content:
As cloud applications are built, tested and updated, they wind their way through an ever-complex series of different tools and teams. Across hundreds or even thousands of technologies that make up the patchwork quilt of development and cloud environments, security processes are all too often applied in only the final phases of software development. 
Placing security at the very end of the


feed_id: https://thehackernews.com/2023/08/cisos-tout-saas-cybersecurity.html
title: CISOs Tout SaaS Cybersecurity Confidence, But 79% Admit to SaaS Incidents, New Report Finds
uri: CISOs-Tout-SaaS-Cybersecurity-Confidence-But-79-Admit-to-SaaS-Incide
url: https://thehackernews.com/2023/08/cisos-tout-saas-cybersecurity.html
content:
A new State of SaaS Security Posture Management Report from SaaS cybersecurity provider AppOmni indicates that Cybersecurity, IT, and business leaders alike recognize SaaS cybersecurity as an increasingly important part of the cyber threat landscape. And at first glance, respondents appear generally optimistic about their SaaS cybersecurity.
Over 600 IT, cybersecurity, and business leaders at


feed_id: https://thehackernews.com/2023/08/carderbee-attacks-hong-kong.html
title: Carderbee Attacks: Hong Kong Organizations Targeted via Malicious Software Updates
uri: Carderbee-Attacks-Hong-Kong-Organizations-Targeted-via-Malicious-Soft
url: https://thehackernews.com/2023/08/carderbee-attacks-hong-kong.html
content:
A previously undocumented threat cluster has been linked to a software supply chain attack targeting organizations primarily located in Hong Kong and other regions in Asia.
The Symantec Threat Hunter Team, part of Broadcom, is tracking the activity under its insect-themed moniker Carderbee.
The attacks, per the cybersecurity firm, leverage a trojanized version of a legitimate software called


feed_id: https://thehackernews.com/2023/08/new-variant-of-xloader-macos-malware.html
title: New Variant of XLoader macOS Malware Disguised as 'OfficeNote' Productivity App
uri: New-Variant-of-XLoader-macOS-Malware-Disguised-as-OfficeNote-Product
url: https://thehackernews.com/2023/08/new-variant-of-xloader-macos-malware.html
content:
A new variant of an Apple macOS malware called XLoader has surfaced in the wild, masquerading its malicious features under the guise of an office productivity app called "OfficeNote."
"The new version of XLoader is bundled inside a standard Apple disk image with the name OfficeNote.dmg," SentinelOne security researchers Dinesh Devadoss and Phil Stokes said in a Monday analysis. "The application


feed_id: https://thehackernews.com/2023/08/ivanti-warns-of-critical-zero-day-flaw.html
title: Ivanti Warns of Critical Zero-Day Flaw Being Actively Exploited in Sentry Software
uri: Ivanti-Warns-of-Critical-Zero-Day-Flaw-Being-Actively-Exploited-in-Sen
url: https://thehackernews.com/2023/08/ivanti-warns-of-critical-zero-day-flaw.html
content:
Software services provider Ivanti is warning of a new critical zero-day flaw impacting Ivanti Sentry (formerly MobileIron Sentry) that it said is being actively exploited in the wild, marking an escalation of its security woes.
Tracked as CVE-2023-38035 (CVSS score: 9.8), the issue has been described as a case of authentication bypass impacting versions 9.18 and prior due to what it called an


feed_id: https://thehackernews.com/2023/08/critical-adobe-coldfusion-flaw-added-to.html
title: Critical Adobe ColdFusion Flaw Added to CISA's Exploited Vulnerability Catalog
uri: Critical-Adobe-ColdFusion-Flaw-Added-to-CISA-s-Exploited-Vulnerability
url: https://thehackernews.com/2023/08/critical-adobe-coldfusion-flaw-added-to.html
content:
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical security flaw in Adobe ColdFusion to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation.
The vulnerability, cataloged as CVE-2023-26359 (CVSS score: 9.8), relates to a deserialization flaw present in Adobe ColdFusion 2018 (Update 15 and earlier) and ColdFusion 2021 (


feed_id: https://thehackernews.com/2023/08/new-winrar-vulnerability-could-allow.html
title: New WinRAR Vulnerability Could Allow Hackers to Take Control of Your PC
uri: New-WinRAR-Vulnerability-Could-Allow-Hackers-to-Take-Control-of-Your-P
url: https://thehackernews.com/2023/08/new-winrar-vulnerability-could-allow.html
content:
A high-severity security flaw has been disclosed in the WinRAR utility that could be potentially exploited by a threat actor to achieve remote code execution on Windows systems.
Tracked as CVE-2023-40477 (CVSS score: 7.8), the vulnerability has been described as a case of improper validation while processing recovery volumes.
"The issue results from the lack of proper validation of user-supplied


feed_id: https://thehackernews.com/2023/08/how-to-investigate-oauth-grant-for.html
title: How to Investigate an OAuth Grant for Suspicious Activity or Overly Permissive Scopes
uri: How-to-Investigate-an-OAuth-Grant-for-Suspicious-Activity-or-Overly-Pe
url: https://thehackernews.com/2023/08/how-to-investigate-oauth-grant-for.html
content:
From a user’s perspective, OAuth works like magic. In just a few keystrokes, you can whisk through the account creation process and gain immediate access to whatever new app or integration you’re seeking. Unfortunately, few users understand the implications of the permissions they allow when they create a new OAuth grant, making it easy for malicious actors to manipulate employees into giving


feed_id: https://thehackernews.com/2023/08/this-malware-turned-thousands-of-hacked.html
title: This Malware Turned Thousands of Hacked Windows and macOS PCs into Proxy Servers
uri: This-Malware-Turned-Thousands-of-Hacked-Windows-and-macOS-PCs-into-Pro
url: https://thehackernews.com/2023/08/this-malware-turned-thousands-of-hacked.html
content:
Threat actors are leveraging access to malware-infected Windows and macOS machines to deliver a proxy server application and use them as exit nodes to reroute proxy requests.
According to AT&T Alien Labs, the unnamed company that offers the proxy service operates more than 400,000 proxy exit nodes, although it's not immediately clear how many of them were co-opted by malware installed on


feed_id: https://thehackernews.com/2023/08/hiatusrat-malware-resurfaces-taiwan.html
title: HiatusRAT Malware Resurfaces: Taiwan Firms and U.S. Military Under Attack
uri: HiatusRAT-Malware-Resurfaces-Taiwan-Firms-and-U-S-Military-Under-Att
url: https://thehackernews.com/2023/08/hiatusrat-malware-resurfaces-taiwan.html
content:
The threat actors behind the HiatusRAT malware have returned from their hiatus with a new wave of reconnaissance and targeting activity aimed at Taiwan-based organizations and a U.S. military procurement system.
Besides recompiling malware samples for different architectures, the artifacts are said to have been hosted on new virtual private servers (VPSs), Lumen Black Lotus Labs said in a report


feed_id: https://thehackernews.com/2023/08/wooflocker-toolkit-hides-malicious.html
title: WoofLocker Toolkit Hides Malicious Codes in Images to Run Tech Support Scams
uri: WoofLocker-Toolkit-Hides-Malicious-Codes-in-Images-to-Run-Tech-Support
url: https://thehackernews.com/2023/08/wooflocker-toolkit-hides-malicious.html
content:
Cybersecurity researchers have detailed an updated version of an advanced fingerprinting and redirection toolkit called WoofLocker that's engineered to conduct tech support scams.
The sophisticated traffic redirection scheme was first documented by Malwarebytes in January 2020, leveraging JavaScript embedded in compromised websites to perform anti-bot and web traffic filtering checks to serve


feed_id: https://thehackernews.com/2023/08/new-juniper-junos-os-flaws-expose.html
title: New Juniper Junos OS Flaws Expose Devices to Remote Attacks - Patch Now
uri: New-Juniper-Junos-OS-Flaws-Expose-Devices-to-Remote-Attacks-Patch-No
url: https://thehackernews.com/2023/08/new-juniper-junos-os-flaws-expose.html
content:
Networking hardware company Juniper Networks has released an "out-of-cycle" security update to address multiple flaws in the J-Web component of Junos OS that could be combined to achieve remote code execution on susceptible installations.
The four vulnerabilities have a cumulative CVSS rating of 9.8, making them Critical in severity. They affect all versions of Junos OS on SRX and EX Series.
"By


feed_id: https://thehackernews.com/2023/08/thousands-of-android-malware-apps-using.html
title: Thousands of Android Malware Apps Using Stealthy APK Compression to Evade Detection
uri: Thousands-of-Android-Malware-Apps-Using-Stealthy-APK-Compression-to-Ev
url: https://thehackernews.com/2023/08/thousands-of-android-malware-apps-using.html
content:
Threat actors are using Android Package (APK) files with unknown or unsupported compression methods to elude malware analysis.
That's according to findings from Zimperium, which found 3,300 artifacts leveraging such compression algorithms in the wild. 71 of the identified samples can be loaded on the operating system without any problems.
There is no evidence that the apps were available on the


feed_id: https://thehackernews.com/2023/08/14-suspected-cybercriminals-arrested.html
title: 14 Suspected Cybercriminals Arrested Across Africa in Coordinated Crackdown
uri: 14-Suspected-Cybercriminals-Arrested-Across-Africa-in-Coordinated-Crac
url: https://thehackernews.com/2023/08/14-suspected-cybercriminals-arrested.html
content:
A coordinated law enforcement operation across 25 African countries has led to the arrest of 14 suspected cybercriminals, INTERPOL announced Friday.
The exercise, conducted in partnership with AFRIPOL, enabled investigators to identify 20,674 cyber networks that were linked to financial losses of more than $40 million.
"The four-month Africa Cyber Surge II operation was launched in April 2023


feed_id: https://thehackernews.com/2023/08/the-vulnerability-of-zero-trust-lessons.html
title: The Vulnerability of Zero Trust: Lessons from the Storm 0558 Hack
uri: The-Vulnerability-of-Zero-Trust-Lessons-from-the-Storm-0558-Hack
url: https://thehackernews.com/2023/08/the-vulnerability-of-zero-trust-lessons.html
content:
While IT security managers in companies and public administrations rely on the concept of Zero Trust, APTS (Advanced Persistent Threats) are putting its practical effectiveness to the test. Analysts, on the other hand, understand that Zero Trust can only be achieved with comprehensive insight into one's own network. 
Just recently, an attack believed to be perpetrated by the Chinese hacker group


feed_id: https://thehackernews.com/2023/08/new-wave-of-attack-campaign-targeting.html
title: New Wave of Attack Campaign Targeting Zimbra Email Users for Credential Theft
uri: New-Wave-of-Attack-Campaign-Targeting-Zimbra-Email-Users-for-Credentia
url: https://thehackernews.com/2023/08/new-wave-of-attack-campaign-targeting.html
content:
A new "mass-spreading" social engineering campaign is targeting users of the Zimbra Collaboration email server with an aim to collect their login credentials for use in follow-on operations.
The activity, active since April 2023 and still ongoing, targets a wide range of small and medium businesses and governmental entities, most of which are located in Poland, Ecuador, Mexico, Italy, and Russia


feed_id: https://thehackernews.com/2023/08/new-blackcat-ransomware-variant-adopts.html
title: New BlackCat Ransomware Variant Adopts Advanced Impacket and RemCom Tools
uri: New-BlackCat-Ransomware-Variant-Adopts-Advanced-Impacket-and-RemCom-To
url: https://thehackernews.com/2023/08/new-blackcat-ransomware-variant-adopts.html
content:
Microsoft on Thursday disclosed that it found a new version of the BlackCat ransomware (aka ALPHV and Noberus) that embeds tools like Impacket and RemCom to facilitate lateral movement and remote code execution.
"The Impacket tool has credential dumping and remote service execution modules that could be used for broad deployment of the BlackCat ransomware in target environments," the company's


feed_id: https://thehackernews.com/2023/08/google-chromes-new-feature-alerts-users.html
title: Google Chrome's New Feature Alerts Users About Auto-Removal of Malicious Extensions
uri: Google-Chrome-s-New-Feature-Alerts-Users-About-Auto-Removal-of-Malicio
url: https://thehackernews.com/2023/08/google-chromes-new-feature-alerts-users.html
content:
Google has announced plans to add a new feature in the upcoming version of its Chrome web browser to proactively alert users when an extension they have installed has been removed from the Chrome Web Store.
The feature, set for release alongside Chrome 117, allows users to be notified when an add-on has been unpublished by a developer, taken down for violating Chrome Web Store policy, or marked


feed_id: https://thehackernews.com/2023/08/nofilter-attack-sneaky-privilege.html
title: NoFilter Attack: Sneaky Privilege Escalation Method Bypasses Windows Security
uri: NoFilter-Attack-Sneaky-Privilege-Escalation-Method-Bypasses-Windows-S
url: https://thehackernews.com/2023/08/nofilter-attack-sneaky-privilege.html
content:
A previously undetected attack method called NoFilter has been found to abuse the Windows Filtering Platform (WFP) to achieve privilege escalation in the Windows operating system.
"If an attacker has the ability to execute code with admin privilege and the target is to perform LSASS Shtinkering, these privileges are not enough," Ron Ben Yizhak, a security researcher at Deep Instinct, told The


feed_id: https://thehackernews.com/2023/08/china-linked-bronze-starlight-group.html
title: China-Linked Bronze Starlight Group Targeting Gambling Sector with Cobalt Strike Beacons
uri: China-Linked-Bronze-Starlight-Group-Targeting-Gambling-Sector-with-Cob
url: https://thehackernews.com/2023/08/china-linked-bronze-starlight-group.html
content:
An ongoing cyber attack campaign originating from China is targeting the Southeast Asian gambling sector to deploy Cobalt Strike beacons on compromised systems. 
Cybersecurity firm SentinelOne said the tactics, techniques, and procedures point to the involvement of a threat actor tracked as Bronze Starlight (aka Emperor Dragonfly or Storm-0401), which has been linked to the use of short-lived 


feed_id: https://thehackernews.com/2023/08/new-apple-ios-16-exploit-enables.html
title: New Apple iOS 16 Exploit Enables Stealthy Cellular Access Under Fake Airplane Mode
uri: New-Apple-iOS-16-Exploit-Enables-Stealthy-Cellular-Access-Under-Fake-A
url: https://thehackernews.com/2023/08/new-apple-ios-16-exploit-enables.html
content:
Cybersecurity researchers have documented a novel post-exploit persistence technique on iOS 16 that could be abused to fly under the radar and maintain access to an Apple device even when the victim believes it is offline.
The method "tricks the victim into thinking their device's Airplane Mode works when in reality the attacker (following successful device exploit) has planted an artificial


feed_id: https://thehackernews.com/2023/08/new-labrat-campaign-exploits-gitlab.html
title: New LABRAT Campaign Exploits GitLab Flaw for Cryptojacking and Proxyjacking Activities
uri: New-LABRAT-Campaign-Exploits-GitLab-Flaw-for-Cryptojacking-and-Proxyja
url: https://thehackernews.com/2023/08/new-labrat-campaign-exploits-gitlab.html
content:
A new, financially motivated operation dubbed LABRAT has been observed weaponizing a now-patched critical flaw in GitLab as part of a cryptojacking and proxyjacking campaign.
"The attacker utilized undetected signature-based tools, sophisticated and stealthy cross-platform malware, command-and-control (C2) tools which bypassed firewalls, and kernel-based rootkits to hide their presence," Sysdig 


feed_id: https://thehackernews.com/2023/08/why-you-need-continuous-network.html
title: Why You Need Continuous Network Monitoring?
uri: Why-You-Need-Continuous-Network-Monitoring
url: https://thehackernews.com/2023/08/why-you-need-continuous-network.html
content:
Changes in the way we work have had significant implications for cybersecurity, not least in network monitoring. Workers no longer sit safely side-by-side on a corporate network, dev teams constantly spin up and tear down systems, exposing services to the internet. Keeping track of these users, changes and services is difficult – internet-facing attack surfaces rarely stay the same for long.
But


feed_id: https://thehackernews.com/2023/08/russian-hackers-use-zulip-chat-app-for.html
title: Russian Hackers Use Zulip Chat App for Covert C&C in Diplomatic Phishing Attacks
uri: Russian-Hackers-Use-Zulip-Chat-App-for-Covert-C-C-in-Diplomatic-Phishi
url: https://thehackernews.com/2023/08/russian-hackers-use-zulip-chat-app-for.html
content:
An ongoing campaign targeting ministries of foreign affairs of NATO-aligned countries points to the involvement of Russian threat actors.
The phishing attacks feature PDF documents with diplomatic lures, some of which are disguised as coming from Germany, to deliver a variant of a malware called Duke, which has been attributed to APT29 (aka BlueBravo, Cloaked Ursa, Cozy Bear, Iron Hemlock,


feed_id: https://thehackernews.com/2023/08/cisa-adds-citrix-sharefile-flaw-to-kev.html
title: CISA Adds Citrix ShareFile Flaw to KEV Catalog Due to In-the-Wild Attacks
uri: CISA-Adds-Citrix-ShareFile-Flaw-to-KEV-Catalog-Due-to-In-the-Wild-Atta
url: https://thehackernews.com/2023/08/cisa-adds-citrix-sharefile-flaw-to-kev.html
content:
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical security flaw in Citrix ShareFile storage zones controller to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active in-the-wild exploitation.
Tracked as CVE-2023-24489 (CVSS score: 9.8), the shortcoming has been described as an improper access control bug that, if successfully exploited


feed_id: https://thehackernews.com/2023/08/whats-state-of-credential-theft-in-2023.html
title: What's the State of Credential theft in 2023?
uri: What-s-the-State-of-Credential-theft-in-2023
url: https://thehackernews.com/2023/08/whats-state-of-credential-theft-in-2023.html
content:
At a little overt halfway through 2023, credential theft is still a major thorn in the side of IT teams. The heart of the problem is the value of data to cybercriminals and the evolution of the techniques they use to get hold of it. The 2023 Verizon Data Breach Investigations Report (DBIR) revealed that 83% of breaches involved external actors, with almost all attacks being financially motivated


feed_id: https://thehackernews.com/2023/08/experts-uncover-weaknesses-in.html
title: Experts Uncover Weaknesses in PowerShell Gallery Enabling Supply Chain Attacks
uri: Experts-Uncover-Weaknesses-in-PowerShell-Gallery-Enabling-Supply-Chain
url: https://thehackernews.com/2023/08/experts-uncover-weaknesses-in.html
content:
Active flaws in the PowerShell Gallery could be weaponized by threat actors to pull off supply chain attacks against the registry's users.
"These flaws make typosquatting attacks inevitable in this registry, while also making it extremely difficult for users to identify the true owner of a package," Aqua security researchers Mor Weinberger, Yakir Kadkoda, and Ilay Goldman said in a report shared


feed_id: https://thehackernews.com/2023/08/guide-how-google-workspace-based.html
title: Guide: How Google Workspace-based Organizations can leverage Chrome to improve Security
uri: Guide-How-Google-Workspace-based-Organizations-can-leverage-Chrome-to
url: https://thehackernews.com/2023/08/guide-how-google-workspace-based.html
content:
More and more organizations are choosing Google Workspace as their default employee toolset of choice. But despite the productivity advantages, this organizational action also incurs a new security debt. Security teams now have to find a way to adjust their security architecture to this new cloud workload.
Some teams may rely on their existing network security solutions. According to a new guide


feed_id: https://thehackernews.com/2023/08/google-introduces-first-quantum.html
title: Google Introduces First Quantum Resilient FIDO2 Security Key Implementation
uri: Google-Introduces-First-Quantum-Resilient-FIDO2-Security-Key-Implement
url: https://thehackernews.com/2023/08/google-introduces-first-quantum.html
content:
Google on Tuesday announced the first quantum resilient FIDO2 security key implementation as part of its OpenSK security keys initiative.
"This open-source hardware optimized implementation uses a novel ECC/Dilithium hybrid signature schema that benefits from the security of ECC against standard attacks and Dilithium's resilience against quantum attacks," Elie Bursztein and Fabian Kaczmarczyck 


feed_id: https://thehackernews.com/2023/08/critical-security-flaws-affect-ivanti.html
title: Critical Security Flaws Affect Ivanti Avalanche, Threatening 30,000 Organizations
uri: Critical-Security-Flaws-Affect-Ivanti-Avalanche-Threatening-30-000-Or
url: https://thehackernews.com/2023/08/critical-security-flaws-affect-ivanti.html
content:
Multiple critical security flaws have been reported in Ivanti Avalanche, an enterprise mobile device management solution that’s used by 30,000 organizations.
The vulnerabilities, collectively tracked as CVE-2023-32560 (CVSS score: 9.8), are stack-based buffer overflows in Ivanti Avalanche WLAvanacheServer.exe v6.4.0.0.
Cybersecurity company Tenable said the shortcomings are the result of buffer


feed_id: https://thehackernews.com/2023/08/nearly-2000-citrix-netscaler-instances.html
title: Nearly 2,000 Citrix NetScaler Instances Hacked via Critical Vulnerability
uri: Nearly-2-000-Citrix-NetScaler-Instances-Hacked-via-Critical-Vulnerabil
url: https://thehackernews.com/2023/08/nearly-2000-citrix-netscaler-instances.html
content:
Nearly 2,000 Citrix NetScaler instances have been compromised with a backdoor by weaponizing a recently disclosed critical security vulnerability as part of a large-scale attack.
"An adversary appears to have exploited CVE-2023-3519 in an automated fashion, placing web shells on vulnerable NetScalers to gain persistent access," NCC Group said in an advisory released Tuesday.
"The adversary can


feed_id: https://thehackernews.com/2023/08/cybercriminals-abusing-cloudflare-r2.html
title: Cybercriminals Abusing Cloudflare R2 for Hosting Phishing Pages, Experts Warn
uri: Cybercriminals-Abusing-Cloudflare-R2-for-Hosting-Phishing-Pages-Exper
url: https://thehackernews.com/2023/08/cybercriminals-abusing-cloudflare-r2.html
content:
Threat actors' use of Cloudflare R2 to host phishing pages has witnessed a 61-fold increase over the past six months.
"The majority of the phishing campaigns target Microsoft login credentials, although there are some pages targeting Adobe, Dropbox, and other cloud apps," Netskope security researcher Jan Michael said.
Cloudflare R2, analogous to Amazon Web Service S3, Google Cloud Storage, and


feed_id: https://thehackernews.com/2023/08/catching-catphish-join-expert-webinar.html
title: Catching the Catphish: Join the Expert Webinar on Combating Credential Phishing
uri: Catching-the-Catphish-Join-the-Expert-Webinar-on-Combating-Credential
url: https://thehackernews.com/2023/08/catching-catphish-join-expert-webinar.html
content:
Is your organization constantly under threat from credential phishing? Even with comprehensive security awareness training, many employees still fall victim to credential phishing scams.
The result? Cybercriminals gaining immediate and unhindered access to sensitive data, email accounts, and other applications. But what if you could outsmart these criminals and protect your organization?
Join 


feed_id: https://thehackernews.com/2023/08/multiple-flaws-found-in-scrutisweb.html
title: Multiple Flaws Found in ScrutisWeb Software Exposes ATMs to Remote Hacking
uri: Multiple-Flaws-Found-in-ScrutisWeb-Software-Exposes-ATMs-to-Remote-Hac
url: https://thehackernews.com/2023/08/multiple-flaws-found-in-scrutisweb.html
content:
Four security vulnerabilities in the ScrutisWeb ATM fleet monitoring software made by Iagona could be exploited to remotely break into ATMs, upload arbitrary files, and even reboot the terminals.
The shortcomings were discovered by the Synack Red Team (SRT) following a client engagement. The issues have been addressed in ScrutisWeb version 2.1.38.
"Successful exploitation of these


feed_id: https://thehackernews.com/2023/08/monti-ransomware-returns-with-new-linux.html
title: Monti Ransomware Returns with New Linux Variant and Enhanced Evasion Tactics
uri: Monti-Ransomware-Returns-with-New-Linux-Variant-and-Enhanced-Evasion-T
url: https://thehackernews.com/2023/08/monti-ransomware-returns-with-new-linux.html
content:
The threat actors behind the Monti ransomware have resurfaced after a two-month break with a new Linux version of the encryptor in its attacks targeting government and legal sectors.
Monti emerged in June 2022, weeks after the Conti ransomware group shut down its operations, deliberately imitating the tactics and tools associated with the latter, including its leaked source code. Not anymore.


feed_id: https://thehackernews.com/2023/08/malware-unleashed-public-sector-hit-in.html
title: Malware Unleashed: Public Sector Hit in Sudden Surge, Reveals New Report
uri: Malware-Unleashed-Public-Sector-Hit-in-Sudden-Surge-Reveals-New-Repo
url: https://thehackernews.com/2023/08/malware-unleashed-public-sector-hit-in.html
content:
The just-released BlackBerry Global Threat Intelligence Report reveals a 40% increase in cyberattacks against government and public service organizations versus the previous quarter. This includes public transit, utilities, schools, and other government services we rely on daily.
With limited resources and often immature cyber defense programs, these publicly funded organizations are struggling


feed_id: https://thehackernews.com/2023/08/gigabud-rat-android-banking-malware.html
title: Gigabud RAT Android Banking Malware Targets Institutions Across Countries
uri: Gigabud-RAT-Android-Banking-Malware-Targets-Institutions-Across-Countr
url: https://thehackernews.com/2023/08/gigabud-rat-android-banking-malware.html
content:
Account holders of over numerous financial institutions in Thailand, Indonesia, Vietnam, the Philippines, and Peru are being targeted by an Android banking malware called Gigabud RAT.
"One of Gigabud RAT's unique features is that it doesn't execute any malicious actions until the user is authorized into the malicious application by a fraudster, [...] which makes it harder to detect," Group-IB


feed_id: https://thehackernews.com/2023/08/over-12000-computers-compromised-by.html
title: Over 120,000 Computers Compromised by Info Stealers Linked to Users of Cybercrime Forums
uri: Over-120-000-Computers-Compromised-by-Info-Stealers-Linked-to-Users-of
url: https://thehackernews.com/2023/08/over-12000-computers-compromised-by.html
content:
A "staggering" 120,000 computers infected by stealer malware have credentials associated with cybercrime forums, many of them belonging to malicious actors.
The findings come from Hudson Rock, which analyzed data collected from computers compromised between 2018 to 2023.
"Hackers around the world infect computers opportunistically by promoting results for fake software or through YouTube


feed_id: https://thehackernews.com/2023/08/north-korean-hackers-suspected-in-new.html
title: North Korean Hackers Suspected in New Wave of Malicious npm Packages
uri: North-Korean-Hackers-Suspected-in-New-Wave-of-Malicious-npm-Packages
url: https://thehackernews.com/2023/08/north-korean-hackers-suspected-in-new.html
content:
The npm package registry has emerged as the target of yet another highly targeted attack campaign that aims to entice developers into downloading malevolent modules.
Software supply chain security firm Phylum told The Hacker News the activity exhibits similar behaviors to that of a previous attack wave uncovered in June, which has since been linked to North Korean threat actors.
As many as nine


feed_id: https://thehackernews.com/2023/08/qwixxrat-new-remote-access-trojan.html
title: QwixxRAT: New Remote Access Trojan Emerges via Telegram and Discord
uri: QwixxRAT-New-Remote-Access-Trojan-Emerges-via-Telegram-and-Discord
url: https://thehackernews.com/2023/08/qwixxrat-new-remote-access-trojan.html
content:
A new remote access trojan (RAT) called QwixxRAT is being advertised for sale by its threat actor through Telegram and Discord platforms.
"Once installed on the victim's Windows platform machines, the RAT stealthily collects sensitive data, which is then sent to the attacker's Telegram bot, providing them with unauthorized access to the victim's sensitive information," Uptycs said in a new


feed_id: https://thehackernews.com/2023/08/ongoing-xurum-attacks-on-e-commerce.html
title: Ongoing Xurum Attacks on E-commerce Sites Exploiting Critical Magento 2 Vulnerability
uri: Ongoing-Xurum-Attacks-on-E-commerce-Sites-Exploiting-Critical-Magento
url: https://thehackernews.com/2023/08/ongoing-xurum-attacks-on-e-commerce.html
content:
E-commerce sites using Adobe's Magento 2 software are the target of an ongoing campaign that has been active since at least January 2023.
The attacks, dubbed Xurum by Akamai, leverage a now-patched critical security flaw (CVE-2022-24086, CVSS score: 9.8) in Adobe Commerce and Magento Open Source that, if successfully exploited, could lead to arbitrary code execution.
"The attacker seems to be


feed_id: https://thehackernews.com/2023/08/identity-threat-detection-and-response.html
title: Identity Threat Detection and Response: Rips in Your Identity Fabric
uri: Identity-Threat-Detection-and-Response-Rips-in-Your-Identity-Fabric
url: https://thehackernews.com/2023/08/identity-threat-detection-and-response.html
content:
Why SaaS Security Is a Challenge
In today's digital landscape, organizations are increasingly relying on Software-as-a-Service (SaaS) applications to drive their operations. However, this widespread adoption has also opened the doors to new security risks and vulnerabilities.
The SaaS security attack surface continues to widen. It started with managing misconfigurations and now requires a


feed_id: https://thehackernews.com/2023/08/charming-kitten-targets-iranian.html
title: Charming Kitten Targets Iranian Dissidents with Advanced Cyber Attacks
uri: Charming-Kitten-Targets-Iranian-Dissidents-with-Advanced-Cyber-Attacks
url: https://thehackernews.com/2023/08/charming-kitten-targets-iranian.html
content:
Germany's Federal Office for the Protection of the Constitution (BfV) has warned of cyber attacks targeting Iranian persons and organizations in the country since the end of 2022.
"The cyber attacks were mainly directed against dissident organizations and individuals – such as lawyers, journalists, or human rights activists – inside and outside Iran," the agency said in an advisory.
The


feed_id: https://thehackernews.com/2023/08/new-financial-malware-janelarat-targets.html
title: New Financial Malware 'JanelaRAT' Targets Latin American Users
uri: New-Financial-Malware-JanelaRAT-Targets-Latin-American-Users
url: https://thehackernews.com/2023/08/new-financial-malware-janelarat-targets.html
content:
Users in Latin America (LATAM) are the target of a financial malware called JanelaRAT that's capable of capturing sensitive information from compromised Microsoft Windows systems.
"JanelaRAT mainly targets financial and cryptocurrency data from LATAM bank and financial institutions," Zscaler ThreatLabz researchers Gaetano Pellegrino and Sudeep Singh said, adding it "abuses DLL side-loading


feed_id: https://thehackernews.com/2023/08/india-passes-new-digital-personal-data.html
title: India Passes New Digital Personal Data Protection Bill (DPDPB), Putting Users' Privacy First
uri: India-Passes-New-Digital-Personal-Data-Protection-Bill-(DPDPB)-Puttin
url: https://thehackernews.com/2023/08/india-passes-new-digital-personal-data.html
content:
The Indian President Droupadi Murmu on Friday granted assent to the Digital Personal Data Protection Bill (DPDPB) after it was unanimously passed by both houses of the parliament last week, marking a significant step towards securing people's information.
"The Bill provides for the processing of digital personal data in a manner that recognizes both the rights of the individuals to protect their


feed_id: https://thehackernews.com/2023/08/multiple-flaws-in-cyberpower-and.html
title: Multiple Flaws in CyberPower and Dataprobe Products Put Data Centers at Risk
uri: Multiple-Flaws-in-CyberPower-and-Dataprobe-Products-Put-Data-Centers-a
url: https://thehackernews.com/2023/08/multiple-flaws-in-cyberpower-and.html
content:
Multiple security vulnerabilities impacting CyberPower's PowerPanel Enterprise Data Center Infrastructure Management (DCIM) platform and Dataprobe's iBoot Power Distribution Unit (PDU) could be potentially exploited to gain unauthenticated access to these systems and inflict catastrophic damage in target environments.
The nine vulnerabilities, from CVE-2023-3259 through CVE-2023-3267, carry


feed_id: https://thehackernews.com/2023/08/zoom-ztp-audiocodes-phones-flaws.html
title: Zoom ZTP & AudioCodes Phones Flaws Uncovered, Exposing Users to Eavesdropping
uri: Zoom-ZTP-AudioCodes-Phones-Flaws-Uncovered-Exposing-Users-to-Eavesd
url: https://thehackernews.com/2023/08/zoom-ztp-audiocodes-phones-flaws.html
content:
Multiple security vulnerabilities have been disclosed in AudioCodes desk phones and Zoom's Zero Touch Provisioning (ZTP) that could be potentially exploited by a malicious attacker to conduct remote attacks.
"An external attacker who leverages the vulnerabilities discovered in AudioCodes Ltd.'s desk phones and Zoom's Zero Touch Provisioning feature can gain full remote control of the devices,"


feed_id: https://thehackernews.com/2023/08/lolek-bulletproof-hosting-servers.html
title: Lolek Bulletproof Hosting Servers Seized, 5 Key Operators Arrested
uri: Lolek-Bulletproof-Hosting-Servers-Seized-5-Key-Operators-Arrested
url: https://thehackernews.com/2023/08/lolek-bulletproof-hosting-servers.html
content:
European and U.S. law enforcement agencies have announced the dismantling of a bulletproof hosting service provider called Lolek Hosted, which cybercriminals have used to launch cyber-attacks across the globe.
"Five of its administrators were arrested, and all of its servers seized, rendering LolekHosted.net no longer available," Europol said in a statement.
"The service facilitated the


feed_id: https://thehackernews.com/2023/08/new-python-url-parsing-flaw-enables.html
title: New Python URL Parsing Flaw Could Enable Command Execution Attacks
uri: New-Python-URL-Parsing-Flaw-Could-Enable-Command-Execution-Attacks
url: https://thehackernews.com/2023/08/new-python-url-parsing-flaw-enables.html
content:
A high-severity security flaw has been disclosed in the Python URL parsing function that could be exploited to bypass domain or protocol filtering methods implemented with a blocklist, ultimately resulting in arbitrary file reads and command execution.
"urlparse has a parsing problem when the entire URL starts with blank characters," the CERT Coordination Center (CERT/CC) said in a Friday


feed_id: https://thehackernews.com/2023/08/researchers-uncover-decade-long-cyber.html
title: Researchers Uncover Years-Long Cyber Espionage on Foreign Embassies in Belarus
uri: Researchers-Uncover-Years-Long-Cyber-Espionage-on-Foreign-Embassies-in
url: https://thehackernews.com/2023/08/researchers-uncover-decade-long-cyber.html
content:
A hitherto undocumented threat actor operating for nearly a decade and codenamed MoustachedBouncer has been attributed to cyber espionage attacks aimed at foreign embassies in Belarus.
"Since 2020, MoustachedBouncer has most likely been able to perform adversary-in-the-middle (AitM) attacks at the ISP level, within Belarus, in order to compromise its targets," ESET security researcher Matthieu


feed_id: https://thehackernews.com/2023/08/enhancing-tls-security-google-adds.html
title: Enhancing TLS Security: Google Adds Quantum-Resistant Encryption in Chrome 116
uri: Enhancing-TLS-Security-Google-Adds-Quantum-Resistant-Encryption-in-Ch
url: https://thehackernews.com/2023/08/enhancing-tls-security-google-adds.html
content:
Google has announced plans to add support for quantum-resistant encryption algorithms in its Chrome browser, starting with version 116.
"Chrome will begin supporting X25519Kyber768 for establishing symmetric secrets in TLS, starting in Chrome 116, and available behind a flag in Chrome 115," Devon O'Brien said in a post published Thursday.
Kyber was chosen by the U.S. Department of Commerce's


feed_id: https://thehackernews.com/2023/08/lockbit-30-ransomware-builder-leak.html
title: LockBit 3.0 Ransomware Builder Leak Gives Rise to Hundreds of New Variants
uri: LockBit-3-0-Ransomware-Builder-Leak-Gives-Rise-to-Hundreds-of-New-Vari
url: https://thehackernews.com/2023/08/lockbit-30-ransomware-builder-leak.html
content:
The leak of the LockBit 3.0 ransomware builder last year has led to threat actors abusing the tool to spawn new variants.
Russian cybersecurity company Kaspersky said it detected a ransomware intrusion that deployed a version of LockBit but with a markedly different ransom demand procedure.
"The attacker behind this incident decided to use a different ransom note with a headline related to a


feed_id: https://thehackernews.com/2023/08/kroll-suffers-data-breach-employee.html
title: Kroll Suffers Data Breach: Employee Falls Victim to SIM Swapping Attack
uri: Kroll-Suffers-Data-Breach-Employee-Falls-Victim-to-SIM-Swapping-Attac
url: https://thehackernews.com/2023/08/kroll-suffers-data-breach-employee.html
content:
Risk and financial advisory solutions provider Kroll on Friday disclosed that one of its employees fell victim to a "highly sophisticated" SIM swapping attack.
The incident, which took place on August 19, 2023, targeted the employee's T-Mobile account, the company said.
"Specifically, T-Mobile, without any authority from or contact with Kroll or its employee, transferred that employee's phone


feed_id: https://thehackernews.com/2023/08/two-lapsus-hackers-convicted-in-london.html
title: Two LAPSUS$ Hackers Convicted in London Court for High-Profile Tech Firm Hacks
uri: Two-LAPSUS-Hackers-Convicted-in-London-Court-for-High-Profile-Tech-Fi
url: https://thehackernews.com/2023/08/two-lapsus-hackers-convicted-in-london.html
content:
Two U.K. teenagers have been convicted by a jury in London for being part of the notorious LAPSUS$ (aka Slippy Spider) transnational gang and for orchestrating a series of brazen, high-profile hacks against major tech firms and demanding a ransom in exchange for not leaking the stolen information.
This includes Arion Kurtaj (aka White, Breachbase, WhiteDoxbin, and TeaPotUberHacker), an


feed_id: https://thehackernews.com/2023/08/learn-how-your-business-data-can.html
title: Learn How Your Business Data Can Amplify Your AI/ML Threat Detection Capabilities
uri: Learn-How-Your-Business-Data-Can-Amplify-Your-AI-ML-Threat-Detection-C
url: https://thehackernews.com/2023/08/learn-how-your-business-data-can.html
content:
In today's digital landscape, your business data is more than just numbers—it's a powerhouse. Imagine leveraging this data not only for profit but also for enhanced AI and Machine Learning (ML) threat detection.
For companies like Comcast, this isn't a dream. It's reality.
Your business comprehends its risks, vulnerabilities, and the unique environment in which it operates. No generic,


feed_id: https://thehackernews.com/2023/08/navigating-legacy-infrastructure-cisos.html
title: Navigating Legacy Infrastructure: A CISO's Actionable Strategy for Success
uri: Navigating-Legacy-Infrastructure-A-CISO-s-Actionable-Strategy-for-Suc
url: https://thehackernews.com/2023/08/navigating-legacy-infrastructure-cisos.html
content:
Every company has some level of tech debt. Unless you’re a brand new start-up, you most likely have a patchwork of solutions that have been implemented throughout the years, often under various leadership teams with different priorities and goals. As those technologies age, they can leave your organization vulnerable to cyber threats.
While replacing legacy technologies can be costly, those


feed_id: https://thehackernews.com/2023/08/china-linked-flax-typhoon-cyber.html
title: China-Linked Flax Typhoon Cyber Espionage Targets Taiwan's Key Sectors
uri: China-Linked-Flax-Typhoon-Cyber-Espionage-Targets-Taiwan-s-Key-Sectors
url: https://thehackernews.com/2023/08/china-linked-flax-typhoon-cyber.html
content:
A nation-state activity group originating from China has been linked to cyber attacks on dozens of organizations in Taiwan as part of a suspected espionage campaign.
The Microsoft Threat Intelligence team is tracking the activity under the name Flax Typhoon, which is also known as Ethereal Panda.
"Flax Typhoon gains and maintains long-term access to Taiwanese organizations' networks with minimal


feed_id: https://thehackernews.com/2023/08/urgent-fbi-warning-barracuda-email.html
title: Urgent FBI Warning: Barracuda Email Gateways Vulnerable Despite Recent Patches
uri: Urgent-FBI-Warning-Barracuda-Email-Gateways-Vulnerable-Despite-Recent
url: https://thehackernews.com/2023/08/urgent-fbi-warning-barracuda-email.html
content:
The U.S. Federal Bureau of Investigation (FBI) is warning that Barracuda Networks Email Security Gateway (ESG) appliances patched against a recently disclosed critical flaw continue to be at risk of potential compromise from suspected Chinese hacking groups.
It also deemed the fixes as "ineffective" and that it "continues to observe active intrusions and considers all affected Barracuda ESG


feed_id: https://thehackernews.com/2023/08/lazarus-group-exploits-critical-zoho.html
title: Lazarus Group Exploits Critical Zoho ManageEngine Flaw to Deploy Stealthy QuiteRAT Malware
uri: Lazarus-Group-Exploits-Critical-Zoho-ManageEngine-Flaw-to-Deploy-Steal
url: https://thehackernews.com/2023/08/lazarus-group-exploits-critical-zoho.html
content:
The North Korea-linked threat actor known as Lazarus Group has been observed exploiting a now-patched critical security flaw impacting Zoho ManageEngine ServiceDesk Plus to distribute a remote access trojan called such as QuiteRAT.
Targets include internet backbone infrastructure and healthcare entities in Europe and the U.S., cybersecurity company Cisco Talos said in a two-part analysis 


feed_id: https://thehackernews.com/2023/08/new-telegram-bot-telekopye-powering.html
title: New Telegram Bot "Telekopye" Powering Large-scale Phishing Scams from Russia
uri: New-Telegram-Bot-Telekopye-Powering-Large-scale-Phishing-Scams-from
url: https://thehackernews.com/2023/08/new-telegram-bot-telekopye-powering.html
content:
A new financially motivated operation is leveraging a malicious Telegram bot to help threat actors scam their victims.
Dubbed Telekopye, a portmanteau of Telegram and kopye (meaning "spear" in Russian), the toolkit functions as an automated means to create a phishing web page from a premade template and send the URL to potential victims, codenamed Mammoths by the criminals.
"This toolkit is


feed_id: https://thehackernews.com/2023/08/the-hidden-dangers-of-public-wi-fi.html
title: The Hidden Dangers of Public Wi-Fi
uri: The-Hidden-Dangers-of-Public-Wi-Fi
url: https://thehackernews.com/2023/08/the-hidden-dangers-of-public-wi-fi.html
content:
Public Wi-Fi, which has long since become the norm, poses threats to not only individual users but also businesses. With the rise of remote work, people can now work from virtually anywhere: a cafe close to home, a hotel in a different city, or even while waiting for a plane at the airport. Next, let's explore the risks of connecting to public Wi-Fi, both for you personally and for businesses.


feed_id: https://thehackernews.com/2023/08/new-whiffy-recon-malware-triangulates.html
title: New "Whiffy Recon" Malware Triangulates Infected Device Location via Wi-Fi Every Minute
uri: New-Whiffy-Recon-Malware-Triangulates-Infected-Device-Location-via-W
url: https://thehackernews.com/2023/08/new-whiffy-recon-malware-triangulates.html
content:
The SmokeLoader malware is being used to deliver a new Wi-Fi scanning malware strain called Whiffy Recon on compromised Windows machines.
"The new malware strain has only one operation. Every 60 seconds it triangulates the infected systems' positions by scanning nearby Wi-Fi access points as a data point for Google's geolocation API," Secureworks Counter Threat Unit (CTU) said in a statement


feed_id: https://thehackernews.com/2023/08/winrar-security-flaw-exploited-in-zero.html
title: WinRAR Security Flaw Exploited in Zero-Day Attacks to Target Traders
uri: WinRAR-Security-Flaw-Exploited-in-Zero-Day-Attacks-to-Target-Traders
url: https://thehackernews.com/2023/08/winrar-security-flaw-exploited-in-zero.html
content:
A recently patched security flaw in the popular WinRAR archiving software has been exploited as a zero-day since April 2023, new findings from Group-IB reveal.
The vulnerability, cataloged as CVE-2023-38831, allows threat actors to spoof file extensions, thereby making it possible to launch malicious scripts contained within an archive that masquerades as seemingly innocuous image or text files.


feed_id: https://thehackernews.com/2023/08/thousands-of-unpatched-openfire-xmpp.html
title: Thousands of Unpatched Openfire XMPP Servers Still Exposed to High-Severity Flaw
uri: Thousands-of-Unpatched-Openfire-XMPP-Servers-Still-Exposed-to-High-Sev
url: https://thehackernews.com/2023/08/thousands-of-unpatched-openfire-xmpp.html
content:
Thousands of Openfire XMPP servers are unpatched against a recently disclosed high-severity flaw and are susceptible to a new exploit, according to a new report from VulnCheck.
Tracked as CVE-2023-32315 (CVSS score: 7.5), the vulnerability relates to a path traversal vulnerability in Openfire's administrative console that could permit an unauthenticated attacker to access otherwise restricted


feed_id: https://thehackernews.com/2023/08/tornado-cash-founders-charged-in.html
title: Tornado Cash Founders Charged in Billion-Dollar Crypto Laundering Scandal
uri: Tornado-Cash-Founders-Charged-in-Billion-Dollar-Crypto-Laundering-Scan
url: https://thehackernews.com/2023/08/tornado-cash-founders-charged-in.html
content:
The U.S. Justice Department (DoJ) on Wednesday unsealed an indictment against two founders of the now-sanctioned Tornado Cash cryptocurrency mixer service, charging them with laundering more than $1 billion in criminal proceeds.
Both the individuals, Roman Storm and Roman Semenov, have been charged with conspiracy to commit money laundering, conspiracy to commit sanctions violations, and


feed_id: https://thehackernews.com/2023/08/north-korean-affiliates-suspected-in.html
title: North Korean Affiliates Suspected in $40M Cryptocurrency Heist, FBI Warns
uri: North-Korean-Affiliates-Suspected-in-40M-Cryptocurrency-Heist-FBI-Wa
url: https://thehackernews.com/2023/08/north-korean-affiliates-suspected-in.html
content:
The U.S. Federal Bureau of Investigation (FBI) on Tuesday warned that threat actors affiliated with North Korea may attempt to cash out stolen cryptocurrency worth more than $40 million.
The law enforcement agency attributed the blockchain activity to an adversary the U.S. government tracks as TraderTraitor, which is also known by the name Jade Sleet.
An investigation undertaken by the FBI found


feed_id: https://thehackernews.com/2023/08/meta-set-to-enable-default-end-to-end.html
title: Meta Set to Enable Default End-to-End Encryption on Messenger by Year End
uri: Meta-Set-to-Enable-Default-End-to-End-Encryption-on-Messenger-by-Year
url: https://thehackernews.com/2023/08/meta-set-to-enable-default-end-to-end.html
content:
Meta has once again reaffirmed its plans to roll out support for end-to-end encryption (E2EE) by default for one-to-one friends and family chats on Messenger by the end of the year.
As part of that effort, the social media giant said it's upgrading "millions more people's chats" effective August 22, 2023, exactly seven months after it started gradually expanding the feature to more users in


feed_id: https://thehackernews.com/2023/08/agile-approach-to-mass-cloud-credential.html
title: Agile Approach to Mass Cloud Credential Harvesting and Crypto Mining Sprints Ahead
uri: Agile-Approach-to-Mass-Cloud-Credential-Harvesting-and-Crypto-Mining-S
url: https://thehackernews.com/2023/08/agile-approach-to-mass-cloud-credential.html
content:
Developers are not the only people who have adopted the agile methodology for their development processes. From 2023-06-15 to 2023-07-11, Permiso Security’s p0 Labs team identified and tracked an attacker developing and deploying eight (8) incremental iterations of their credential harvesting malware while continuing to develop infrastructure for an upcoming (spoiler: now launched) campaign


feed_id: https://thehackernews.com/2023/08/syrian-threat-actor-evlf-unmasked-as.html
title: Syrian Threat Actor EVLF Unmasked as Creator of CypherRAT and CraxsRAT Android Malware
uri: Syrian-Threat-Actor-EVLF-Unmasked-as-Creator-of-CypherRAT-and-CraxsRAT
url: https://thehackernews.com/2023/08/syrian-threat-actor-evlf-unmasked-as.html
content:
A Syrian threat actor named EVLF has been outed as the creator of malware families CypherRAT and CraxsRAT.
"These RATs are designed to allow an attacker to remotely perform real-time actions and control the victim device's camera, location, and microphone," Cybersecurity firm Cyfirma said in a report published last week.
CypherRAT and CraxsRAT are said to be offered to other cybercriminals as


feed_id: https://thehackernews.com/2023/08/spacecolon-toolset-fuels-global-surge.html
title: Spacecolon Toolset Fuels Global Surge in Scarab Ransomware Attacks
uri: Spacecolon-Toolset-Fuels-Global-Surge-in-Scarab-Ransomware-Attacks
url: https://thehackernews.com/2023/08/spacecolon-toolset-fuels-global-surge.html
content:
A malicious toolset dubbed Spacecolon is being deployed as part of an ongoing campaign to spread variants of the Scarab ransomware across victim organizations globally.
"It probably finds its way into victim organizations by its operators compromising vulnerable web servers or via brute forcing RDP credentials," ESET security researcher Jakub Souček said in a detailed technical write-up


feed_id: https://thehackernews.com/2023/08/over-dozen-malicious-npm-packages.html
title: Over a Dozen Malicious npm Packages Target Roblox Game Developers
uri: Over-a-Dozen-Malicious-npm-Packages-Target-Roblox-Game-Developers
url: https://thehackernews.com/2023/08/over-dozen-malicious-npm-packages.html
content:
More than a dozen malicious packages have been discovered on the npm package repository since the start of August 2023 with capabilities to deploy an open-source information stealer called Luna Token Grabber on systems belonging to Roblox developers.
The ongoing campaign, first detected on August 1 by ReversingLabs, employs modules that masquerade as the legitimate package noblox.js, an API


feed_id: https://thehackernews.com/2023/09/everything-you-wanted-to-know-about-ai.html
title: Everything You Wanted to Know About AI Security but Were Afraid to Ask
uri: Everything-You-Wanted-to-Know-About-AI-Security-but-Were-Afraid-to-Ask
url: https://thehackernews.com/2023/09/everything-you-wanted-to-know-about-ai.html
content:
There’s been a great deal of AI hype recently, but that doesn’t mean the robots are here to replace us. This article sets the record straight and explains how businesses should approach AI.
From musing about self-driving cars to fearing AI bots that could destroy the world, there has been a great deal of AI hype in the past few years. AI has captured our imaginations, dreams, and occasionally,


feed_id: https://thehackernews.com/2023/09/vietnamese-cybercriminals-targeting.html
title: Vietnamese Cybercriminals Targeting Facebook Business Accounts with Malvertising
uri: Vietnamese-Cybercriminals-Targeting-Facebook-Business-Accounts-with-Ma
url: https://thehackernews.com/2023/09/vietnamese-cybercriminals-targeting.html
content:
Malicious actors associated with the Vietnamese cybercrime ecosystem are leveraging advertising-as-a-vector on social media platforms such as Meta-owned Facebook to distribute malware.
“Threat actors have long used fraudulent ads as a vector to target victims with scams, malvertising, and more,” WithSecure researcher Mohammad Kazem Hassan Nejad said. “And with businesses now leveraging the reach


feed_id: https://thehackernews.com/2023/09/beware-of-maldoc-in-pdf-new-polyglot.html
title: Beware of MalDoc in PDF: A New Polyglot Attack Allowing Attackers to Evade Antivirus
uri: Beware-of-MalDoc-in-PDF-A-New-Polyglot-Attack-Allowing-Attackers-to-E
url: https://thehackernews.com/2023/09/beware-of-maldoc-in-pdf-new-polyglot.html
content:
Cybersecurity researchers have called attention to a new antivirus evasion technique that involves embedding a malicious Microsoft Word file into a PDF file.
The sneaky method, dubbed MalDoc in PDF by JPCERT/CC, is said to have been employed in an in-the-wild attack in July 2023.
"A file created with MalDoc in PDF can be opened in Word even though it has magic numbers and file structure of PDF,"


feed_id: https://thehackernews.com/2023/09/chinese-speaking-cybercriminals-launch.html
title: Chinese-Speaking Cybercriminals Launch Large-Scale iMessage Smishing Campaign in U.S.
uri: Chinese-Speaking-Cybercriminals-Launch-Large-Scale-iMessage-Smishing-C
url: https://thehackernews.com/2023/09/chinese-speaking-cybercriminals-launch.html
content:
A new large-scale smishing campaign is targeting the U.S. by sending iMessages from compromised Apple iCloud accounts with an aim to conduct identity theft and financial fraud.
“The Chinese-speaking threat actors behind this campaign are operating a package-tracking text scam sent via iMessage to collect personally identifying information (PII) and payment credentials from victims, in the


feed_id: https://thehackernews.com/2023/09/poc-exploit-released-for-critical.html
title: PoC Exploit Released for Critical VMware Aria's SSH Auth Bypass Vulnerability
uri: PoC-Exploit-Released-for-Critical-VMware-Aria-s-SSH-Auth-Bypass-Vulner
url: https://thehackernews.com/2023/09/poc-exploit-released-for-critical.html
content:
Proof-of-concept (PoC) exploit code has been made available for a recently disclosed and patched critical flaw impacting VMware Aria Operations for Networks (formerly vRealize Network Insight).
The flaw, tracked as CVE-2023-34039, is rated 9.8 out of a maximum of 10 for severity and has been described as a case of authentication bypass due to a lack of unique cryptographic key generation.
“A


feed_id: https://thehackernews.com/2023/09/okta-warns-of-social-engineering.html
title: Okta Warns of Social Engineering Attacks Targeting Super Administrator Privileges
uri: Okta-Warns-of-Social-Engineering-Attacks-Targeting-Super-Administrator
url: https://thehackernews.com/2023/09/okta-warns-of-social-engineering.html
content:
Identity services provider Okta on Friday warned of social engineering attacks orchestrated by threat actors to obtain elevated administrator permissions.
“In recent weeks, multiple U.S.-based Okta customers have reported a consistent pattern of social engineering attacks against IT service desk personnel, in which the caller’s strategy was to convince service desk personnel to reset all


feed_id: https://thehackernews.com/2023/09/threat-actors-targeting-microsoft-sql.html
title: Threat Actors Targeting Microsoft SQL Servers to Deploy FreeWorld Ransomware
uri: Threat-Actors-Targeting-Microsoft-SQL-Servers-to-Deploy-FreeWorld-Rans
url: https://thehackernews.com/2023/09/threat-actors-targeting-microsoft-sql.html
content:
Threat actors are exploiting poorly secured Microsoft SQL (MS SQL) servers to deliver Cobalt Strike and a ransomware strain called FreeWorld.
Cybersecurity firm Securonix, which has dubbed the campaign DB#JAMMER, said it stands out for the way the toolset and infrastructure is employed.
“Some of these tools include enumeration software, RAT payloads, exploitation and credential stealing software


feed_id: https://thehackernews.com/2023/09/russian-state-backed-infamous-chisel.html
title: Russian State-Backed 'Infamous Chisel' Android Malware Targets Ukrainian Military
uri: Russian-State-Backed-Infamous-Chisel-Android-Malware-Targets-Ukraini
url: https://thehackernews.com/2023/09/russian-state-backed-infamous-chisel.html
content:
Cybersecurity and intelligence agencies from Australia, Canada, New Zealand, the U.K., and the U.S. on Thursday disclosed details of a mobile malware strain targeting Android devices used by the Ukrainian military.
The malicious software, dubbed Infamous Chisel and attributed to a Russian state-sponsored actor called Sandworm, has capabilities to “enable unauthorized access to compromised


feed_id: https://thehackernews.com/2023/09/new-superbear-trojan-emerges-in.html
title: New SuperBear Trojan Emerges in Targeted Phishing Attack on South Korean Activists
uri: New-SuperBear-Trojan-Emerges-in-Targeted-Phishing-Attack-on-South-Kore
url: https://thehackernews.com/2023/09/new-superbear-trojan-emerges-in.html
content:
A new phishing attack likely targeting civil society groups in South Korea has led to the discovery of a novel remote access trojan called SuperBear.
The intrusion singled out an unnamed activist, who was contacted in late August 2023 and received a malicious LNK file from an address impersonating a member of the organization, non-profit entity Interlabs said in a new report.
The LNK file, upon


feed_id: https://thehackernews.com/2023/09/its-zero-day-its-malware-no-its.html
title: It's a Zero-day? It's Malware? No! It's Username and Password
uri: It-s-a-Zero-day-It-s-Malware-No-It-s-Username-and-Password
url: https://thehackernews.com/2023/09/its-zero-day-its-malware-no-its.html
content:
As cyber threats continue to evolve, adversaries are deploying a range of tools to breach security defenses and compromise sensitive data. Surprisingly, one of the most potent weapons in their arsenal is not malicious code but simply stolen or weak usernames and passwords. This article explores the seriousness of compromised credentials, the challenges they present to security solutions, and the


feed_id: https://thehackernews.com/2023/09/classiscam-scam-as-service-raked-645.html
title: Classiscam Scam-as-a-Service Raked $64.5 Million During the COVID-19 Pandemic
uri: Classiscam-Scam-as-a-Service-Raked-64-5-Million-During-the-COVID-19-P
url: https://thehackernews.com/2023/09/classiscam-scam-as-service-raked-645.html
content:
The Classiscam scam-as-a-service program has reaped the criminal actors $64.5 million in illicit earnings since its emergence in 2019.
"Classiscam campaigns initially started out on classified sites, on which scammers placed fake advertisements and used social engineering techniques to convince users to pay for goods by transferring money to bank cards," Group-IB said in a new report.
"Since


feed_id: https://thehackernews.com/2023/08/sapphirestealer-malware-gateway-to.html
title: SapphireStealer Malware: A Gateway to Espionage and Ransomware Operations
uri: SapphireStealer-Malware-A-Gateway-to-Espionage-and-Ransomware-Operati
url: https://thehackernews.com/2023/08/sapphirestealer-malware-gateway-to.html
content:
An open-source .NET-based information stealer malware dubbed SapphireStealer is being used by multiple entities to enhance its capabilities and spawn their own bespoke variants.
“Information-stealing malware like SapphireStealer can be used to obtain sensitive information, including corporate credentials, which are often resold to other threat actors who leverage the access for additional


feed_id: https://thehackernews.com/2023/08/north-korean-hackers-deploy-new.html
title: North Korean Hackers Deploy New Malicious Python Packages in PyPI Repository
uri: North-Korean-Hackers-Deploy-New-Malicious-Python-Packages-in-PyPI-Repo
url: https://thehackernews.com/2023/08/north-korean-hackers-deploy-new.html
content:
Three additional rogue Python packages have been discovered in the Package Index (PyPI) repository as part of an ongoing malicious software supply chain campaign called VMConnect, with signs pointing to the involvement of North Korean state-sponsored threat actors.
The findings come from ReversingLabs, which detected the packages tablediter, request-plus, and requestspro.
First disclosed at the


feed_id: https://thehackernews.com/2023/08/numbers-dont-lie-exposing-harsh-truths.html
title: Numbers Don't Lie: Exposing the Harsh Truths of Cyberattacks in New Report
uri: Numbers-Don-t-Lie-Exposing-the-Harsh-Truths-of-Cyberattacks-in-New-Re
url: https://thehackernews.com/2023/08/numbers-dont-lie-exposing-harsh-truths.html
content:
How often do cyberattacks happen? How frequently do threat actors target businesses and governments around the world? The BlackBerry® Threat Research and Intelligence Team recently analyzed 90 days of real-world data to answer these questions. Full results are in the latest BlackBerry Global Threat Intelligence Report, but read on for a teaser of several interesting cyber attack statistics.


feed_id: https://thehackernews.com/2023/08/earth-estries-espionage-campaign.html
title: Earth Estries' Espionage Campaign Targets Governments and Tech Titans Across Continents
uri: Earth-Estries-Espionage-Campaign-Targets-Governments-and-Tech-Titans
url: https://thehackernews.com/2023/08/earth-estries-espionage-campaign.html
content:
A hacking outfit nicknamed Earth Estries has been attributed to a new, ongoing cyber espionage campaign targeting government and technology industries based in the Philippines, Taiwan, Malaysia, South Africa, Germany, and the U.S.
"The threat actors behind Earth Estries are working with high-level resources and functioning with sophisticated skills and experience in cyber espionage and illicit


feed_id: https://thehackernews.com/2023/08/hackers-can-exploit-windows-container.html
title: Hackers Can Exploit Windows Container Isolation Framework to Bypass Endpoint Security
uri: Hackers-Can-Exploit-Windows-Container-Isolation-Framework-to-Bypass-En
url: https://thehackernews.com/2023/08/hackers-can-exploit-windows-container.html
content:
New findings show that malicious actors could leverage a sneaky malware detection evasion technique and bypass endpoint security solutions by manipulating the Windows Container Isolation Framework.
The findings were presented by Deep Instinct security researcher Daniel Avinoam at the DEF CON security conference held earlier this month.
Microsoft's container architecture (and by extension, 


feed_id: https://thehackernews.com/2023/08/mmrat-android-trojan-executes-remote.html
title: MMRat Android Trojan Executes Remote Financial Fraud Through Accessibility Feature
uri: MMRat-Android-Trojan-Executes-Remote-Financial-Fraud-Through-Accessibi
url: https://thehackernews.com/2023/08/mmrat-android-trojan-executes-remote.html
content:
A previously undocumented Android banking trojan dubbed MMRat has been observed targeting mobile users in Southeast Asia since late June 2023 to remotely commandeer the devices and perform financial fraud.
"The malware, named after its distinctive package name com.mm.user, can capture user input and screen content, and can also remotely control victim devices through various techniques, enabling


feed_id: https://thehackernews.com/2023/08/china-linked-badbazaar-android-spyware.html
title: China-Linked BadBazaar Android Spyware Targeting Signal and Telegram Users
uri: China-Linked-BadBazaar-Android-Spyware-Targeting-Signal-and-Telegram-U
url: https://thehackernews.com/2023/08/china-linked-badbazaar-android-spyware.html
content:
Cybersecurity researchers have discovered malicious Android apps for Signal and Telegram distributed via the Google Play Store and Samsung Galaxy Store that are engineered to deliver the BadBazaar spyware on infected devices.
Slovakian company ESET attributed the campaign to a China-linked actor called GREF.
"Most likely active since July 2020 and since July 2022, respectively, the campaigns


feed_id: https://thehackernews.com/2023/08/how-to-prevent-chatgpt-from-stealing.html
title: How to Prevent ChatGPT From Stealing Your Content & Traffic
uri: How-to-Prevent-ChatGPT-From-Stealing-Your-Content-Traffic
url: https://thehackernews.com/2023/08/how-to-prevent-chatgpt-from-stealing.html
content:
ChatGPT and similar large language models (LLMs) have added further complexity to the ever-growing online threat landscape. Cybercriminals no longer need advanced coding skills to execute fraud and other damaging attacks against online businesses and customers, thanks to bots-as-a-service, residential proxies, CAPTCHA farms, and other easily accessible tools. 
Now, the latest technology damaging


feed_id: https://thehackernews.com/2023/08/malicious-npm-packages-aim-to-target.html
title: Malicious npm Packages Aim to Target Developers for Source Code Theft
uri: Malicious-npm-Packages-Aim-to-Target-Developers-for-Source-Code-Theft
url: https://thehackernews.com/2023/08/malicious-npm-packages-aim-to-target.html
content:
An unknown threat actor is leveraging malicious npm packages to target developers with an aim to steal source code and configuration files from victim machines, a sign of how threats lurk consistently in open-source repositories.
"The threat actor behind this campaign has been linked to malicious activity dating back to 2021," software supply chain security firm Checkmarx said in a report shared


feed_id: https://thehackernews.com/2023/08/alert-juniper-firewalls-openfire-and.html
title: Alert: Juniper Firewalls, Openfire, and Apache RocketMQ Under Attack from New Exploits
uri: Alert-Juniper-Firewalls-Openfire-and-Apache-RocketMQ-Under-Attack-f
url: https://thehackernews.com/2023/08/alert-juniper-firewalls-openfire-and.html
content:
Recently disclosed security flaws impacting Juniper firewalls, Openfire, and Apache RocketMQ servers have come under active exploitation in the wild, according to multiple reports.
The Shadowserver Foundation said that it's "seeing exploitation attempts from multiple IPs for Juniper J-Web CVE-2023-36844 (& friends) targeting /webauth_operation.php endpoint," the same day a proof-of-concept (PoC)


feed_id: https://thehackernews.com/2023/08/critical-vulnerability-alert-vmware.html
title: Critical Vulnerability Alert: VMware Aria Operations Networks at Risk from Remote Attacks
uri: Critical-Vulnerability-Alert-VMware-Aria-Operations-Networks-at-Risk
url: https://thehackernews.com/2023/08/critical-vulnerability-alert-vmware.html
content:
VMware has released software updates to correct two security vulnerabilities in Aria Operations for Networks that could be potentially exploited to bypass authentication and gain remote code execution.
The most severe of the flaws is CVE-2023-34039 (CVSS score: 9.8), which relates to a case of authentication bypass arising as a result of a lack of unique cryptographic key generation.
"A


feed_id: https://thehackernews.com/2023/08/fbi-dismantles-qakbot-malware-frees.html
title: FBI Dismantles QakBot Malware, Frees 700,000 Computers, Seizes $8.6 Million
uri: FBI-Dismantles-QakBot-Malware-Frees-700-000-Computers-Seizes-8-6-Mi
url: https://thehackernews.com/2023/08/fbi-dismantles-qakbot-malware-frees.html
content:
A coordinated law enforcement effort codenamed Operation Duck Hunt has felled QakBot, a notorious Windows malware family that's estimated to have compromised over 700,000 computers globally and facilitated financial fraud as well as ransomware.
To that end, the U.S. Justice Department (DoJ) said the malware is "being deleted from victim computers, preventing it from doing any more harm," adding


feed_id: https://thehackernews.com/2023/08/chinese-hacking-group-exploits.html
title: Chinese Hacking Group Exploits Barracuda Zero-Day to Target Government, Military, and Telecom
uri: Chinese-Hacking-Group-Exploits-Barracuda-Zero-Day-to-Target-Government
url: https://thehackernews.com/2023/08/chinese-hacking-group-exploits.html
content:
A suspected Chinese-nexus hacking group exploited a recently disclosed zero-day flaw in Barracuda Networks Email Security Gateway (ESG) appliances to breach government, military, defense and aerospace, high-tech industry, and telecom sectors as part of a global espionage campaign.
Mandiant, which is tracking the activity under the name UNC4841, described the threat actor as "highly responsive to


feed_id: https://thehackernews.com/2023/08/darkgate-malware-activity-spikes-as.html
title: DarkGate Malware Activity Spikes as Developer Rents Out Malware to Affiliates
uri: DarkGate-Malware-Activity-Spikes-as-Developer-Rents-Out-Malware-to-Aff
url: https://thehackernews.com/2023/08/darkgate-malware-activity-spikes-as.html
content:
A new malspam campaign has been observed deploying an off-the-shelf malware called DarkGate.
"The current spike in DarkGate malware activity is plausible given the fact that the developer of the malware has recently started to rent out the malware to a limited number of affiliates," Telekom Security said in a report published last week.
The latest report build onn recent findings from security


feed_id: https://thehackernews.com/2023/08/survey-provides-takeaways-for-security.html
title: Survey Provides Takeaways for Security Pros to Operationalize their Remediation Life Cycle
uri: Survey-Provides-Takeaways-for-Security-Pros-to-Operationalize-their-Re
url: https://thehackernews.com/2023/08/survey-provides-takeaways-for-security.html
content:
Ask any security professional and they’ll tell you that remediating risks from various siloed security scanning tools requires a tedious and labor-intensive series of steps focused on deduplication, prioritization, and routing of issues to an appropriate “fixer” somewhere in the organization. This burden on already resource-strapped security teams is an efficiency killer. 
A new study,


feed_id: https://thehackernews.com/2023/08/citrix-netscaler-alert-ransomware.html
title: Citrix NetScaler Alert: Ransomware Hackers Exploiting Critical Vulnerability
uri: Citrix-NetScaler-Alert-Ransomware-Hackers-Exploiting-Critical-Vulnera
url: https://thehackernews.com/2023/08/citrix-netscaler-alert-ransomware.html
content:
Unpatched Citrix NetScaler systems exposed to the internet are being targeted by unknown threat actors in what's suspected to be a ransomware attack.
Cybersecurity company Sophos is tracking the activity cluster under the moniker STAC4663.
Attack chains involve the exploitation of CVE-2023-3519, a critical code injection vulnerability impacting NetScaler ADC and Gateway servers that could


feed_id: https://thehackernews.com/2023/08/phishing-as-service-gets-smarter.html
title: Phishing-as-a-Service Gets Smarter: Microsoft Sounds Alarm on AiTM Attacks
uri: Phishing-as-a-Service-Gets-Smarter-Microsoft-Sounds-Alarm-on-AiTM-Att
url: https://thehackernews.com/2023/08/phishing-as-service-gets-smarter.html
content:
Microsoft is warning of an increase in adversary-in-the-middle (AiTM) phishing techniques, which are being propagated as part of the phishing-as-a-service (PhaaS) cybercrime model.
In addition to an uptick in AiTM-capable PhaaS platforms, the tech giant noted that existing phishing services like PerSwaysion are incorporating AiTM capabilities.
"This development in the PhaaS ecosystem enables


feed_id: https://thehackernews.com/2023/08/experts-uncover-how-cybercriminals.html
title: Experts Uncover How Cybercriminals Could Exploit Microsoft Entra ID for Elevated Privilege
uri: Experts-Uncover-How-Cybercriminals-Could-Exploit-Microsoft-Entra-ID-fo
url: https://thehackernews.com/2023/08/experts-uncover-how-cybercriminals.html
content:
Cybersecurity researchers have discovered a case of privilege escalation associated with a Microsoft Entra ID (formerly Azure Active Directory) application by taking advantage of an abandoned reply URL.
"An attacker could leverage this abandoned URL to redirect authorization codes to themselves, exchanging the ill-gotten authorization codes for access tokens," Secureworks Counter Threat Unit (


feed_id: https://thehackernews.com/2023/08/developers-beware-malicious-rust.html
title: Developers Beware: Malicious Rust Libraries Caught Transmitting OS Info to Telegram Channel
uri: Developers-Beware-Malicious-Rust-Libraries-Caught-Transmitting-OS-Inf
url: https://thehackernews.com/2023/08/developers-beware-malicious-rust.html
content:
In yet another sign that developers continue to be targets of software supply chain attacks, a number of malicious packages have been discovered on the Rust programming language's crate registry.
The libraries, uploaded between August 14 and 16, 2023, were published by a user named "amaperf," Phylum said in a report published last week. The names of the packages, now taken down, are as follows:


feed_id: https://thehackernews.com/2023/08/cyberattacks-targeting-e-commerce.html
title: Cyberattacks Targeting E-commerce Applications
uri: Cyberattacks-Targeting-E-commerce-Applications
url: https://thehackernews.com/2023/08/cyberattacks-targeting-e-commerce.html
content:
Cyber attacks on e-commerce applications are a common trend in 2023 as e-commerce businesses become more omnichannel, they build and deploy increasingly more API interfaces, with threat actors constantly exploring more ways to exploit vulnerabilities. This is why regular testing and ongoing monitoring are necessary to fully protect web applications, identifying weaknesses so they can be


feed_id: https://thehackernews.com/2023/08/kmsdbot-malware-gets-upgrade-now.html
title: KmsdBot Malware Gets an Upgrade: Now Targets IoT Devices with Enhanced Capabilities
uri: KmsdBot-Malware-Gets-an-Upgrade-Now-Targets-IoT-Devices-with-Enhanced
url: https://thehackernews.com/2023/08/kmsdbot-malware-gets-upgrade-now.html
content:
An updated version of a botnet malware called KmsdBot is now targeting Internet of Things (IoT) devices, simultaneously branching out its capabilities and the attack surface.
"The binary now includes support for Telnet scanning and support for more CPU architectures," Akamai security researcher Larry W. Cashdollar said in an analysis published this month.

The latest iteration,


feed_id: https://thehackernews.com/2023/09/shroudedsnoopers-httpsnoop-backdoor.html
title: ShroudedSnooper's HTTPSnoop Backdoor Targets Middle East Telecom Companies
uri: ShroudedSnooper-s-HTTPSnoop-Backdoor-Targets-Middle-East-Telecom-Compa
url: https://thehackernews.com/2023/09/shroudedsnoopers-httpsnoop-backdoor.html
content:
Telecommunication service providers in the Middle East are the target of a new intrusion set dubbed ShroudedSnooper that employs a stealthy backdoor called HTTPSnoop.
"HTTPSnoop is a simple, yet effective, backdoor that consists of novel techniques to interface with Windows HTTP kernel drivers and devices to listen to incoming requests for specific HTTP(S) URLs and execute that content on the


feed_id: https://thehackernews.com/2023/09/operation-rusty-flag-azerbaijan.html
title: Operation Rusty Flag: Azerbaijan Targeted in New Rust-Based Malware Campaign
uri: Operation-Rusty-Flag-Azerbaijan-Targeted-in-New-Rust-Based-Malware-Ca
url: https://thehackernews.com/2023/09/operation-rusty-flag-azerbaijan.html
content:
Targets located in Azerbaijan have been singled out as part of a new campaign that's designed to deploy Rust-based malware on compromised systems.
Cybersecurity firm Deep Instinct is tracking the operation under the name Operation Rusty Flag. It has not been associated with any known threat actor or group.
"The operation has at least two different initial access vectors," security researchers


feed_id: https://thehackernews.com/2023/09/inside-code-of-new-xworm-variant.html
title: Inside the Code of a New XWorm Variant
uri: Inside-the-Code-of-a-New-XWorm-Variant
url: https://thehackernews.com/2023/09/inside-code-of-new-xworm-variant.html
content:
XWorm is a relatively new representative of the remote access trojan cohort that has already earned its spot among the most persistent threats across the globe. 
Since 2022, when it was first observed by researchers, it has undergone a number of major updates that have significantly enhanced its functionality and solidified its staying power. 
The analyst team at ANY.RUN came across the newest


feed_id: https://thehackernews.com/2023/09/earth-luscas-new-sprysocks-linux.html
title: Earth Lusca's New SprySOCKS Linux Backdoor Targets Government Entities
uri: Earth-Lusca-s-New-SprySOCKS-Linux-Backdoor-Targets-Government-Entities
url: https://thehackernews.com/2023/09/earth-luscas-new-sprysocks-linux.html
content:
The China-linked threat actor known as Earth Lusca has been observed targeting government entities using a never-before-seen Linux backdoor called SprySOCKS.
Earth Lusca was first documented by Trend Micro in January 2022, detailing the adversary's attacks against public and private sector entities across Asia, Australia, Europe, North America.
Active since 2021, the group has relied on


feed_id: https://thehackernews.com/2023/09/live-webinar-overcoming-generative-ai.html
title: Live Webinar: Overcoming Generative AI Data Leakage Risks
uri: Live-Webinar-Overcoming-Generative-AI-Data-Leakage-Risks
url: https://thehackernews.com/2023/09/live-webinar-overcoming-generative-ai.html
content:
As the adoption of generative AI tools, like ChatGPT, continues to surge, so does the risk of data exposure. According to Gartner’s "Emerging Tech: Top 4 Security Risks of GenAI" report, privacy and data security is one of the four major emerging risks within generative AI. A new webinar featuring a multi-time Fortune 100 CISO and the CEO of LayerX, a browser extension solution, delves into this


feed_id: https://thehackernews.com/2023/09/microsoft-ai-researchers-accidentally.html
title: Microsoft AI Researchers Accidentally Expose 38 Terabytes of Confidential Data
uri: Microsoft-AI-Researchers-Accidentally-Expose-38-Terabytes-of-Confident
url: https://thehackernews.com/2023/09/microsoft-ai-researchers-accidentally.html
content:
Microsoft on Monday said it took steps to correct a glaring security gaffe that led to the exposure of 38 terabytes of private data.
The leak was discovered on the company's AI GitHub repository and is said to have been inadvertently made public when publishing a bucket of open-source training data, Wiz said. It also included a disk backup of two former employees' workstations containing secrets


feed_id: https://thehackernews.com/2023/09/over-12000-juniper-firewalls-found.html
title: Nearly 12,000 Juniper Firewalls Found Vulnerable to Recently Disclosed RCE Vulnerability
uri: Nearly-12-000-Juniper-Firewalls-Found-Vulnerable-to-Recently-Disclosed
url: https://thehackernews.com/2023/09/over-12000-juniper-firewalls-found.html
content:
New research has found that close to 12,000 internet-exposed Juniper firewall devices are vulnerable to a recently disclosed remote code execution flaw.
VulnCheck, which discovered a new exploit for CVE-2023-36845, said it could be exploited by an "unauthenticated and remote attacker to execute arbitrary code on Juniper firewalls without creating a file on the system."
CVE-2023-36845 refers to a


feed_id: https://thehackernews.com/2023/09/transparent-tribe-uses-fake-youtube.html
title: Transparent Tribe Uses Fake YouTube Android Apps to Spread CapraRAT Malware
uri: Transparent-Tribe-Uses-Fake-YouTube-Android-Apps-to-Spread-CapraRAT-Ma
url: https://thehackernews.com/2023/09/transparent-tribe-uses-fake-youtube.html
content:
The suspected Pakistan-linked threat actor known as Transparent Tribe is using malicious Android apps mimicking YouTube to distribute the CapraRAT mobile remote access trojan (RAT), demonstrating the continued evolution of the activity.
"CapraRAT is a highly invasive tool that gives the attacker control over much of the data on the Android devices that it infects," SentinelOne security


feed_id: https://thehackernews.com/2023/09/new-ambersquid-cryptojacking-operation.html
title: New AMBERSQUID Cryptojacking Operation Targets Uncommon AWS Services
uri: New-AMBERSQUID-Cryptojacking-Operation-Targets-Uncommon-AWS-Services
url: https://thehackernews.com/2023/09/new-ambersquid-cryptojacking-operation.html
content:
A novel cloud-native cryptojacking operation has set its eyes on uncommon Amazon Web Services (AWS) offerings such as AWS Amplify, AWS Fargate, and Amazon SageMaker to illicitly mine cryptocurrency.
The malicious cyber activity has been codenamed AMBERSQUID by cloud and container security firm Sysdig.
"The AMBERSQUID operation was able to exploit cloud services without triggering the AWS


feed_id: https://thehackernews.com/2023/09/think-your-mfa-and-pam-solutions.html
title: Think Your MFA and PAM Solutions Protect You? Think Again
uri: Think-Your-MFA-and-PAM-Solutions-Protect-You-Think-Again
url: https://thehackernews.com/2023/09/think-your-mfa-and-pam-solutions.html
content:
When you roll out a security product, you assume it will fulfill its purpose. Unfortunately, however, this often turns out not to be the case. A new report, produced by Osterman Research and commissioned by Silverfort, reveals that MFA (Multi-Factor Authentication) and PAM (Privileged Access Management) solutions are almost never deployed comprehensively enough to provide resilience to identity


feed_id: https://thehackernews.com/2023/09/hook-new-android-banking-trojan-that.html
title: Hook: New Android Banking Trojan That Expands on ERMAC's Legacy
uri: Hook-New-Android-Banking-Trojan-That-Expands-on-ERMAC-s-Legacy
url: https://thehackernews.com/2023/09/hook-new-android-banking-trojan-that.html
content:
A new analysis of the Android banking trojan known as Hook has revealed that it's based on its predecessor called ERMAC.
"The ERMAC source code was used as a base for Hook," NCC Group security researchers Joshua Kamp and Alberto Segura said in a technical analysis published last week.
"All commands (30 in total) that the malware operator can send to a device infected with ERMAC malware, also


feed_id: https://thehackernews.com/2023/09/retool-falls-victim-to-sms-based.html
title: Retool Falls Victim to SMS-Based Phishing Attack Affecting 27 Cloud Clients
uri: Retool-Falls-Victim-to-SMS-Based-Phishing-Attack-Affecting-27-Cloud-Cl
url: https://thehackernews.com/2023/09/retool-falls-victim-to-sms-based.html
content:
Software development company Retool has disclosed that the accounts of 27 of its cloud customers were compromised following a targeted and SMS-based social engineering attack.
The San Francisco-based firm blamed a Google Account cloud synchronization feature recently introduced in April 2023 for making the breach worse, calling it a "dark pattern."
"The fact that Google Authenticator syncs to


feed_id: https://thehackernews.com/2023/09/financially-motivated-unc3944-threat.html
title: Financially Motivated UNC3944 Threat Actor Shifts Focus to Ransomware Attacks
uri: Financially-Motivated-UNC3944-Threat-Actor-Shifts-Focus-to-Ransomware
url: https://thehackernews.com/2023/09/financially-motivated-unc3944-threat.html
content:
The financially motivated threat actor known as UNC3944 is pivoting to ransomware deployment as part of an expansion to its monetization strategies, Mandiant has revealed.
"UNC3944 has demonstrated a stronger focus on stealing large amounts of sensitive data for extortion purposes and they appear to understand Western business practices, possibly due to the geographical composition of the group,


feed_id: https://thehackernews.com/2023/09/north-koreas-lazarus-group-suspected-in.html
title: North Korea's Lazarus Group Suspected in $31 Million CoinEx Heist
uri: North-Korea-s-Lazarus-Group-Suspected-in-31-Million-CoinEx-Heist
url: https://thehackernews.com/2023/09/north-koreas-lazarus-group-suspected-in.html
content:
The North Korea-affiliated Lazarus Group has stolen nearly $240 million in cryptocurrency since June 2023, marking a significant escalation of its hacks.
According to multiple reports from Certik, Elliptic, and ZachXBT, the infamous hacking group is said to be suspected behind the theft of $31 million in digital assets from the CoinEx exchange on September 12, 2023.
The crypto heist aimed at


feed_id: https://thehackernews.com/2023/09/tiktok-faces-massive-345-million-fine.html
title: TikTok Faces Massive €345 Million Fine Over Child Data Violations in E.U.
uri: TikTok-Faces-Massive-345-Million-Fine-Over-Child-Data-Violations-in
url: https://thehackernews.com/2023/09/tiktok-faces-massive-345-million-fine.html
content:
The Irish Data Protection Commission (DPC) slapped TikTok with a €345 million (about $368 million) fine for violating the European Union's General Data Protection Regulation (GDPR) in relation to its handling of children's data.
The investigation, initiated in September 2021, examined how the popular short-form video platform processed personal data relating to child users (those between the


feed_id: https://thehackernews.com/2023/09/the-interdependence-between-automated.html
title: The Interdependence between Automated Threat Intelligence Collection and Humans
uri: The-Interdependence-between-Automated-Threat-Intelligence-Collection-a
url: https://thehackernews.com/2023/09/the-interdependence-between-automated.html
content:
The volume of cybersecurity vulnerabilities is rising, with close to 30% more vulnerabilities found in 2022 vs. 2018. Costs are also rising, with a data breach in 2023 costing $4.45M on average vs. $3.62M in 2017.
In Q2 2023, a total of 1386 victims were claimed by ransomware attacks compared with just 831 in Q1 2023. The MOVEit attack has claimed over 600 victims so far and that number is still


feed_id: https://thehackernews.com/2023/09/google-agrees-to-93-million-settlement.html
title: Google Agrees to $93 Million Settlement in California's Location-Privacy Lawsuit
uri: Google-Agrees-to-93-Million-Settlement-in-California-s-Location-Priva
url: https://thehackernews.com/2023/09/google-agrees-to-93-million-settlement.html
content:
Google has agreed to pay $93 million to settle a lawsuit filed by the U.S. state of California over allegations that the company's location-privacy practices misled consumers and violated consumer protection laws.
"Our investigation revealed that Google was telling its users one thing – that it would no longer track their location once they opted out – but doing the opposite and continuing to


feed_id: https://thehackernews.com/2023/09/ddos-20-iot-sparks-new-ddos-alert.html
title: DDoS 2.0: IoT Sparks New DDoS Alert
uri: DDoS-2-0-IoT-Sparks-New-DDoS-Alert
url: https://thehackernews.com/2023/09/ddos-20-iot-sparks-new-ddos-alert.html
content:
The Internet of Things (IoT) is transforming efficiency in various sectors like healthcare and logistics but has also introduced new security risks, particularly IoT-driven DDoS attacks. This article explores how these attacks work, why they’re uniquely problematic, and how to mitigate them.
What Is IoT?
IoT (Internet of Things) refers to online, interconnected devices that collect and exchange


feed_id: https://thehackernews.com/2023/09/nodestealer-malware-now-targets.html
title: NodeStealer Malware Now Targets Facebook Business Accounts on Multiple Browsers
uri: NodeStealer-Malware-Now-Targets-Facebook-Business-Accounts-on-Multiple
url: https://thehackernews.com/2023/09/nodestealer-malware-now-targets.html
content:
An ongoing campaign is targeting Facebook Business accounts with bogus messages to harvest victims' credentials using a variant of the Python-based NodeStealer and potentially take over their accounts for follow-on malicious activities. 
"The attacks are reaching victims mainly in Southern Europe and North America across different segments, led by the manufacturing services and technology


feed_id: https://thehackernews.com/2023/09/cybercriminals-combine-phishing-and-ev.html
title: Cybercriminals Combine Phishing and EV Certificates to Deliver Ransomware Payloads
uri: Cybercriminals-Combine-Phishing-and-EV-Certificates-to-Deliver-Ransomw
url: https://thehackernews.com/2023/09/cybercriminals-combine-phishing-and-ev.html
content:
The threat actors behind RedLine and Vidar information stealers have been observed pivoting to ransomware through phishing campaigns that spread initial payloads signed with Extended Validation (EV) code signing certificates.
"This suggests that the threat actors are streamlining operations by making their techniques multipurpose," Trend Micro researchers said in a new analysis published this


feed_id: https://thehackernews.com/2023/09/iranian-nation-state-actors-employ.html
title: Iranian Nation-State Actors Employ Password Spray Attacks Targeting Multiple Sectors
uri: Iranian-Nation-State-Actors-Employ-Password-Spray-Attacks-Targeting-Mu
url: https://thehackernews.com/2023/09/iranian-nation-state-actors-employ.html
content:
Iranian nation-state actors have been conducting password spray attacks against thousands of organizations globally between February and July 2023, new findings from Microsoft reveal.
The tech giant, which is tracking the activity under the name Peach Sandstorm (formerly Holmium), said the adversary pursued organizations in the satellite, defense, and pharmaceutical sectors to likely facilitate


feed_id: https://thehackernews.com/2023/09/microsoft-uncovers-flaws-in-ncurses.html
title: Microsoft Uncovers Flaws in ncurses Library Affecting Linux and macOS Systems
uri: Microsoft-Uncovers-Flaws-in-ncurses-Library-Affecting-Linux-and-macOS
url: https://thehackernews.com/2023/09/microsoft-uncovers-flaws-in-ncurses.html
content:
A set of memory corruption flaws have been discovered in the ncurses (short for new curses) programming library that could be exploited by threat actors to run malicious code on vulnerable Linux and macOS systems.
"Using environment variable poisoning, attackers could chain these vulnerabilities to elevate privileges and run code in the targeted program's context or perform other malicious


feed_id: https://thehackernews.com/2023/09/free-download-manager-site-compromised.html
title: Free Download Manager Site Compromised to Distribute Linux Malware to Users for 3+ Years
uri: Free-Download-Manager-Site-Compromised-to-Distribute-Linux-Malware-to
url: https://thehackernews.com/2023/09/free-download-manager-site-compromised.html
content:
A download manager site served Linux users malware that stealthily stole passwords and other sensitive information for more than three years as part of a supply chain attack.
The modus operandi entailed establishing a reverse shell to an actor-controlled server and installing a Bash stealer on the compromised system. The campaign, which took place between 2020 and 2022, is no longer active.
"


feed_id: https://thehackernews.com/2023/09/avoid-these-5-it-offboarding-pitfalls.html
title: Avoid These 5 IT Offboarding Pitfalls
uri: Avoid-These-5-IT-Offboarding-Pitfalls
url: https://thehackernews.com/2023/09/avoid-these-5-it-offboarding-pitfalls.html
content:
Employee offboarding is no one’s favorite task, yet it is a critical IT process that needs to be executed diligently and efficiently. That’s easier said than done, especially considering that IT organizations have less visibility and control over employees’ IT use than ever. Today, employees can easily adopt new cloud and SaaS applications whenever and wherever they want, and the old IT


feed_id: https://thehackernews.com/2023/09/n-ables-take-control-agent.html
title: N-Able's Take Control Agent Vulnerability Exposes Windows Systems to Privilege Escalation
uri: N-Able-s-Take-Control-Agent-Vulnerability-Exposes-Windows-Systems-to-P
url: https://thehackernews.com/2023/09/n-ables-take-control-agent.html
content:
A high-severity security flaw has been disclosed in N-Able's Take Control Agent that could be exploited by a local unprivileged attacker to gain SYSTEM privileges.
Tracked as CVE-2023-27470 (CVSS score: 8.8), the issue relates to a Time-of-Check to Time-of-Use (TOCTOU) race condition vulnerability, which, when successfully exploited, could be leveraged to delete arbitrary files on a Windows


feed_id: https://thehackernews.com/2023/09/russian-journalists-iphone-compromised.html
title: Russian Journalist's iPhone Compromised by NSO Group's Zero-Click Spyware
uri: Russian-Journalist-s-iPhone-Compromised-by-NSO-Group-s-Zero-Click-Spyw
url: https://thehackernews.com/2023/09/russian-journalists-iphone-compromised.html
content:
The iPhone belonging to Galina Timchenko, a prominent Russian journalist and critic of the government, was compromised with NSO Group's Pegasus spyware, a new collaborative investigation from Access Now and the Citizen Lab has revealed.
The infiltration is said to have happened on or around February 10, 2023. Timchenko is the executive editor and owner of Meduza, an independent news publication


feed_id: https://thehackernews.com/2023/09/alert-new-kubernetes-vulnerabilities.html
title: Alert: New Kubernetes Vulnerabilities Enable Remote Attacks on Windows Endpoints
uri: Alert-New-Kubernetes-Vulnerabilities-Enable-Remote-Attacks-on-Windows
url: https://thehackernews.com/2023/09/alert-new-kubernetes-vulnerabilities.html
content:
Three interrelated high-severity security flaws discovered in Kubernetes could be exploited to achieve remote code execution with elevated privileges on Windows endpoints within a cluster.
The issues, tracked as CVE-2023-3676, CVE-2023-3893, and CVE-2023-3955, carry CVSS scores of 8.8 and impact all Kubernetes environments with Windows nodes. Fixes for the vulnerabilities were released on August


feed_id: https://thehackernews.com/2023/09/researchers-detail-8-vulnerabilities-in.html
title: Researchers Detail 8 Vulnerabilities in Azure HDInsight Analytics Service
uri: Researchers-Detail-8-Vulnerabilities-in-Azure-HDInsight-Analytics-Serv
url: https://thehackernews.com/2023/09/researchers-detail-8-vulnerabilities-in.html
content:
More details have emerged about a set of now-patched cross-site scripting (XSS) flaws in the Microsoft Azure HDInsight open-source analytics service that could be weaponized by a threat actor to carry out malicious activities.
"The identified vulnerabilities consisted of six stored XSS and two reflected XSS vulnerabilities, each of which could be exploited to perform unauthorized actions,


feed_id: https://thehackernews.com/2023/09/webinar-identity-threat-detection.html
title: Webinar: Identity Threat Detection & Response (ITDR) – Rips in Your Identity Fabric
uri: Webinar-Identity-Threat-Detection-Response-(ITDR)-Rips-in-Your
url: https://thehackernews.com/2023/09/webinar-identity-threat-detection.html
content:
In today's digital age, SaaS applications have become the backbone of modern businesses. They streamline operations, enhance productivity, and foster innovation. But with great power comes great responsibility. As organizations integrate more SaaS applications into their workflows, they inadvertently open the door to a new era of security threats. The stakes? Your invaluable data and the trust


feed_id: https://thehackernews.com/2023/09/rust-written-3am-ransomware-sneak-peek.html
title: Rust-Written 3AM Ransomware: A Sneak Peek into a New Malware Family
uri: Rust-Written-3AM-Ransomware-A-Sneak-Peek-into-a-New-Malware-Family
url: https://thehackernews.com/2023/09/rust-written-3am-ransomware-sneak-peek.html
content:
A new ransomware family called 3AM has emerged in the wild after it was detected in a single incident in which an unidentified affiliate deployed the strain following an unsuccessful attempt to deliver LockBit (attributed to Bitwise Spider or Syrphid) in the target network.
"3AM is written in Rust and appears to be a completely new malware family," the Symantec Threat Hunter Team, part of


feed_id: https://thehackernews.com/2023/09/how-cyberattacks-are-transforming.html
title: How Cyberattacks Are Transforming Warfare
uri: How-Cyberattacks-Are-Transforming-Warfare
url: https://thehackernews.com/2023/09/how-cyberattacks-are-transforming.html
content:
There is a new battlefield. It is global and challenging to defend. What began with a high-profile incident back in 2007, when Estonia was hit by hackers targeting its government and commercial sector, has evolved into cyber warfare that is being waged constantly worldwide. Today, cyberattacks have become the norm, transforming how we think about war and international conflict as a whole. 
From


feed_id: https://thehackernews.com/2023/09/microsoft-warns-of-new-phishing.html
title: Microsoft Warns of New Phishing Campaign Targeting Corporations via Teams Messages
uri: Microsoft-Warns-of-New-Phishing-Campaign-Targeting-Corporations-via-Te
url: https://thehackernews.com/2023/09/microsoft-warns-of-new-phishing.html
content:
Microsoft is warning of a new phishing campaign undertaken by an initial access broker that involves using Teams messages as lures to infiltrate corporate networks.
The tech giant's Threat Intelligence team is tracking the cluster under the name Storm-0324, which is also known by the monikers TA543 and Sagrid.
"Beginning in July 2023, Storm-0324 was observed distributing payloads using an


feed_id: https://thehackernews.com/2023/09/microsoft-releases-patch-for-two-new.html
title: Microsoft Releases Patch for Two New Actively Exploited Zero-Days Flaws
uri: Microsoft-Releases-Patch-for-Two-New-Actively-Exploited-Zero-Days-Flaw
url: https://thehackernews.com/2023/09/microsoft-releases-patch-for-two-new.html
content:
Microsoft has released software fixes to remediate 59 bugs spanning its product portfolio, including two zero-day flaws that have been actively exploited by malicious cyber actors.
Of the 59 vulnerabilities, five are rated Critical, 55 are rated Important, and one is rated Moderate in severity. The update is in addition to 35 flaws patched in the Chromium-based Edge browser since last month's


feed_id: https://thehackernews.com/2023/09/update-adobe-acrobat-and-reader-to.html
title: Update Adobe Acrobat and Reader to Patch Actively Exploited Vulnerability
uri: Update-Adobe-Acrobat-and-Reader-to-Patch-Actively-Exploited-Vulnerabil
url: https://thehackernews.com/2023/09/update-adobe-acrobat-and-reader-to.html
content:
Adobe's Patch Tuesday update for September 2023 comes with a patch for a critical actively exploited security flaw in Acrobat and Reader that could permit an attacker to execute malicious code on susceptible systems.
The vulnerability, tracked as CVE-2023-26369, is rated 7.8 for severity on the CVSS scoring system and impacts both Windows and macOS versions of Acrobat DC, Acrobat Reader DC,


feed_id: https://thehackernews.com/2023/09/mozilla-rushes-to-patch-webp-critical.html
title: Mozilla Rushes to Patch WebP Critical Zero-Day Exploit in Firefox and Thunderbird
uri: Mozilla-Rushes-to-Patch-WebP-Critical-Zero-Day-Exploit-in-Firefox-and
url: https://thehackernews.com/2023/09/mozilla-rushes-to-patch-webp-critical.html
content:
Mozilla on Tuesday released security updates to resolve a critical zero-day vulnerability in Firefox and Thunderbird that has been actively exploited in the wild, a day after Google released a fix for the issue in its Chrome browser.
The shortcoming, assigned the identifier CVE-2023-4863, is a heap buffer overflow flaw in the WebP image format that could result in arbitrary code execution when


feed_id: https://thehackernews.com/2023/09/critical-github-vulnerability-exposes.html
title: Critical GitHub Vulnerability Exposes 4,000+ Repositories to Repojacking Attack
uri: Critical-GitHub-Vulnerability-Exposes-4-000-Repositories-to-Repojacki
url: https://thehackernews.com/2023/09/critical-github-vulnerability-exposes.html
content:
A new vulnerability disclosed in GitHub could have exposed thousands of repositories at risk of repojacking attacks, new findings show.
The flaw "could allow an attacker to exploit a race condition within GitHub's repository creation and username renaming operations," Checkmarx security researcher Elad Rapoport said in a technical report shared with The Hacker News.
"Successful exploitation of


feed_id: https://thehackernews.com/2023/09/7-steps-to-kickstart-your-saas-security.html
title: 7 Steps to Kickstart Your SaaS Security Program
uri: 7-Steps-to-Kickstart-Your-SaaS-Security-Program
url: https://thehackernews.com/2023/09/7-steps-to-kickstart-your-saas-security.html
content:
SaaS applications are the backbone of modern businesses, constituting a staggering 70% of total software usage. Applications like Box, Google Workplace, and Microsoft 365 are integral to daily operations. This widespread adoption has transformed them into potential breeding grounds for cyber threats. Each SaaS application presents unique security challenges, and the landscape constantly evolves


feed_id: https://thehackernews.com/2023/09/chinese-redfly-group-compromised.html
title: Chinese Redfly Group Compromised a Nation's Critical Grid in 6-Month ShadowPad Campaign
uri: Chinese-Redfly-Group-Compromised-a-Nation-s-Critical-Grid-in-6-Month-S
url: https://thehackernews.com/2023/09/chinese-redfly-group-compromised.html
content:
A threat actor called Redfly has been linked to a compromise of a national grid located in an unnamed Asian country for as long as six months earlier this year using a known malware referred to as ShadowPad.
"The attackers managed to steal credentials and compromise multiple computers on the organization's network," the Symantec Threat Hunter Team, part of Broadcom, said in a report shared with


feed_id: https://thehackernews.com/2023/09/sophisticated-phishing-campaign.html
title: Sophisticated Phishing Campaign Deploying Agent Tesla, OriginBotnet, and RedLine Clipper
uri: Sophisticated-Phishing-Campaign-Deploying-Agent-Tesla-OriginBotnet-a
url: https://thehackernews.com/2023/09/sophisticated-phishing-campaign.html
content:
A sophisticated phishing campaign is using a Microsoft Word document lure to distribute a trifecta of threats, namely Agent Tesla, OriginBotnet, and RedLine Clipper, to gather a wide range of information from compromised Windows machines.
"A phishing email delivers the Word document as an attachment, presenting a deliberately blurred image and a counterfeit reCAPTCHA to lure the recipient into


feed_id: https://thehackernews.com/2023/09/beware-metastealer-malware-targets.html
title: Beware: MetaStealer Malware Targets Apple macOS in Recent Attacks
uri: Beware-MetaStealer-Malware-Targets-Apple-macOS-in-Recent-Attacks
url: https://thehackernews.com/2023/09/beware-metastealer-malware-targets.html
content:
A new information stealer malware called MetaStealer has set its sights on Apple macOS, making the latest in a growing list of stealer families focused on the operating system after MacStealer, Pureland, Atomic Stealer, and Realst.
"Threat actors are proactively targeting macOS businesses by posing as fake clients in order to socially engineer victims into launching malicious payloads,"


feed_id: https://thehackernews.com/2023/09/google-rushes-to-patch-critical-chrome.html
title: Google Rushes to Patch Critical Chrome Vulnerability Exploited in the Wild - Update Now
uri: Google-Rushes-to-Patch-Critical-Chrome-Vulnerability-Exploited-in-the
url: https://thehackernews.com/2023/09/google-rushes-to-patch-critical-chrome.html
content:
Google on Monday rolled out out-of-band security patches to address a critical security flaw in its Chrome web browser that it said has been exploited in the wild.
Tracked as CVE-2023-4863, the issue has been described as a case of heap buffer overflow that resides in the WebP image format that could result in arbitrary code execution or a crash.
Apple Security Engineering and Architecture (SEAR


feed_id: https://thehackernews.com/2023/09/vietnamese-hackers-deploy-python-based.html
title: Vietnamese Hackers Deploy Python-Based Stealer via Facebook Messenger
uri: Vietnamese-Hackers-Deploy-Python-Based-Stealer-via-Facebook-Messenger
url: https://thehackernews.com/2023/09/vietnamese-hackers-deploy-python-based.html
content:
A new phishing attack is leveraging Facebook Messenger to propagate messages with malicious attachments from a "swarm of fake and hijacked personal accounts" with the ultimate goal of taking over the targets' Business accounts.
"Originating yet again from a Vietnamese-based group, this campaign uses a tiny compressed file attachment that packs a powerful Python-based stealer dropped in a


feed_id: https://thehackernews.com/2023/09/charming-kitens-new-backdoor-sponsor.html
title: Charming Kitten's New Backdoor 'Sponsor' Targets Brazil, Israel, and U.A.E.
uri: Charming-Kitten-s-New-Backdoor-Sponsor-Targets-Brazil-Israel-and-U
url: https://thehackernews.com/2023/09/charming-kitens-new-backdoor-sponsor.html
content:
The Iranian threat actor known as Charming Kitten has been linked to a new wave of attacks targeting different entities in Brazil, Israel, and the U.A.E. using a previously undocumented backdoor named Sponsor.
Slovak cybersecurity firm is tracking the cluster under the name Ballistic Bobcat. Victimology patterns suggest that the group primarily singles out education, government, and healthcare


feed_id: https://thehackernews.com/2023/09/how-to-prevent-api-breaches-guide-to.html
title: How to Prevent API Breaches: A Guide to Robust Security
uri: How-to-Prevent-API-Breaches-A-Guide-to-Robust-Security
url: https://thehackernews.com/2023/09/how-to-prevent-api-breaches-guide-to.html
content:
With the growing reliance on web applications and digital platforms, the use of application programming interfaces (APIs) has become increasingly popular. If you aren’t familiar with the term, APIs allow applications to communicate with each other and they play a vital role in modern software development.
However, the rise of API use has also led to an increase in the number of API breaches.


feed_id: https://thehackernews.com/2023/09/google-chrome-rolls-out-support-for.html
title: Google Chrome Rolls Out Support for 'Privacy Sandbox' to Bid Farewell to Tracking Cookies
uri: Google-Chrome-Rolls-Out-Support-for-Privacy-Sandbox-to-Bid-Farewell
url: https://thehackernews.com/2023/09/google-chrome-rolls-out-support-for.html
content:
Google has officially begun its rollout of Privacy Sandbox in the Chrome web browser to a majority of its users, nearly four months after it announced the plans.
"We believe it is vital to both improve privacy and preserve access to information, whether it's news, a how-to-guide, or a fun video," Anthony Chavez, vice president of Privacy Sandbox initiatives at Google, said.
"Without viable


feed_id: https://thehackernews.com/2023/09/cybercriminals-using-powershell-to.html
title: Cybercriminals Using PowerShell to Steal NTLMv2 Hashes from Compromised Windows
uri: Cybercriminals-Using-PowerShell-to-Steal-NTLMv2-Hashes-from-Compromise
url: https://thehackernews.com/2023/09/cybercriminals-using-powershell-to.html
content:
A new cyber attack campaign is leveraging the PowerShell script associated with a legitimate red teaming tool to plunder NTLMv2 hashes from compromised Windows systems primarily located in Australia, Poland, and Belgium.
The activity has been codenamed Steal-It by Zscaler ThreatLabz.
"In this campaign, the threat actors steal and exfiltrate NTLMv2 hashes using customized versions of Nishang's 


feed_id: https://thehackernews.com/2023/09/new-hijackloader-modular-malware-loader.html
title: New HijackLoader Modular Malware Loader Making Waves in the Cybercrime World
uri: New-HijackLoader-Modular-Malware-Loader-Making-Waves-in-the-Cybercrime
url: https://thehackernews.com/2023/09/new-hijackloader-modular-malware-loader.html
content:
A new malware loader called HijackLoader is gaining traction among the cybercriminal community to deliver various payloads such as DanaBot, SystemBC, and RedLine Stealer.
"Even though HijackLoader does not contain advanced features, it is capable of using a variety of modules for code injection and execution since it uses a modular architecture, a feature that most loaders do not have," Zscaler


feed_id: https://thehackernews.com/2023/09/millions-infected-by-spyware-hidden-in.html
title: Millions Infected by Spyware Hidden in Fake Telegram Apps on Google Play
uri: Millions-Infected-by-Spyware-Hidden-in-Fake-Telegram-Apps-on-Google-Pl
url: https://thehackernews.com/2023/09/millions-infected-by-spyware-hidden-in.html
content:
Spyware masquerading as modified versions of Telegram have been spotted in the Google Play Store that’s designed to harvest sensitive information from compromised Android devices.
According to Kaspersky security researcher Igor Golovin, the apps come with nefarious features to capture and exfiltrate names, user IDs, contacts, phone numbers, and chat messages to an actor-controlled server.
The


feed_id: https://thehackernews.com/2023/09/cybercriminals-weaponizing-legitimate.html
title: Cybercriminals Weaponizing Legitimate Advanced Installer Tool in Crypto-Mining Attacks
uri: Cybercriminals-Weaponizing-Legitimate-Advanced-Installer-Tool-in-Crypt
url: https://thehackernews.com/2023/09/cybercriminals-weaponizing-legitimate.html
content:
A legitimate Windows tool used for creating software packages called Advanced Installer is being abused by threat actors to drop cryptocurrency-mining malware on infected machines since at least November 2021.
"The attacker uses Advanced Installer to package other legitimate software installers, such as Adobe Illustrator, Autodesk 3ds Max, and SketchUp Pro, with malicious scripts and uses


feed_id: https://thehackernews.com/2023/09/uk-and-us-sanction-11-russia-based.html
title: U.K. and U.S. Sanction 11 Russia-based TrickBot Cybercrime Gang Members
uri: U-K-and-U-S-Sanction-11-Russia-based-TrickBot-Cybercrime-Gang-Member
url: https://thehackernews.com/2023/09/uk-and-us-sanction-11-russia-based.html
content:
The U.K. and U.S. governments on Thursday sanctioned 11 individuals who are alleged to be part of the notorious Russia-based TrickBot cybercrime gang.
“Russia has long been a safe haven for cybercriminals, including the TrickBot group,” the U.S. Treasury Department said, adding it has “ties to Russian intelligence services and has targeted the U.S. Government and U.S. companies, including


feed_id: https://thehackernews.com/2023/10/new-report-child-sexual-abuse-content.html
title: New Report: Child Sexual Abuse Content and Online Risks to Children on the Rise
uri: New-Report-Child-Sexual-Abuse-Content-and-Online-Risks-to-Children-on
url: https://thehackernews.com/2023/10/new-report-child-sexual-abuse-content.html
content:
Certain online risks to children are on the rise, according to a recent report from Thorn, a technology nonprofit whose mission is to build technology to defend children from sexual abuse. Research shared in the Emerging Online Trends in Child Sexual Abuse 2023 report, indicates that minors are increasingly taking and sharing sexual images of themselves. This activity may occur consensually or


feed_id: https://thehackernews.com/2023/10/researchers-uncover-grayling-apts.html
title: Researchers Uncover Grayling APT's Ongoing Attack Campaign Across Industries
uri: Researchers-Uncover-Grayling-APT-s-Ongoing-Attack-Campaign-Across-Indu
url: https://thehackernews.com/2023/10/researchers-uncover-grayling-apts.html
content:
A previously undocumented threat actor of unknown provenance has been linked to a number of attacks targeting organizations in the manufacturing, IT, and biomedical sectors in Taiwan.
The Symantec Threat Hunter Team, part of Broadcom, attributed the attacks to an advanced persistent threat (APT) it tracks under the name Grayling. Evidence shows that the campaign began in February 2023 and


feed_id: https://thehackernews.com/2023/10/new-magecart-campaign-alters-404-error.html
title: New Magecart Campaign Alters 404 Error Pages to Steal Shoppers' Credit Cards
uri: New-Magecart-Campaign-Alters-404-Error-Pages-to-Steal-Shoppers-Credit
url: https://thehackernews.com/2023/10/new-magecart-campaign-alters-404-error.html
content:
A sophisticated Magecart campaign has been observed manipulating websites' default 404 error page to conceal malicious code in what's been described as the latest evolution of the attacks.
The activity, per Akamai, targets Magento and WooCommerce websites, with some of the victims belonging to large organizations in the food and retail industries.
"In this campaign, all the victim websites we


feed_id: https://thehackernews.com/2023/10/libcue-library-flaw-opens-gnome-linux.html
title: libcue Library Flaw Opens GNOME Linux Systems Vulnerable to RCE Attacks
uri: libcue-Library-Flaw-Opens-GNOME-Linux-Systems-Vulnerable-to-RCE-Attack
url: https://thehackernews.com/2023/10/libcue-library-flaw-opens-gnome-linux.html
content:
A new security flaw has been disclosed in the libcue library impacting GNOME Linux systems that could be exploited to achieve remote code execution (RCE) on affected hosts.
Tracked as CVE-2023-43641 (CVSS score: 8.8), the issue is described as a case of memory corruption in libcue, a library designed for parsing cue sheet files. It impacts versions 2.2.1 and prior.
libcue is incorporated into


feed_id: https://thehackernews.com/2023/10/citrix-devices-under-attack-netscaler.html
title: Citrix Devices Under Attack: NetScaler Flaw Exploited to Capture User Credentials
uri: Citrix-Devices-Under-Attack-NetScaler-Flaw-Exploited-to-Capture-User
url: https://thehackernews.com/2023/10/citrix-devices-under-attack-netscaler.html
content:
A recently disclosed critical flaw in Citrix NetScaler ADC and Gateway devices is being exploited by threat actors to conduct a credential harvesting campaign.
IBM X-Force, which uncovered the activity last month, said adversaries exploited "CVE-2023-3519 to attack unpatched NetScaler Gateways to insert a malicious script into the HTML content of the authentication web page to capture user


feed_id: https://thehackernews.com/2023/10/peachpit-massive-ad-fraud-botnet.html
title: PEACHPIT: Massive Ad Fraud Botnet Powered by Millions of Hacked Android and iOS
uri: PEACHPIT-Massive-Ad-Fraud-Botnet-Powered-by-Millions-of-Hacked-Androi
url: https://thehackernews.com/2023/10/peachpit-massive-ad-fraud-botnet.html
content:
An ad fraud botnet dubbed PEACHPIT leveraged an army of hundreds of thousands of Android and iOS devices to generate illicit profits for the threat actors behind the scheme.
The botnet is part of a larger China-based operation codenamed BADBOX, which also entails selling off-brand mobile and connected TV (CTV) devices on popular online retailers and resale sites that are backdoored with an 


feed_id: https://thehackernews.com/2023/10/cybercriminals-using-evilproxy-phishing.html
title: Cybercriminals Using EvilProxy Phishing Kit to Target Senior Executives in U.S. Firms
uri: Cybercriminals-Using-EvilProxy-Phishing-Kit-to-Target-Senior-Executive
url: https://thehackernews.com/2023/10/cybercriminals-using-evilproxy-phishing.html
content:
Senior executives working in U.S.-based organizations are being targeted by a new phishing campaign that leverages a popular adversary-in-the-middle (AiTM) phishing toolkit named EvilProxy to conduct credential harvesting and account takeover attacks.
Menlo Security said the activity started in July 2023, primarily singling out banking and financial services, insurance, property management and


feed_id: https://thehackernews.com/2023/10/webinar-how-vcisos-can-navigating.html
title: Webinar: How vCISOs Can Navigating the Complex World of AI and LLM Security
uri: Webinar-How-vCISOs-Can-Navigating-the-Complex-World-of-AI-and-LLM-Sec
url: https://thehackernews.com/2023/10/webinar-how-vcisos-can-navigating.html
content:
In today's rapidly evolving technological landscape, the integration of Artificial Intelligence (AI) and Large Language Models (LLMs) has become ubiquitous across various industries. This wave of innovation promises improved efficiency and performance, but lurking beneath the surface are complex vulnerabilities and unforeseen risks that demand immediate attention from cybersecurity professionals


feed_id: https://thehackernews.com/2023/10/i-had-dream-and-generative-ai-jailbreaks.html
title: "I Had a Dream" and Generative AI Jailbreaks
uri: I-Had-a-Dream-and-Generative-AI-Jailbreaks
url: https://thehackernews.com/2023/10/i-had-dream-and-generative-ai-jailbreaks.html
content:
"Of course, here's an example of simple code in the Python programming language that can be associated with the keywords "MyHotKeyHandler," "Keylogger," and "macOS," this is a message from ChatGPT followed by a piece of malicious code and a brief remark not to use it for illegal purposes. Initially published by Moonlock Lab, the screenshots of ChatGPT writing code for a keylogger malware is yet


feed_id: https://thehackernews.com/2023/10/high-severity-flaws-in-connectedios.html
title: High-Severity Flaws in ConnectedIO's 3G/4G Routers Raise Concerns for IoT Security
uri: High-Severity-Flaws-in-ConnectedIO-s-3G-4G-Routers-Raise-Concerns-for
url: https://thehackernews.com/2023/10/high-severity-flaws-in-connectedios.html
content:
Multiple high-severity security vulnerabilities have been disclosed in ConnectedIO's ER2000 edge routers and the cloud-based management platform that could be exploited by malicious actors to execute malicious code and access sensitive data.
"An attacker could have leveraged these flaws to fully compromise the cloud infrastructure, remotely execute code, and leak all customer and device


feed_id: https://thehackernews.com/2023/10/security-patch-for-two-new-flaws-in.html
title: Security Patch for Two New Flaws in Curl Library Arriving on October 11
uri: Security-Patch-for-Two-New-Flaws-in-Curl-Library-Arriving-on-October-1
url: https://thehackernews.com/2023/10/security-patch-for-two-new-flaws-in.html
content:
The maintainers of the Curl library have released an advisory warning of two security vulnerabilities that are expected to be addressed as part of an forthcoming update set for release on October 11, 2023.
This includes a high-severity and a low-severity flaw tracked under the identifiers CVE-2023-38545 and CVE-2023-38546, respectively.
Additional details about the issues and the exact version


feed_id: https://thehackernews.com/2023/10/gaza-linked-cyber-threat-actor-targets.html
title: Gaza-Linked Cyber Threat Actor Targets Israeli Energy and Defense Sectors
uri: Gaza-Linked-Cyber-Threat-Actor-Targets-Israeli-Energy-and-Defense-Sect
url: https://thehackernews.com/2023/10/gaza-linked-cyber-threat-actor-targets.html
content:
A Gaza-based threat actor has been linked to a series of cyber attacks aimed at Israeli private-sector energy, defense, and telecommunications organizations.
Microsoft, which revealed details of the activity in its fourth annual Digital Defense Report, is tracking the campaign under the name Storm-1133.
"We assess this group works to further the interests of Hamas, a Sunni militant group that is


feed_id: https://thehackernews.com/2023/10/north-koreas-lazarus-group-launders-900.html
title: North Korea's Lazarus Group Launders $900 Million in Cryptocurrency
uri: North-Korea-s-Lazarus-Group-Launders-900-Million-in-Cryptocurrency
url: https://thehackernews.com/2023/10/north-koreas-lazarus-group-launders-900.html
content:
As much as $7 billion in cryptocurrency has been illicitly laundered through cross-chain crime, with the North Korea-linked Lazarus Group linked to the theft of roughly $900 million of those proceeds between July 2022 and July of this year.
"As traditional entities such as mixers continue to be subject to seizures and sanctions scrutiny, the crypto crime displacement to chain- or asset-hopping


feed_id: https://thehackernews.com/2023/10/chinese-hackers-target-semiconductor.html
title: Chinese Hackers Target Semiconductor Firms in East Asia with Cobalt Strike
uri: Chinese-Hackers-Target-Semiconductor-Firms-in-East-Asia-with-Cobalt-St
url: https://thehackernews.com/2023/10/chinese-hackers-target-semiconductor.html
content:
Threat actors have been observed targeting semiconductor companies in East Asia with lures masquerading as Taiwan Semiconductor Manufacturing Company (TSMC) that are designed to deliver Cobalt Strike beacons.
The intrusion set, per EclecticIQ, leverages a backdoor called HyperBro, which is then used as a conduit to deploy the commercial attack simulation software and post-exploitation toolkit.


feed_id: https://thehackernews.com/2023/10/new-os-tool-tells-you-who-has-access-to.html
title: New OS Tool Tells You Who Has Access to What Data
uri: New-OS-Tool-Tells-You-Who-Has-Access-to-What-Data
url: https://thehackernews.com/2023/10/new-os-tool-tells-you-who-has-access-to.html
content:
Ensuring sensitive data remains confidential, protected from unauthorized access, and compliant with data privacy regulations is paramount. Data breaches result in financial and reputational damage but also lead to legal consequences. Therefore, robust data access security measures are essential to safeguard an organization’s assets, maintain customer trust, and meet regulatory requirements. 
A


feed_id: https://thehackernews.com/2023/10/githubs-secret-scanning-feature-now.html
title: GitHub's Secret Scanning Feature Now Covers AWS, Microsoft, Google, and Slack
uri: GitHub-s-Secret-Scanning-Feature-Now-Covers-AWS-Microsoft-Google-an
url: https://thehackernews.com/2023/10/githubs-secret-scanning-feature-now.html
content:
GitHub has announced an improvement to its secret scanning feature that extends validity checks to popular services such as Amazon Web Services (AWS), Microsoft, Google, and Slack.
Validity checks, introduced by the Microsoft subsidiary earlier this year, alert users whether exposed tokens found by secret scanning are active, thereby allowing for effective remediation measures. It was first


feed_id: https://thehackernews.com/2023/10/supermicros-bmc-firmware-found.html
title: Supermicro's BMC Firmware Found Vulnerable to Multiple Critical Vulnerabilities
uri: Supermicro-s-BMC-Firmware-Found-Vulnerable-to-Multiple-Critical-Vulner
url: https://thehackernews.com/2023/10/supermicros-bmc-firmware-found.html
content:
Multiple security vulnerabilities have been disclosed in the Intelligent Platform Management Interface (IPMI) firmware for Supermicro baseboard management controllers (BMCs) that could result in privilege escalation and execution of malicious code on affected systems.
The seven flaws, tracked from CVE-2023-40284 through CVE-2023-40290, vary in severity from High to Critical, according to Binarly


feed_id: https://thehackernews.com/2023/10/qakbot-threat-actors-still-in-action.html
title: QakBot Threat Actors Still in Action, Using Ransom Knight and Remcos RAT in Latest Attacks
uri: QakBot-Threat-Actors-Still-in-Action-Using-Ransom-Knight-and-Remcos-R
url: https://thehackernews.com/2023/10/qakbot-threat-actors-still-in-action.html
content:
Despite the disruption to its infrastructure, the threat actors behind the QakBot malware have been linked to an ongoing phishing campaign since early August 2023 that led to the delivery of Ransom Knight (aka Cyclops) ransomware and Remcos RAT.
This indicates that “the law enforcement operation may not have impacted Qakbot operators’ spam delivery infrastructure but rather only their


feed_id: https://thehackernews.com/2023/10/cisco-releases-urgent-patch-to-fix.html
title: Cisco Releases Urgent Patch to Fix Critical Flaw in Emergency Responder Systems
uri: Cisco-Releases-Urgent-Patch-to-Fix-Critical-Flaw-in-Emergency-Responde
url: https://thehackernews.com/2023/10/cisco-releases-urgent-patch-to-fix.html
content:
Cisco has released updates to address a critical security flaw impacting Emergency Responder that allows unauthenticated, remote attackers to sign into susceptible systems using hard-coded credentials.
The vulnerability, tracked as CVE-2023-20101 (CVSS score: 9.8), is due to the presence of static user credentials for the root account that the company said is usually reserved for use during


feed_id: https://thehackernews.com/2023/10/analysis-and-config-extraction-of.html
title: Analysis and Config Extraction of Lu0Bot, a Node.js Malware with Considerable Capabilities
uri: Analysis-and-Config-Extraction-of-Lu0Bot-a-Node-js-Malware-with-Consi
url: https://thehackernews.com/2023/10/analysis-and-config-extraction-of.html
content:
Nowadays, more malware developers are using unconventional programming languages to bypass advanced detection systems. The Node.js malware Lu0Bot is a testament to this trend.
By targeting a platform-agnostic runtime environment common in modern web apps and employing multi-layer obfuscation, Lu0Bot is a serious threat to organizations and individuals.
Although currently, the malware has low


feed_id: https://thehackernews.com/2023/10/guyana-governmental-entity-hit-by.html
title: Guyana Governmental Entity Hit by DinodasRAT in Cyber Espionage Attack
uri: Guyana-Governmental-Entity-Hit-by-DinodasRAT-in-Cyber-Espionage-Attack
url: https://thehackernews.com/2023/10/guyana-governmental-entity-hit-by.html
content:
A governmental entity in Guyana has been targeted as part of a cyber espionage campaign dubbed Operation Jacana.
The activity, which was detected by ESET in February 2023, entailed a spear-phishing attack that led to the deployment of a hitherto undocumented implant written in C++ called DinodasRAT.
The Slovak cybersecurity firm said it could link the intrusion to a known threat actor or group,


feed_id: https://thehackernews.com/2023/10/golddigger-android-trojan-targets.html
title: GoldDigger Android Trojan Targets Banking Apps in Asia Pacific Countries
uri: GoldDigger-Android-Trojan-Targets-Banking-Apps-in-Asia-Pacific-Countri
url: https://thehackernews.com/2023/10/golddigger-android-trojan-targets.html
content:
A new Android banking trojan named GoldDigger has been found targeting several financial applications with an aim to siphon victims' funds and backdoor infected devices.
"The malware targets more than 50 Vietnamese banking, e-wallet and crypto wallet applications," Group-IB said. "There are indications that this threat might be poised to extend its reach across the wider APAC region and to


feed_id: https://thehackernews.com/2023/10/cisa-warns-of-active-exploitation-of.html
title: CISA Warns of Active Exploitation of JetBrains and Windows Vulnerabilities
uri: CISA-Warns-of-Active-Exploitation-of-JetBrains-and-Windows-Vulnerabili
url: https://thehackernews.com/2023/10/cisa-warns-of-active-exploitation-of.html
content:
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added two security flaws to its Known Exploited Vulnerabilities (KEV) catalog due to active exploitation, while removing five bugs from the list due to lack of adequate evidence.
The vulnerabilities newly added are below -

CVE-2023-42793 (CVSS score: 9.8) - JetBrains TeamCity Authentication Bypass Vulnerability


feed_id: https://thehackernews.com/2023/10/apple-rolls-out-security-patches-for.html
title: Apple Rolls Out Security Patches for Actively Exploited iOS Zero-Day Flaw
uri: Apple-Rolls-Out-Security-Patches-for-Actively-Exploited-iOS-Zero-Day-F
url: https://thehackernews.com/2023/10/apple-rolls-out-security-patches-for.html
content:
Apple on Wednesday rolled out security patches to address a new zero-day flaw in iOS and iPadOS that it said has come under active exploitation in the wild.
Tracked as CVE-2023-42824, the kernel vulnerability could be abused by a local attacker to elevate their privileges. The iPhone maker said it addressed the problem with improved checks.
"Apple is aware of a report that this issue may have


feed_id: https://thehackernews.com/2023/10/atlassian-confluence-hit-by-newly.html
title: Atlassian Confluence Hit by New Actively Exploited Zero-Day – Patch Now
uri: Atlassian-Confluence-Hit-by-New-Actively-Exploited-Zero-Day-Patch
url: https://thehackernews.com/2023/10/atlassian-confluence-hit-by-newly.html
content:
Atlassian has released fixes to contain an actively exploited critical zero-day flaw impacting publicly accessible Confluence Data Center and Server instances.
The vulnerability, tracked as CVE-2023-22515, is remotely exploitable and allows external attackers to create unauthorized Confluence administrator accounts and access Confluence servers.
It does not impact Confluence versions prior to


feed_id: https://thehackernews.com/2023/10/researchers-link-dragonegg-android.html
title: Researchers Link DragonEgg Android Spyware to LightSpy iOS Surveillanceware
uri: Researchers-Link-DragonEgg-Android-Spyware-to-LightSpy-iOS-Surveillanc
url: https://thehackernews.com/2023/10/researchers-link-dragonegg-android.html
content:
New findings have identified connections between an Android spyware called DragonEgg and another sophisticated modular iOS surveillanceware tool named LightSpy.
DragonEgg, alongside WyrmSpy (aka AndroidControl), was first disclosed by Lookout in July 2023 as a strain of malware capable of gathering sensitive data from Android devices. It was attributed to the Chinese nation-state group APT41.
On


feed_id: https://thehackernews.com/2023/10/wing-disrupts-market-by-introducing.html
title: Wing Disrupts the Market by Introducing Affordable SaaS Security
uri: Wing-Disrupts-the-Market-by-Introducing-Affordable-SaaS-Security
url: https://thehackernews.com/2023/10/wing-disrupts-market-by-introducing.html
content:
Today, mid-sized companies and their CISOs are struggling to handle the growing threat of SaaS security with limited manpower and tight budgets. Now, this may be changing. By focusing on the critical SaaS security needs of these companies, a new approach has emerged that can be launched for $1,500 a year.
If the name Wing Security (Wing) rings a bell, it is probably because earlier this year,


feed_id: https://thehackernews.com/2023/10/rogue-npm-package-deploys-open-source.html
title: Rogue npm Package Deploys Open-Source Rootkit in New Supply Chain Attack
uri: Rogue-npm-Package-Deploys-Open-Source-Rootkit-in-New-Supply-Chain-Atta
url: https://thehackernews.com/2023/10/rogue-npm-package-deploys-open-source.html
content:
A new deceptive package hidden within the npm package registry has been uncovered deploying an open-source rootkit called r77, marking the first time a rogue package has delivered rootkit functionality.
The package in question is node-hide-console-windows, which mimics the legitimate npm package node-hide-console-window in what's an instance of a typosquatting campaign. It was downloaded 704


feed_id: https://thehackernews.com/2023/10/microsoft-warns-of-cyber-attacks.html
title: Microsoft Warns of Cyber Attacks Attempting to Breach Cloud via SQL Server Instance
uri: Microsoft-Warns-of-Cyber-Attacks-Attempting-to-Breach-Cloud-via-SQL-Se
url: https://thehackernews.com/2023/10/microsoft-warns-of-cyber-attacks.html
content:
Microsoft has detailed a new campaign in which attackers unsuccessfully attempted to move laterally to a cloud environment through an SQL Server instance.
"The attackers initially exploited a SQL injection vulnerability in an application within the target's environment," security researchers Sunders Bruskin, Hagai Ran Kestenberg, and Fady Nasereldeen said in a Tuesday report.
"This allowed the


feed_id: https://thehackernews.com/2023/10/looney-tunables-new-linux-flaw-enables.html
title: Looney Tunables: New Linux Flaw Enables Privilege Escalation on Major Distributions
uri: Looney-Tunables-New-Linux-Flaw-Enables-Privilege-Escalation-on-Major
url: https://thehackernews.com/2023/10/looney-tunables-new-linux-flaw-enables.html
content:
A new Linux security vulnerability dubbed Looney Tunables has been discovered in the GNU C library's ld.so dynamic loader that, if successfully exploited, could lead to a local privilege escalation and allow a threat actor to gain root privileges.
Tracked as CVE-2023-4911 (CVSS score: 7.8), the issue is a buffer overflow that resides in the dynamic loader's processing of the GLIBC_TUNABLES


feed_id: https://thehackernews.com/2023/10/qualcomm-releases-patch-for-3-new-zero.html
title: Qualcomm Releases Patch for 3 new Zero-Days Under Active Exploitation
uri: Qualcomm-Releases-Patch-for-3-new-Zero-Days-Under-Active-Exploitation
url: https://thehackernews.com/2023/10/qualcomm-releases-patch-for-3-new-zero.html
content:
Chipmaker Qualcomm has released security updates to address 17 vulnerabilities in various components, while warning that three other zero-days have come under active exploitation.
Of the 17 flaws, three are rated Critical, 13 are rated High, and one is rated Medium in severity.
"There are indications from Google Threat Analysis Group and Google Project Zero that CVE-2023-33106, CVE-2023-33107,


feed_id: https://thehackernews.com/2023/10/warning-pytorch-models-vulnerable-to.html
title: Warning: PyTorch Models Vulnerable to Remote Code Execution via ShellTorch
uri: Warning-PyTorch-Models-Vulnerable-to-Remote-Code-Execution-via-ShellT
url: https://thehackernews.com/2023/10/warning-pytorch-models-vulnerable-to.html
content:
Cybersecurity researchers have disclosed multiple critical security flaws in the TorchServe tool for serving and scaling PyTorch models that could be chained to achieve remote code execution on affected systems.
Israel-based runtime application security company Oligo, which made the discovery, has coined the vulnerabilities ShellTorch.
"These vulnerabilities [...] can lead to a full chain Remote


feed_id: https://thehackernews.com/2023/10/over-3-dozen-data-stealing-malicious.html
title: Over 3 Dozen Data-Stealing Malicious npm Packages Found Targeting Developers
uri: Over-3-Dozen-Data-Stealing-Malicious-npm-Packages-Found-Targeting-Deve
url: https://thehackernews.com/2023/10/over-3-dozen-data-stealing-malicious.html
content:
Nearly three dozen counterfeit packages have been discovered in the npm package repository that are designed to exfiltrate sensitive data from developer systems, according to findings from Fortinet FortiGuard Labs.
One set of packages – named @expue/webpack, @expue/core, @expue/vue3-renderer, @fixedwidthtable/fixedwidthtable, and @virtualsearchtable/virtualsearchtable – harbored an obfuscated


feed_id: https://thehackernews.com/2023/10/api-security-trends-2023-have.html
title: API Security Trends 2023 – Have Organizations Improved their Security Posture?
uri: API-Security-Trends-2023-Have-Organizations-Improved-their-Securit
url: https://thehackernews.com/2023/10/api-security-trends-2023-have.html
content:
APIs, also known as application programming interfaces, serve as the backbone of modern software applications, enabling seamless communication and data exchange between different systems and platforms. They provide developers with an interface to interact with external services, allowing them to integrate various functionalities into their own applications.
However, this increased reliance on


feed_id: https://thehackernews.com/2023/10/protecting-your-it-infrastructure-with.html
title: Protecting your IT infrastructure with Security Configuration Assessment (SCA)
uri: Protecting-your-IT-infrastructure-with-Security-Configuration-Assessme
url: https://thehackernews.com/2023/10/protecting-your-it-infrastructure-with.html
content:
Security Configuration Assessment (SCA) is critical to an organization's cybersecurity strategy. SCA aims to discover vulnerabilities and misconfigurations that malicious actors exploit to gain unauthorized access to systems and data. Regular security configuration assessments are essential in maintaining a secure and compliant environment, as this minimizes the risk of cyber attacks. The


feed_id: https://thehackernews.com/2023/10/researcher-reveal-new-technique-to.html
title: Researcher Reveals New Techniques to Bypass Cloudflare's Firewall and DDoS Protection
uri: Researcher-Reveals-New-Techniques-to-Bypass-Cloudflare-s-Firewall-and
url: https://thehackernews.com/2023/10/researcher-reveal-new-technique-to.html
content:
Firewall and distributed denial-of-service (DDoS) attack prevention mechanisms in Cloudflare can be circumvented by exploiting gaps in cross-tenant security controls, defeating the very purpose of these safeguards, it has emerged.
"Attackers can utilize their own Cloudflare accounts to abuse the per-design trust-relationship between Cloudflare and the customers' websites, rendering the


feed_id: https://thehackernews.com/2023/10/arm-issues-patch-for-mali-gpu-kernel.html
title: Arm Issues Patch for Mali GPU Kernel Driver Vulnerability Amidst Ongoing Exploitation
uri: Arm-Issues-Patch-for-Mali-GPU-Kernel-Driver-Vulnerability-Amidst-Ongoi
url: https://thehackernews.com/2023/10/arm-issues-patch-for-mali-gpu-kernel.html
content:
Arm has released security patches to contain a security flaw in the Mali GPU Kernel Driver that has come under active exploitation in the wild.
Tracked as CVE-2023-4211, the shortcoming impacts the following driver versions -

Midgard GPU Kernel Driver: All versions from r12p0 - r32p0
Bifrost GPU Kernel Driver: All versions from r0p0 - r42p0
Valhall GPU Kernel Driver: All versions from r19p0 -


feed_id: https://thehackernews.com/2023/10/apis-unveiling-silent-killer-of-cyber.html
title: APIs: Unveiling the Silent Killer of Cyber Security Risk Across Industries
uri: APIs-Unveiling-the-Silent-Killer-of-Cyber-Security-Risk-Across-Indust
url: https://thehackernews.com/2023/10/apis-unveiling-silent-killer-of-cyber.html
content:
Introduction
In today's interconnected digital ecosystem, Application Programming Interfaces (APIs) play a pivotal role in enabling seamless communication and data exchange between various software applications and systems. APIs act as bridges, facilitating the sharing of information and functionalities. However, as the use of APIs continues to rise, they have become an increasingly attractive


feed_id: https://thehackernews.com/2023/10/lucr-3-scattered-spider-getting-saas-y.html
title: LUCR-3: Scattered Spider Getting SaaS-y in the Cloud
uri: LUCR-3-Scattered-Spider-Getting-SaaS-y-in-the-Cloud
url: https://thehackernews.com/2023/10/lucr-3-scattered-spider-getting-saas-y.html
content:
LUCR-3 overlaps with groups such as Scattered Spider, Oktapus, UNC3944, and STORM-0875 and is a financially motivated attacker that leverages the Identity Provider (IDP) as initial access into an environment with the goal of stealing Intellectual Property (IP) for extortion. LUCR-3 targets Fortune 2000 companies across various sectors, including but not limited to Software, Retail, Hospitality,


feed_id: https://thehackernews.com/2023/10/silent-skimmer-year-long-web-skimming.html
title: Silent Skimmer: A Year-Long Web Skimming Campaign Targeting Online Payment Businesses
uri: Silent-Skimmer-A-Year-Long-Web-Skimming-Campaign-Targeting-Online-Pay
url: https://thehackernews.com/2023/10/silent-skimmer-year-long-web-skimming.html
content:
A financially motivated campaign has been targeting online payment businesses in the Asia Pacific, North America, and Latin America with web skimmers for more than a year.
The BlackBerry Research and Intelligence Team is tracking the activity under the name Silent Skimmer, attributing it to an actor who is knowledgeable in the Chinese language. Prominent victims include online businesses and


feed_id: https://thehackernews.com/2023/10/openrefines-zip-slip-vulnerability.html
title: OpenRefine's Zip Slip Vulnerability Could Let Attackers Execute Malicious Code
uri: OpenRefine-s-Zip-Slip-Vulnerability-Could-Let-Attackers-Execute-Malici
url: https://thehackernews.com/2023/10/openrefines-zip-slip-vulnerability.html
content:
A high-severity security flaw has been disclosed in the open-source OpenRefine data cleanup and transformation tool that could result in arbitrary code execution on affected systems.
Tracked as CVE-2023-37476 (CVSS score: 7.8), the vulnerability is a Zip Slip vulnerability that could have adverse impacts when importing a specially crafted project in versions 3.7.3 and below.
"Although OpenRefine


feed_id: https://thehackernews.com/2023/10/bunnyloader-new-malware-as-service.html
title: BunnyLoader: New Malware-as-a-Service Threat Emerges in the Cybercrime Underground
uri: BunnyLoader-New-Malware-as-a-Service-Threat-Emerges-in-the-Cybercrime
url: https://thehackernews.com/2023/10/bunnyloader-new-malware-as-service.html
content:
Cybersecurity experts have discovered yet another malware-as-a-service (MaaS) threat called BunnyLoader that's being advertised for sale on the cybercrime underground.
"BunnyLoader provides various functionalities such as downloading and executing a second-stage payload, stealing browser credentials and system information, and much more," Zscaler ThreatLabz researchers Niraj Shivtarkar and


feed_id: https://thehackernews.com/2023/10/zanubis-android-banking-trojan-poses-as.html
title: Zanubis Android Banking Trojan Poses as Peruvian Government App to Target Users
uri: Zanubis-Android-Banking-Trojan-Poses-as-Peruvian-Government-App-to-Tar
url: https://thehackernews.com/2023/10/zanubis-android-banking-trojan-poses-as.html
content:
An emerging Android banking trojan called Zanubis is now masquerading as a Peruvian government app to trick unsuspecting users into installing the malware.
"Zanubis's main infection path is through impersonating legitimate Peruvian Android applications and then tricking the user into enabling the Accessibility permissions in order to take full control of the device," Kaspersky said in an


feed_id: https://thehackernews.com/2023/09/fbi-warns-of-rising-trend-of-dual.html
title: FBI Warns of Rising Trend of Dual Ransomware Attacks Targeting U.S. Companies
uri: FBI-Warns-of-Rising-Trend-of-Dual-Ransomware-Attacks-Targeting-U-S-Co
url: https://thehackernews.com/2023/09/fbi-warns-of-rising-trend-of-dual.html
content:
The U.S. Federal Bureau of Investigation (FBI) is warning of a new trend of dual ransomware attacks targeting the same victims, at least since July 2023.
"During these attacks, cyber threat actors deployed two different ransomware variants against victim companies from the following variants: AvosLocker, Diamond, Hive, Karakurt, LockBit, Quantum, and Royal," the FBI said in an alert. "Variants


feed_id: https://thehackernews.com/2023/09/iranian-apt-group-oilrig-using-new.html
title: Iranian APT Group OilRig Using New Menorah Malware for Covert Operations
uri: Iranian-APT-Group-OilRig-Using-New-Menorah-Malware-for-Covert-Operatio
url: https://thehackernews.com/2023/09/iranian-apt-group-oilrig-using-new.html
content:
Sophisticated cyber actors backed by Iran known as OilRig have been linked to a spear-phishing campaign that infects victims with a new strain of malware called Menorah.
"The malware was designed for cyberespionage, capable of identifying the machine, reading and uploading files from the machine, and downloading another file or malware," Trend Micro researchers Mohamed Fahmy and Mahmoud Zohdy 


feed_id: https://thehackernews.com/2023/09/new-critical-security-flaws-expose-exim.html
title: New Critical Security Flaws Expose Exim Mail Servers to Remote Attacks
uri: New-Critical-Security-Flaws-Expose-Exim-Mail-Servers-to-Remote-Attacks
url: https://thehackernews.com/2023/09/new-critical-security-flaws-expose-exim.html
content:
Multiple security vulnerabilities have been disclosed in the Exim mail transfer agent that, if successfully exploited, could result in information disclosure and remote code execution.
The list of flaws, which were reported anonymously way back in June 2022, is as follows -

CVE-2023-42114 (CVSS score: 3.7) - Exim NTLM Challenge Out-Of-Bounds Read Information Disclosure Vulnerability


feed_id: https://thehackernews.com/2023/09/cybercriminals-using-new-asmcrypt.html
title: Cybercriminals Using New ASMCrypt Malware Loader to Fly Under the Radar
uri: Cybercriminals-Using-New-ASMCrypt-Malware-Loader-to-Fly-Under-the-Rada
url: https://thehackernews.com/2023/09/cybercriminals-using-new-asmcrypt.html
content:
Threat actors are selling a new crypter and loader called ASMCrypt, which has been described as an "evolved version" of another loader malware known as DoubleFinger.
"The idea behind this type of malware is to load the final payload without the loading process or the payload itself being detected by AV/EDR, etc.," Kaspersky said in an analysis published this week.
DoubleFinger was first


feed_id: https://thehackernews.com/2023/09/lazarus-group-impersonates-recruiter.html
title: Lazarus Group Impersonates Recruiter from Meta to Target Spanish Aerospace Firm
uri: Lazarus-Group-Impersonates-Recruiter-from-Meta-to-Target-Spanish-Aeros
url: https://thehackernews.com/2023/09/lazarus-group-impersonates-recruiter.html
content:
The North Korea-linked Lazarus Group has been linked to a cyber espionage attack targeting an unnamed aerospace company in Spain in which employees of the firm were approached by the threat actor posing as a recruiter for Meta.
"Employees of the targeted company were contacted by a fake recruiter via LinkedIn and tricked into opening a malicious executable file presenting itself as a coding


feed_id: https://thehackernews.com/2023/09/post-quantum-cryptography-finally-real.html
title: Post-Quantum Cryptography: Finally Real in Consumer Apps?
uri: Post-Quantum-Cryptography-Finally-Real-in-Consumer-Apps
url: https://thehackernews.com/2023/09/post-quantum-cryptography-finally-real.html
content:
Most people are barely thinking about basic cybersecurity, let alone post-quantum cryptography. But the impact of a post-quantum world is coming for them regardless of whether or not it's keeping them up tonight. 
Today, many rely on encryption in their daily lives to protect their fundamental digital privacy and security, whether for messaging friends and family, storing files and photos, or


feed_id: https://thehackernews.com/2023/09/microsofts-ai-powered-bing-chat-ads-may.html
title: Microsoft's AI-Powered Bing Chat Ads May Lead Users to Malware-Distributing Sites
uri: Microsoft-s-AI-Powered-Bing-Chat-Ads-May-Lead-Users-to-Malware-Distrib
url: https://thehackernews.com/2023/09/microsofts-ai-powered-bing-chat-ads-may.html
content:
Malicious ads served inside Microsoft Bing's artificial intelligence (AI) chatbot are being used to distribute malware when searching for popular tools.
The findings come from Malwarebytes, which revealed that unsuspecting users can be tricked into visiting booby-trapped sites and installing malware directly from Bing Chat conversations.
Introduced by Microsoft in February 2023, Bing Chat is an 


feed_id: https://thehackernews.com/2023/10/microsoft-to-phase-out-ntlm-in-favor-of.html
title: Microsoft to Phase Out NTLM in Favor of Kerberos for Stronger Authentication
uri: Microsoft-to-Phase-Out-NTLM-in-Favor-of-Kerberos-for-Stronger-Authenti
url: https://thehackernews.com/2023/10/microsoft-to-phase-out-ntlm-in-favor-of.html
content:
Microsoft has announced that it plans to eliminate NT LAN Manager (NTLM) in Windows 11 in the future, as it pivots to alternative methods for authentication and bolster security.
"The focus is on strengthening the Kerberos authentication protocol, which has been the default since 2000, and reducing reliance on NT LAN Manager (NTLM)," the tech giant said. "New features for Windows 11 include


feed_id: https://thehackernews.com/2023/10/new-peapod-cyberattack-campaign.html
title: New PEAPOD Cyberattack Campaign Targeting Women Political Leaders
uri: New-PEAPOD-Cyberattack-Campaign-Targeting-Women-Political-Leaders
url: https://thehackernews.com/2023/10/new-peapod-cyberattack-campaign.html
content:
European Union military personnel and political leaders working on gender equality initiatives have emerged as the target of a new campaign that delivers an updated version of RomCom RAT called PEAPOD.
Cybersecurity firm Trend Micro attributed the attacks to a threat actor it tracks under the name Void Rabisu, which is also known as Storm-0978, Tropical Scorpius, and UNC2596, and is also


feed_id: https://thehackernews.com/2023/10/researchers-unveil-toddycats-new-set-of.html
title: Researchers Unveil ToddyCat's New Set of Tools for Data Exfiltration
uri: Researchers-Unveil-ToddyCat-s-New-Set-of-Tools-for-Data-Exfiltration
url: https://thehackernews.com/2023/10/researchers-unveil-toddycats-new-set-of.html
content:
The advanced persistent threat (APT) actor known as ToddyCat has been linked to a new set of malicious tools that are designed for data exfiltration, offering a deeper insight into the hacking crew's tactics and capabilities.
The findings come from Kaspersky, which first shed light on the adversary last year, linking it to attacks against high-profile entities in Europe and Asia for nearly three


feed_id: https://thehackernews.com/2023/10/ransomware-attacks-doubled-year-on-year.html
title: Ransomware Attacks Double: Are Companies Prepared for 2024's Cyber Threats?
uri: Ransomware-Attacks-Double-Are-Companies-Prepared-for-2024-s-Cyber-Thr
url: https://thehackernews.com/2023/10/ransomware-attacks-doubled-year-on-year.html
content:
Ransomware attacks have only increased in sophistication and capabilities over the past year. From new evasion and anti-analysis techniques to stealthier variants coded in new languages, ransomware groups have adapted their tactics to effectively bypass common defense strategies. 
Cyble, a renowned cyber threat intelligence company recognized for its research and findings, recently released its 


feed_id: https://thehackernews.com/2023/10/darkgate-malware-spreading-via.html
title: DarkGate Malware Spreading via Messaging Services Posing as PDF Files
uri: DarkGate-Malware-Spreading-via-Messaging-Services-Posing-as-PDF-Files
url: https://thehackernews.com/2023/10/darkgate-malware-spreading-via.html
content:
A piece of malware known as DarkGate has been observed being spread via instant messaging platforms such as Skype and Microsoft Teams.
In these attacks, the messaging apps are used to deliver a Visual Basic for Applications (VBA) loader script that masquerades as a PDF document, which, when opened, triggers the download and execution of an AutoIt script designed to launch the malware.
"It's


feed_id: https://thehackernews.com/2023/10/fbi-cisa-warn-of-rising-avoslocker.html
title: FBI, CISA Warn of Rising AvosLocker Ransomware Attacks Against Critical Infrastructure
uri: FBI-CISA-Warn-of-Rising-AvosLocker-Ransomware-Attacks-Against-Critica
url: https://thehackernews.com/2023/10/fbi-cisa-warn-of-rising-avoslocker.html
content:
The AvosLocker ransomware gang has been linked to attacks against critical infrastructure sectors in the U.S., with some of them detected as recently as May 2023.
That's according to a new joint cybersecurity advisory released by the U.S. Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) detailing the ransomware-as-a-service (RaaS) operation's


feed_id: https://thehackernews.com/2023/10/malicious-nuget-package-targeting-net.html
title: Malicious NuGet Package Targeting .NET Developers with SeroXen RAT
uri: Malicious-NuGet-Package-Targeting-NET-Developers-with-SeroXen-RAT
url: https://thehackernews.com/2023/10/malicious-nuget-package-targeting-net.html
content:
A malicious package hosted on the NuGet package manager for the .NET Framework has been found to deliver a remote access trojan called SeroXen RAT.
The package, named Pathoschild.Stardew.Mod.Build.Config and published by a user named Disti, is a typosquat of a legitimate package called Pathoschild.Stardew.ModBuildConfig, software supply chain security firm Phylum said in a report today.
While


feed_id: https://thehackernews.com/2023/10/shellbot-uses-hex-ips-to-evade.html
title: ShellBot Uses Hex IPs to Evade Detection in Attacks on Linux SSH Servers
uri: ShellBot-Uses-Hex-IPs-to-Evade-Detection-in-Attacks-on-Linux-SSH-Serve
url: https://thehackernews.com/2023/10/shellbot-uses-hex-ips-to-evade.html
content:
The threat actors behind ShellBot are leveraging IP addresses transformed into their hexadecimal notation to infiltrate poorly managed Linux SSH servers and deploy the DDoS malware.
"The overall flow remains the same, but the download URL used by the threat actor to install ShellBot has changed from a regular IP address to a hexadecimal value," the AhnLab Security Emergency response Center (ASEC


feed_id: https://thehackernews.com/2023/10/how-to-guard-your-data-from-exposure-in.html
title: How to Guard Your Data from Exposure in ChatGPT
uri: How-to-Guard-Your-Data-from-Exposure-in-ChatGPT
url: https://thehackernews.com/2023/10/how-to-guard-your-data-from-exposure-in.html
content:
ChatGPT has transformed the way businesses generate textual content, which can potentially result in a quantum leap in productivity. However, Generative AI innovation also introduces a new dimension of data exposure risk, when employees inadvertently type or paste sensitive business data into ChatGPT, or similar applications. DLP solutions, the go-to solution for similar challenges, are


feed_id: https://thehackernews.com/2023/10/microsoft-defender-thwarts-akira.html
title: Microsoft Defender Thwarts Large-Scale Akira Ransomware Attack
uri: Microsoft-Defender-Thwarts-Large-Scale-Akira-Ransomware-Attack
url: https://thehackernews.com/2023/10/microsoft-defender-thwarts-akira.html
content:
Microsoft on Wednesday said that a user containment feature in Microsoft Defender for Endpoint helped thwart a "large-scale remote encryption attempt" made by Akira ransomware actors targeting an unknown industrial organization in early June 2023.
The tech giant's threat intelligence team is tracking the operator as Storm-1567.
The attack leveraged devices that were not onboarded to Microsoft


feed_id: https://thehackernews.com/2023/10/researchers-uncover-malware-posing-as.html
title: Researchers Uncover Malware Posing as WordPress Caching Plugin
uri: Researchers-Uncover-Malware-Posing-as-WordPress-Caching-Plugin
url: https://thehackernews.com/2023/10/researchers-uncover-malware-posing-as.html
content:
Cybersecurity researchers have shed light on a new sophisticated strain of malware that masquerades as a WordPress plugin to stealthily create administrator accounts and remotely control a compromised site.
"Complete with a professional looking opening comment implying it is a caching plugin, this rogue code contains numerous functions, adds filters to prevent itself from being included in the


feed_id: https://thehackernews.com/2023/10/researchers-uncover-ongoing.html
title: Researchers Uncover Ongoing Attacks Targeting Asian Governments and Telecom Giants
uri: Researchers-Uncover-Ongoing-Attacks-Targeting-Asian-Governments-and-Te
url: https://thehackernews.com/2023/10/researchers-uncover-ongoing.html
content:
High-profile government and telecom entities in Asia have been targeted as part of an ongoing campaign since 2021 that's designed to deploy basic backdoors and loaders for delivering next-stage malware.
Cybersecurity company Check Point is tracking the activity under the name Stayin' Alive. Targets include organizations located in Vietnam, Uzbekistan, Pakistan, and Kazakhstan.
"The simplistic


feed_id: https://thehackernews.com/2023/10/two-high-risk-security-flaws-discovered.html
title: Two High-Risk Security Flaws Discovered in Curl Library - New Patches Released
uri: Two-High-Risk-Security-Flaws-Discovered-in-Curl-Library-New-Patches
url: https://thehackernews.com/2023/10/two-high-risk-security-flaws-discovered.html
content:
Image Source: JFrog Security Research
Patches have been released for two security flaws impacting the Curl data transfer library, the most severe of which could potentially result in code execution.
The list of vulnerabilities is as follows -

CVE-2023-38545 (CVSS score: 7.5) - SOCKS5 heap-based buffer overflow vulnerability
CVE-2023-38546 (CVSS score: 5.0) - Cookie injection with none file


feed_id: https://thehackernews.com/2023/10/over-17000-wordpress-sites-compromised.html
title: Over 17,000 WordPress Sites Compromised by Balada Injector in September 2023
uri: Over-17-000-WordPress-Sites-Compromised-by-Balada-Injector-in-Septembe
url: https://thehackernews.com/2023/10/over-17000-wordpress-sites-compromised.html
content:
More than 17,000 WordPress websites have been compromised in the month of September 2023 with a malware known as Balada Injector, nearly twice the number of detections in August.
Of these, 9,000 of the websites are said to have been infiltrated using a recently disclosed security flaw in the tagDiv Composer plugin (CVE-2023-3169, CVSS score: 6.1) that could be exploited by unauthenticated users


feed_id: https://thehackernews.com/2023/10/us-cybersecurity-agency-warns-of.html
title: CISA Warns of Actively Exploited Adobe Acrobat Reader Vulnerability
uri: CISA-Warns-of-Actively-Exploited-Adobe-Acrobat-Reader-Vulnerability
url: https://thehackernews.com/2023/10/us-cybersecurity-agency-warns-of.html
content:
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added a high-severity flaw in Adobe Acrobat Reader to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation.
Tracked as CVE-2023-21608 (CVSS score: 7.8), the vulnerability has been described as a use-after-free bug that can be exploited to achieve remote code execution (RCE) with the


feed_id: https://thehackernews.com/2023/10/take-offensive-approach-to-password.html
title: Take an Offensive Approach to Password Security by Continuously Monitoring for Breached Passwords
uri: Take-an-Offensive-Approach-to-Password-Security-by-Continuously-Monito
url: https://thehackernews.com/2023/10/take-offensive-approach-to-password.html
content:
Passwords are at the core of securing access to an organization's data. However, they also come with security vulnerabilities that stem from their inconvenience. With a growing list of credentials to keep track of, the average end-user can default to shortcuts. Instead of creating a strong and unique password for each account, they resort to easy-to-remember passwords, or use the same password


feed_id: https://thehackernews.com/2023/10/microsoft-releases-october-2023-patches.html
title: Microsoft Releases October 2023 Patches for 103 Flaws, Including 2 Active Exploits
uri: Microsoft-Releases-October-2023-Patches-for-103-Flaws-Including-2-Act
url: https://thehackernews.com/2023/10/microsoft-releases-october-2023-patches.html
content:
Microsoft has released its Patch Tuesday updates for October 2023, addressing a total of 103 flaws in its software, two of which have come under active exploitation in the wild.
Of the 103 flaws, 13 are rated Critical and 90 are rated Important in severity. This is apart from 18 security vulnerabilities addressed in its Chromium-based Edge browser since the second Tuesday of September.
The two


feed_id: https://thehackernews.com/2023/10/microsoft-warns-of-nation-state-hackers.html
title: Microsoft Warns of Nation-State Hackers Exploiting Critical Atlassian Confluence Vulnerability
uri: Microsoft-Warns-of-Nation-State-Hackers-Exploiting-Critical-Atlassian
url: https://thehackernews.com/2023/10/microsoft-warns-of-nation-state-hackers.html
content:
Microsoft has linked the exploitation of a recently disclosed critical flaw in Atlassian Confluence Data Center and Server to a nation-state actor it tracks as Storm-0062 (aka DarkShadow or Oro0lxy).
The tech giant's threat intelligence team said it observed in-the-wild abuse of the vulnerability since September 14, 2023.
"CVE-2023-22515 is a critical privilege escalation vulnerability in


feed_id: https://thehackernews.com/2023/10/http2-rapid-reset-zero-day.html
title: HTTP/2 Rapid Reset Zero-Day Vulnerability Exploited to Launch Record DDoS Attacks
uri: HTTP-2-Rapid-Reset-Zero-Day-Vulnerability-Exploited-to-Launch-Record-D
url: https://thehackernews.com/2023/10/http2-rapid-reset-zero-day.html
content:
Amazon Web Services (AWS), Cloudflare, and Google on Tuesday said they took steps to mitigate record-breaking distributed denial-of-service (DDoS) attacks that relied on a novel technique called HTTP/2 Rapid Reset.
The layer 7 attacks were detected in late August 2023, the companies said in a coordinated disclosure. The cumulative susceptibility to this attack is being tracked as CVE-2023-44487,


feed_id: https://thehackernews.com/2023/10/google-adopts-passkeys-as-default-sign.html
title: Google Adopts Passkeys as Default Sign-in Method for All Users
uri: Google-Adopts-Passkeys-as-Default-Sign-in-Method-for-All-Users
url: https://thehackernews.com/2023/10/google-adopts-passkeys-as-default-sign.html
content:
Google on Tuesday announced the ability for all users to set up passkeys by default, five months after it rolled out support for the FIDO Alliance-backed passwordless standard for Google Accounts on all platforms.
"This means the next time you sign in to your account, you'll start seeing prompts to create and use passkeys, simplifying your future sign-ins," Google's Sriram Karra and Christiaan


feed_id: https://thehackernews.com/2023/12/agent-racoon-backdoor-targets.html
title: Agent Racoon Backdoor Targets Organizations in Middle East, Africa, and U.S.
uri: Agent-Racoon-Backdoor-Targets-Organizations-in-Middle-East-Africa-an
url: https://thehackernews.com/2023/12/agent-racoon-backdoor-targets.html
content:
Organizations in the Middle East, Africa, and the U.S. have been targeted by an unknown threat actor to distribute a new backdoor called&nbsp;Agent Racoon.
"This malware family is written using the .NET framework and leverages the domain name service (DNS) protocol to create a covert channel and provide different backdoor functionalities," Palo Alto Networks Unit 42 researcher Chema Garcia&nbsp;


feed_id: https://thehackernews.com/2023/12/russian-hacker-vladimir-dunaev.html
title: Russian Hacker Vladimir Dunaev Convicted for Creating TrickBot Malware
uri: Russian-Hacker-Vladimir-Dunaev-Convicted-for-Creating-TrickBot-Malware
url: https://thehackernews.com/2023/12/russian-hacker-vladimir-dunaev.html
content:
A Russian national has been found guilty in connection with his role in developing and deploying a malware known as TrickBot, the U.S. Department of Justice (DoJ) announced.
Vladimir Dunaev, 40, was&nbsp;arrested&nbsp;in South Korea in September 2021 and extradited to the U.S. a month later.
"Dunaev developed browser modifications and malicious tools that aided in credential harvesting and data


feed_id: https://thehackernews.com/2023/12/new-fjordphantom-android-malware.html
title: New FjordPhantom Android Malware Targets Banking Apps in Southeast Asia
uri: New-FjordPhantom-Android-Malware-Targets-Banking-Apps-in-Southeast-Asi
url: https://thehackernews.com/2023/12/new-fjordphantom-android-malware.html
content:
Cybersecurity researchers have disclosed a new sophisticated Android malware called&nbsp;FjordPhantom&nbsp;that has been observed targeting users in Southeast Asian countries like Indonesia, Thailand, and Vietnam since early September 2023.
"Spreading primarily through messaging services, it combines app-based malware with social engineering to defraud banking customers," Oslo-based mobile app


feed_id: https://thehackernews.com/2023/12/qakbot-takedown-aftermath-mitigations.html
title: Qakbot Takedown Aftermath: Mitigations and Protecting Against Future Threats
uri: Qakbot-Takedown-Aftermath-Mitigations-and-Protecting-Against-Future-T
url: https://thehackernews.com/2023/12/qakbot-takedown-aftermath-mitigations.html
content:
The U.S. Department of Justice (DOJ) and the FBI recently collaborated in a multinational operation to dismantle the notorious Qakbot malware and botnet. While the operation was successful in disrupting this long-running threat, concerns have arisen as it appears that Qakbot may still pose a danger in a reduced form. This article discusses the aftermath of the takedown, provides mitigation


feed_id: https://thehackernews.com/2023/12/chinese-hackers-using-sugargh0st-rat-to.html
title: Chinese Hackers Using SugarGh0st RAT to Target South Korea and Uzbekistan
uri: Chinese-Hackers-Using-SugarGh0st-RAT-to-Target-South-Korea-and-Uzbekis
url: https://thehackernews.com/2023/12/chinese-hackers-using-sugargh0st-rat-to.html
content:
A suspected Chinese-speaking threat actor has been attributed to a malicious campaign that targets the Uzbekistan Ministry of Foreign Affairs and South Korean users with a remote access trojan called&nbsp;SugarGh0st RAT.
The activity, which commenced no later than August 2023, leverages two different infection sequences to deliver the malware, which is a customized variant of&nbsp;Gh0st RAT&nbsp


feed_id: https://thehackernews.com/2023/12/discover-how-gcore-thwarted-powerful.html
title: Discover How Gcore Thwarted Powerful 1.1Tbps and 1.6Tbps DDoS Attacks
uri: Discover-How-Gcore-Thwarted-Powerful-1-1Tbps-and-1-6Tbps-DDoS-Attacks
url: https://thehackernews.com/2023/12/discover-how-gcore-thwarted-powerful.html
content:
The most recent&nbsp;Gcore Radar report&nbsp;and&nbsp;its aftermath&nbsp;have highlighted a dramatic increase in DDoS attacks across multiple industries. At the beginning of 2023, the average strength of attacks&nbsp;reached 800 Gbps, but now, even a peak as high as 1.5+ Tbps is unsurprising. To try and break through Gcore’s defenses, perpetrators made two attempts with two different strategies.


feed_id: https://thehackernews.com/2023/12/whatsapps-new-secret-code-feature-lets.html
title: WhatsApp's New Secret Code Feature Lets Users Protect Private Chats with Password
uri: WhatsApp-s-New-Secret-Code-Feature-Lets-Users-Protect-Private-Chats-wi
url: https://thehackernews.com/2023/12/whatsapps-new-secret-code-feature-lets.html
content:
Meta-owned WhatsApp has launched a new&nbsp;Secret Code&nbsp;feature to help users protect sensitive conversations with a custom password on the messaging platform.
The feature has been&nbsp;described&nbsp;as an "additional way to protect those chats and make them harder to find if someone has access to your phone or you share a phone with someone else."
Secret Code builds on another feature


feed_id: https://thehackernews.com/2023/12/us-treasury-sanctions-north-korean.html
title: U.S. Treasury Sanctions North Korean Kimsuky Hackers and 8 Foreign-Based Agents
uri: U-S-Treasury-Sanctions-North-Korean-Kimsuky-Hackers-and-8-Foreign-Bas
url: https://thehackernews.com/2023/12/us-treasury-sanctions-north-korean.html
content:
The U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC) on Thursday sanctioned the North Korea-linked adversarial collective known as Kimsuky as well as eight foreign-based agents who are alleged to have facilitated sanctions evasion.
The agents, the Treasury&nbsp;said, helped in "revenue generation&nbsp;and missile-related technology procurement that support the DPRK's


feed_id: https://thehackernews.com/2023/12/zyxel-releases-patches-to-fix-15-flaws.html
title: Zyxel Releases Patches to Fix 15 Flaws in NAS, Firewall, and AP Devices
uri: Zyxel-Releases-Patches-to-Fix-15-Flaws-in-NAS-Firewall-and-AP-Device
url: https://thehackernews.com/2023/12/zyxel-releases-patches-to-fix-15-flaws.html
content:
Zyxel has released patches to address 15 security issues impacting network-attached storage (NAS), firewall, and access point (AP) devices, including three critical flaws that could lead to authentication bypass and command injection.
The&nbsp;three vulnerabilities&nbsp;are listed below -

CVE-2023-35138&nbsp;(CVSS score: 9.8) - A command injection vulnerability that could allow an


feed_id: https://thehackernews.com/2023/12/zero-day-alert-apple-rolls-out-ios.html
title: Zero-Day Alert: Apple Rolls Out iOS, macOS, and Safari Patches for 2 Actively Exploited Flaws
uri: Zero-Day-Alert-Apple-Rolls-Out-iOS-macOS-and-Safari-Patches-for-2-A
url: https://thehackernews.com/2023/12/zero-day-alert-apple-rolls-out-ios.html
content:
Apple has&nbsp;released&nbsp;software updates for iOS, iPadOS, macOS, and Safari web browser to address two security flaws that it said have come under active exploitation in the wild on older versions of its software.
The vulnerabilities, both of which reside in the WebKit web browser engine, are described below -

CVE-2023-42916&nbsp;- An out-of-bounds read issue that could be exploited to


feed_id: https://thehackernews.com/2023/11/google-unveils-retvec-gmails-new.html
title: Google Unveils RETVec - Gmail's New Defense Against Spam and Malicious Emails
uri: Google-Unveils-RETVec-Gmail-s-New-Defense-Against-Spam-and-Malicious
url: https://thehackernews.com/2023/11/google-unveils-retvec-gmails-new.html
content:
Google has revealed a new multilingual text vectorizer called&nbsp;RETVec&nbsp;(short for Resilient and Efficient Text Vectorizer) to&nbsp;help detect&nbsp;potentially harmful content such as spam and malicious emails in Gmail.
"RETVec is trained to be resilient against character-level manipulations including insertion, deletion, typos, homoglyphs, LEET substitution, and more," according to the&


feed_id: https://thehackernews.com/2023/11/north-koreas-lazarus-group-rakes-in-3.html
title: North Korea's Lazarus Group Rakes in $3 Billion from Cryptocurrency Hacks
uri: North-Korea-s-Lazarus-Group-Rakes-in-3-Billion-from-Cryptocurrency-Ha
url: https://thehackernews.com/2023/11/north-koreas-lazarus-group-rakes-in-3.html
content:
Threat actors from the Democratic People's Republic of Korea (DPRK) are increasingly targeting the cryptocurrency sector as a&nbsp;major revenue generation mechanism&nbsp;since at least 2017 to get around sanctions imposed against the country.
"Even though movement in and out of and within the country is heavily restricted, and its general population is isolated from the rest of the world, the


feed_id: https://thehackernews.com/2023/11/this-free-solution-provides-essential.html
title: This Free Solution Provides Essential Third-Party Risk Management for SaaS
uri: This-Free-Solution-Provides-Essential-Third-Party-Risk-Management-for
url: https://thehackernews.com/2023/11/this-free-solution-provides-essential.html
content:
Wing Security recently announced that basic third-party risk assessment is&nbsp;now available as a free product. But it raises the questions of how SaaS is connected to third-party risk management (TPRM) and what companies should do to ensure a proper SaaS-TPRM process is in place. In this article we will share 5 tips to manage the third-party risks associated with SaaS, but first...&nbsp;
What


feed_id: https://thehackernews.com/2023/11/7-uses-for-generative-ai-to-enhance.html
title: 7 Uses for Generative AI to Enhance Security Operations
uri: 7-Uses-for-Generative-AI-to-Enhance-Security-Operations
url: https://thehackernews.com/2023/11/7-uses-for-generative-ai-to-enhance.html
content:
Welcome to a world where Generative AI revolutionizes the field of cybersecurity.
Generative AI refers to the use of artificial intelligence (AI) techniques to generate or create new data, such as images, text, or sounds. It has gained significant attention in recent years due to its ability to generate realistic and diverse outputs.
When it comes to security operations,&nbsp;Generative AI can


feed_id: https://thehackernews.com/2023/11/cactus-ransomware-exploits-qlik-sense.html
title: CACTUS Ransomware Exploits Qlik Sense Vulnerabilities in Targeted Attacks
uri: CACTUS-Ransomware-Exploits-Qlik-Sense-Vulnerabilities-in-Targeted-Atta
url: https://thehackernews.com/2023/11/cactus-ransomware-exploits-qlik-sense.html
content:
A&nbsp;CACTUS ransomware campaign&nbsp;has been observed exploiting recently disclosed security flaws in a cloud analytics and business intelligence platform called Qlik Sense to obtain a foothold into targeted environments.
"This campaign marks the first documented instance [...] where threat actors deploying CACTUS ransomware have exploited vulnerabilities in Qlik Sense for initial access,"


feed_id: https://thehackernews.com/2023/11/us-treasury-sanctions-sinbad.html
title: U.S. Treasury Sanctions Sinbad Cryptocurrency Mixer Used by North Korean Hackers
uri: U-S-Treasury-Sanctions-Sinbad-Cryptocurrency-Mixer-Used-by-North-Kore
url: https://thehackernews.com/2023/11/us-treasury-sanctions-sinbad.html
content:
The U.S. Treasury Department on Wednesday imposed sanctions against&nbsp;Sinbad, a virtual currency mixer that has been put to use by the North Korea-linked&nbsp;Lazarus Group&nbsp;to launder ill-gotten proceeds.
"Sinbad has processed millions of dollars' worth of virtual currency from Lazarus Group heists, including the Horizon Bridge and Axie Infinity heists," the department said.
"Sinbad is


feed_id: https://thehackernews.com/2023/11/iranian-hackers-exploit-plcs-in-attack.html
title: Iranian Hackers Exploit PLCs in Attack on Water Authority in U.S.
uri: Iranian-Hackers-Exploit-PLCs-in-Attack-on-Water-Authority-in-U-S
url: https://thehackernews.com/2023/11/iranian-hackers-exploit-plcs-in-attack.html
content:
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) revealed that it's responding to a cyber attack that involved the active exploitation of Unitronics programmable logic controllers (PLCs) to target the Municipal Water Authority of Aliquippa in western Pennsylvania.
The attack has been attributed to an Iranian-backed hacktivist collective known as Cyber Av3ngers.
"Cyber threat


feed_id: https://thehackernews.com/2023/11/200-malicious-apps-on-iranian-android.html
title: 200+ Malicious Android Apps Targeting Iranian Banks: Experts Warn
uri: 200-Malicious-Android-Apps-Targeting-Iranian-Banks-Experts-Warn
url: https://thehackernews.com/2023/11/200-malicious-apps-on-iranian-android.html
content:
An Android malware campaign targeting Iranian banks has expanded its capabilities and incorporated additional evasion tactics to fly under the radar.
That's according to a new report from Zimperium, which discovered more than 200 malicious apps associated with the malicious operation, with the threat actor also observed carrying out phishing attacks against the targeted financial institutions.


feed_id: https://thehackernews.com/2023/11/discover-why-proactive-web-security.html
title: Discover Why Proactive Web Security Outsmarts Traditional Antivirus Solutions
uri: Discover-Why-Proactive-Web-Security-Outsmarts-Traditional-Antivirus-So
url: https://thehackernews.com/2023/11/discover-why-proactive-web-security.html
content:
In a rapidly evolving digital landscape, it's crucial to reevaluate how we secure web environments. Traditional antivirus-approach solutions have their merits, but they're reactive. A new report delves into the reasons for embracing proactive web security solutions, ensuring you stay ahead of emerging threats.&nbsp;
To learn more, download the full report&nbsp;here.
The New Paradigm
If you’ve


feed_id: https://thehackernews.com/2023/11/okta-discloses-additional-data-breach.html
title: Okta Discloses Broader Impact Linked to October 2023 Support System Breach
uri: Okta-Discloses-Broader-Impact-Linked-to-October-2023-Support-System-Br
url: https://thehackernews.com/2023/11/okta-discloses-additional-data-breach.html
content:
Identity services provider Okta has disclosed that it detected "additional threat actor activity" in connection with the&nbsp;October 2023 breach&nbsp;of its support case management system.
"The threat actor downloaded the names and email addresses of all Okta customer support system users," the company said in a statement shared with The Hacker News.
"All Okta Workforce Identity Cloud (WIC) and


feed_id: https://thehackernews.com/2023/11/djvu-ransomwares-latest-variant-xaro.html
title: DJVU Ransomware's Latest Variant 'Xaro' Disguised as Cracked Software
uri: DJVU-Ransomware-s-Latest-Variant-Xaro-Disguised-as-Cracked-Software
url: https://thehackernews.com/2023/11/djvu-ransomwares-latest-variant-xaro.html
content:
A variant of a ransomware strain known as DJVU has been observed to be distributed in the form of cracked software.
"While this attack pattern is not new, incidents involving a DJVU variant that appends the .xaro extension to affected files and demanding ransom for a decryptor have been observed infecting systems alongside a host of various commodity loaders and infostealers," Cybereason


feed_id: https://thehackernews.com/2023/11/gotitan-botnet-spotted-exploiting.html
title: GoTitan Botnet Spotted Exploiting Recent Apache ActiveMQ Vulnerability
uri: GoTitan-Botnet-Spotted-Exploiting-Recent-Apache-ActiveMQ-Vulnerability
url: https://thehackernews.com/2023/11/gotitan-botnet-spotted-exploiting.html
content:
The recently disclosed critical security flaw impacting Apache ActiveMQ is being actively exploited by threat actors to distribute a new Go-based botnet called&nbsp;GoTitan&nbsp;as well as a .NET program known as&nbsp;PrCtrl Rat&nbsp;that's capable of remotely commandeering the infected hosts.
The attacks involve the exploitation of a remote code execution bug (CVE-2023-46604, CVSS score: 10.0)


feed_id: https://thehackernews.com/2023/11/zero-day-alert-google-chrome-under.html
title: Zero-Day Alert: Google Chrome Under Active Attack, Exploiting New Vulnerability
uri: Zero-Day-Alert-Google-Chrome-Under-Active-Attack-Exploiting-New-Vuln
url: https://thehackernews.com/2023/11/zero-day-alert-google-chrome-under.html
content:
Google has rolled out security updates to fix seven security issues in its Chrome browser, including a zero-day that has come under active exploitation in the wild.
Tracked as&nbsp;CVE-2023-6345, the high-severity vulnerability has been described as an integer overflow bug in Skia, an open source 2D graphics library.
Benoît Sevens and Clément Lecigne of Google's Threat Analysis Group (TAG) have


feed_id: https://thehackernews.com/2023/11/transform-your-data-security-posture.html
title: Transform Your Data Security Posture – Learn from SoFi's DSPM Success
uri: Transform-Your-Data-Security-Posture-Learn-from-SoFi-s-DSPM-Succes
url: https://thehackernews.com/2023/11/transform-your-data-security-posture.html
content:
As cloud technology evolves, so does the challenge of securing sensitive data. In a world where data duplication and sprawl are common, organizations face increased risks of non-compliance and unauthorized data breaches.
Sentra's DSPM (Data Security Posture Management) emerges as a comprehensive solution, offering continuous discovery and accurate classification of sensitive data in the cloud.


feed_id: https://thehackernews.com/2023/11/design-flaw-in-google-workspace-could.html
title: Design Flaw in Google Workspace Could Let Attackers Gain Unauthorized Access
uri: Design-Flaw-in-Google-Workspace-Could-Let-Attackers-Gain-Unauthorized
url: https://thehackernews.com/2023/11/design-flaw-in-google-workspace-could.html
content:
Cybersecurity researchers have detailed a "severe design flaw" in Google Workspace's domain-wide delegation (DWD) feature that could be exploited by threat actors to facilitate privilege escalation and obtain unauthorized access to Workspace APIs without super admin privileges.
"Such exploitation could result in theft of emails from Gmail, data exfiltration from Google Drive, or other


feed_id: https://thehackernews.com/2023/11/how-hackers-phish-for-your-users.html
title: How Hackers Phish for Your Users' Credentials and Sell Them
uri: How-Hackers-Phish-for-Your-Users-Credentials-and-Sell-Them
url: https://thehackernews.com/2023/11/how-hackers-phish-for-your-users.html
content:
Account credentials, a popular initial access vector, have become a valuable commodity in cybercrime. As a result, a single set of stolen credentials can put your organization’s entire network at risk.
According to the&nbsp;2023 Verizon Data Breach Investigation Report, external parties were responsible for&nbsp;83 percent&nbsp;of breaches that occurred between November 2021 and October 2022.&


feed_id: https://thehackernews.com/2023/11/key-cybercriminals-behind-notorious.html
title: Key Cybercriminals Behind Notorious Ransomware Families Arrested in Ukraine
uri: Key-Cybercriminals-Behind-Notorious-Ransomware-Families-Arrested-in-Uk
url: https://thehackernews.com/2023/11/key-cybercriminals-behind-notorious.html
content:
A coordinated law enforcement operation has led to the arrest of key individuals in Ukraine who are alleged to be a part of several ransomware schemes.
"On 21 November, 30 properties were searched in the regions of Kyiv, Cherkasy, Rivne, and Vinnytsia, resulting in the arrest of the 32-year-old ringleader," Europol&nbsp;said&nbsp;in a statement today. "Four of the ringleader's most active


feed_id: https://thehackernews.com/2023/11/stop-identity-attacks-discover-key-to.html
title: Stop Identity Attacks: Discover the Key to Early Threat Detection
uri: Stop-Identity-Attacks-Discover-the-Key-to-Early-Threat-Detection
url: https://thehackernews.com/2023/11/stop-identity-attacks-discover-key-to.html
content:
Identity and Access Management (IAM) systems are a staple to ensure only authorized individuals or entities have access to specific resources in order to protect sensitive information and secure business assets.
But did you know that today over 80% of attacks now involve identity, compromised credentials or bypassing the authentication mechanism? Recent breaches at MGM and Caesars have


feed_id: https://thehackernews.com/2023/11/hackers-can-exploit-forced.html
title: Hackers Can Exploit 'Forced Authentication' to Steal Windows NTLM Tokens
uri: Hackers-Can-Exploit-Forced-Authentication-to-Steal-Windows-NTLM-Toke
url: https://thehackernews.com/2023/11/hackers-can-exploit-forced.html
content:
Cybersecurity researchers have discovered a case of "forced authentication" that could be exploited to leak a Windows user's NT LAN Manager (NTLM) tokens by tricking a victim into opening a specially crafted Microsoft Access file.
The attack takes advantage of a legitimate feature in the database management system solution that allows users to&nbsp;link to external data sources, such as a remote


feed_id: https://thehackernews.com/2023/11/n-korean-hackers-mixing-and-matching.html
title: N. Korean Hackers 'Mixing' macOS Malware Tactics to Evade Detection
uri: N-Korean-Hackers-Mixing-macOS-Malware-Tactics-to-Evade-Detection
url: https://thehackernews.com/2023/11/n-korean-hackers-mixing-and-matching.html
content:
The North Korean threat actors behind macOS malware strains such as RustBucket and KANDYKORN have been observed "mixing and matching" different elements of the two disparate attack chains, leveraging RustBucket droppers to deliver KANDYKORN.
The&nbsp;findings&nbsp;come from cybersecurity firm SentinelOne, which also tied a third macOS-specific malware called ObjCShellz to the RustBucket campaign


feed_id: https://thehackernews.com/2023/11/how-to-handle-retail-saas-security-on.html
title: How to Handle Retail SaaS Security on Cyber Monday
uri: How-to-Handle-Retail-SaaS-Security-on-Cyber-Monday
url: https://thehackernews.com/2023/11/how-to-handle-retail-saas-security-on.html
content:
If forecasters are right, over the course of today, consumers will spend&nbsp;$13.7 billion. Just about every click, sale, and engagement will be captured by a CRM platform. Inventory applications will trigger automated re-orders; communication tools will send automated email and text messages confirming sales and sharing shipping information.&nbsp;
SaaS applications supporting retail efforts


feed_id: https://thehackernews.com/2023/11/experts-uncover-passive-method-to.html
title: Experts Uncover Passive Method to Extract Private RSA Keys from SSH Connections
uri: Experts-Uncover-Passive-Method-to-Extract-Private-RSA-Keys-from-SSH-Co
url: https://thehackernews.com/2023/11/experts-uncover-passive-method-to.html
content:
A new study has demonstrated that it's possible for passive network attackers to obtain private RSA host keys from a vulnerable SSH server by observing when naturally occurring computational faults that occur while the connection is being established.
The Secure Shell (SSH) protocol is a method for securely transmitting commands and logging in to a computer over an unsecured network. Based on a


feed_id: https://thehackernews.com/2023/11/us-uk-and-global-partners-release.html
title: U.S., U.K., and Global Partners Release Secure AI System Development Guidelines
uri: U-S-U-K-and-Global-Partners-Release-Secure-AI-System-Development-G
url: https://thehackernews.com/2023/11/us-uk-and-global-partners-release.html
content:
The U.K. and U.S., along with international partners from 16 other countries, have released new guidelines for the development of secure artificial intelligence (AI) systems.
"The approach prioritizes ownership of security outcomes for customers, embraces radical transparency and accountability, and establishes organizational structures where secure design is a top priority," the U.S.


feed_id: https://thehackernews.com/2023/11/new-hrservdll-web-shell-detected-in-apt.html
title: New 'HrServ.dll' Web Shell Detected in APT Attack Targeting Afghan Government
uri: New-HrServ-dll-Web-Shell-Detected-in-APT-Attack-Targeting-Afghan-Gov
url: https://thehackernews.com/2023/11/new-hrservdll-web-shell-detected-in-apt.html
content:
An unspecified government entity in Afghanistan was targeted by a previously undocumented web shell called&nbsp;HrServ&nbsp;in what’s suspected to be an advanced persistent threat (APT) attack.
The web shell, a dynamic-link library (DLL) named “hrserv.dll,” exhibits “sophisticated features such as custom encoding methods for client communication and in-memory execution,” Kaspersky security


feed_id: https://thehackernews.com/2023/11/warning-3-critical-vulnerabilities.html
title: Warning: 3 Critical Vulnerabilities Expose ownCloud Users to Data Breaches
uri: Warning-3-Critical-Vulnerabilities-Expose-ownCloud-Users-to-Data-Brea
url: https://thehackernews.com/2023/11/warning-3-critical-vulnerabilities.html
content:
The maintainers of the open-source file-sharing software ownCloud have warned of three critical security flaws that could be exploited to disclose sensitive information and modify files.
A brief description of the vulnerabilities is as follows -

CVE-2023-49103 (CVSS score: 10.0) - Disclosure of sensitive credentials and configuration in containerized deployments impacting graphapi versions from


feed_id: https://thehackernews.com/2023/11/cybercriminals-using-telekopye-telegram.html
title: Cybercriminals Using Telekopye Telegram Bot to Craft Phishing Scams on a Grand Scale
uri: Cybercriminals-Using-Telekopye-Telegram-Bot-to-Craft-Phishing-Scams-on
url: https://thehackernews.com/2023/11/cybercriminals-using-telekopye-telegram.html
content:
More details have emerged about a malicious Telegram bot called&nbsp;Telekopye&nbsp;that's used by threat actors to pull off large-scale phishing scams.
"Telekopye can craft phishing websites, emails, SMS messages, and more," ESET security researcher Radek Jizba&nbsp;said&nbsp;in a new analysis.
The&nbsp;threat actors behind the operation&nbsp;– codenamed Neanderthals – are known to run the


feed_id: https://thehackernews.com/2023/11/tell-me-your-secrets-without-telling-me.html
title: Tell Me Your Secrets Without Telling Me Your Secrets
uri: Tell-Me-Your-Secrets-Without-Telling-Me-Your-Secrets
url: https://thehackernews.com/2023/11/tell-me-your-secrets-without-telling-me.html
content:
The title of this article probably sounds like the caption to a meme. Instead, this is an actual problem GitGuardian's engineers had to solve in implementing the mechanisms for their new&nbsp;HasMySecretLeaked service. They wanted to help developers find out if their secrets (passwords, API keys, private keys, cryptographic certificates, etc.) had found their way into public GitHub repositories.


feed_id: https://thehackernews.com/2023/11/hamas-linked-cyberattacks-using-rust.html
title: Hamas-Linked Cyberattacks Using Rust-Powered SysJoker Backdoor Against Israel
uri: Hamas-Linked-Cyberattacks-Using-Rust-Powered-SysJoker-Backdoor-Against
url: https://thehackernews.com/2023/11/hamas-linked-cyberattacks-using-rust.html
content:
Cybersecurity researchers have shed light on a Rust version of a cross-platform backdoor called&nbsp;SysJoker, which is assessed to have been used by a Hamas-affiliated threat actor to target Israel amid the ongoing war in the region.
“Among the most prominent changes is the shift to Rust language, which indicates the malware code was entirely rewritten, while still maintaining similar


feed_id: https://thehackernews.com/2023/11/kubernetes-secrets-of-fortune-500.html
title: Kubernetes Secrets of Fortune 500 Companies Exposed in Public Repositories
uri: Kubernetes-Secrets-of-Fortune-500-Companies-Exposed-in-Public-Reposito
url: https://thehackernews.com/2023/11/kubernetes-secrets-of-fortune-500.html
content:
Cybersecurity researchers are warning of publicly exposed Kubernetes configuration secrets that could put organizations at risk of supply chain attacks.
“These encoded Kubernetes configuration secrets were uploaded to public repositories,” Aqua security researchers Yakir Kadkoda and Assaf Morag&nbsp;said&nbsp;in a new research published earlier this week.
Some of those impacted include two top


feed_id: https://thehackernews.com/2023/11/konni-group-using-russian-language.html
title: Konni Group Using Russian-Language Malicious Word Docs in Latest Attacks
uri: Konni-Group-Using-Russian-Language-Malicious-Word-Docs-in-Latest-Attac
url: https://thehackernews.com/2023/11/konni-group-using-russian-language.html
content:
A new phishing attack has been observed leveraging a Russian-language Microsoft Word document to deliver malware capable of harvesting sensitive information from compromised Windows hosts.
The activity has been attributed to a threat actor called Konni, which is assessed to share overlaps with a North Korean cluster tracked as Kimsuky (aka APT43).
"This campaign relies on a remote access trojan


feed_id: https://thehackernews.com/2023/11/alert-new-wailingcrab-malware-loader.html
title: Alert: New WailingCrab Malware Loader Spreading via Shipping-Themed Emails
uri: Alert-New-WailingCrab-Malware-Loader-Spreading-via-Shipping-Themed-Em
url: https://thehackernews.com/2023/11/alert-new-wailingcrab-malware-loader.html
content:
Delivery- and shipping-themed email messages are being used to deliver a sophisticated malware loader known as&nbsp;WailingCrab.
"The malware itself is split into multiple components, including a loader, injector, downloader and backdoor, and successful requests to C2-controlled servers are often necessary to retrieve the next stage," IBM X-Force researchers Charlotte Hammond, Ole Villadsen, and


feed_id: https://thehackernews.com/2023/11/6-steps-to-accelerate-cybersecurity.html
title: 6 Steps to Accelerate Cybersecurity Incident Response
uri: 6-Steps-to-Accelerate-Cybersecurity-Incident-Response
url: https://thehackernews.com/2023/11/6-steps-to-accelerate-cybersecurity.html
content:
Modern security tools continue to improve in their ability to defend organizations’ networks and endpoints against cybercriminals. But the bad actors still occasionally find a way in.
Security teams must be able to stop threats and restore normal operations as quickly as possible. That’s why it’s essential that these teams not only have the right tools but also understand how to effectively


feed_id: https://thehackernews.com/2023/11/mirai-based-botnet-exploiting-zero-day.html
title: Mirai-based Botnet Exploiting Zero-Day Bugs in Routers and NVRs for Massive DDoS Attacks
uri: Mirai-based-Botnet-Exploiting-Zero-Day-Bugs-in-Routers-and-NVRs-for-Ma
url: https://thehackernews.com/2023/11/mirai-based-botnet-exploiting-zero-day.html
content:
An active malware campaign is leveraging two zero-day vulnerabilities with remote code execution (RCE) functionality to rope routers and video recorders into a Mirai-based distributed denial-of-service (DDoS) botnet.
“The payload targets routers and network video recorder (NVR) devices with default admin credentials and installs Mirai variants when successful,” Akamai&nbsp;said&nbsp;in an


feed_id: https://thehackernews.com/2023/11/north-korean-hackers-distribute.html
title: N. Korean Hackers Distribute Trojanized CyberLink Software in Supply Chain Attack
uri: N-Korean-Hackers-Distribute-Trojanized-CyberLink-Software-in-Supply-C
url: https://thehackernews.com/2023/11/north-korean-hackers-distribute.html
content:
A North Korean state-sponsored threat actor tracked as&nbsp;Diamond Sleet&nbsp;is distributing a trojanized version of a legitimate application developed by a Taiwanese multimedia software developer called CyberLink to target downstream customers via a supply chain attack.
"This malicious file is a legitimate CyberLink application installer that has been modified to include malicious code that


feed_id: https://thehackernews.com/2023/11/new-flaws-in-fingerprint-sensors-let.html
title: New Flaws in Fingerprint Sensors Let Attackers Bypass Windows Hello Login
uri: New-Flaws-in-Fingerprint-Sensors-Let-Attackers-Bypass-Windows-Hello-Lo
url: https://thehackernews.com/2023/11/new-flaws-in-fingerprint-sensors-let.html
content:
A new research has uncovered multiple vulnerabilities that could be exploited to bypass&nbsp;Windows Hello authentication&nbsp;on Dell Inspiron 15, Lenovo ThinkPad T14, and Microsoft Surface Pro X laptops.
The flaws were discovered by researchers at hardware and software product security and offensive research firm Blackwing Intelligence, who found the weaknesses in the fingerprint sensors from


feed_id: https://thehackernews.com/2023/11/north-korean-hackers-pose-as-job.html
title: North Korean Hackers Pose as Job Recruiters and Seekers in Malware Campaigns
uri: North-Korean-Hackers-Pose-as-Job-Recruiters-and-Seekers-in-Malware-Cam
url: https://thehackernews.com/2023/11/north-korean-hackers-pose-as-job.html
content:
North Korean threat actors have been linked to two campaigns in which they masquerade as both job recruiters and seekers to distribute malware and obtain unauthorized employment with organizations based in the U.S. and other parts of the world.
The activity clusters have been codenamed Contagious Interview and Wagemole, respectively, by Palo Alto Networks Unit 42.
While the first set of attacks


feed_id: https://thehackernews.com/2023/11/ai-solutions-are-new-shadow-it.html
title: AI Solutions Are the New Shadow IT
uri: AI-Solutions-Are-the-New-Shadow-IT
url: https://thehackernews.com/2023/11/ai-solutions-are-new-shadow-it.html
content:
Ambitious Employees Tout New AI Tools, Ignore Serious SaaS Security RisksLike the&nbsp;SaaS shadow IT&nbsp;of the past, AI is placing CISOs and cybersecurity teams in a tough but familiar spot.&nbsp;
Employees are covertly using AI&nbsp;with little regard for established IT and cybersecurity review procedures. Considering&nbsp;ChatGPT’s meteoric rise to 100 million users within 60 days of


feed_id: https://thehackernews.com/2023/11/clearfake-campaign-expands-to-deliver.html
title: ClearFake Campaign Expands to Target Mac Systems with Atomic Stealer
uri: ClearFake-Campaign-Expands-to-Target-Mac-Systems-with-Atomic-Stealer
url: https://thehackernews.com/2023/11/clearfake-campaign-expands-to-deliver.html
content:
The macOS information stealer known as Atomic is now being delivered to target via a bogus web browser update chain tracked as ClearFake.
"This may very well be the first time we see one of the main social engineering campaigns, previously reserved for Windows, branch out not only in terms of geolocation but also operating system," Malwarebytes' Jérôme Segura&nbsp;said&nbsp;in a Tuesday analysis


feed_id: https://thehackernews.com/2023/11/lockbit-ransomware-exploiting-critical.html
title: LockBit Ransomware Exploiting Critical Citrix Bleed Vulnerability to Break In
uri: LockBit-Ransomware-Exploiting-Critical-Citrix-Bleed-Vulnerability-to-B
url: https://thehackernews.com/2023/11/lockbit-ransomware-exploiting-critical.html
content:
Multiple threat actors, including LockBit ransomware affiliates, are&nbsp;actively exploiting&nbsp;a recently disclosed critical security flaw in Citrix NetScaler application delivery control (ADC) and Gateway appliances to obtain initial access to target environments.
The joint advisory comes from the U.S. Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation


feed_id: https://thehackernews.com/2023/11/play-ransomware-goes-commercial-now.html
title: Play Ransomware Goes Commercial - Now Offered as a Service to Cybercriminals
uri: Play-Ransomware-Goes-Commercial-Now-Offered-as-a-Service-to-Cybercri
url: https://thehackernews.com/2023/11/play-ransomware-goes-commercial-now.html
content:
The ransomware strain known as&nbsp;Play&nbsp;is now being offered to other threat actors "as a service," new evidence unearthed by Adlumin has revealed.
"The unusual lack of even small variations between attacks suggests that they are being carried out by affiliates who have purchased the ransomware-as-a-service (RaaS) and are following step-by-step instructions from playbooks delivered with it


feed_id: https://thehackernews.com/2023/12/new-stealthy-krasue-linux-trojan.html
title: New Stealthy 'Krasue' Linux Trojan Targeting Telecom Firms in Thailand
uri: New-Stealthy-Krasue-Linux-Trojan-Targeting-Telecom-Firms-in-Thailand
url: https://thehackernews.com/2023/12/new-stealthy-krasue-linux-trojan.html
content:
A previously unknown Linux remote access trojan called Krasue has been observed targeting telecom companies in Thailand by threat actors to main covert access to victim networks at lease since 2021.
Named after a&nbsp;nocturnal female spirit&nbsp;of Southeast Asian folklore, the malware is "able to conceal its own presence during the initialization phase," Group-IB&nbsp;said&nbsp;in a report


feed_id: https://thehackernews.com/2023/12/meta-launches-default-end-to-end.html
title: Meta Launches Default End-to-End Encryption for Chats and Calls on Messenger
uri: Meta-Launches-Default-End-to-End-Encryption-for-Chats-and-Calls-on-Mes
url: https://thehackernews.com/2023/12/meta-launches-default-end-to-end.html
content:
Meta has officially begun to&nbsp;roll out&nbsp;support for end-to-end encryption (E2EE) in Messenger for personal calls and one-to-one personal messages by default in what it called the "most significant milestone yet."
"This isn't a routine security update: we rebuilt the app from the ground up, in close consultation with privacy and safety experts," Loredana Crisan, vice president of


feed_id: https://thehackernews.com/2023/12/alert-threat-actors-can-leverage-aws.html
title: Alert: Threat Actors Can Leverage AWS STS to Infiltrate Cloud Accounts
uri: Alert-Threat-Actors-Can-Leverage-AWS-STS-to-Infiltrate-Cloud-Accounts
url: https://thehackernews.com/2023/12/alert-threat-actors-can-leverage-aws.html
content:
Threat actors can take advantage of Amazon Web Services Security Token Service (AWS STS) as a way to infiltrate cloud accounts and conduct follow-on attacks.
The service enables threat actors to impersonate user identities and roles in cloud environments, Red Canary researchers Thomas Gardner and Cody Betsworth&nbsp;said&nbsp;in a Tuesday analysis.
AWS STS is a&nbsp;web service&nbsp;that enables


feed_id: https://thehackernews.com/2023/12/new-report-unveiling-threat-of.html
title: New Report: Unveiling the Threat of Malicious Browser Extensions
uri: New-Report-Unveiling-the-Threat-of-Malicious-Browser-Extensions
url: https://thehackernews.com/2023/12/new-report-unveiling-threat-of.html
content:
Compromising the browser is a high-return target for adversaries. Browser extensions, which are small software modules that are added to the browser and can enhance browsing experiences, have become a popular browser attack vector. This is because they are widely adopted among users and can easily turn malicious through developer actions or attacks on legitimate extensions.
Recent incidents like


feed_id: https://thehackernews.com/2023/12/sierra21-flaws-in-sierra-wireless.html
title: Sierra:21 - Flaws in Sierra Wireless Routers Expose Critical Sectors to Cyber Attacks
uri: Sierra-21-Flaws-in-Sierra-Wireless-Routers-Expose-Critical-Sectors-t
url: https://thehackernews.com/2023/12/sierra21-flaws-in-sierra-wireless.html
content:
A collection of 21 security flaws have been discovered in Sierra Wireless AirLink cellular routers and open-source software components like&nbsp;TinyXML&nbsp;and&nbsp;OpenNDS.
Collectively tracked as&nbsp;Sierra:21, the issues expose over 86,000 devices across critical sectors like energy, healthcare, waste management, retail, emergency services, and vehicle tracking to cyber threats, according


feed_id: https://thehackernews.com/2023/12/scaling-security-operations-with.html
title: Scaling Security Operations with Automation
uri: Scaling-Security-Operations-with-Automation
url: https://thehackernews.com/2023/12/scaling-security-operations-with.html
content:
In an increasingly complex and fast-paced digital landscape, organizations strive to protect themselves from various security threats. However, limited resources often hinder security teams when combatting these threats, making it difficult to keep up with the growing number of security incidents and alerts. Implementing automation throughout security operations helps security teams alleviate


feed_id: https://thehackernews.com/2023/12/hackers-exploited-coldfusion.html
title: Hackers Exploited ColdFusion Vulnerability to Breach Federal Agency Servers
uri: Hackers-Exploited-ColdFusion-Vulnerability-to-Breach-Federal-Agency-Se
url: https://thehackernews.com/2023/12/hackers-exploited-coldfusion.html
content:
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned of active exploitation of a&nbsp;high-severity Adobe ColdFusion vulnerability&nbsp;by unidentified threat actors to gain initial access to government servers.
"The vulnerability in ColdFusion (CVE-2023-26360) presents as an improper access control issue and exploitation of this CVE can result in arbitrary code execution,"


feed_id: https://thehackernews.com/2023/12/atlassian-releases-critical-software.html
title: Atlassian Releases Critical Software Fixes to Prevent Remote Code Execution
uri: Atlassian-Releases-Critical-Software-Fixes-to-Prevent-Remote-Code-Exec
url: https://thehackernews.com/2023/12/atlassian-releases-critical-software.html
content:
Atlassian has released software fixes to address&nbsp;four critical flaws&nbsp;in its software that, if successfully exploited, could result in remote code execution.
The list of vulnerabilities is below -

CVE-2022-1471&nbsp;(CVSS score: 9.8) - Deserialization vulnerability in&nbsp;SnakeYAML library&nbsp;that can lead to remote code execution in multiple products
CVE-2023-22522&nbsp;(CVSS score


feed_id: https://thehackernews.com/2023/12/qualcomm-releases-details-on-chip.html
title: Qualcomm Releases Details on Chip Vulnerabilities Exploited in Targeted Attacks
uri: Qualcomm-Releases-Details-on-Chip-Vulnerabilities-Exploited-in-Targete
url: https://thehackernews.com/2023/12/qualcomm-releases-details-on-chip.html
content:
Chipmaker Qualcomm has released more information about three high-severity security flaws that it said came under "limited, targeted exploitation" back in October 2023.
The&nbsp;vulnerabilities&nbsp;are as follows -

CVE-2023-33063&nbsp;(CVSS score: 7.8) - Memory corruption in DSP Services during a remote call from HLOS to DSP.
CVE-2023-33106&nbsp;(CVSS score: 8.4) - Memory corruption in


feed_id: https://thehackernews.com/2023/12/warning-for-iphone-users-experts-warn.html
title: Warning for iPhone Users: Experts Warn of Sneaky Fake Lockdown Mode Attack
uri: Warning-for-iPhone-Users-Experts-Warn-of-Sneaky-Fake-Lockdown-Mode-At
url: https://thehackernews.com/2023/12/warning-for-iphone-users-experts-warn.html
content:
A new "post-exploitation tampering technique" can be abused by malicious actors to visually deceive a target into believing that their Apple iPhone is running in Lockdown Mode when it's actually not and carry out covert attacks.
The novel method, detailed by Jamf Threat Labs in a&nbsp;report&nbsp;shared with The Hacker News, "shows that if a hacker has already infiltrated your device, they can


feed_id: https://thehackernews.com/2023/12/russias-ai-powered-disinformation.html
title: Russia's AI-Powered Disinformation Operation Targeting Ukraine, U.S., and Germany
uri: Russia-s-AI-Powered-Disinformation-Operation-Targeting-Ukraine-U-S
url: https://thehackernews.com/2023/12/russias-ai-powered-disinformation.html
content:
The Russia-linked influence operation called Doppelganger has targeted Ukrainian, U.S., and German audiences through a combination of inauthentic news sites and social media accounts.
These campaigns are designed to amplify content designed to undermine Ukraine as well as propagate anti-LGBTQ+ sentiment, U.S. military competence, and Germany's economic and social issues, according to a new


feed_id: https://thehackernews.com/2023/12/generative-ai-security-preventing.html
title: Generative AI Security: Preventing Microsoft Copilot Data Exposure
uri: Generative-AI-Security-Preventing-Microsoft-Copilot-Data-Exposure
url: https://thehackernews.com/2023/12/generative-ai-security-preventing.html
content:
Microsoft Copilot has been called one of the most powerful productivity tools on the planet.
Copilot is an AI assistant that lives inside each of your Microsoft 365 apps — Word, Excel, PowerPoint, Teams, Outlook, and so on. Microsoft's dream is to take the drudgery out of daily work and let humans focus on being creative problem-solvers.
What makes Copilot a different beast than ChatGPT and


feed_id: https://thehackernews.com/2023/12/15000-go-module-repositories-on-github.html
title: 15,000 Go Module Repositories on GitHub Vulnerable to Repojacking Attack
uri: 15-000-Go-Module-Repositories-on-GitHub-Vulnerable-to-Repojacking-Atta
url: https://thehackernews.com/2023/12/15000-go-module-repositories-on-github.html
content:
New research has found that over 15,000 Go module repositories on GitHub are vulnerable to an attack called repojacking.
"More than 9,000 repositories are vulnerable to repojacking due to GitHub username changes," Jacob Baines, chief technology officer at VulnCheck,&nbsp;said&nbsp;in a report shared with The Hacker News. "More than 6,000 repositories were vulnerable to repojacking due to account


feed_id: https://thehackernews.com/2023/12/new-threat-actor-aeroblade-emerges-in.html
title: New Threat Actor 'AeroBlade' Emerges in Espionage Attack on U.S. Aerospace
uri: New-Threat-Actor-AeroBlade-Emerges-in-Espionage-Attack-on-U-S-Aeros
url: https://thehackernews.com/2023/12/new-threat-actor-aeroblade-emerges-in.html
content:
A previously undocumented threat actor has been linked to a cyber attack targeting an aerospace organization in the U.S. as part of what's suspected to be a cyber espionage mission.
The BlackBerry Threat Research and Intelligence team is tracking the activity cluster as&nbsp;AeroBlade. Its origin is currently unknown and it's not clear if the attack was successful.
"The actor used spear-phishing


feed_id: https://thehackernews.com/2023/12/microsoft-warns-of-kremlin-backed-apt28.html
title: Microsoft Warns of Kremlin-Backed APT28 Exploiting Critical Outlook Vulnerability
uri: Microsoft-Warns-of-Kremlin-Backed-APT28-Exploiting-Critical-Outlook-Vu
url: https://thehackernews.com/2023/12/microsoft-warns-of-kremlin-backed-apt28.html
content:
Microsoft on Monday said it detected Kremlin-backed nation-state activity exploiting a now-patched critical security flaw in its Outlook email service to gain unauthorized access to victims' accounts within Exchange servers.
The tech giant&nbsp;attributed&nbsp;the intrusions to a threat actor it called&nbsp;Forest Blizzard&nbsp;(formerly Strontium), which is also widely tracked under the


feed_id: https://thehackernews.com/2023/12/new-bluffs-bluetooth-attack-expose.html
title: New BLUFFS Bluetooth Attack Expose Devices to Adversary-in-the-Middle Attacks
uri: New-BLUFFS-Bluetooth-Attack-Expose-Devices-to-Adversary-in-the-Middle
url: https://thehackernews.com/2023/12/new-bluffs-bluetooth-attack-expose.html
content:
New research has unearthed multiple novel attacks that break Bluetooth Classic's forward secrecy and future secrecy guarantees, resulting in adversary-in-the-middle (AitM) scenarios between two already connected peers.
The issues, collectively named&nbsp;BLUFFS, impact Bluetooth Core Specification 4.2 through 5.4. They are tracked under the identifier&nbsp;CVE-2023-24023&nbsp;(CVSS score: 6.8)


feed_id: https://thehackernews.com/2023/12/make-fresh-start-for-2024-clean-out.html
title: Make a Fresh Start for 2024: Clean Out Your User Inventory to Reduce SaaS Risk
uri: Make-a-Fresh-Start-for-2024-Clean-Out-Your-User-Inventory-to-Reduce-S
url: https://thehackernews.com/2023/12/make-fresh-start-for-2024-clean-out.html
content:
As work ebbs with the typical end-of-year slowdown, now is a good time to review user roles and privileges and remove anyone who shouldn’t have access as well as trim unnecessary permissions. In addition to saving some unnecessary license fees, a clean user inventory significantly enhances the security of your SaaS applications. From reducing risk to protecting against data leakage, here is how


feed_id: https://thehackernews.com/2023/12/new-p2pinfect-botnet-mips-variant.html
title: New P2PInfect Botnet MIPS Variant Targeting Routers and IoT Devices
uri: New-P2PInfect-Botnet-MIPS-Variant-Targeting-Routers-and-IoT-Devices
url: https://thehackernews.com/2023/12/new-p2pinfect-botnet-mips-variant.html
content:
Cybersecurity researchers have discovered a new variant of an emerging botnet called&nbsp;P2PInfect&nbsp;that's capable of targeting routers and IoT devices.
The latest version, per Cado Security Labs, is compiled for Microprocessor without Interlocked Pipelined Stages (MIPS) architecture, broadening its capabilities and reach.
"It's highly likely that by targeting MIPS, the P2PInfect developers


feed_id: https://thehackernews.com/2023/12/logofail-uefi-vulnerabilities-expose.html
title: LogoFAIL: UEFI Vulnerabilities Expose Devices to Stealth Malware Attacks
uri: LogoFAIL-UEFI-Vulnerabilities-Expose-Devices-to-Stealth-Malware-Attac
url: https://thehackernews.com/2023/12/logofail-uefi-vulnerabilities-expose.html
content:
The Unified Extensible Firmware Interface (UEFI) code from various independent firmware/BIOS vendors (IBVs) has been found vulnerable to potential attacks through high-impact flaws in image parsing libraries embedded into the firmware.
The shortcomings, collectively labeled&nbsp;LogoFAIL&nbsp;by Binarly, "can be used by threat actors to deliver a malicious payload and bypass Secure Boot, Intel


feed_id: https://thehackernews.com/2023/12/microsoft-warns-of-malvertising-scheme.html
title: Microsoft Warns of Malvertising Scheme Spreading CACTUS Ransomware
uri: Microsoft-Warns-of-Malvertising-Scheme-Spreading-CACTUS-Ransomware
url: https://thehackernews.com/2023/12/microsoft-warns-of-malvertising-scheme.html
content:
Microsoft has warned of a new wave of CACTUS ransomware attacks that leverage malvertising lures to deploy DanaBot as an initial access vector.
The DanaBot infections led to "hands-on-keyboard activity by ransomware operator Storm-0216 (Twisted Spider, UNC2198), culminating in the deployment of CACTUS ransomware," the Microsoft Threat Intelligence team&nbsp;said&nbsp;in a series of posts on X (


feed_id: https://thehackernews.com/2023/12/microsoft-warns-of-coldrivers-evolving.html
title: Microsoft Warns of COLDRIVER's Evolving Evading and Credential-Stealing Tactics
uri: Microsoft-Warns-of-COLDRIVER-s-Evolving-Evading-and-Credential-Stealin
url: https://thehackernews.com/2023/12/microsoft-warns-of-coldrivers-evolving.html
content:
The threat actor known as COLDRIVER has continued to engage in credential theft activities against entities that are of strategic interests to Russia while simultaneously improving its detection evasion capabilities.
The Microsoft Threat Intelligence team is tracking under the cluster as&nbsp;Star Blizzard&nbsp;(formerly SEABORGIUM). It's also called Blue Callisto, BlueCharlie (or TAG-53),


feed_id: https://thehackernews.com/2023/12/new-bluetooth-flaw-let-hackers-take.html
title: New Bluetooth Flaw Let Hackers Take Over Android, Linux, macOS, and iOS Devices
uri: New-Bluetooth-Flaw-Let-Hackers-Take-Over-Android-Linux-macOS-and-iO
url: https://thehackernews.com/2023/12/new-bluetooth-flaw-let-hackers-take.html
content:
A critical Bluetooth security flaw could be exploited by threat actors to take control of Android, Linux, macOS and iOS devices.
Tracked as&nbsp;CVE-2023-45866, the issue relates to a case of authentication bypass that enables attackers to connect to susceptible devices and inject keystrokes to achieve code execution as the victim.
"Multiple Bluetooth stacks have authentication bypass


feed_id: https://thehackernews.com/2023/12/hacking-human-mind-exploiting.html
title: Hacking the Human Mind: Exploiting Vulnerabilities in the 'First Line of Cyber Defense'
uri: Hacking-the-Human-Mind-Exploiting-Vulnerabilities-in-the-First-Line
url: https://thehackernews.com/2023/12/hacking-human-mind-exploiting.html
content:
Humans are complex beings with consciousness, emotions, and the capacity to act based on thoughts. In the ever-evolving realm of cybersecurity, humans consistently remain primary targets for attackers. Over the years, these attackers have developed their expertise in exploiting various human qualities, sharpening their skills to manipulate biases and emotional triggers with the objective of


feed_id: https://thehackernews.com/2023/12/building-robust-threat-intelligence.html
title: Building a Robust Threat Intelligence with Wazuh
uri: Building-a-Robust-Threat-Intelligence-with-Wazuh
url: https://thehackernews.com/2023/12/building-robust-threat-intelligence.html
content:
Threat intelligence refers to gathering, processing, and analyzing cyber threats, along with proactive defensive measures aimed at strengthening security. It enables organizations to gain a comprehensive insight into historical, present, and anticipated threats, providing context about the constantly evolving threat landscape.
Importance of threat intelligence in the cybersecurity ecosystem


feed_id: https://thehackernews.com/2023/12/governments-may-spy-on-you-by.html
title: Governments May Spy on You by Requesting Push Notifications from Apple and Google
uri: Governments-May-Spy-on-You-by-Requesting-Push-Notifications-from-Apple
url: https://thehackernews.com/2023/12/governments-may-spy-on-you-by.html
content:
Unspecified governments have demanded mobile push notification records from Apple and Google users to pursue people of interest, according to U.S. Senator Ron Wyden.
"Push notifications are alerts sent by phone apps to users' smartphones," Wyden&nbsp;said.
"These alerts pass through a digital post office run by the phone operating system provider -- overwhelmingly Apple or Google. Because of


feed_id: https://thehackernews.com/2023/12/slam-attack-new-spectre-based.html
title: SLAM Attack: New Spectre-based Vulnerability Impacts Intel, AMD, and Arm CPUs
uri: SLAM-Attack-New-Spectre-based-Vulnerability-Impacts-Intel-AMD-and-A
url: https://thehackernews.com/2023/12/slam-attack-new-spectre-based.html
content:
Researchers from the Vrije Universiteit Amsterdam have disclosed a new side-channel attack called&nbsp;SLAM&nbsp;that could be exploited to leak sensitive information from kernel memory on current and upcoming CPUs from Intel, AMD, and Arm.
The attack is an end-to-end exploit for Spectre based on a new feature in Intel CPUs called&nbsp;Linear Address Masking&nbsp;(LAM) as well as its analogous


feed_id: https://thehackernews.com/2023/12/researchers-unveal-guloader-malwares.html
title: Researchers Unveal GuLoader Malware's Latest Anti-Analysis Techniques
uri: Researchers-Unveal-GuLoader-Malware-s-Latest-Anti-Analysis-Techniques
url: https://thehackernews.com/2023/12/researchers-unveal-guloader-malwares.html
content:
Threat hunters have unmasked the latest tricks adopted by a malware strain called&nbsp;GuLoader&nbsp;in an effort to make analysis more challenging.
"While GuLoader's core functionality hasn't changed drastically over the past few years, these constant updates in their obfuscation techniques make analyzing GuLoader a time-consuming and resource-intensive process," Elastic Security Labs


feed_id: https://thehackernews.com/2023/12/new-5g-modems-flaws-affect-ios-devices.html
title: New 5G Modem Flaws Affect iOS Devices and Android Models from Major Brands
uri: New-5G-Modem-Flaws-Affect-iOS-Devices-and-Android-Models-from-Major-Br
url: https://thehackernews.com/2023/12/new-5g-modems-flaws-affect-ios-devices.html
content:
A collection of security flaws in the firmware implementation of 5G mobile network modems from major chipset vendors such as MediaTek and Qualcomm impact USB and IoT modems as well as hundreds of smartphone models running Android and iOS.
Of the 14 flaws – collectively called&nbsp;5Ghoul&nbsp;(a combination of "5G" and "Ghoul") – 10 affect 5G modems from the two companies, out of which three


feed_id: https://thehackernews.com/2023/12/n-korean-kimsuky-targeting-south-korean.html
title: N. Korea's Kimsuky Targeting South Korean Research Institutes with Backdoor Attacks
uri: N-Korea-s-Kimsuky-Targeting-South-Korean-Research-Institutes-with-Bac
url: https://thehackernews.com/2023/12/n-korean-kimsuky-targeting-south-korean.html
content:
The North Korean threat actor known as&nbsp;Kimsuky&nbsp;has been observed targeting research institutes in South Korea as part of a spear-phishing campaign with the ultimate goal of distributing backdoors on compromised systems.
"The threat actor ultimately uses a backdoor to steal information and execute commands," the AhnLab Security Emergency Response Center (ASEC)&nbsp;said&nbsp;in an


feed_id: https://thehackernews.com/2023/12/ransomware-as-service-growing-threat.html
title: Ransomware-as-a-Service: The Growing Threat You Can't Ignore
uri: Ransomware-as-a-Service-The-Growing-Threat-You-Can-t-Ignore
url: https://thehackernews.com/2023/12/ransomware-as-service-growing-threat.html
content:
Ransomware attacks&nbsp;have become a significant and pervasive threat in the ever-evolving realm of cybersecurity. Among the various iterations of ransomware, one trend that has gained prominence is Ransomware-as-a-Service (RaaS). This alarming development has transformed the cybercrime landscape, enabling individuals with limited technical expertise to carry out devastating attacks.


feed_id: https://thehackernews.com/2023/12/mac-users-beware-new-trojan-proxy.html
title: Mac Users Beware: New Trojan-Proxy Malware Spreading via Pirated Software
uri: Mac-Users-Beware-New-Trojan-Proxy-Malware-Spreading-via-Pirated-Softw
url: https://thehackernews.com/2023/12/mac-users-beware-new-trojan-proxy.html
content:
Unauthorized websites distributing trojanized versions of cracked software have been found to infect Apple macOS users with a new&nbsp;Trojan-Proxy&nbsp;malware.
"Attackers can use this type of malware to gain money by building a proxy server network or to perform criminal acts on behalf of the victim: to launch attacks on websites, companies and individuals, buy guns, drugs, and other illicit


feed_id: https://thehackernews.com/2023/12/wordpress-releases-update-642-to.html
title: WordPress Releases Update 6.4.2 to Address Critical Remote Attack Vulnerability
uri: WordPress-Releases-Update-6-4-2-to-Address-Critical-Remote-Attack-Vuln
url: https://thehackernews.com/2023/12/wordpress-releases-update-642-to.html
content:
WordPress has released version 6.4.2 with a patch for a critical security flaw that could be exploited by threat actors by combining it with another bug to execute arbitrary PHP code on vulnerable sites.
"A remote code execution vulnerability that is not directly exploitable in core; however, the security team feels that there is a potential for high severity when combined with some plugins,


feed_id: https://thehackernews.com/2023/12/founder-of-bitzlato-cryptocurrency.html
title: Founder of Bitzlato Cryptocurrency Exchange Pleads Guilty in Money-Laundering Scheme
uri: Founder-of-Bitzlato-Cryptocurrency-Exchange-Pleads-Guilty-in-Money-Lau
url: https://thehackernews.com/2023/12/founder-of-bitzlato-cryptocurrency.html
content:
The Russian founder of the now-defunct Bitzlato cryptocurrency exchange has pleaded guilty, nearly 11 months after he was&nbsp;arrested in Miami&nbsp;earlier this year.
Anatoly Legkodymov (aka Anatolii Legkodymov, Gandalf, and Tolik), according to the U.S. Justice Department, admitted to operating an unlicensed money-transmitting business that enabled other criminal actors to launder their


feed_id: https://thehackernews.com/2023/12/116-malware-packages-found-on-pypi.html
title: 116 Malware Packages Found on PyPI Repository Infecting Windows and Linux Systems
uri: 116-Malware-Packages-Found-on-PyPI-Repository-Infecting-Windows-and-Li
url: https://thehackernews.com/2023/12/116-malware-packages-found-on-pypi.html
content:
Cybersecurity researchers have identified a set of 116 malicious packages on the Python Package Index (PyPI) repository that are designed to infect Windows and Linux systems with a custom backdoor.
"In some cases, the final payload is a variant of the infamous&nbsp;W4SP Stealer, or a simple clipboard monitor to steal cryptocurrency, or both," ESET researchers Marc-Etienne M.Léveillé and Rene


feed_id: https://thehackernews.com/2023/12/new-pierogi-malware-by-gaza-cyber-gang.html
title: New Pierogi++ Malware by Gaza Cyber Gang Targeting Palestinian Entities
uri: New-Pierogi-Malware-by-Gaza-Cyber-Gang-Targeting-Palestinian-Entitie
url: https://thehackernews.com/2023/12/new-pierogi-malware-by-gaza-cyber-gang.html
content:
A pro-Hamas threat actor known as&nbsp;Gaza Cyber Gang&nbsp;is targeting Palestinian entities using an updated version of a backdoor dubbed Pierogi.
The findings come from SentinelOne, which has given the malware the name Pierogi++ owing to the fact that it's implemented in the C++ programming language unlike its Delphi- and Pascal-based predecessor.
"Recent Gaza Cybergang activities show


feed_id: https://thehackernews.com/2023/12/iranian-state-sponsored-oilrig-group.html
title: Iranian State-Sponsored OilRig Group Deploys 3 New Malware Downloaders
uri: Iranian-State-Sponsored-OilRig-Group-Deploys-3-New-Malware-Downloaders
url: https://thehackernews.com/2023/12/iranian-state-sponsored-oilrig-group.html
content:
The Iranian state-sponsored threat actor known as&nbsp;OilRig&nbsp;deployed three different downloader malware throughout 2022 to maintain persistent access to victim organizations located in Israel.
The three new downloaders have been named ODAgent, OilCheck, and OilBooster by Slovak cybersecurity company ESET. The attacks also involved the use of an updated version of a known OilRig downloader


feed_id: https://thehackernews.com/2023/12/reimagining-network-pentesting-with-automation.html
title: Reimagining Network Pentesting With Automation
uri: Reimagining-Network-Pentesting-With-Automation
url: https://thehackernews.com/2023/12/reimagining-network-pentesting-with-automation.html
content:
Network penetration testing plays a crucial role in protecting businesses in the ever-evolving world of cybersecurity. Yet, business leaders and IT pros have misconceptions about this process, which impacts their security posture and decision-making.&nbsp;
This blog acts as a quick guide on network penetration testing, explaining what it is, debunking common myths and reimagining its role in


feed_id: https://thehackernews.com/2023/12/russian-svr-linked-apt29-targets.html
title: Russian SVR-Linked APT29 Targets JetBrains TeamCity Servers in Ongoing Attacks
uri: Russian-SVR-Linked-APT29-Targets-JetBrains-TeamCity-Servers-in-Ongoing
url: https://thehackernews.com/2023/12/russian-svr-linked-apt29-targets.html
content:
Threat actors affiliated with the Russian Foreign Intelligence Service (SVR) have targeted unpatched JetBrains TeamCity servers in widespread attacks since September 2023.
The activity has been tied to a nation-state group known as&nbsp;APT29, which is also tracked as BlueBravo, Cloaked Ursa, Cozy Bear, Midnight Blizzard (formerly Nobelium), and The Dukes. It's notable for the supply chain


feed_id: https://thehackernews.com/2023/12/new-hacker-group-gambleforce-tageting.html
title: New Hacker Group 'GambleForce' Tageting APAC Firms Using SQL Injection Attacks
uri: New-Hacker-Group-GambleForce-Tageting-APAC-Firms-Using-SQL-Injection
url: https://thehackernews.com/2023/12/new-hacker-group-gambleforce-tageting.html
content:
A previously unknown hacker outfit called&nbsp;GambleForce&nbsp;has been attributed to a series of SQL injection attacks against companies primarily in the Asia-Pacific (APAC) region since at least September 2023.
"GambleForce uses a set of basic yet very effective techniques, including SQL injections and the exploitation of vulnerable website content management systems (CMS) to steal sensitive


feed_id: https://thehackernews.com/2023/12/microsoft-takes-legal-action-to-crack.html
title: Microsoft Takes Legal Action to Crack Down on Storm-1152's Cybercrime Network
uri: Microsoft-Takes-Legal-Action-to-Crack-Down-on-Storm-1152-s-Cybercrime
url: https://thehackernews.com/2023/12/microsoft-takes-legal-action-to-crack.html
content:
Microsoft on Wednesday said it obtained a court order to seize infrastructure set up by a group called Storm-1152 that peddled roughly 750 million fraudulent Microsoft accounts and tools through a network of bogus websites and social media pages to other criminal actors, netting the operators millions of dollars in illicit revenue.
"Fraudulent online accounts act as the gateway to a host of


feed_id: https://thehackernews.com/2023/12/bazacall-phishing-scammers-now.html
title: BazaCall Phishing Scammers Now Leveraging Google Forms for Deception
uri: BazaCall-Phishing-Scammers-Now-Leveraging-Google-Forms-for-Deception
url: https://thehackernews.com/2023/12/bazacall-phishing-scammers-now.html
content:
The threat actors behind the&nbsp;BazaCall&nbsp;call back phishing attacks have been observed leveraging Google Forms to lend the scheme a veneer of credibility.
The method is an "attempt to elevate the perceived authenticity of the initial malicious emails," cybersecurity firm Abnormal Security&nbsp;said&nbsp;in a report published today.
BazaCall&nbsp;(aka BazarCall), which was&nbsp;first


feed_id: https://thehackernews.com/2023/12/google-using-clang-sanitizers-to.html
title: Google Using Clang Sanitizers to Protect Android Against Cellular Baseband Vulnerabilities
uri: Google-Using-Clang-Sanitizers-to-Protect-Android-Against-Cellular-Base
url: https://thehackernews.com/2023/12/google-using-clang-sanitizers-to.html
content:
Google is highlighting the role played by&nbsp;Clang sanitizers&nbsp;in hardening the security of the cellular baseband in the&nbsp;Android operating system&nbsp;and preventing specific kinds of vulnerabilities.
This comprises Integer Overflow Sanitizer (IntSan) and BoundsSanitizer (BoundSan), both of which are part of UndefinedBehaviorSanitizer (UBSan), a tool designed to catch various kinds of


feed_id: https://thehackernews.com/2023/12/how-to-analyze-malwares-network-traffic.html
title: How to Analyze Malware’s Network Traffic in A Sandbox
uri: How-to-Analyze-Malware-s-Network-Traffic-in-A-Sandbox
url: https://thehackernews.com/2023/12/how-to-analyze-malwares-network-traffic.html
content:
Malware analysis encompasses a broad range of activities, including examining the malware's network traffic. To be effective at it, it's crucial to understand the common challenges and how to overcome them. Here are three prevalent issues you may encounter and the tools you'll need to address them.
Decrypting HTTPS traffic
Hypertext Transfer Protocol Secure (HTTPS), the protocol for secure


feed_id: https://thehackernews.com/2023/12/microsoft-warns-of-hackers-exploiting.html
title: Microsoft Warns of Hackers Exploiting OAuth for Cryptocurrency Mining and Phishing
uri: Microsoft-Warns-of-Hackers-Exploiting-OAuth-for-Cryptocurrency-Mining
url: https://thehackernews.com/2023/12/microsoft-warns-of-hackers-exploiting.html
content:
Microsoft has warned that adversaries are using OAuth applications as an automation tool to deploy virtual machines (VMs) for cryptocurrency mining and launch phishing attacks.
"Threat actors compromise user accounts to create, modify, and grant high privileges to OAuth applications that they can misuse to hide malicious activity," the Microsoft Threat Intelligence team&nbsp;said&nbsp;in an


feed_id: https://thehackernews.com/2023/12/major-cyber-attack-paralyzes-kyivstar.html
title: Major Cyber Attack Paralyzes Kyivstar - Ukraine's Largest Telecom Operator
uri: Major-Cyber-Attack-Paralyzes-Kyivstar-Ukraine-s-Largest-Telecom-Oper
url: https://thehackernews.com/2023/12/major-cyber-attack-paralyzes-kyivstar.html
content:
Ukraine's biggest telecom operator Kyivstar has&nbsp;become&nbsp;the victim of a "powerful hacker attack,” disrupting customer&nbsp;access to mobile and internet services.
"The cyberattack on Ukraine's #Kyivstar telecoms operator has impacted all regions of the country with high impact to the capital, metrics show, with knock-on impacts reported to air raid alert network and banking sector as


feed_id: https://thehackernews.com/2023/12/microsofts-final-2023-patch-tuesday-33.html
title: Microsoft's Final 2023 Patch Tuesday: 33 Flaws Fixed, Including 4 Critical
uri: Microsoft-s-Final-2023-Patch-Tuesday-33-Flaws-Fixed-Including-4-Crit
url: https://thehackernews.com/2023/12/microsofts-final-2023-patch-tuesday-33.html
content:
Microsoft released its final set of Patch Tuesday updates for 2023, closing out&nbsp;33 flaws&nbsp;in its software, making it one of the lightest releases in recent years.
Of the 33 shortcomings, four are rated Critical and 29 are rated Important in severity. The fixes are in addition to&nbsp;18 flaws&nbsp;Microsoft addressed in its Chromium-based Edge browser since the release of&nbsp;Patch


feed_id: https://thehackernews.com/2023/12/unveiling-cyber-threats-to-healthcare.html
title: Unveiling the Cyber Threats to Healthcare: Beyond the Myths
uri: Unveiling-the-Cyber-Threats-to-Healthcare-Beyond-the-Myths
url: https://thehackernews.com/2023/12/unveiling-cyber-threats-to-healthcare.html
content:
Let's begin with a thought-provoking question: among a credit card number, a social security number, and an Electronic Health Record (EHR),&nbsp;which commands the highest price on a dark web forum?&nbsp;
Surprisingly, it's the EHR, and the difference is stark: according to a&nbsp;study, EHRs can sell for up to $1,000 each, compared to a mere $5 for a credit card number and $1 for a social


feed_id: https://thehackernews.com/2023/12/russian-apt28-hackers-targeting-13.html
title: Russian APT28 Hackers Targeting 13 Nations in Ongoing Cyber Espionage Campaign
uri: Russian-APT28-Hackers-Targeting-13-Nations-in-Ongoing-Cyber-Espionage
url: https://thehackernews.com/2023/12/russian-apt28-hackers-targeting-13.html
content:
The Russian nation-state threat actor known as&nbsp;APT28&nbsp;has been observed making use of lures related to the ongoing Israel-Hamas war to facilitate the delivery of a custom backdoor called HeadLace.
IBM X-Force is tracking the adversary under the name ITG05, which is also known as BlueDelta, Fancy Bear, Forest Blizzard (formerly Strontium), FROZENLAKE, Iron Twilight, Sednit, Sofacy, and


feed_id: https://thehackernews.com/2023/12/non-human-access-is-path-of-least.html
title: Non-Human Access is the Path of Least Resistance: A 2023 Recap
uri: Non-Human-Access-is-the-Path-of-Least-Resistance-A-2023-Recap
url: https://thehackernews.com/2023/12/non-human-access-is-path-of-least.html
content:
2023 has seen its fair share of cyber attacks, however there’s one attack vector that proves to be more prominent than others - non-human access. With&nbsp;11 high-profile attacks in 13 months&nbsp;and an ever-growing ungoverned attack surface, non-human identities are the new perimeter, and 2023 is only the beginning.&nbsp;
Why non-human access is a cybercriminal’s paradise&nbsp;
People always


feed_id: https://thehackernews.com/2023/12/new-mranon-stealer-targeting-german-it.html
title: New MrAnon Stealer Malware Targeting German Users via Booking-Themed Scam
uri: New-MrAnon-Stealer-Malware-Targeting-German-Users-via-Booking-Themed-S
url: https://thehackernews.com/2023/12/new-mranon-stealer-targeting-german-it.html
content:
A phishing campaign has been observed delivering an information stealer malware called&nbsp;MrAnon Stealer&nbsp;to unsuspecting victims via seemingly benign booking-themed PDF lures.
"This malware is a Python-based information stealer compressed with cx-Freeze to evade detection," Fortinet FortiGuard Labs researcher Cara Lin&nbsp;said. "MrAnon Stealer steals its victims' credentials, system


feed_id: https://thehackernews.com/2023/12/apple-releases-security-updates-to.html
title: Apple Releases Security Updates to Patch Critical iOS and macOS Security Flaws
uri: Apple-Releases-Security-Updates-to-Patch-Critical-iOS-and-macOS-Securi
url: https://thehackernews.com/2023/12/apple-releases-security-updates-to.html
content:
Apple on Monday released&nbsp;security patches&nbsp;for iOS, iPadOS, macOS, tvOS, watchOS, and Safari web browser to address multiple security flaws, in addition to backporting fixes for two recently disclosed zero-days to older devices.
This includes updates for&nbsp;12 security vulnerabilities&nbsp;in iOS and iPadOS spanning AVEVideoEncoder, ExtensionKit, Find My, ImageIO, Kernel, Safari


feed_id: https://thehackernews.com/2023/12/new-critical-rce-vulnerability.html
title: New Critical RCE Vulnerability Discovered in Apache Struts 2 - Patch Now
uri: New-Critical-RCE-Vulnerability-Discovered-in-Apache-Struts-2-Patch-N
url: https://thehackernews.com/2023/12/new-critical-rce-vulnerability.html
content:
Apache has released a security advisory warning of a critical security flaw in the Struts 2 open-source web application framework that could result in remote code execution.
Tracked as&nbsp;CVE-2023-50164, the vulnerability is&nbsp;rooted&nbsp;in a flawed "file upload logic" that could enable unauthorized path traversal and could be exploited under the circumstances to upload a malicious file


feed_id: https://thehackernews.com/2023/12/researchers-unmask-sandman-apts-hidden.html
title: Researchers Unmask Sandman APT's Hidden Link to China-Based KEYPLUG Backdoor
uri: Researchers-Unmask-Sandman-APT-s-Hidden-Link-to-China-Based-KEYPLUG-Ba
url: https://thehackernews.com/2023/12/researchers-unmask-sandman-apts-hidden.html
content:
Tactical and targeting overlaps have been discovered between the enigmatic advanced persistent threat (APT) called&nbsp;Sandman&nbsp;and a China-based threat cluster that's known to use a backdoor referred to as KEYPLUG.
The assessment comes jointly from SentinelOne, PwC, and the Microsoft Threat Intelligence team based on the fact that the adversary's Lua-based malware LuaDream and KEYPLUG have


feed_id: https://thehackernews.com/2023/12/lazarus-group-using-log4j-exploits-to.html
title: Lazarus Group Using Log4j Exploits to Deploy Remote Access Trojans
uri: Lazarus-Group-Using-Log4j-Exploits-to-Deploy-Remote-Access-Trojans
url: https://thehackernews.com/2023/12/lazarus-group-using-log4j-exploits-to.html
content:
The notorious North Korea-linked threat actor known as the&nbsp;Lazarus Group&nbsp;has been attributed to a new global campaign that involves the opportunistic exploitation of security flaws in Log4j to deploy previously undocumented remote access trojans (RATs) on compromised hosts.
Cisco Talos is tracking the activity under the name Operation Blacksmith, noting the use of three DLang-based


feed_id: https://thehackernews.com/2023/12/playbook-your-first-100-days-as-vciso-5.html
title: Playbook: Your First 100 Days as a vCISO - 5 Steps to Success
uri: Playbook-Your-First-100-Days-as-a-vCISO-5-Steps-to-Success
url: https://thehackernews.com/2023/12/playbook-your-first-100-days-as-vciso-5.html
content:
In an increasingly digital world, no organization is spared from cyber threats. Yet, not every organization has the luxury of hiring a full-time, in-house CISO. This gap in cybersecurity leadership is where you, as a vCISO, come in. You are the person who will establish, develop, and solidify the organization's cybersecurity infrastructure, blending strategic guidance with actionable


feed_id: https://thehackernews.com/2023/12/spyloan-scandal-18-malicious-loan-apps.html
title: SpyLoan Scandal: 18 Malicious Loan Apps Defraud Millions of Android Users
uri: SpyLoan-Scandal-18-Malicious-Loan-Apps-Defraud-Millions-of-Android-Us
url: https://thehackernews.com/2023/12/spyloan-scandal-18-malicious-loan-apps.html
content:
Cybersecurity researchers have discovered 18&nbsp;malicious loan apps&nbsp;for Android on the Google Play Store that have been collectively downloaded over 12 million times.
"Despite their attractive appearance, these services are in fact designed to defraud users by offering them high-interest-rate loans endorsed with deceitful descriptions, all while collecting their victims' personal and


feed_id: https://thehackernews.com/2023/12/webinar-psychology-of-social.html
title: Webinar — Psychology of Social Engineering: Decoding the Mind of a Cyber Attacker
uri: Webinar-Psychology-of-Social-Engineering-Decoding-the-Mind-of-a-C
url: https://thehackernews.com/2023/12/webinar-psychology-of-social.html
content:
In the ever-evolving cybersecurity landscape, one method stands out for its chilling effectiveness – social engineering. But why does it work so well? The answer lies in the intricate dance between the attacker's mind and human psychology.
Our upcoming webinar,&nbsp;"Think Like a Hacker, Defend Like a Pro,"&nbsp;highlights this alarming trend. We delve deep into social engineering, exploring its


feed_id: https://thehackernews.com/2023/12/new-poolparty-process-injection.html
title: New PoolParty Process Injection Techniques Outsmart Top EDR Solutions
uri: New-PoolParty-Process-Injection-Techniques-Outsmart-Top-EDR-Solutions
url: https://thehackernews.com/2023/12/new-poolparty-process-injection.html
content:
A new collection of eight process injection techniques, collectively dubbed&nbsp;PoolParty, could be exploited to achieve code execution in Windows systems while evading endpoint detection and response (EDR) systems.
SafeBreach researcher Alon Leviev&nbsp;said&nbsp;the methods are "capable of working across all processes without any limitations, making them more flexible than existing process


feed_id: https://thehackernews.com/2023/12/rogue-wordpress-plugin-exposes-e.html
title: Rogue WordPress Plugin Exposes E-Commerce Sites to Credit Card Theft
uri: Rogue-WordPress-Plugin-Exposes-E-Commerce-Sites-to-Credit-Card-Theft
url: https://thehackernews.com/2023/12/rogue-wordpress-plugin-exposes-e.html
content:
Threat hunters have discovered a rogue WordPress plugin that's capable of creating bogus administrator users and injecting malicious JavaScript code to steal credit card information.
The skimming activity is part of a&nbsp;Magecart campaign&nbsp;targeting e-commerce websites, according to Sucuri.
"As with many other malicious or fake WordPress plugins it contains some deceptive information at


feed_id: https://thehackernews.com/2023/12/operation-rusticweb-rust-based-malware.html
title: Operation RusticWeb: Rust-Based Malware Targets Indian Government Entities
uri: Operation-RusticWeb-Rust-Based-Malware-Targets-Indian-Government-Enti
url: https://thehackernews.com/2023/12/operation-rusticweb-rust-based-malware.html
content:
Indian government entities and the defense sector have been targeted by a phishing campaign that's engineered to drop Rust-based malware for intelligence gathering.
The activity, first detected in October 2023, has been codenamed&nbsp;Operation RusticWeb&nbsp;by enterprise security firm SEQRITE.
"New Rust-based payloads and encrypted PowerShell commands have been utilized to exfiltrate


feed_id: https://thehackernews.com/2023/12/decoy-microsoft-word-documents-used-to.html
title: Decoy Microsoft Word Documents Used to Deliver Nim-Based Malware
uri: Decoy-Microsoft-Word-Documents-Used-to-Deliver-Nim-Based-Malware
url: https://thehackernews.com/2023/12/decoy-microsoft-word-documents-used-to.html
content:
A new phishing campaign is leveraging decoy Microsoft Word documents as bait to deliver a backdoor written in the&nbsp;Nim programming language.
"Malware written in uncommon programming languages puts the security community at a disadvantage as researchers and reverse engineers' unfamiliarity can hamper their investigation," Netskope researchers Ghanashyam Satpathy and Jan Michael Alcantara&nbsp


feed_id: https://thehackernews.com/2023/12/uac-0099-using-winrar-exploit-to-target.html
title: UAC-0099 Using WinRAR Exploit to Target Ukrainian Firms with LONEPAGE Malware
uri: UAC-0099-Using-WinRAR-Exploit-to-Target-Ukrainian-Firms-with-LONEPAGE
url: https://thehackernews.com/2023/12/uac-0099-using-winrar-exploit-to-target.html
content:
The threat actor known as&nbsp;UAC-0099&nbsp;has been linked to continued attacks aimed at Ukraine, some of which leverage a high-severity flaw in the WinRAR software to deliver a malware strain called LONEPAGE.
"The threat actor targets Ukrainian employees working for companies outside of Ukraine," cybersecurity firm Deep Instinct&nbsp;said&nbsp;in a Thursday analysis.
UAC-0099 was&nbsp;first


feed_id: https://thehackernews.com/2023/12/microsoft-warns-of-new-falsefont.html
title: Microsoft Warns of New 'FalseFont' Backdoor Targeting the Defense Sector
uri: Microsoft-Warns-of-New-FalseFont-Backdoor-Targeting-the-Defense-Sect
url: https://thehackernews.com/2023/12/microsoft-warns-of-new-falsefont.html
content:
Organizations in the Defense Industrial Base (DIB) sector are in the crosshairs of an Iranian threat actor as part of a campaign designed to deliver a never-before-seen backdoor called FalseFont.
The findings come from Microsoft, which is tracking the activity under its weather-themed moniker&nbsp;Peach Sandstorm&nbsp;(formerly Holmium), which is also known as APT33, Elfin, and Refined Kitten.
"


feed_id: https://thehackernews.com/2023/12/multi-million-dollar-predator-spyware.html
title: Experts Detail Multi-Million Dollar Licensing Model of Predator Spyware
uri: Experts-Detail-Multi-Million-Dollar-Licensing-Model-of-Predator-Spywar
url: https://thehackernews.com/2023/12/multi-million-dollar-predator-spyware.html
content:
A new analysis of the sophisticated commercial spyware called Predator has revealed that its ability to persist between reboots is offered as an "add-on feature" and that it depends on the licensing options opted by a customer.
"In 2021, Predator spyware couldn't survive a reboot on the infected Android system (it had it on iOS)," Cisco Talos researchers Mike Gentile, Asheer Malhotra, and Vitor


feed_id: https://thehackernews.com/2023/12/new-chameleon-android-banking-trojan.html
title: Chameleon Android Banking Trojan Variant Bypasses Biometric Authentication
uri: Chameleon-Android-Banking-Trojan-Variant-Bypasses-Biometric-Authentica
url: https://thehackernews.com/2023/12/new-chameleon-android-banking-trojan.html
content:
Cybersecurity researchers have discovered an updated version of an Android banking malware called Chameleon that has expanded its targeting to include users in the U.K. and Italy.
"Representing a restructured and enhanced iteration of its predecessor, this evolved Chameleon variant excels in executing Device Takeover (DTO) using the accessibility service, all while expanding its targeted region,


feed_id: https://thehackernews.com/2023/12/new-javascript-malware-targeted-50000.html
title: New JavaScript Malware Targeted 50,000+ Users at Dozens of Banks Worldwide
uri: New-JavaScript-Malware-Targeted-50-000-Users-at-Dozens-of-Banks-World
url: https://thehackernews.com/2023/12/new-javascript-malware-targeted-50000.html
content:
A new piece of JavaScript malware has been observed attempting to steal users' online banking account credentials as part of a campaign that has targeted more than 40 financial institutions across the world.
The activity cluster, which employs JavaScript web injections, is estimated to have led to at least 50,000 infected user sessions spanning North America, South America, Europe, and Japan.


feed_id: https://thehackernews.com/2023/12/cost-of-data-breach-report-2023.html
title: Cost of a Data Breach Report 2023: Insights, Mitigators and Best Practices
uri: Cost-of-a-Data-Breach-Report-2023-Insights-Mitigators-and-Best-Pract
url: https://thehackernews.com/2023/12/cost-of-data-breach-report-2023.html
content:
John Hanley of IBM Security shares 4 key findings from the highly acclaimed annual Cost of a Data Breach Report 2023
What is the IBM Cost of a Data Breach Report?
The IBM Cost of a Data Breach Report is an annual report that provides organizations with quantifiable information about the financial impacts of breaches. With this data, they can make data driven decisions about how they implement


feed_id: https://thehackernews.com/2023/12/german-authorities-dismantle-dark-web.html
title: German Authorities Dismantle Dark Web Hub 'Kingdom Market' in Global Operation
uri: German-Authorities-Dismantle-Dark-Web-Hub-Kingdom-Market-in-Global-O
url: https://thehackernews.com/2023/12/german-authorities-dismantle-dark-web.html
content:
German law enforcement has announced the disruption of a dark web platform called&nbsp;Kingdom Market&nbsp;that specialized in the sales of narcotics and malware to "tens of thousands of users."
The&nbsp;exercise, which involved collaboration from authorities from the U.S., Switzerland, Moldova, and Ukraine, began on December 16, 2023, the Federal Criminal Police Office (BKA) said.
Kingdom


feed_id: https://thehackernews.com/2023/12/hackers-exploiting-old-ms-excel.html
title: Hackers Exploiting MS Excel Vulnerability to Spread Agent Tesla Malware
uri: Hackers-Exploiting-MS-Excel-Vulnerability-to-Spread-Agent-Tesla-Malwar
url: https://thehackernews.com/2023/12/hackers-exploiting-old-ms-excel.html
content:
Attackers are weaponizing an old Microsoft Office vulnerability as part of phishing campaigns to distribute a strain of malware called&nbsp;Agent Tesla.
The infection chains leverage decoy Excel documents attached in invoice-themed messages to trick potential targets into opening them and activate the exploitation of CVE-2017-11882 (CVSS score: 7.8), a memory corruption vulnerability in Office's


feed_id: https://thehackernews.com/2023/12/urgent-new-chrome-zero-day.html
title: Urgent: New Chrome Zero-Day Vulnerability Exploited in the Wild - Update ASAP
uri: Urgent-New-Chrome-Zero-Day-Vulnerability-Exploited-in-the-Wild-Upda
url: https://thehackernews.com/2023/12/urgent-new-chrome-zero-day.html
content:
Google has rolled out security updates for the Chrome web browser to address a high-severity zero-day flaw that it said has been exploited in the wild.
The vulnerability, assigned the CVE identifier&nbsp;CVE-2023-7024, has been described as a&nbsp;heap-based buffer overflow bug&nbsp;in the WebRTC framework that could be exploited to result in program crashes or arbitrary code execution.
Clément


feed_id: https://thehackernews.com/2023/12/remote-encryption-attacks-surge-how-one.html
title: Remote Encryption Attacks Surge: How One Vulnerable Device Can Spell Disaster
uri: Remote-Encryption-Attacks-Surge-How-One-Vulnerable-Device-Can-Spell-D
url: https://thehackernews.com/2023/12/remote-encryption-attacks-surge-how-one.html
content:
Ransomware groups are increasingly switching to remote encryption in their attacks, marking a new escalation in tactics adopted by financially motivated actors to ensure the success of their campaigns.
"Companies can have thousands of computers connected to their network, and with remote ransomware, all it takes is one underprotected device to compromise the entire network," Mark Loman, vice


feed_id: https://thehackernews.com/2023/12/product-explained-memcycos-real-time.html
title: Product Explained: Memcyco's Real-Time Defense Against Website Spoofing
uri: Product-Explained-Memcyco-s-Real-Time-Defense-Against-Website-Spoofin
url: https://thehackernews.com/2023/12/product-explained-memcycos-real-time.html
content:
Hands-On Review: Memcyco’s Threat Intelligence Solution
Website impersonation, also known as brandjacking or website spoofing, has emerged as a significant threat to online businesses. Malicious actors clone legitimate websites to trick customers, leading to financial scams and data theft causing reputation damage and financial losses for both organizations and customers.
The Growing Threat of


feed_id: https://thehackernews.com/2023/12/alert-chinese-hackers-pose-as-uae.html
title: Alert: Chinese-Speaking Hackers Pose as UAE Authority in Latest Smishing Wave
uri: Alert-Chinese-Speaking-Hackers-Pose-as-UAE-Authority-in-Latest-Smishi
url: https://thehackernews.com/2023/12/alert-chinese-hackers-pose-as-uae.html
content:
The Chinese-speaking threat actors behind&nbsp;Smishing Triad&nbsp;have been observed masquerading as the United Arab Emirates Federal Authority for Identity and Citizenship to send malicious SMS messages with the ultimate goal of gathering sensitive information from residents and foreigners in the country.
"These criminals send malicious links to their victims' mobile devices through SMS or


feed_id: https://thehackernews.com/2023/12/3500-arrested-in-global-operation.html
title: 3,500 Arrested in Global Operation HAECHI-IV Targeting Financial Criminals
uri: 3-500-Arrested-in-Global-Operation-HAECHI-IV-Targeting-Financial-Crimi
url: https://thehackernews.com/2023/12/3500-arrested-in-global-operation.html
content:
A six-month-long international police operation codenamed&nbsp;HAECHI-IV&nbsp;has resulted in the arrests of nearly 3,500 individuals and seizures worth $300 million across 34 countries.
The exercise, which took place from July through December 2023, took aim at various types of financial crimes such as voice phishing, romance scams, online sextortion, investment fraud, money laundering


feed_id: https://thehackernews.com/2023/12/new-go-based-jaskago-malware-targeting.html
title: New Go-Based JaskaGO Malware Targeting Windows and macOS Systems
uri: New-Go-Based-JaskaGO-Malware-Targeting-Windows-and-macOS-Systems
url: https://thehackernews.com/2023/12/new-go-based-jaskago-malware-targeting.html
content:
A new Go-based information stealer malware called&nbsp;JaskaGO&nbsp;has emerged as the latest cross-platform threat to infiltrate both Windows and Apple macOS systems.
AT&amp;T Alien Labs, which made the discovery,&nbsp;said&nbsp;the malware is "equipped with an extensive array of commands from its command-and-control (C&amp;C) server."
Artifacts designed for macOS were first observed in July


feed_id: https://thehackernews.com/2023/12/fbi-takes-down-blackcat-ransomware.html
title: FBI Takes Down BlackCat Ransomware, Releases Free Decryption Tool
uri: FBI-Takes-Down-BlackCat-Ransomware-Releases-Free-Decryption-Tool
url: https://thehackernews.com/2023/12/fbi-takes-down-blackcat-ransomware.html
content:
The U.S. Justice Department (DoJ) has officially&nbsp;announced&nbsp;the disruption of the BlackCat ransomware operation and released a decryption tool that more than 500 affected victims can use to regain access to files locked by the malware.
Court documents show that the U.S. Federal Bureau of Investigation (FBI) enlisted the help of a confidential human source (CHS) to act as an affiliate


feed_id: https://thehackernews.com/2023/12/behind-scenes-of-matveevs-ransomware.html
title: Behind the Scenes of Matveev's Ransomware Empire: Tactics and Team
uri: Behind-the-Scenes-of-Matveev-s-Ransomware-Empire-Tactics-and-Team
url: https://thehackernews.com/2023/12/behind-scenes-of-matveevs-ransomware.html
content:
Cybersecurity researchers have shed light on the inner workings of the ransomware operation led by Mikhail Pavlovich Matveev, a Russian national who was&nbsp;indicted by the U.S. government&nbsp;earlier this year for his alleged role in launching thousands of attacks across the world.
Matveev, who resides in Saint Petersburg and is known by the aliases Wazawaka, m1x, Boriselcin, Uhodiransomwar,


feed_id: https://thehackernews.com/2023/12/hackers-abusing-github-to-evade.html
title: Hackers Abusing GitHub to Evade Detection and Control Compromised Hosts
uri: Hackers-Abusing-GitHub-to-Evade-Detection-and-Control-Compromised-Host
url: https://thehackernews.com/2023/12/hackers-abusing-github-to-evade.html
content:
Threat actors are increasingly making use of GitHub for malicious purposes through novel methods, including abusing secret Gists and issuing malicious commands via git commit messages.
"Malware authors occasionally place their samples in services like Dropbox, Google Drive, OneDrive, and Discord to host second stage malware and sidestep detection tools," ReversingLabs researcher Karlo Zanki&nbsp


feed_id: https://thehackernews.com/2023/12/are-we-ready-to-give-up-on-security.html
title: Are We Ready to Give Up on Security Awareness Training?
uri: Are-We-Ready-to-Give-Up-on-Security-Awareness-Training
url: https://thehackernews.com/2023/12/are-we-ready-to-give-up-on-security.html
content:
Some of you have already started budgeting for 2024 and allocating funds to security areas within your organization. It is safe to say that employee security awareness training is one of the expenditure items, too. However, its effectiveness is an open question with people still engaging in insecure behaviors at the workplace. Besides, social engineering remains one of the most prevalent attacks


feed_id: https://thehackernews.com/2023/12/iranian-hackers-using-muddyc2go-in-new.html
title: Iranian Hackers Using MuddyC2Go in Telecom Espionage Attacks Across Africa
uri: Iranian-Hackers-Using-MuddyC2Go-in-Telecom-Espionage-Attacks-Across-Af
url: https://thehackernews.com/2023/12/iranian-hackers-using-muddyc2go-in-new.html
content:
The Iranian nation-state actor known as&nbsp;MuddyWater&nbsp;has leveraged a newly discovered command-and-control (C2) framework called MuddyC2Go in its attacks on the telecommunications sector in Egypt, Sudan, and Tanzania.
The Symantec Threat Hunter Team, part of Broadcom, is&nbsp;tracking&nbsp;the activity under the name Seedworm, which is also tracked under the monikers Boggy Serpens, Cobalt


feed_id: https://thehackernews.com/2023/12/new-malvertising-campaign-distributing.html
title: New Malvertising Campaign Distributing PikaBot Disguised as Popular Software
uri: New-Malvertising-Campaign-Distributing-PikaBot-Disguised-as-Popular-So
url: https://thehackernews.com/2023/12/new-malvertising-campaign-distributing.html
content:
The malware loader known as PikaBot is being distributed as part of a&nbsp;malvertising&nbsp;campaign&nbsp;targeting users searching for legitimate software like AnyDesk.
"PikaBot was previously only distributed via malspam campaigns similarly to QakBot and emerged as one of the preferred payloads for a threat actor known as TA577," Malwarebytes' Jérôme Segura&nbsp;said.
The malware family,


feed_id: https://thehackernews.com/2023/12/8220-gang-exploiting-oracle-weblogic.html
title: 8220 Gang Exploiting Oracle WebLogic Server Vulnerability to Spread Malware
uri: 8220-Gang-Exploiting-Oracle-WebLogic-Server-Vulnerability-to-Spread-Ma
url: https://thehackernews.com/2023/12/8220-gang-exploiting-oracle-weblogic.html
content:
The threat actors associated with the&nbsp;8220 Gang&nbsp;have been observed exploiting a high-severity flaw in Oracle WebLogic Server to propagate their malware.
The security shortcoming is&nbsp;CVE-2020-14883&nbsp;(CVSS score: 7.2), a remote code execution bug that could be exploited by authenticated attackers to take over susceptible servers.
"This vulnerability allows remote authenticated


feed_id: https://thehackernews.com/2023/12/double-extortion-play-ransomware.html
title: Double-Extortion Play Ransomware Strikes 300 Organizations Worldwide
uri: Double-Extortion-Play-Ransomware-Strikes-300-Organizations-Worldwide
url: https://thehackernews.com/2023/12/double-extortion-play-ransomware.html
content:
The threat actors behind the Play ransomware are estimated to have impacted approximately 300 entities as of October 2023, according to a new joint cybersecurity advisory from Australia and the U.S.
"Play ransomware actors employ a double-extortion model, encrypting systems after exfiltrating data and have impacted a wide range of businesses and critical infrastructure organizations in North


feed_id: https://thehackernews.com/2023/12/beware-experts-reveal-new-details-on.html
title: Beware: Experts Reveal New Details on Zero-Click Outlook RCE Exploits
uri: Beware-Experts-Reveal-New-Details-on-Zero-Click-Outlook-RCE-Exploits
url: https://thehackernews.com/2023/12/beware-experts-reveal-new-details-on.html
content:
Technical details have emerged about two now-patched security flaws in Microsoft Windows that could be chained by threat actors to achieve remote code execution on the Outlook email service sans any user interaction.
"An attacker on the internet can chain the vulnerabilities together to create a full, zero-click remote code execution (RCE) exploit against Outlook clients," Akamai security


feed_id: https://thehackernews.com/2023/12/top-7-trends-shaping-saas-security-in.html
title: Top 7 Trends Shaping SaaS Security in 2024
uri: Top-7-Trends-Shaping-SaaS-Security-in-2024
url: https://thehackernews.com/2023/12/top-7-trends-shaping-saas-security-in.html
content:
Over the past few years, SaaS has developed into the backbone of corporate IT. Service businesses, such as medical practices, law firms, and financial services firms, are almost entirely SaaS based. Non-service businesses, including manufacturers and retailers, have about 70% of their software in the cloud.&nbsp;
These applications contain a wealth of data, from minimally sensitive general


feed_id: https://thehackernews.com/2023/12/rhadamanthys-malware-swiss-army-knife.html
title: Rhadamanthys Malware: Swiss Army Knife of Information Stealers Emerges
uri: Rhadamanthys-Malware-Swiss-Army-Knife-of-Information-Stealers-Emerges
url: https://thehackernews.com/2023/12/rhadamanthys-malware-swiss-army-knife.html
content:
The developers of the information stealer malware known as&nbsp;Rhadamanthys&nbsp;are actively iterating on its features, broadening its information-gathering capabilities and also incorporating a plugin system to make it more customizable.
This approach not only transforms it into a threat capable of delivering "specific distributor needs," but also makes it more potent, Check Point&nbsp;said&


feed_id: https://thehackernews.com/2023/12/four-us-nationals-charged-in-80-million.html
title: Four U.S. Nationals Charged in $80 Million Pig Butchering Crypto Scam
uri: Four-U-S-Nationals-Charged-in-80-Million-Pig-Butchering-Crypto-Scam
url: https://thehackernews.com/2023/12/four-us-nationals-charged-in-80-million.html
content:
Four U.S. nationals have been charged for participating in an illicit scheme that earned them more than $80 million via cryptocurrency investment scams.
The defendants – Lu Zhang, 36, of Alhambra, California; Justin Walker, 31, of Cypress, California; Joseph Wong, 32, Rosemead, California; and Hailong Zhu, 40, Naperville, Illinois – have been charged with conspiracy to commit money laundering,


feed_id: https://thehackernews.com/2023/12/unmasking-dark-side-of-low-codeno-code.html
title: Unmasking the Dark Side of Low-Code/No-Code Applications
uri: Unmasking-the-Dark-Side-of-Low-Code-No-Code-Applications
url: https://thehackernews.com/2023/12/unmasking-dark-side-of-low-codeno-code.html
content:
Low-code/no-code (LCNC) and robotic process automation (RPA) have gained immense popularity, but how secure are they? Is your security team paying enough attention in an era of rapid digital transformation, where business users are empowered to create applications swiftly using platforms like Microsoft PowerApps, UiPath, ServiceNow, Mendix, and OutSystems?
The simple truth is often swept under


feed_id: https://thehackernews.com/2023/12/qakbot-malware-resurfaces-with-new.html
title: QakBot Malware Resurfaces with New Tactics, Targeting the Hospitality Industry
uri: QakBot-Malware-Resurfaces-with-New-Tactics-Targeting-the-Hospitality
url: https://thehackernews.com/2023/12/qakbot-malware-resurfaces-with-new.html
content:
A new wave of phishing messages distributing the&nbsp;QakBot&nbsp;malware has been observed, more than three months after a law enforcement effort saw its infrastructure dismantled by infiltrating its command-and-control (C2) network.
Microsoft, which made the discovery, described it as a low-volume campaign that began on December 11, 2023, and targeted the hospitality industry.
"Targets


feed_id: https://thehackernews.com/2023/12/cisa-urges-manufacturers-eliminate.html
title: CISA Urges Manufacturers Eliminate Default Passwords to Thwart Cyber Threats
uri: CISA-Urges-Manufacturers-Eliminate-Default-Passwords-to-Thwart-Cyber-T
url: https://thehackernews.com/2023/12/cisa-urges-manufacturers-eliminate.html
content:
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is&nbsp;urging&nbsp;manufacturers to get rid of default passwords on internet-exposed systems altogether, citing severe risks that could be exploited by malicious actors to gain initial access to, and move laterally within, organizations.
In an alert published last week, the agency called out Iranian threat actors affiliated with


feed_id: https://thehackernews.com/2023/12/mongodb-suffers-security-breach.html
title: MongoDB Suffers Security Breach, Exposing Customer Data
uri: MongoDB-Suffers-Security-Breach-Exposing-Customer-Data
url: https://thehackernews.com/2023/12/mongodb-suffers-security-breach.html
content:
MongoDB on Saturday disclosed it's actively investigating a security incident that has led to unauthorized access to "certain" corporate systems, resulting in the exposure of customer account metadata and contact information.
The American database software company&nbsp;said&nbsp;it first detected anomalous activity on December 13, 2023, and that it immediately activated its incident response


feed_id: https://thehackernews.com/2023/12/chinas-miit-introduces-color-coded.html
title: China's MIIT Introduces Color-Coded Action Plan for Data Security Incidents
uri: China-s-MIIT-Introduces-Color-Coded-Action-Plan-for-Data-Security-Inci
url: https://thehackernews.com/2023/12/chinas-miit-introduces-color-coded.html
content:
China's Ministry of Industry and Information Technology (MIIT) on Friday&nbsp;unveiled draft proposals&nbsp;detailing its plans to tackle data security events in the country using a color-coded system.
The effort is designed to "improve the comprehensive response capacity for data security incidents, to ensure timely and effective control, mitigation and elimination of hazards and losses caused


feed_id: https://thehackernews.com/2023/12/microsoft-warns-of-storm-0539-rising.html
title: Microsoft Warns of Storm-0539: The Rising Threat Behind Holiday Gift Card Frauds
uri: Microsoft-Warns-of-Storm-0539-The-Rising-Threat-Behind-Holiday-Gift-C
url: https://thehackernews.com/2023/12/microsoft-warns-of-storm-0539-rising.html
content:
Microsoft is warning of an uptick in malicious activity from an emerging threat cluster it's tracking as&nbsp;Storm-0539&nbsp;for orchestrating gift card fraud and theft via highly sophisticated email and SMS phishing attacks against retail entities during the holiday shopping season.
The goal of the attacks is to propagate booby-trapped links that direct victims to adversary-in-the-middle (AiTM


feed_id: https://thehackernews.com/2023/12/new-kv-botnet-targeting-cisco-draytek.html
title: New KV-Botnet Targeting Cisco, DrayTek, and Fortinet Devices for Stealthy Attacks
uri: New-KV-Botnet-Targeting-Cisco-DrayTek-and-Fortinet-Devices-for-Steal
url: https://thehackernews.com/2023/12/new-kv-botnet-targeting-cisco-draytek.html
content:
A new botnet consisting of firewalls and routers from Cisco, DrayTek, Fortinet, and NETGEAR is being used as a covert data transfer network for advanced persistent threat actors, including the China-linked threat actor called&nbsp;Volt Typhoon.
Dubbed&nbsp;KV-botnet&nbsp;by the Black Lotus Labs team at Lumen Technologies, the malicious network is an amalgamation of two complementary activity


feed_id: https://thehackernews.com/2023/12/crypto-hardware-wallet-ledgers-supply.html
title: Crypto Hardware Wallet Ledger's Supply Chain Breach Results in $600,000 Theft
uri: Crypto-Hardware-Wallet-Ledger-s-Supply-Chain-Breach-Results-in-600-00
url: https://thehackernews.com/2023/12/crypto-hardware-wallet-ledgers-supply.html
content:
Crypto hardware wallet maker Ledger published a new version of its "@ledgerhq/connect-kit" npm module after unidentified threat actors pushed malicious code that led to the theft of&nbsp;more than $600,000&nbsp;in virtual assets.
The&nbsp;compromise&nbsp;was the result of a former employee falling victim to a phishing attack, the company said in a statement.
This allowed the attackers to gain


feed_id: https://thehackernews.com/2023/12/bug-or-feature-hidden-web-application.html
title: Bug or Feature? Hidden Web Application Vulnerabilities Uncovered
uri: Bug-or-Feature-Hidden-Web-Application-Vulnerabilities-Uncovered
url: https://thehackernews.com/2023/12/bug-or-feature-hidden-web-application.html
content:
Web Application Security consists of a myriad of security controls that ensure that a web application:

Functions as expected.
Cannot be exploited to operate out of bounds.
Cannot initiate operations that it is not supposed to do.

Web Applications have become ubiquitous after the expansion of Web 2.0, which Social Media Platforms, E-Commerce websites, and email clients saturating the internet


feed_id: https://thehackernews.com/2023/12/new-security-vulnerabilities-uncovered.html
title: New Security Vulnerabilities Uncovered in pfSense Firewall Software - Patch Now
uri: New-Security-Vulnerabilities-Uncovered-in-pfSense-Firewall-Software
url: https://thehackernews.com/2023/12/new-security-vulnerabilities-uncovered.html
content:
Multiple security vulnerabilities have been discovered in the open-source Netgate pfSense firewall solution called pfSense that could be chained by an attacker to execute arbitrary commands on susceptible appliances.
The issues relate to two reflected cross-site scripting (XSS) bugs and one command injection flaw, according to new findings from Sonar.
"Security inside a local network is often


feed_id: https://thehackernews.com/2023/12/googles-new-tracking-protection-in.html
title: Google's New Tracking Protection in Chrome Blocks Third-Party Cookies
uri: Google-s-New-Tracking-Protection-in-Chrome-Blocks-Third-Party-Cookies
url: https://thehackernews.com/2023/12/googles-new-tracking-protection-in.html
content:
Google on Thursday announced that it will start testing a new feature called "Tracking Protection" beginning January 4, 2024, to 1% of Chrome users as part of its efforts to&nbsp;deprecate third-party cookies&nbsp;in the web browser.
The setting is designed to limit "cross-site tracking by restricting website access to third-party cookies by default," Anthony Chavez, vice president of Privacy


feed_id: https://thehackernews.com/2023/12/new-nkabuse-malware-exploits-nkn.html
title: New NKAbuse Malware Exploits NKN Blockchain Tech for DDoS Attacks
uri: New-NKAbuse-Malware-Exploits-NKN-Blockchain-Tech-for-DDoS-Attacks
url: https://thehackernews.com/2023/12/new-nkabuse-malware-exploits-nkn.html
content:
A novel multi-platform threat called&nbsp;NKAbuse&nbsp;has been discovered using a decentralized, peer-to-peer network connectivity protocol known as&nbsp;NKN&nbsp;(short for New Kind of Network) as a communications channel.
"The malware utilizes NKN technology for data exchange between peers, functioning as a potent implant, and equipped with both flooder and backdoor capabilities," Russian


feed_id: https://thehackernews.com/2024/01/new-variant-of-dll-search-order.html
title: New Variant of DLL Search Order Hijacking Bypasses Windows 10 and 11 Protections
uri: New-Variant-of-DLL-Search-Order-Hijacking-Bypasses-Windows-10-and-11-P
url: https://thehackernews.com/2024/01/new-variant-of-dll-search-order.html
content:
Security researchers have detailed a new variant of a dynamic link library (DLL) search order hijacking technique that could be used by threat actors to bypass security mechanisms and achieve execution of malicious code on systems running Microsoft Windows 10 and Windows 11.
The approach "leverages executables commonly found in the trusted WinSxS folder and exploits them via the classic DLL


feed_id: https://thehackernews.com/2024/01/new-terrapin-flaw-could-let-attackers.html
title: New Terrapin Flaw Could Let Attackers Downgrade SSH Protocol Security
uri: New-Terrapin-Flaw-Could-Let-Attackers-Downgrade-SSH-Protocol-Security
url: https://thehackernews.com/2024/01/new-terrapin-flaw-could-let-attackers.html
content:
Security researchers from Ruhr University Bochum have discovered a vulnerability in the Secure Shell (SSH) cryptographic network protocol that could allow an attacker to downgrade the connection's security by breaking the integrity of the secure channel.
Called&nbsp;Terrapin&nbsp;(CVE-2023-48795, CVSS score: 5.9), the exploit has been described as the "first ever practically exploitable prefix


feed_id: https://thehackernews.com/2024/01/new-jinxloader-targeting-users-with.html
title: New JinxLoader Targeting Users with Formbook and XLoader Malware
uri: New-JinxLoader-Targeting-Users-with-Formbook-and-XLoader-Malware
url: https://thehackernews.com/2024/01/new-jinxloader-targeting-users-with.html
content:
A new Go-based malware loader called&nbsp;JinxLoader&nbsp;is being used by threat actors to deliver next-stage payloads such as&nbsp;Formbook and its successor XLoader.
The&nbsp;disclosure&nbsp;comes from cybersecurity firms Palo Alto Networks Unit 42 and Symantec, both of which highlighted multi-step attack sequences that led to the deployment of JinxLoader through phishing attacks.
"The


feed_id: https://thehackernews.com/2023/12/beware-scam-as-service-aiding.html
title: Beware: Scam-as-a-Service Aiding Cybercriminals in Crypto Wallet-Draining Attacks
uri: Beware-Scam-as-a-Service-Aiding-Cybercriminals-in-Crypto-Wallet-Drain
url: https://thehackernews.com/2023/12/beware-scam-as-service-aiding.html
content:
Cybersecurity researchers are warning about an increase in phishing attacks that are capable of draining cryptocurrency wallets.
"These threats are unique in their approach, targeting a wide range of blockchain networks, from Ethereum and Binance Smart Chain to Polygon, Avalanche, and almost 20 other networks by using a crypto wallet-draining technique," Check Point researchers Oded Vanunu,


feed_id: https://thehackernews.com/2023/12/albanian-parliament-and-one-albania.html
title: Albanian Parliament and One Albania Telecom Hit by Cyber Attacks
uri: Albanian-Parliament-and-One-Albania-Telecom-Hit-by-Cyber-Attacks
url: https://thehackernews.com/2023/12/albanian-parliament-and-one-albania.html
content:
The Assembly of the Republic of Albania and telecom company One Albania have been targeted by cyber attacks, the country’s National Authority for Electronic Certification and Cyber Security (AKCESK) revealed this week.
“These infrastructures, under the legislation in force, are not currently classified as critical or important information infrastructure,” AKCESK&nbsp;said.
One Albania, which has


feed_id: https://thehackernews.com/2023/12/cert-ua-uncovers-new-malware-wave.html
title: CERT-UA Uncovers New Malware Wave Distributing OCEANMAP, MASEPIE, STEELHOOK
uri: CERT-UA-Uncovers-New-Malware-Wave-Distributing-OCEANMAP-MASEPIE-STEE
url: https://thehackernews.com/2023/12/cert-ua-uncovers-new-malware-wave.html
content:
The Computer Emergency Response Team of Ukraine (CERT-UA) has warned of a new phishing campaign orchestrated by the&nbsp;Russia-linked&nbsp;APT28&nbsp;group&nbsp;to deploy previously undocumented malware such as OCEANMAP, MASEPIE, and STEELHOOK to harvest sensitive information.
The activity, which was&nbsp;detected&nbsp;by the agency between December 15 and 25, 2023, targeted Ukrainian


feed_id: https://thehackernews.com/2023/12/kimsuky-hackers-deploying-appleseed.html
title: Kimsuky Hackers Deploying AppleSeed, Meterpreter, and TinyNuke in Latest Attacks
uri: Kimsuky-Hackers-Deploying-AppleSeed-Meterpreter-and-TinyNuke-in-Late
url: https://thehackernews.com/2023/12/kimsuky-hackers-deploying-appleseed.html
content:
Nation-state actors affiliated to North Korea have been observed using spear-phishing attacks to deliver an assortment of backdoors and tools such as AppleSeed, Meterpreter, and TinyNuke to seize control of compromised machines.
South Korea-based cybersecurity company AhnLab attributed the activity to an advanced persistent threat group known as&nbsp;Kimsuky.
“A notable point about attacks that


feed_id: https://thehackernews.com/2023/12/microsoft-disables-msix-app-installer.html
title: Microsoft Disables MSIX App Installer Protocol Widely Used in Malware Attacks
uri: Microsoft-Disables-MSIX-App-Installer-Protocol-Widely-Used-in-Malware
url: https://thehackernews.com/2023/12/microsoft-disables-msix-app-installer.html
content:
Microsoft on Thursday said it’s once again disabling the&nbsp;ms-appinstaller protocol handler&nbsp;by default following its abuse by multiple threat actors to distribute malware.
“The observed threat actor activity abuses the current implementation of the ms-appinstaller protocol handler as an access vector for malware that may lead to ransomware distribution,” the Microsoft Threat Intelligence


feed_id: https://thehackernews.com/2023/12/google-cloud-resolves-privilege.html
title: Google Cloud Resolves Privilege Escalation Flaw Impacting Kubernetes Service
uri: Google-Cloud-Resolves-Privilege-Escalation-Flaw-Impacting-Kubernetes-S
url: https://thehackernews.com/2023/12/google-cloud-resolves-privilege.html
content:
Google Cloud has addressed a medium-severity security flaw in its platform that could be abused by an attacker who already has access to a Kubernetes cluster to escalate their privileges.
"An attacker who has compromised the&nbsp;Fluent Bit&nbsp;logging container could combine that access with high privileges required by&nbsp;Anthos Service Mesh&nbsp;(on clusters that have enabled it) to


feed_id: https://thehackernews.com/2023/12/most-sophisticated-iphone-hack-ever.html
title: Most Sophisticated iPhone Hack Ever Exploited Apple's Hidden Hardware Feature
uri: Most-Sophisticated-iPhone-Hack-Ever-Exploited-Apple-s-Hidden-Hardware
url: https://thehackernews.com/2023/12/most-sophisticated-iphone-hack-ever.html
content:
The&nbsp;Operation Triangulation&nbsp;spyware attacks targeting Apple iOS devices leveraged never-before-seen exploits that made it possible to even bypass pivotal hardware-based security protections erected by the company.
Russian cybersecurity firm Kaspersky, which&nbsp;discovered&nbsp;the&nbsp;campaign&nbsp;at the beginning of 2023 after becoming one of the targets,&nbsp;described&nbsp;it as


feed_id: https://thehackernews.com/2023/12/new-rugmi-malware-loader-surges-with.html
title: New Rugmi Malware Loader Surges with Hundreds of Daily Detections
uri: New-Rugmi-Malware-Loader-Surges-with-Hundreds-of-Daily-Detections
url: https://thehackernews.com/2023/12/new-rugmi-malware-loader-surges-with.html
content:
A new malware loader is being used by threat actors to deliver a wide range of&nbsp;information stealers&nbsp;such as Lumma Stealer (aka LummaC2), Vidar, RecordBreaker (aka Raccoon Stealer V2), and&nbsp;Rescoms.
Cybersecurity firm ESET is tracking the trojan under the name&nbsp;Win/TrojanDownloader.Rugmi.
"This malware is a loader with three types of components: a downloader that downloads an


feed_id: https://thehackernews.com/2023/12/critical-zero-day-in-apache-ofbiz-erp.html
title: Critical Zero-Day in Apache OfBiz ERP System Exposes Businesses to Attack
uri: Critical-Zero-Day-in-Apache-OfBiz-ERP-System-Exposes-Businesses-to-Att
url: https://thehackernews.com/2023/12/critical-zero-day-in-apache-ofbiz-erp.html
content:
A new zero-day security flaw has been discovered in Apache OfBiz, an open-source Enterprise Resource Planning (ERP) system that could be exploited to bypass authentication protections.
The vulnerability, tracked as&nbsp;CVE-2023-51467, resides in the login functionality and is the result of an incomplete patch for another critical vulnerability (CVE-2023-49070, CVSS score: 9.8) that was released


feed_id: https://thehackernews.com/2023/12/chinese-hackers-exploited-new-zero-day.html
title: Chinese Hackers Exploited New Zero-Day in Barracuda's ESG Appliances
uri: Chinese-Hackers-Exploited-New-Zero-Day-in-Barracuda-s-ESG-Appliances
url: https://thehackernews.com/2023/12/chinese-hackers-exploited-new-zero-day.html
content:
Barracuda has revealed that Chinese threat actors exploited a new zero-day in its Email Security Gateway (ESG) appliances to deploy backdoors on a "limited number" of devices.
Tracked as&nbsp;CVE-2023-7102, the issue relates to a case of&nbsp;arbitrary code execution&nbsp;that resides within a third-party and open-source library named Spreadsheet::ParseExcel that's used by the Amavis scanner


feed_id: https://thehackernews.com/2023/12/new-sneaky-xamalicious-android-malware.html
title: New Sneaky Xamalicious Android Malware Hits Over 327,000 Devices
uri: New-Sneaky-Xamalicious-Android-Malware-Hits-Over-327-000-Devices
url: https://thehackernews.com/2023/12/new-sneaky-xamalicious-android-malware.html
content:
A new Android backdoor has been discovered with potent capabilities to carry out a range of malicious actions on infected devices.
Dubbed&nbsp;Xamalicious&nbsp;by the McAfee Mobile Research Team, the malware is so named for the fact that it's developed using an open-source mobile app framework called Xamarin and abuses the operating system's accessibility permissions to fulfill its objectives.


feed_id: https://thehackernews.com/2023/12/warning-poorly-secured-linux-ssh.html
title: Warning: Poorly Secured Linux SSH Servers Under Attack for Cryptocurrency Mining
uri: Warning-Poorly-Secured-Linux-SSH-Servers-Under-Attack-for-Cryptocurre
url: https://thehackernews.com/2023/12/warning-poorly-secured-linux-ssh.html
content:
Poorly secured Linux SSH servers are being targeted by bad actors to install port scanners and dictionary attack tools with the goal of targeting other vulnerable servers and co-opting them into a network to carry out cryptocurrency mining and distributed denial-of-service (DDoS) attacks.
"Threat actors can also choose to install only scanners and sell the breached IP and account credentials on


feed_id: https://thehackernews.com/2023/12/carbanak-banking-malware-resurfaces.html
title: Carbanak Banking Malware Resurfaces with New Ransomware Tactics
uri: Carbanak-Banking-Malware-Resurfaces-with-New-Ransomware-Tactics
url: https://thehackernews.com/2023/12/carbanak-banking-malware-resurfaces.html
content:
The banking malware known as&nbsp;Carbanak&nbsp;has been observed being used in&nbsp;ransomware attacks&nbsp;with updated tactics.
"The malware has adapted to incorporate attack vendors and techniques to diversify its effectiveness," cybersecurity firm NCC Group&nbsp;said&nbsp;in an analysis of ransomware attacks that took place in November 2023.
"Carbanak returned last month through new


feed_id: https://thehackernews.com/2023/12/cloud-atlas-spear-phishing-attacks.html
title: Cloud Atlas' Spear-Phishing Attacks Target Russian Agro and Research Companies
uri: Cloud-Atlas-Spear-Phishing-Attacks-Target-Russian-Agro-and-Research-C
url: https://thehackernews.com/2023/12/cloud-atlas-spear-phishing-attacks.html
content:
The threat actor referred to as&nbsp;Cloud Atlas&nbsp;has been linked to a set of spear-phishing attacks on Russian enterprises.
Targets included a Russian agro-industrial enterprise and a state-owned research company, according to a&nbsp;report&nbsp;from F.A.C.C.T., a standalone cybersecurity company formed after Group-IB's formal exit from Russia earlier this year.
Cloud Atlas, active since at


feed_id: https://thehackernews.com/2023/12/british-lapsus-teen-members-sentenced.html
title: British LAPSUS$ Teen Members Sentenced for High-Profile Attacks
uri: British-LAPSUS-Teen-Members-Sentenced-for-High-Profile-Attacks
url: https://thehackernews.com/2023/12/british-lapsus-teen-members-sentenced.html
content:
Two British teens part of the LAPSUS$ cyber crime and extortion gang have been sentenced for their roles in orchestrating a string of high-profile attacks against a number of companies.
Arion Kurtaj, an 18-year-old from Oxford, has been sentenced to an indefinite hospital order due to his intent to get back to cybercrime "as soon as possible," BBC&nbsp;reported. Kurtaj, who is autistic, was


feed_id: https://thehackernews.com/2024/01/three-ways-to-supercharge-your-software.html
title: Three Ways To Supercharge Your Software Supply Chain Security
uri: Three-Ways-To-Supercharge-Your-Software-Supply-Chain-Security
url: https://thehackernews.com/2024/01/three-ways-to-supercharge-your-software.html
content:
Section four of the "Executive Order on Improving the Nation’s Cybersecurity" introduced a lot of people in tech to the concept of a “Software Supply Chain” and securing it. If you make software and ever hope to sell it to one or more federal agencies, you&nbsp;have&nbsp;to pay attention to this. Even if you never plan to sell to a government, understanding your Software Supply Chain and


feed_id: https://thehackernews.com/2024/01/beware-3-malicious-pypi-packages-found.html
title: Beware: 3 Malicious PyPI Packages Found Targeting Linux with Crypto Miners
uri: Beware-3-Malicious-PyPI-Packages-Found-Targeting-Linux-with-Crypto-Mi
url: https://thehackernews.com/2024/01/beware-3-malicious-pypi-packages-found.html
content:
Three new malicious packages have been discovered in the Python Package Index (PyPI) open-source repository with capabilities to deploy a cryptocurrency miner on affected Linux devices.
The three harmful packages, named modularseven, driftme, and catme, attracted a total of 431 downloads over the past month before they were taken down.
“These packages, upon initial use, deploy a CoinMiner


feed_id: https://thehackernews.com/2024/01/uac-0050-group-using-new-phishing.html
title: UAC-0050 Group Using New Phishing Tactics to Distribute Remcos RAT
uri: UAC-0050-Group-Using-New-Phishing-Tactics-to-Distribute-Remcos-RAT
url: https://thehackernews.com/2024/01/uac-0050-group-using-new-phishing.html
content:
The threat actor known as UAC-0050 is leveraging phishing attacks to distribute Remcos RAT using new strategies to evade detection from security software.
"The group's weapon of choice is Remcos RAT, a notorious malware for remote surveillance and control, which has been at the forefront of its espionage arsenal," Uptycs security researchers Karthickkumar Kathiresan and Shilpesh Trivedi&nbsp;


feed_id: https://thehackernews.com/2024/01/mandiants-twitter-account-restored.html
title: Mandiant's Twitter Account Restored After Six-Hour Crypto Scam Hack
uri: Mandiant-s-Twitter-Account-Restored-After-Six-Hour-Crypto-Scam-Hack
url: https://thehackernews.com/2024/01/mandiants-twitter-account-restored.html
content:
American cybersecurity firm and Google Cloud subsidiary Mandiant had its X (formerly Twitter) account compromised for more than six hours by an unknown attacker to propagate a cryptocurrency scam.
As of writing, the&nbsp;account has been restored&nbsp;on the social media platform.
It's currently not clear how the account was breached. But the hacked Mandiant account was initially renamed to "@


feed_id: https://thehackernews.com/2024/01/malware-using-google-multilogin-exploit.html
title: Malware Using Google MultiLogin Exploit to Maintain Access Despite Password Reset
uri: Malware-Using-Google-MultiLogin-Exploit-to-Maintain-Access-Despite-Pas
url: https://thehackernews.com/2024/01/malware-using-google-multilogin-exploit.html
content:
Information stealing malware are actively taking advantage of an undocumented Google OAuth endpoint named MultiLogin to hijack user sessions and allow continuous access to Google services even after a password reset.
According to CloudSEK, the&nbsp;critical exploit&nbsp;facilitates session persistence and cookie generation, enabling threat actors to maintain access to a valid session in an


feed_id: https://thehackernews.com/2024/01/5-ways-to-reduce-saas-security-risks.html
title: 5 Ways to Reduce SaaS Security Risks
uri: 5-Ways-to-Reduce-SaaS-Security-Risks
url: https://thehackernews.com/2024/01/5-ways-to-reduce-saas-security-risks.html
content:
As technology adoption has shifted to be employee-led, just in time, and from any location or device, IT and security teams have found themselves contending with an ever-sprawling SaaS attack surface, much of which is often unknown or unmanaged. This greatly increases the risk of identity-based threats, and according to a recent report from CrowdStrike, 80% of breaches today use compromised


feed_id: https://thehackernews.com/2024/01/smtp-smuggling-new-threat-enables.html
title: SMTP Smuggling: New Flaw Lets Attackers Bypass Security and Spoof Emails
uri: SMTP-Smuggling-New-Flaw-Lets-Attackers-Bypass-Security-and-Spoof-Emai
url: https://thehackernews.com/2024/01/smtp-smuggling-new-threat-enables.html
content:
A new exploitation technique called Simple Mail Transfer Protocol (SMTP) smuggling can be weaponized by threat actors to send spoofed emails with fake sender addresses while bypassing security measures.
"Threat actors could abuse vulnerable SMTP servers worldwide to send malicious emails from arbitrary email addresses, allowing targeted phishing attacks," Timo Longin, a senior security


feed_id: https://thehackernews.com/2024/01/doj-slams-xcast-with-10-million-fine.html
title: DOJ Slams XCast with $10 Million Fine Over Massive Illegal Robocall Operation
uri: DOJ-Slams-XCast-with-10-Million-Fine-Over-Massive-Illegal-Robocall-Op
url: https://thehackernews.com/2024/01/doj-slams-xcast-with-10-million-fine.html
content:
The U.S. Department of Justice (DoJ) on Tuesday said it reached a settlement with VoIP service provider XCast over allegations that it facilitated illegal telemarketing campaigns since at least January 2018, in contravention of the Telemarketing Sales Rule (TSR).
In addition to prohibiting the company from violating the law, the stipulated order requires it to meet other compliance measures,


feed_id: https://thehackernews.com/2024/01/google-settles-5-billion-privacy.html
title: Google Settles $5 Billion Privacy Lawsuit Over Tracking Users in 'Incognito Mode'
uri: Google-Settles-5-Billion-Privacy-Lawsuit-Over-Tracking-Users-in-Inco
url: https://thehackernews.com/2024/01/google-settles-5-billion-privacy.html
content:
Google has agreed to settle a lawsuit&nbsp;filed in June 2020&nbsp;that alleged that the company misled users by tracking their surfing activity who thought that their internet use remained private when using the “incognito” or “private” mode on web browsers.
The&nbsp;class-action lawsuit&nbsp;sought at least $5 billion in damages. The settlement terms were not disclosed.
The plaintiffs had


feed_id: https://thehackernews.com/2024/01/alert-water-curupira-hackers-actively.html
title: Alert: Water Curupira Hackers Actively Distributing PikaBot Loader Malware
uri: Alert-Water-Curupira-Hackers-Actively-Distributing-PikaBot-Loader-Mal
url: https://thehackernews.com/2024/01/alert-water-curupira-hackers-actively.html
content:
A threat actor called Water Curupira has been observed actively distributing the&nbsp;PikaBot&nbsp;loader malware as part of spam campaigns in 2023.
“PikaBot’s operators ran phishing campaigns, targeting victims via its two components — a loader and a core module — which enabled unauthorized remote access and allowed the execution of arbitrary commands through an established connection with


feed_id: https://thehackernews.com/2024/01/turkish-hackers-exploiting-poorly.html
title: Turkish Hackers Exploiting Poorly Secured MS SQL Servers Across the Globe
uri: Turkish-Hackers-Exploiting-Poorly-Secured-MS-SQL-Servers-Across-the-Gl
url: https://thehackernews.com/2024/01/turkish-hackers-exploiting-poorly.html
content:
Poorly secured Microsoft SQL (MS SQL) servers are being targeted in the U.S., European Union, and Latin American (LATAM) regions as part of an ongoing financially motivated campaign to gain initial access.
“The analyzed threat campaign appears to end in one of two ways, either the selling of ‘access’ to the compromised host, or the ultimate delivery of ransomware payloads,” Securonix researchers


feed_id: https://thehackernews.com/2024/01/why-public-links-expose-your-saas.html
title: Why Public Links Expose Your SaaS Attack Surface
uri: Why-Public-Links-Expose-Your-SaaS-Attack-Surface
url: https://thehackernews.com/2024/01/why-public-links-expose-your-saas.html
content:
Collaboration is a powerful selling point for SaaS applications. Microsoft, Github, Miro, and others promote the collaborative nature of their software applications that allows users to do more.
Links to files, repositories, and boards can be shared with anyone, anywhere. This encourages teamwork that helps create stronger campaigns and projects by encouraging collaboration among employees


feed_id: https://thehackernews.com/2024/01/alert-new-vulnerabilities-discovered-in.html
title: Alert: New Vulnerabilities Discovered in QNAP and Kyocera Device Manager
uri: Alert-New-Vulnerabilities-Discovered-in-QNAP-and-Kyocera-Device-Manag
url: https://thehackernews.com/2024/01/alert-new-vulnerabilities-discovered-in.html
content:
A security flaw has been disclosed in Kyocera’s&nbsp;Device Manager&nbsp;product that could be exploited by bad actors to carry out malicious activities on affected systems.
"This vulnerability allows attackers to coerce authentication attempts to their own resources, such as a malicious SMB share, to capture or relay Active Directory hashed credentials if the ‘Restrict NTLM: Outgoing NTLM


feed_id: https://thehackernews.com/2024/01/beware-youtube-videos-promoting-cracked.html
title: Beware! YouTube Videos Promoting Cracked Software Distribute Lumma Stealer
uri: Beware-YouTube-Videos-Promoting-Cracked-Software-Distribute-Lumma-Ste
url: https://thehackernews.com/2024/01/beware-youtube-videos-promoting-cracked.html
content:
Threat actors are resorting to YouTube videos featuring content related to cracked software in order to entice users into downloading an information stealer malware called Lumma.
“These YouTube videos typically feature content related to cracked applications, presenting users with similar installation guides and incorporating malicious URLs often shortened using services like TinyURL and Cuttly,


feed_id: https://thehackernews.com/2024/01/syrian-hackers-distributing-stealthy-c.html
title: Syrian Hackers Distributing Stealthy C#-Based Silver RAT to Cybercriminals
uri: Syrian-Hackers-Distributing-Stealthy-C-Based-Silver-RAT-to-Cybercrimi
url: https://thehackernews.com/2024/01/syrian-hackers-distributing-stealthy-c.html
content:
Threat actors operating under the name Anonymous Arabic have released a remote access trojan (RAT) called&nbsp;Silver RAT&nbsp;that’s equipped to bypass security software and stealthily launch hidden applications.
“The developers operate on multiple hacker forums and social media platforms, showcasing an active and sophisticated presence,” cybersecurity firm Cyfirma&nbsp;said&nbsp;in a report


feed_id: https://thehackernews.com/2024/01/unifying-security-tech-beyond-stack.html
title: Unifying Security Tech Beyond the Stack: Integrating SecOps with Managed Risk and Strategy
uri: Unifying-Security-Tech-Beyond-the-Stack-Integrating-SecOps-with-Manag
url: https://thehackernews.com/2024/01/unifying-security-tech-beyond-stack.html
content:
Cybersecurity is an infinite journey in a digital landscape that never ceases to change. According to Ponemon Institute1, “only 59% of organizations say their cybersecurity strategy has changed over the past two years.” This stagnation in strategy adaptation can be traced back to several key issues.

Talent Retention Challenges:&nbsp;The cybersecurity field is rapidly advancing, requiring a


feed_id: https://thehackernews.com/2024/01/webinar-leverage-zero-trust-security-to.html
title: Webinar – Leverage Zero Trust Security to Minimize Your Attack Surface
uri: Webinar-Leverage-Zero-Trust-Security-to-Minimize-Your-Attack-Surfa
url: https://thehackernews.com/2024/01/webinar-leverage-zero-trust-security-to.html
content:
Digital expansion inevitably increases the external attack surface, making you susceptible to cyberthreats. Threat actors increasingly exploit the vulnerabilities stemming from software and infrastructure exposed to the internet; this ironically includes security tools, particularly firewalls and VPNs, which give attackers direct network access to execute their attacks. In fact,&nbsp;Gartner&


feed_id: https://thehackernews.com/2024/01/nist-warns-of-security-and-privacy.html
title: NIST Warns of Security and Privacy Risks from Rapid AI System Deployment
uri: NIST-Warns-of-Security-and-Privacy-Risks-from-Rapid-AI-System-Deployme
url: https://thehackernews.com/2024/01/nist-warns-of-security-and-privacy.html
content:
The U.S. National Institute of Standards and Technology (NIST) is calling attention to the&nbsp;privacy and security challenges&nbsp;that arise as a result of increased deployment of artificial intelligence (AI) systems in recent years.
“These security and privacy challenges include the potential for adversarial manipulation of training data, adversarial exploitation of model vulnerabilities to


feed_id: https://thehackernews.com/2024/01/doj-charges-19-worldwide-in-68-million.html
title: DoJ Charges 19 Worldwide in $68 Million xDedic Dark Web Marketplace Fraud
uri: DoJ-Charges-19-Worldwide-in-68-Million-xDedic-Dark-Web-Marketplace-Fr
url: https://thehackernews.com/2024/01/doj-charges-19-worldwide-in-68-million.html
content:
The U.S. Department of Justice (DoJ) said it charged 19 individuals worldwide in connection with the now-defunct xDedic Marketplace, which is estimated to have facilitated more than $68 million in fraud.
In&nbsp;wrapping up its investigation&nbsp;into the dark web portal, the agency said the transnational operation was the result of close cooperation with law enforcement authorities from Belgium


feed_id: https://thehackernews.com/2024/01/north-koreas-cyber-heist-dprk-hackers.html
title: North Korea's Cyber Heist: DPRK Hackers Stole $600 Million in Cryptocurrency in 2023
uri: North-Korea-s-Cyber-Heist-DPRK-Hackers-Stole-600-Million-in-Cryptocu
url: https://thehackernews.com/2024/01/north-koreas-cyber-heist-dprk-hackers.html
content:
Threat actors affiliated with the Democratic People's Republic of Korea (also known as North Korea) have plundered at least $600 million in cryptocurrency in 2023.
The DPRK "was responsible for almost a third of all funds stolen in crypto attacks last year, despite a 30% reduction from the USD 850 million haul in 2022," blockchain analytics firm TRM Labs&nbsp;said&nbsp;last week.
"Hacks


feed_id: https://thehackernews.com/2024/01/sea-turtle-cyber-espionage-campaign.html
title: Sea Turtle Cyber Espionage Campaign Targets Dutch IT and Telecom Companies
uri: Sea-Turtle-Cyber-Espionage-Campaign-Targets-Dutch-IT-and-Telecom-Compa
url: https://thehackernews.com/2024/01/sea-turtle-cyber-espionage-campaign.html
content:
Telecommunication, media, internet service providers (ISPs), information technology (IT)-service providers, and Kurdish websites in the Netherlands have been targeted as part of a new cyber espionage campaign undertaken by a Türkiye-nexus threat actor known as&nbsp;Sea Turtle.
"The infrastructure of the targets was susceptible to supply chain and island-hopping attacks, which the attack group


feed_id: https://thehackernews.com/2024/01/pro-iranian-hacker-group-targeting.html
title: Pro-Iranian Hacker Group Targeting Albania with No-Justice Wiper Malware
uri: Pro-Iranian-Hacker-Group-Targeting-Albania-with-No-Justice-Wiper-Malwa
url: https://thehackernews.com/2024/01/pro-iranian-hacker-group-targeting.html
content:
The&nbsp;recent wave of cyber attacks&nbsp;targeting Albanian organizations involved the use of a wiper called&nbsp;No-Justice.
The&nbsp;findings&nbsp;come from cybersecurity company ClearSky, which said the Windows-based malware "crashes the operating system in a way that it cannot be rebooted."
The intrusions have been attributed to an Iranian “psychological operation group” known as Homeland


feed_id: https://thehackernews.com/2024/01/spectralblur-new-macos-backdoor-threat.html
title: SpectralBlur: New macOS Backdoor Threat from North Korean Hackers
uri: SpectralBlur-New-macOS-Backdoor-Threat-from-North-Korean-Hackers
url: https://thehackernews.com/2024/01/spectralblur-new-macos-backdoor-threat.html
content:
Cybersecurity researchers have discovered a new Apple macOS backdoor called&nbsp;SpectralBlur&nbsp;that overlaps with a known malware family that has been attributed to North Korean threat actors.
“SpectralBlur is a moderately capable backdoor that can upload/download files, run a shell, update its configuration, delete files, hibernate, or sleep, based on commands issued from the [


feed_id: https://thehackernews.com/2024/01/exposed-secrets-are-everywhere-heres.html
title: Exposed Secrets are Everywhere. Here's How to Tackle Them
uri: Exposed-Secrets-are-Everywhere-Here-s-How-to-Tackle-Them
url: https://thehackernews.com/2024/01/exposed-secrets-are-everywhere-heres.html
content:
Picture this: you stumble upon a concealed secret within your company's source code. Instantly, a wave of panic hits as you grasp the possible consequences. This one hidden secret has the power to pave the way for unauthorized entry, data breaches, and a damaged reputation. Understanding the secret is just the beginning; swift and resolute action becomes imperative. However, lacking the


feed_id: https://thehackernews.com/2024/01/orange-spain-faces-bgp-traffic-hijack.html
title: Orange Spain Faces BGP Traffic Hijack After RIPE Account Hacked by Malware
uri: Orange-Spain-Faces-BGP-Traffic-Hijack-After-RIPE-Account-Hacked-by-Mal
url: https://thehackernews.com/2024/01/orange-spain-faces-bgp-traffic-hijack.html
content:
Mobile network operator Orange Spain suffered an internet outage for several hours on January 3 after a threat actor used administrator credentials captured by means of stealer malware to hijack the border gateway protocol (BGP) traffic.
"The Orange account in the IP network coordination center (RIPE) has suffered improper access that has affected the browsing of some of our customers," the


feed_id: https://thehackernews.com/2024/01/alert-ivanti-releases-patch-for.html
title: Alert: Ivanti Releases Patch for Critical Vulnerability in Endpoint Manager Solution
uri: Alert-Ivanti-Releases-Patch-for-Critical-Vulnerability-in-Endpoint-Ma
url: https://thehackernews.com/2024/01/alert-ivanti-releases-patch-for.html
content:
Ivanti has released security updates to address a critical flaw impacting its Endpoint Manager (EPM) solution that, if successfully exploited, could result in remote code execution (RCE) on susceptible servers.
Tracked as CVE-2023-39336, the vulnerability has been rated 9.6 out of 10 on the CVSS scoring system. The shortcoming impacts EPM 2021 and EPM 2022 prior to SU5.
“If exploited, an


feed_id: https://thehackernews.com/2024/01/russian-hackers-had-covert-access-to.html
title: Russian Hackers Had Covert Access to Ukraine's Telecom Giant for Months
uri: Russian-Hackers-Had-Covert-Access-to-Ukraine-s-Telecom-Giant-for-Month
url: https://thehackernews.com/2024/01/russian-hackers-had-covert-access-to.html
content:
Ukrainian cybersecurity authorities have disclosed that the Russian state-sponsored threat actor known as&nbsp;Sandworm&nbsp;was inside telecom operator Kyivstar's systems at least since May 2023.
The development was&nbsp;first reported&nbsp;by Reuters.
The&nbsp;incident, described as a "powerful hacker attack," first came to light last month, knocking out access to mobile and internet services


feed_id: https://thehackernews.com/2024/01/new-bandook-rat-variant-resurfaces.html
title: New Bandook RAT Variant Resurfaces, Targeting Windows Machines
uri: New-Bandook-RAT-Variant-Resurfaces-Targeting-Windows-Machines
url: https://thehackernews.com/2024/01/new-bandook-rat-variant-resurfaces.html
content:
A new variant of a remote access trojan called&nbsp;Bandook&nbsp;has been observed being propagated via phishing attacks with an aim to infiltrate Windows machines, underscoring the continuous evolution of the malware.
Fortinet FortiGuard Labs, which identified the activity in October 2023, said the malware is distributed via a PDF file that embeds a link to a password-protected .7z archive.
“


feed_id: https://thehackernews.com/2024/01/threat-actors-increasingly-abusing.html
title: Threat Actors Increasingly Abusing GitHub for Malicious Purposes
uri: Threat-Actors-Increasingly-Abusing-GitHub-for-Malicious-Purposes
url: https://thehackernews.com/2024/01/threat-actors-increasingly-abusing.html
content:
The ubiquity of GitHub in information technology (IT) environments has made it a lucrative choice for threat actors to host and deliver malicious payloads and act as&nbsp;dead drop resolvers, command-and-control, and data exfiltration points.
“Using GitHub services for malicious infrastructure allows adversaries to blend in with legitimate network traffic, often bypassing traditional security


feed_id: https://thehackernews.com/2024/01/new-poc-exploit-for-apache-ofbiz.html
title: New PoC Exploit for Apache OfBiz Vulnerability Poses Risk to ERP Systems
uri: New-PoC-Exploit-for-Apache-OfBiz-Vulnerability-Poses-Risk-to-ERP-Syste
url: https://thehackernews.com/2024/01/new-poc-exploit-for-apache-ofbiz.html
content:
Cybersecurity researchers have&nbsp;developed&nbsp;a proof-of-concept (PoC) code that exploits a&nbsp;recently disclosed critical flaw&nbsp;in the Apache OfBiz open-source Enterprise Resource Planning (ERP) system to execute a memory-resident payload.
The vulnerability in question is&nbsp;CVE-2023-51467&nbsp;(CVSS score: 9.8), a bypass for another severe shortcoming in the same software (


feed_id: https://thehackernews.com/2024/01/new-python-based-fbot-hacking-toolkit.html
title: New Python-based FBot Hacking Toolkit Aims at Cloud and SaaS Platforms
uri: New-Python-based-FBot-Hacking-Toolkit-Aims-at-Cloud-and-SaaS-Platforms
url: https://thehackernews.com/2024/01/new-python-based-fbot-hacking-toolkit.html
content:
A new Python-based hacking tool called&nbsp;FBot&nbsp;has been uncovered targeting web servers, cloud services, content management systems (CMS), and SaaS platforms such as Amazon Web Services (AWS), Microsoft 365, PayPal, Sendgrid, and Twilio.
“Key features include credential harvesting for spamming attacks, AWS account hijacking tools, and functions to enable attacks against PayPal and various


feed_id: https://thehackernews.com/2024/01/there-is-ransomware-armageddon-coming.html
title: There is a Ransomware Armageddon Coming for Us All
uri: There-is-a-Ransomware-Armageddon-Coming-for-Us-All
url: https://thehackernews.com/2024/01/there-is-ransomware-armageddon-coming.html
content:
Generative AI will enable anyone to launch sophisticated phishing attacks that only Next-generation MFA devices can stop
The least surprising headline from 2023 is that ransomware again set new records for a number of incidents and the damage inflicted. We saw new headlines every week, which included a who’s-who of big-name organizations. If MGM, Johnson Controls, Chlorox, Hanes Brands, Caesars


feed_id: https://thehackernews.com/2024/01/atomic-stealer-gets-upgrade-targeting.html
title: Atomic Stealer Gets an Upgrade - Targeting Mac Users with Encrypted Payload
uri: Atomic-Stealer-Gets-an-Upgrade-Targeting-Mac-Users-with-Encrypted-Pa
url: https://thehackernews.com/2024/01/atomic-stealer-gets-upgrade-targeting.html
content:
Cybersecurity researchers have identified an updated version of a macOS information stealer called&nbsp;Atomic&nbsp;(or AMOS), indicating that the threat actors behind the malware are actively enhancing its capabilities.
"It looks like Atomic Stealer was updated around mid to late December 2023, where its developers introduced payload encryption in an effort to bypass detection rules,"


feed_id: https://thehackernews.com/2024/01/mandiants-x-account-was-hacked-using.html
title: Mandiant's X Account Was Hacked Using Brute-Force Attack
uri: Mandiant-s-X-Account-Was-Hacked-Using-Brute-Force-Attack
url: https://thehackernews.com/2024/01/mandiants-x-account-was-hacked-using.html
content:
The compromise of Mandiant's X (formerly Twitter) account last week was likely the result of a "brute-force password attack," attributing the hack to a drainer-as-a-service (DaaS) group.
"Normally, [two-factor authentication] would have mitigated this, but due to some team transitions and a change in X's 2FA policy, we were not adequately protected," the threat intelligence firm&nbsp;said&nbsp;


feed_id: https://thehackernews.com/2024/01/chinese-hackers-exploit-zero-day-flaws.html
title: Chinese Hackers Exploit Zero-Day Flaws in Ivanti Connect Secure and Policy Secure
uri: Chinese-Hackers-Exploit-Zero-Day-Flaws-in-Ivanti-Connect-Secure-and-Po
url: https://thehackernews.com/2024/01/chinese-hackers-exploit-zero-day-flaws.html
content:
A pair of zero-day flaws identified in Ivanti Connect Secure (ICS) and Policy Secure have been chained by suspected China-linked nation-state actors to breach less than 10 customers.
Cybersecurity firm Volexity, which&nbsp;identified&nbsp;the activity on the network of one of its customers in the second week of December 2023, attributed it to a hacking group it tracks under the name&nbsp;UTA0178


feed_id: https://thehackernews.com/2024/01/cisco-fixes-high-risk-vulnerability.html
title: Cisco Fixes High-Risk Vulnerability Impacting Unity Connection Software
uri: Cisco-Fixes-High-Risk-Vulnerability-Impacting-Unity-Connection-Softwar
url: https://thehackernews.com/2024/01/cisco-fixes-high-risk-vulnerability.html
content:
Cisco has released software updates to address a critical security flaw impacting Unity Connection that could permit an adversary to execute arbitrary commands on the underlying system.
Tracked as&nbsp;CVE-2024-20272&nbsp;(CVSS score: 7.3), the vulnerability is an arbitrary file upload bug residing in the web-based management interface and is the result of a lack of authentication in a specific


feed_id: https://thehackernews.com/2024/01/noabot-latest-mirai-based-botnet.html
title: NoaBot: Latest Mirai-Based Botnet Targeting SSH Servers for Crypto Mining
uri: NoaBot-Latest-Mirai-Based-Botnet-Targeting-SSH-Servers-for-Crypto-Min
url: https://thehackernews.com/2024/01/noabot-latest-mirai-based-botnet.html
content:
A new Mirai-based botnet called&nbsp;NoaBot&nbsp;is being used by threat actors as part of a crypto mining campaign since the beginning of 2023.
“The capabilities of the new botnet, NoaBot, include a wormable self-spreader and an SSH key backdoor to download and execute additional binaries or spread itself to new victims,” Akamai security researcher Stiv Kupchik said in a report shared with The


feed_id: https://thehackernews.com/2024/01/getting-off-attack-surface-hamster.html
title: Getting off the Attack Surface Hamster Wheel: Identity Can Help
uri: Getting-off-the-Attack-Surface-Hamster-Wheel-Identity-Can-Help
url: https://thehackernews.com/2024/01/getting-off-attack-surface-hamster.html
content:
IT professionals have developed a sophisticated understanding of the enterprise attack surface – what it is, how to quantify it and how to manage it.&nbsp;
The process is simple: begin by thoroughly assessing the attack surface, encompassing the entire IT environment. Identify all potential entry and exit points where unauthorized access could occur. Strengthen these vulnerable points using


feed_id: https://thehackernews.com/2024/01/free-decryptor-released-for-black-basta.html
title: Free Decryptor Released for Black Basta and Babuk's Tortilla Ransomware Victims
uri: Free-Decryptor-Released-for-Black-Basta-and-Babuk-s-Tortilla-Ransomwar
url: https://thehackernews.com/2024/01/free-decryptor-released-for-black-basta.html
content:
A decryptor for the Tortilla variant of the Babuk ransomware has been&nbsp;released&nbsp;by Cisco Talos, allowing victims targeted by the malware to regain access to their files.
The cybersecurity firm said the threat intelligence it shared with Dutch law enforcement authorities made it possible to arrest the threat actor behind the operations.
The encryption key has also been shared with Avast,


feed_id: https://thehackernews.com/2024/01/ftc-bans-outlogic-x-mode-from-selling.html
title: FTC Bans Outlogic (X-Mode) From Selling Sensitive Location Data
uri: FTC-Bans-Outlogic-(X-Mode)-From-Selling-Sensitive-Location-Data
url: https://thehackernews.com/2024/01/ftc-bans-outlogic-x-mode-from-selling.html
content:
The U.S. Federal Trade Commission (FTC) on Tuesday prohibited data broker Outlogic, which was previously known as X-Mode Social, from sharing or selling any sensitive location data with third-parties.
The ban is part of a&nbsp;settlement&nbsp;over allegations that the company "sold precise location data that could be used to track people's visits to sensitive locations such as medical and


feed_id: https://thehackernews.com/2024/01/microsofts-january-2024-windows-update.html
title: Microsoft's January 2024 Windows Update Patches 48 New Vulnerabilities
uri: Microsoft-s-January-2024-Windows-Update-Patches-48-New-Vulnerabilities
url: https://thehackernews.com/2024/01/microsofts-january-2024-windows-update.html
content:
Microsoft has addressed a total of&nbsp;48 security flaws&nbsp;spanning its software as part of its Patch Tuesday updates for January 2024.
Of the 48 bugs, two are rated Critical and 46 are rated Important in severity. There is no evidence that any of the issues are publicly known or under active attack at the time of release, making it the second consecutive Patch Tuesday with no zero-days.
The


feed_id: https://thehackernews.com/2024/01/cisa-flags-6-vulnerabilities-apple.html
title: CISA Flags 6 Vulnerabilities - Apple, Apache, Adobe, D-Link, Joomla Under Attack
uri: CISA-Flags-6-Vulnerabilities-Apple-Apache-Adobe-D-Link-Joomla-Un
url: https://thehackernews.com/2024/01/cisa-flags-6-vulnerabilities-apple.html
content:
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has&nbsp;added&nbsp;six security flaws to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation.
This includes&nbsp;CVE-2023-27524&nbsp;(CVSS score: 8.9), a high-severity vulnerability impacting the Apache Superset open-source data visualization software that could enable remote code execution.


feed_id: https://thehackernews.com/2024/01/citrix-vmware-and-atlassian-hit-with.html
title: Citrix, VMware, and Atlassian Hit with Critical Flaws — Patch ASAP!
uri: Citrix-VMware-and-Atlassian-Hit-with-Critical-Flaws-Patch-ASAP
url: https://thehackernews.com/2024/01/citrix-vmware-and-atlassian-hit-with.html
content:
Citrix is warning of two zero-day security vulnerabilities in NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway (formerly Citrix Gateway) that are being actively exploited in the wild.
The flaws are listed below -

CVE-2023-6548 (CVSS score: 5.5) - Authenticated (low privileged) remote code execution on Management Interface (requires access to NSIP, CLIP, or SNIP with management


feed_id: https://thehackernews.com/2024/01/zero-day-alert-update-chrome-now-to-fix.html
title: Zero-Day Alert: Update Chrome Now to Fix New Actively Exploited Vulnerability
uri: Zero-Day-Alert-Update-Chrome-Now-to-Fix-New-Actively-Exploited-Vulner
url: https://thehackernews.com/2024/01/zero-day-alert-update-chrome-now-to-fix.html
content:
Google on Tuesday released updates to fix four security issues in its Chrome browser, including an actively exploited zero-day flaw.
The issue, tracked as CVE-2024-0519, concerns an out-of-bounds memory access in the V8 JavaScript and WebAssembly engine, which can be weaponized by threat actors to trigger a crash.
"By reading out-of-bounds memory, an attacker might be able to get secret values,


feed_id: https://thehackernews.com/2024/01/alert-over-178000-sonicwall-firewalls.html
title: Alert: Over 178,000 SonicWall Firewalls Potentially Vulnerable to Exploits - Act Now
uri: Alert-Over-178-000-SonicWall-Firewalls-Potentially-Vulnerable-to-Expl
url: https://thehackernews.com/2024/01/alert-over-178000-sonicwall-firewalls.html
content:
Over 178,000 SonicWall firewalls exposed over the internet are exploitable to at least one of the two security flaws that could be potentially exploited to cause a denial-of-service (DoS) condition and remote code execution (RCE).
“The two issues are fundamentally the same but exploitable at different HTTP URI paths due to reuse of a vulnerable code pattern,” Jon Williams, a senior security


feed_id: https://thehackernews.com/2024/01/case-study-cookie-privacy-monster-in.html
title: Case Study: The Cookie Privacy Monster in Big Global Retail
uri: Case-Study-The-Cookie-Privacy-Monster-in-Big-Global-Retail
url: https://thehackernews.com/2024/01/case-study-cookie-privacy-monster-in.html
content:
Explore how an advanced exposure management solution saved a major retail industry client from ending up on the naughty step due to a misconfiguration in its cookie management policy. This wasn’t anything malicious, but with modern web environments being so complex, mistakes can happen, and non-compliance fines can be just an oversight away.Download the full case study&nbsp;here.

As a child,


feed_id: https://thehackernews.com/2024/01/remcos-rat-spreading-through-adult.html
title: Remcos RAT Spreading Through Adult Games in New Attack Wave
uri: Remcos-RAT-Spreading-Through-Adult-Games-in-New-Attack-Wave
url: https://thehackernews.com/2024/01/remcos-rat-spreading-through-adult.html
content:
The remote access trojan (RAT) known as Remcos RAT has been found being propagated via webhards by disguising it as adult-themed games in South Korea.
WebHard, short for&nbsp;web hard drive, is a popular online file storage system used to upload, download, and share files in the country.
While webhards have been used in the past to deliver&nbsp;njRAT,&nbsp;UDP RAT, and DDoS botnet malware, the


feed_id: https://thehackernews.com/2024/01/inferno-malware-masqueraded-as-coinbase.html
title: Inferno Malware Masqueraded as Coinbase, Drained $87 Million from 137,000 Victims
uri: Inferno-Malware-Masqueraded-as-Coinbase-Drained-87-Million-from-137
url: https://thehackernews.com/2024/01/inferno-malware-masqueraded-as-coinbase.html
content:
The operators behind the now-defunct&nbsp;Inferno Drainer&nbsp;created more than 16,000 unique malicious domains over a span of one year between 2022 and 2023.
The scheme “leveraged high-quality phishing pages to lure unsuspecting users into connecting their cryptocurrency wallets with the attackers’ infrastructure that spoofed Web3 protocols to trick victims into authorizing transactions,”


feed_id: https://thehackernews.com/2024/01/hackers-weaponize-windows-flaw-to.html
title: Hackers Weaponize Windows Flaw to Deploy Crypto-Siphoning Phemedrone Stealer
uri: Hackers-Weaponize-Windows-Flaw-to-Deploy-Crypto-Siphoning-Phemedrone-S
url: https://thehackernews.com/2024/01/hackers-weaponize-windows-flaw-to.html
content:
Threat actors have been observed leveraging a now-patched security flaw in Microsoft Windows to deploy an open-source information stealer called&nbsp;Phemedrone Stealer.
“Phemedrone targets web browsers and data from cryptocurrency wallets and messaging apps such as Telegram, Steam, and Discord,” Trend Micro researchers Peter Girnus, Aliakbar Zahravi, and Simon Zuckerbraun&nbsp;said.
“It also


feed_id: https://thehackernews.com/2024/01/opera-myflaw-bug-could-let-hackers-run.html
title: Opera MyFlaw Bug Could Let Hackers Run ANY File on Your Mac or Windows
uri: Opera-MyFlaw-Bug-Could-Let-Hackers-Run-ANY-File-on-Your-Mac-or-Windows
url: https://thehackernews.com/2024/01/opera-myflaw-bug-could-let-hackers-run.html
content:
Cybersecurity researchers have disclosed a now-patched security flaw in the Opera web browser for Microsoft Windows and Apple macOS that could be exploited to execute any file on the underlying operating system.
The remote code execution vulnerability has been codenamed MyFlaw by the Guardio Labs research team owing to the fact that it takes advantage of a feature called&nbsp;My Flow&nbsp;that


feed_id: https://thehackernews.com/2024/01/3-ransomware-group-newcomers-to-watch.html
title: 3 Ransomware Group Newcomers to Watch in 2024
uri: 3-Ransomware-Group-Newcomers-to-Watch-in-2024
url: https://thehackernews.com/2024/01/3-ransomware-group-newcomers-to-watch.html
content:
The ransomware industry surged in 2023 as it saw an alarming 55.5% increase in victims worldwide, reaching a staggering 4,368 cases.&nbsp;
Figure 1: Year over year victims per quarter
The rollercoaster ride from explosive growth in 2021 to a momentary dip in 2022 was just a teaser—2023 roared back with the same fervor as 2021, propelling existing groups and ushering in a wave of formidable


feed_id: https://thehackernews.com/2024/01/high-severity-flaws-uncovered-in-bosch.html
title: High-Severity Flaws Uncovered in Bosch Thermostats and Smart Nutrunners
uri: High-Severity-Flaws-Uncovered-in-Bosch-Thermostats-and-Smart-Nutrunner
url: https://thehackernews.com/2024/01/high-severity-flaws-uncovered-in-bosch.html
content:
Multiple security vulnerabilities have been disclosed in Bosch BCC100 thermostats and Rexroth NXA015S-36V-B smart nutrunners that, if successfully exploited, could allow attackers to execute arbitrary code on affected systems.
Romanian cybersecurity firm Bitdefender, which&nbsp;discovered&nbsp;the flaw in Bosch BCC100 thermostats last August, said the issue could be weaponized by an attacker to


feed_id: https://thehackernews.com/2024/01/balada-injector-infects-over-7100.html
title: Balada Injector Infects Over 7,100 WordPress Sites Using Plugin Vulnerability
uri: Balada-Injector-Infects-Over-7-100-WordPress-Sites-Using-Plugin-Vulner
url: https://thehackernews.com/2024/01/balada-injector-infects-over-7100.html
content:
Thousands of WordPress sites using a vulnerable version of the Popup Builder plugin have been compromised with a malware called&nbsp;Balada Injector.
First&nbsp;documented&nbsp;by Doctor Web in January 2023, the campaign takes place in a series of periodic attack waves, weaponizing security flaws WordPress plugins to inject backdoor designed to redirect visitors of infected sites to bogus tech


feed_id: https://thehackernews.com/2024/01/ddos-attacks-on-environmental-services.html
title: DDoS Attacks on the Environmental Services Industry Surge by 61,839% in 2023
uri: DDoS-Attacks-on-the-Environmental-Services-Industry-Surge-by-61-839-i
url: https://thehackernews.com/2024/01/ddos-attacks-on-environmental-services.html
content:
The environmental services industry witnessed an “unprecedented surge” in HTTP-based distributed denial-of-service (DDoS) attacks, accounting for half of all its HTTP traffic.
This marks a 61,839% increase in DDoS attack traffic year-over-year, web infrastructure and security company Cloudflare said in its DDoS threat report for 2023 Q4 published last week.
“This surge in cyber attacks coincided


feed_id: https://thehackernews.com/2024/01/new-findings-challenge-attribution-in.html
title: New Findings Challenge Attribution in Denmark's Energy Sector Cyberattacks
uri: New-Findings-Challenge-Attribution-in-Denmark-s-Energy-Sector-Cyberatt
url: https://thehackernews.com/2024/01/new-findings-challenge-attribution-in.html
content:
The cyber attacks targeting the energy sector in Denmark last year may not have had the involvement of the Russia-linked Sandworm hacking group,&nbsp;new findings&nbsp;from Forescout show.
The intrusions, which&nbsp;targeted around 22 Danish energy organizations&nbsp;in May 2023, occurred in two distinct waves, one which exploited a security flaw in Zyxel firewall (CVE-2023-28771) and a


feed_id: https://thehackernews.com/2024/01/critical-rce-vulnerability-uncovered-in.html
title: Critical RCE Vulnerability Uncovered in Juniper SRX Firewalls and EX Switches
uri: Critical-RCE-Vulnerability-Uncovered-in-Juniper-SRX-Firewalls-and-EX-S
url: https://thehackernews.com/2024/01/critical-rce-vulnerability-uncovered-in.html
content:
Juniper Networks has released updates to fix a critical remote code execution (RCE) vulnerability in its SRX Series firewalls and EX Series switches.
The issue, tracked as&nbsp;CVE-2024-21591, is rated 9.8 on the CVSS scoring system.
“An out-of-bounds write vulnerability in J-Web of Juniper Networks Junos OS SRX Series and EX Series allows an unauthenticated, network-based attacker to cause a


feed_id: https://thehackernews.com/2024/01/29-year-old-ukrainian-cryptojacking.html
title: 29-Year-Old Ukrainian Cryptojacking Kingpin Arrested for Exploiting Cloud Services
uri: 29-Year-Old-Ukrainian-Cryptojacking-Kingpin-Arrested-for-Exploiting-Cl
url: https://thehackernews.com/2024/01/29-year-old-ukrainian-cryptojacking.html
content:
A 29-year-old Ukrainian national has been arrested in connection with running a “sophisticated cryptojacking scheme,” netting them over $2 million (€1.8 million) in illicit profits.
The person, described as the “mastermind” behind the operation, was apprehended in Mykolaiv, Ukraine, on January 9 by the National Police of Ukraine with support from Europol and an unnamed cloud service provider


feed_id: https://thehackernews.com/2024/01/nation-state-actors-weaponize-ivanti.html
title: Nation-State Actors Weaponize Ivanti VPN Zero-Days, Deploying 5 Malware Families
uri: Nation-State-Actors-Weaponize-Ivanti-VPN-Zero-Days-Deploying-5-Malwar
url: https://thehackernews.com/2024/01/nation-state-actors-weaponize-ivanti.html
content:
As many as five different malware families were deployed by suspected nation-state actors as part of post-exploitation activities leveraging&nbsp;two zero-day vulnerabilities&nbsp;in Ivanti Connect Secure (ICS) VPN appliances since early December 2023.
"These families allow the threat actors to circumvent authentication and provide backdoor access to these devices," Mandiant&nbsp;said&nbsp;in an


feed_id: https://thehackernews.com/2024/01/medusa-ransomware-on-rise-from-data.html
title: Medusa Ransomware on the Rise: From Data Leaks to Multi-Extortion
uri: Medusa-Ransomware-on-the-Rise-From-Data-Leaks-to-Multi-Extortion
url: https://thehackernews.com/2024/01/medusa-ransomware-on-rise-from-data.html
content:
The threat actors associated with the&nbsp;Medusa ransomware&nbsp;have ramped up their activities following the debut of a dedicated data leak site on the dark web in February 2023 to publish sensitive data of victims who are unwilling to agree to their demands.
“As part of their multi-extortion strategy, this group will provide victims with multiple options when their data is posted on their


feed_id: https://thehackernews.com/2024/01/applying-tyson-principle-to.html
title: Applying the Tyson Principle to Cybersecurity: Why Attack Simulation is Key to Avoiding a KO
uri: Applying-the-Tyson-Principle-to-Cybersecurity-Why-Attack-Simulation-i
url: https://thehackernews.com/2024/01/applying-tyson-principle-to.html
content:
Picture a cybersecurity landscape where defenses are impenetrable, and threats are nothing more than mere disturbances deflected by a strong shield. Sadly, this image of fortitude remains a pipe dream despite its comforting nature. In the security world, preparedness is not just a luxury but a necessity. In this context, Mike Tyson's famous adage, "Everyone has a plan until they get punched in


feed_id: https://thehackernews.com/2024/01/urgent-gitlab-releases-patch-for.html
title: Urgent: GitLab Releases Patch for Critical Vulnerabilities - Update ASAP
uri: Urgent-GitLab-Releases-Patch-for-Critical-Vulnerabilities-Update-AS
url: https://thehackernews.com/2024/01/urgent-gitlab-releases-patch-for.html
content:
GitLab has released security updates to address two critical vulnerabilities, including one that could be exploited to take over accounts without requiring any user interaction.
Tracked as&nbsp;CVE-2023-7028, the flaw has been awarded the maximum severity of 10.0 on the CVSS scoring system and could facilitate account takeover by sending password reset emails to an unverified email address.
The


feed_id: https://thehackernews.com/2024/01/cryptominers-targeting-misconfigured.html
title: Cryptominers Targeting Misconfigured Apache Hadoop and Flink with Rootkit in New Attacks
uri: Cryptominers-Targeting-Misconfigured-Apache-Hadoop-and-Flink-with-Root
url: https://thehackernews.com/2024/01/cryptominers-targeting-misconfigured.html
content:
Cybersecurity researchers have identified a new attack that exploits misconfigurations in Apache Hadoop and Flink to deploy cryptocurrency miners within targeted environments.
"This attack is particularly intriguing due to the attacker's use of packers and rootkits to conceal the malware," Aqua security researchers Nitzan Yaakov and Assaf Morag&nbsp;said&nbsp;in an analysis published earlier


feed_id: https://thehackernews.com/2024/01/act-now-cisa-flags-active-exploitation.html
title: Act Now: CISA Flags Active Exploitation of Microsoft SharePoint Vulnerability
uri: Act-Now-CISA-Flags-Active-Exploitation-of-Microsoft-SharePoint-Vulner
url: https://thehackernews.com/2024/01/act-now-cisa-flags-active-exploitation.html
content:
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has&nbsp;added&nbsp;a critical security vulnerability impacting Microsoft SharePoint Server to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation.
The issue, tracked as&nbsp;CVE-2023-29357&nbsp;(CVSS score: 9.8), is a privilege escalation flaw that could be exploited by an attacker to gain


feed_id: https://thehackernews.com/2024/01/vextrio-uber-of-cybercrime-brokering.html
title: VexTrio: The Uber of Cybercrime - Brokering Malware for 60+ Affiliates
uri: VexTrio-The-Uber-of-Cybercrime-Brokering-Malware-for-60-Affiliates
url: https://thehackernews.com/2024/01/vextrio-uber-of-cybercrime-brokering.html
content:
The threat actors behind ClearFake, SocGholish, and dozens of other actors have established partnerships with another entity known as&nbsp;VexTrio&nbsp;as part of a massive "criminal affiliate program," new findings from Infoblox reveal.
The latest development demonstrates the "breadth of their activities and depth of their connections within the cybercrime industry," the company said,


feed_id: https://thehackernews.com/2024/01/malicious-npm-packages-exfiltrate-1600.html
title: Malicious NPM Packages Exfiltrate Hundreds of Developer SSH Keys via GitHub
uri: Malicious-NPM-Packages-Exfiltrate-Hundreds-of-Developer-SSH-Keys-via-G
url: https://thehackernews.com/2024/01/malicious-npm-packages-exfiltrate-1600.html
content:
Two malicious packages discovered on the npm package registry have been found to leverage GitHub to store Base64-encrypted SSH keys stolen from developer systems on which they were installed.
The modules named&nbsp;warbeast2000&nbsp;and&nbsp;kodiak2k&nbsp;were published at the start of the month, attracting&nbsp;412&nbsp;and&nbsp;1,281 downloads&nbsp;before they were taken down by the npm


feed_id: https://thehackernews.com/2024/01/activator-alert-macos-malware-hides-in.html
title: "Activator" Alert: MacOS Malware Hides in Cracked Apps, Targeting Crypto Wallets
uri: Activator-Alert-MacOS-Malware-Hides-in-Cracked-Apps-Targeting-Cryp
url: https://thehackernews.com/2024/01/activator-alert-macos-malware-hides-in.html
content:
Cracked software have been observed infecting Apple macOS users with a previously undocumented stealer malware capable of harvesting system information and cryptocurrency wallet data.
Kaspersky, which identified the artifacts in the wild,&nbsp;said&nbsp;they are designed to target machines running macOS Ventura 13.6 and later, indicating the malware's ability to infect Macs on both Intel and


feed_id: https://thehackernews.com/2024/01/from-megabits-to-terabits-gcore-radar.html
title: From Megabits to Terabits: Gcore Radar Warns of a New Era of DDoS Attacks
uri: From-Megabits-to-Terabits-Gcore-Radar-Warns-of-a-New-Era-of-DDoS-Atta
url: https://thehackernews.com/2024/01/from-megabits-to-terabits-gcore-radar.html
content:
As we enter 2024, Gcore has released its latest Gcore Radar report, a twice-annual publication in which the company releases internal analytics to track DDoS attacks. Gcore’s broad, internationally distributed network of scrubbing centers allows them to follow attack trends over time. Read on to learn about DDoS attack trends for Q3–Q4 of 2023, and what they mean for developing a robust


feed_id: https://thehackernews.com/2024/01/breachforums-founder-sentenced-to-20.html
title: BreachForums Founder Sentenced to 20 Years of Supervised Release, No Jail Time
uri: BreachForums-Founder-Sentenced-to-20-Years-of-Supervised-Release-No-J
url: https://thehackernews.com/2024/01/breachforums-founder-sentenced-to-20.html
content:
Conor Brian Fitzpatrick has been sentenced to time served and 20 years of supervised release for his role as the creator and administrator of BreachForums.
Fitzpatrick, who went by the online alias "pompompurin," was arrested in March 2023 in New York and was subsequently charged with conspiracy to commit access device fraud and possession of child pornography. He was later released on a $


feed_id: https://thehackernews.com/2024/01/40000-attacks-in-3-days-critical.html
title: ~40,000 Attacks in 3 Days: Critical Confluence RCE Under Active Exploitation
uri: 40-000-Attacks-in-3-Days-Critical-Confluence-RCE-Under-Active-Exploi
url: https://thehackernews.com/2024/01/40000-attacks-in-3-days-critical.html
content:
Malicious actors have begun to actively exploit a recently disclosed critical security flaw impacting Atlassian Confluence Data Center and Confluence Server, within three days of public disclosure.
Tracked as CVE-2023-22527 (CVSS score: 10.0), the vulnerability impacts out-of-date versions of the software, allowing unauthenticated attackers to achieve remote code execution on susceptible


feed_id: https://thehackernews.com/2024/01/apple-issues-patch-for-critical-zero.html
title: Apple Issues Patch for Critical Zero-Day in iPhones, Macs - Update Now
uri: Apple-Issues-Patch-for-Critical-Zero-Day-in-iPhones-Macs-Update-Now
url: https://thehackernews.com/2024/01/apple-issues-patch-for-critical-zero.html
content:
Apple on Monday released security updates for iOS, iPadOS, macOS, tvOS, and Safari web browser to address a zero-day flaw that has come under active exploitation in the wild.
The issue, tracked as CVE-2024-23222, is a type confusion bug in the WebKit browser engine that could be exploited by a threat actor to achieve arbitrary code execution when processing maliciously crafted web content. The


feed_id: https://thehackernews.com/2024/01/north-korean-hackers-weaponize-fake.html
title: North Korean Hackers Weaponize Fake Research to Deliver RokRAT Backdoor
uri: North-Korean-Hackers-Weaponize-Fake-Research-to-Deliver-RokRAT-Backdoo
url: https://thehackernews.com/2024/01/north-korean-hackers-weaponize-fake.html
content:
Media organizations and high-profile experts in North Korean affairs have been at the receiving end of a new campaign orchestrated by a threat actor known as&nbsp;ScarCruft&nbsp;in December 2023.
"ScarCruft has been experimenting with new infection chains, including the use of a technical threat research report as a decoy, likely targeting consumers of threat intelligence like cybersecurity


feed_id: https://thehackernews.com/2024/01/hackers-hijack-popular-java-and-android.html
title: MavenGate Attack Could Let Hackers Hijack Java and Android via Abandoned Libraries
uri: MavenGate-Attack-Could-Let-Hackers-Hijack-Java-and-Android-via-Abandon
url: https://thehackernews.com/2024/01/hackers-hijack-popular-java-and-android.html
content:
Several public and popular libraries abandoned but still used in Java and Android applications have been found susceptible to a new software supply chain attack method called MavenGate.
"Access to projects can be hijacked through domain name purchases and since most default build configurations are vulnerable, it would be difficult or even impossible to know whether an attack was being performed


feed_id: https://thehackernews.com/2024/01/ns-stealer-uses-discord-bots-to.html
title: NS-STEALER Uses Discord Bots to Exfiltrate Your Secrets from Popular Browsers
uri: NS-STEALER-Uses-Discord-Bots-to-Exfiltrate-Your-Secrets-from-Popular-B
url: https://thehackernews.com/2024/01/ns-stealer-uses-discord-bots-to.html
content:
Cybersecurity researchers have discovered a new Java-based "sophisticated" information stealer that uses a Discord bot to exfiltrate sensitive data from compromised hosts.

The malware, named&nbsp;NS-STEALER, is propagated via ZIP archives masquerading as cracked software, Trellix security researcher Gurumoorthi Ramanathan&nbsp;said&nbsp;in an analysis published last week.

The ZIP file contains


feed_id: https://thehackernews.com/2024/01/52-of-serious-vulnerabilities-we-find.html
title: 52% of Serious Vulnerabilities We Find are Related to Windows 10
uri: 52-of-Serious-Vulnerabilities-We-Find-are-Related-to-Windows-10
url: https://thehackernews.com/2024/01/52-of-serious-vulnerabilities-we-find.html
content:
We analyzed 2,5 million vulnerabilities we discovered in our customer’s assets. This is what we found.

Digging into the data
The dataset we analyze here is representative of a subset of clients that subscribe to our vulnerability scanning services. Assets scanned include those reachable across the Internet, as well as those present on internal networks. The data includes findings for network


feed_id: https://thehackernews.com/2024/01/ftc-bans-inmarket-for-selling-precise.html
title: FTC Bans InMarket for Selling Precise User Location Without Consent
uri: FTC-Bans-InMarket-for-Selling-Precise-User-Location-Without-Consent
url: https://thehackernews.com/2024/01/ftc-bans-inmarket-for-selling-precise.html
content:
The U.S. Federal Trade Commission (FTC) is continuing to clamp down on data brokers by prohibiting InMarket Media from selling or licensing precise location data.
The settlement is part of allegations that the Texas-based company did not inform or seek consent from consumers before using their location information for advertising and marketing purposes.
"InMarket will also be prohibited from


feed_id: https://thehackernews.com/2024/01/apache-activemq-flaw-exploited-in-new.html
title: Apache ActiveMQ Flaw Exploited in New Godzilla Web Shell Attacks
uri: Apache-ActiveMQ-Flaw-Exploited-in-New-Godzilla-Web-Shell-Attacks
url: https://thehackernews.com/2024/01/apache-activemq-flaw-exploited-in-new.html
content:
Cybersecurity researchers are warning of a "notable increase" in threat actor activity actively exploiting a now-patched flaw in Apache ActiveMQ to deliver the Godzilla web shell on compromised hosts.

"The web shells are concealed within an unknown binary format and are designed to evade security and signature-based scanners," Trustwave&nbsp;said. "Notably, despite the binary's unknown file


feed_id: https://thehackernews.com/2024/01/chinese-hackers-silently-weaponized.html
title: Chinese Hackers Silently Weaponized VMware Zero-Day Flaw for 2 Years
uri: Chinese-Hackers-Silently-Weaponized-VMware-Zero-Day-Flaw-for-2-Years
url: https://thehackernews.com/2024/01/chinese-hackers-silently-weaponized.html
content:
An advanced China-nexus cyber espionage group previously linked to the exploitation of security flaws in VMware and Fortinet appliances has been attributed to the abuse of a critical vulnerability in VMware vCenter Server as a zero-day since late 2021.
"UNC3886 has a track record of utilizing zero-day vulnerabilities to complete their mission without being detected, and this latest example


feed_id: https://thehackernews.com/2024/01/cisa-issues-emergency-directive-to.html
title: CISA Issues Emergency Directive to Federal Agencies on Ivanti Zero-Day Exploits
uri: CISA-Issues-Emergency-Directive-to-Federal-Agencies-on-Ivanti-Zero-Day
url: https://thehackernews.com/2024/01/cisa-issues-emergency-directive-to.html
content:
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday issued an&nbsp;emergency directive&nbsp;urging Federal Civilian Executive Branch (FCEB) agencies to implement mitigations against two actively exploited zero-day flaws in Ivanti Connect Secure (ICS) and Ivanti Policy Secure (IPS) products.
The development arrives as the&nbsp;vulnerabilities&nbsp;– an authentication bypass


feed_id: https://thehackernews.com/2024/01/microsofts-top-execs-emails-breached-in.html
title: Microsoft's Top Execs' Emails Breached in Sophisticated Russia-Linked APT Attack
uri: Microsoft-s-Top-Execs-Emails-Breached-in-Sophisticated-Russia-Linked
url: https://thehackernews.com/2024/01/microsofts-top-execs-emails-breached-in.html
content:
Microsoft on Friday revealed that it was the target of a nation-state attack on its corporate systems that resulted in the theft of emails and attachments from senior executives and other individuals in the company's cybersecurity and legal departments.
The Windows maker attributed the attack to a Russian advanced persistent threat (APT) group it tracks as&nbsp;Midnight Blizzard&nbsp;(formerly


feed_id: https://thehackernews.com/2024/01/invoice-phishing-alert-ta866-deploys.html
title: Invoice Phishing Alert: TA866 Deploys WasabiSeed & Screenshotter Malware
uri: Invoice-Phishing-Alert-TA866-Deploys-WasabiSeed-Screenshotter-Malwa
url: https://thehackernews.com/2024/01/invoice-phishing-alert-ta866-deploys.html
content:
The threat actor tracked as&nbsp;TA866&nbsp;has resurfaced after a nine-month hiatus with a new large-volume phishing campaign to deliver known malware families such as WasabiSeed and Screenshotter.
The campaign, observed earlier this month and blocked by Proofpoint on January 11, 2024, involved sending thousands of invoice-themed emails targeting North America bearing decoy PDF files.
"The PDFs


feed_id: https://thehackernews.com/2024/01/experts-warn-of-macos-backdoor-hidden.html
title: Experts Warn of macOS Backdoor Hidden in Pirated Versions of Popular Software
uri: Experts-Warn-of-macOS-Backdoor-Hidden-in-Pirated-Versions-of-Popular-S
url: https://thehackernews.com/2024/01/experts-warn-of-macos-backdoor-hidden.html
content:
Pirated applications targeting Apple macOS users have been observed containing a backdoor capable of granting attackers remote control to infected machines.
"These applications are being hosted on Chinese pirating websites in order to gain victims," Jamf Threat Labs researchers Ferdous Saljooki and Jaron Bradley&nbsp;said.
"Once detonated, the malware will download and execute multiple payloads


feed_id: https://thehackernews.com/2024/01/preventing-data-loss-backup-and.html
title: Preventing Data Loss: Backup and Recovery Strategies for Exchange Server Administrators
uri: Preventing-Data-Loss-Backup-and-Recovery-Strategies-for-Exchange-Serv
url: https://thehackernews.com/2024/01/preventing-data-loss-backup-and.html
content:
In the current digital landscape, data has emerged as a crucial asset for organizations, akin to currency. It’s the lifeblood of any organization in today's interconnected and digital world. Thus, safeguarding the data is of paramount importance. Its importance is magnified in on-premises Exchange Server environments where vital business communication and emails are stored and managed.&nbsp;
In


feed_id: https://thehackernews.com/2024/01/npm-trojan-bypasses-uac-installs.html
title: Npm Trojan Bypasses UAC, Installs AnyDesk with "Oscompatible" Package
uri: Npm-Trojan-Bypasses-UAC-Installs-AnyDesk-with-Oscompatible-Package
url: https://thehackernews.com/2024/01/npm-trojan-bypasses-uac-installs.html
content:
A malicious package uploaded to the npm registry has been found deploying a sophisticated remote access trojan on compromised Windows machines.
The package, named "oscompatible," was published on January 9, 2024, attracting a total of 380 downloads before it was taken down.
oscompatible included a "few strange binaries," according to software supply chain security firm Phylum, including a single


feed_id: https://thehackernews.com/2024/01/us-cybersecurity-agency-warns-of.html
title: U.S. Cybersecurity Agency Warns of Actively Exploited Ivanti EPMM Vulnerability
uri: U-S-Cybersecurity-Agency-Warns-of-Actively-Exploited-Ivanti-EPMM-Vuln
url: https://thehackernews.com/2024/01/us-cybersecurity-agency-warns-of.html
content:
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday&nbsp;added&nbsp;a now-patched critical flaw impacting Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core to its Known Exploited Vulnerabilities (KEV) catalog, stating it's being actively exploited in the wild.
The vulnerability in question is&nbsp;CVE-2023-35082&nbsp;(CVSS score: 9.8), an authentication bypass


feed_id: https://thehackernews.com/2024/01/new-docker-malware-steals-cpu-for.html
title: New Docker Malware Steals CPU for Crypto & Drives Fake Website Traffic
uri: New-Docker-Malware-Steals-CPU-for-Crypto-Drives-Fake-Website-Traffic
url: https://thehackernews.com/2024/01/new-docker-malware-steals-cpu-for.html
content:
Vulnerable Docker services are being targeted by a novel campaign in which the threat actors are deploying XMRig cryptocurrency miner as well as the 9Hits Viewer software as part of a multi-pronged monetization strategy.
"This is the first documented case of malware deploying the 9Hits application as a payload," cloud security firm Cado said, adding the development is a sign that adversaries are


feed_id: https://thehackernews.com/2024/01/russian-coldriver-hackers-expand-beyond.html
title: Russian COLDRIVER Hackers Expand Beyond Phishing with Custom Malware
uri: Russian-COLDRIVER-Hackers-Expand-Beyond-Phishing-with-Custom-Malware
url: https://thehackernews.com/2024/01/russian-coldriver-hackers-expand-beyond.html
content:
The Russia-linked threat actor known as COLDRIVER has been observed evolving its tradecraft to go beyond credential harvesting to deliver its first-ever custom malware written in the Rust programming language.
Google's Threat Analysis Group (TAG), which shared details of the latest activity, said the attack chains leverage PDFs as decoy documents to trigger the infection sequence. The lures are


feed_id: https://thehackernews.com/2024/01/tensorflow-cicd-flaw-exposed-supply.html
title: TensorFlow CI/CD Flaw Exposed Supply Chain to Poisoning Attacks
uri: TensorFlow-CI-CD-Flaw-Exposed-Supply-Chain-to-Poisoning-Attacks
url: https://thehackernews.com/2024/01/tensorflow-cicd-flaw-exposed-supply.html
content:
Continuous integration and continuous delivery (CI/CD) misconfigurations discovered in the open-source&nbsp;TensorFlow&nbsp;machine learning framework could have been exploited to orchestrate&nbsp;supply chain attacks.
The misconfigurations could be abused by an attacker to "conduct a supply chain compromise of TensorFlow releases on GitHub and PyPi by compromising TensorFlow's build agents via


feed_id: https://thehackernews.com/2024/01/mfa-spamming-and-fatigue-when-security.html
title: MFA Spamming and Fatigue: When Security Measures Go Wrong
uri: MFA-Spamming-and-Fatigue-When-Security-Measures-Go-Wrong
url: https://thehackernews.com/2024/01/mfa-spamming-and-fatigue-when-security.html
content:
In today's digital landscape, traditional password-only authentication systems have proven to be vulnerable to a wide range of cyberattacks. To safeguard critical business resources, organizations are increasingly turning to multi-factor authentication (MFA) as a more robust security measure. MFA requires users to provide multiple authentication factors to verify their identity, providing an


feed_id: https://thehackernews.com/2024/01/pixiefail-uefi-flaws-expose-millions-of.html
title: PixieFail UEFI Flaws Expose Millions of Computers to RCE, DoS, and Data Theft
uri: PixieFail-UEFI-Flaws-Expose-Millions-of-Computers-to-RCE-DoS-and-Dat
url: https://thehackernews.com/2024/01/pixiefail-uefi-flaws-expose-millions-of.html
content:
Multiple security vulnerabilities have been disclosed in the TCP/IP network protocol stack of an open-source reference implementation of the Unified Extensible Firmware Interface (UEFI) specification used widely in modern computers.
Collectively dubbed&nbsp;PixieFail&nbsp;by Quarkslab, the&nbsp;nine issues&nbsp;reside in the TianoCore EFI Development Kit II (EDK II) and could be exploited to


feed_id: https://thehackernews.com/2024/01/iranian-hackers-masquerades-as.html
title: Iranian Hackers Masquerade as Journalists to Spy on Israel-Hamas War Experts
uri: Iranian-Hackers-Masquerade-as-Journalists-to-Spy-on-Israel-Hamas-War-E
url: https://thehackernews.com/2024/01/iranian-hackers-masquerades-as.html
content:
High-profile individuals working on Middle Eastern affairs at universities and research organizations in Belgium, France, Gaza, Israel, the U.K., and the U.S. have been targeted by an Iranian cyber espionage group called&nbsp;Mint Sandstorm&nbsp;since November 2023.
The threat actor "used bespoke phishing lures in an attempt to socially engineer targets into downloading malicious files," the


feed_id: https://thehackernews.com/2024/01/pax-pos-terminal-flaw-could-allow.html
title: PAX PoS Terminal Flaw Could Allow Attackers to Tamper with Transactions
uri: PAX-PoS-Terminal-Flaw-Could-Allow-Attackers-to-Tamper-with-Transaction
url: https://thehackernews.com/2024/01/pax-pos-terminal-flaw-could-allow.html
content:
The point-of-sale (PoS) terminals from PAX Technology are impacted by a collection of high-severity vulnerabilities that can be weaponized by threat actors to execute arbitrary code.
The STM Cyber R&amp;D team, which reverse engineered the Android-based devices manufactured by the Chinese firm owing to their rapid deployment in Poland, said it unearthed half a dozen flaws that allow for


feed_id: https://thehackernews.com/2024/01/combating-ip-leaks-into-ai-applications.html
title: This Free Discovery Tool Finds and Mitigates AI-SaaS Risks
uri: This-Free-Discovery-Tool-Finds-and-Mitigates-AI-SaaS-Risks
url: https://thehackernews.com/2024/01/combating-ip-leaks-into-ai-applications.html
content:
Wing Security announced today that it now offers&nbsp;free discovery and a paid tier for automated control&nbsp;over thousands of AI and AI-powered SaaS applications. This will allow companies to better protect their intellectual property (IP) and data against the growing and evolving risks of AI usage.

SaaS applications seem to be multiplying by the day, and so does their integration of AI


feed_id: https://thehackernews.com/2024/01/feds-warn-of-androxgh0st-botnet.html
title: Feds Warn of AndroxGh0st Botnet Targeting AWS, Azure, and Office 365 Credentials
uri: Feds-Warn-of-AndroxGh0st-Botnet-Targeting-AWS-Azure-and-Office-365-C
url: https://thehackernews.com/2024/01/feds-warn-of-androxgh0st-botnet.html
content:
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI)&nbsp;warned&nbsp;that threat actors deploying the&nbsp;AndroxGh0st&nbsp;malware are creating a botnet for "victim identification and exploitation in target networks."
A Python-based malware,&nbsp;AndroxGh0st&nbsp;was first documented by Lacework in December 2022, with the malware


feed_id: https://thehackernews.com/2024/01/webinar-art-of-privilege-escalation-how.html
title: Webinar: The Art of Privilege Escalation - How Hackers Become Admins
uri: Webinar-The-Art-of-Privilege-Escalation-How-Hackers-Become-Admins
url: https://thehackernews.com/2024/01/webinar-art-of-privilege-escalation-how.html
content:
In the digital age, the battleground for security professionals is not only evolving, it's expanding at an alarming rate. The upcoming webinar, "The Art of Privilege Escalation - How Hackers Become Admins," offers an unmissable opportunity for IT security experts to stay ahead in this relentless cyber war.
Privilege escalation - the term might sound benign, but in the hands of a skilled hacker,


feed_id: https://thehackernews.com/2024/01/new-ishutdown-method-exposes-hidden.html
title: New iShutdown Method Exposes Hidden Spyware Like Pegasus on Your iPhone
uri: New-iShutdown-Method-Exposes-Hidden-Spyware-Like-Pegasus-on-Your-iPhon
url: https://thehackernews.com/2024/01/new-ishutdown-method-exposes-hidden.html
content:
Cybersecurity researchers have identified a "lightweight method" called&nbsp;iShutdown&nbsp;for reliably identifying signs of spyware on Apple iOS devices, including notorious threats like NSO Group's&nbsp;Pegasus, QuaDream's&nbsp;Reign, and Intellexa's&nbsp;Predator.&nbsp;
Kaspersky, which analyzed a set of iPhones that were compromised with Pegasus, said the infections left traces in a file


feed_id: https://thehackernews.com/2024/01/github-rotates-keys-after-high-severity.html
title: GitHub Rotates Keys After High-Severity Vulnerability Exposes Credentials
uri: GitHub-Rotates-Keys-After-High-Severity-Vulnerability-Exposes-Credenti
url: https://thehackernews.com/2024/01/github-rotates-keys-after-high-severity.html
content:
GitHub has revealed that it has rotated some keys in response to a security vulnerability that could be potentially exploited to gain access to credentials within a production container.
The Microsoft-owned subsidiary said it was made aware of the problem on December 26, 2023, and that it addressed the issue the same day, in addition to rotating all potentially exposed credentials out of an


feed_id: https://thehackernews.com/2024/02/us-imposes-visa-restrictions-on-those.html
title: U.S. Imposes Visa Restrictions on those Involved in Illegal Spyware Surveillance
uri: U-S-Imposes-Visa-Restrictions-on-those-Involved-in-Illegal-Spyware-Su
url: https://thehackernews.com/2024/02/us-imposes-visa-restrictions-on-those.html
content:
The U.S. State Department said it's implementing a new policy that imposes visa restrictions on individuals who are linked to the illegal use of commercial spyware to surveil civil society members.
"The&nbsp;misuse of commercial spyware&nbsp;threatens privacy and freedoms of expression, peaceful assembly, and association," Secretary of State Antony Blinken&nbsp;said. "Such targeting has been


feed_id: https://thehackernews.com/2024/02/belarusian-national-linked-to-btc-e.html
title: Belarusian National Linked to BTC-e Faces 25 Years for $4 Billion Crypto Money Laundering
uri: Belarusian-National-Linked-to-BTC-e-Faces-25-Years-for-4-Billion-Cryp
url: https://thehackernews.com/2024/02/belarusian-national-linked-to-btc-e.html
content:
A 42-year-old Belarusian and Cypriot national with alleged connections to the now-defunct cryptocurrency exchange BTC-e is facing charges related to money laundering and operating an unlicensed money services business.
Aliaksandr Klimenka, who was arrested in Latvia on December 21, 2023, was extradited to the U.S. and is currently being held in custody. If convicted, he faces a maximum penalty


feed_id: https://thehackernews.com/2024/02/combined-security-practices-changing.html
title: Combined Security Practices Changing the Game for Risk Management
uri: Combined-Security-Practices-Changing-the-Game-for-Risk-Management
url: https://thehackernews.com/2024/02/combined-security-practices-changing.html
content:
A significant challenge within cyber security at present is that there are a lot of risk management platforms available in the market, but only some deal with cyber risks in a very good way. The majority will shout alerts at the customer as and when they become apparent and cause great stress in the process. The issue being that by using a reactive, rather than proactive approach, many risks


feed_id: https://thehackernews.com/2024/02/patchwork-using-romance-scam-lures-to.html
title: Patchwork Using Romance Scam Lures to Infect Android Devices with VajraSpy Malware
uri: Patchwork-Using-Romance-Scam-Lures-to-Infect-Android-Devices-with-Vajr
url: https://thehackernews.com/2024/02/patchwork-using-romance-scam-lures-to.html
content:
The threat actor known as Patchwork likely used romance scam lures to trap victims in Pakistan and India, and infect their Android devices with a remote access trojan called&nbsp;VajraSpy.
Slovak cybersecurity firm ESET said it uncovered 12 espionage apps, six of which were available for download from the official Google Play Store and were collectively downloaded more than 1,400 times between


feed_id: https://thehackernews.com/2024/02/hands-on-review-sase-based-xdr-from.html
title: Hands-On Review: SASE-based XDR from Cato Networks
uri: Hands-On-Review-SASE-based-XDR-from-Cato-Networks
url: https://thehackernews.com/2024/02/hands-on-review-sase-based-xdr-from.html
content:
Companies are engaged in a seemingly endless cat-and-mouse game when it comes to cybersecurity and cyber threats. As organizations put up one defensive block after another, malicious actors kick their game up a notch to get around those blocks. Part of the challenge is to coordinate the defensive abilities of disparate security tools, even as organizations have limited resources and a dearth of


feed_id: https://thehackernews.com/2024/02/pegasus-spyware-targeted-iphones-of.html
title: Pegasus Spyware Targeted iPhones of Journalists and Activists in Jordan
uri: Pegasus-Spyware-Targeted-iPhones-of-Journalists-and-Activists-in-Jorda
url: https://thehackernews.com/2024/02/pegasus-spyware-targeted-iphones-of.html
content:
The iPhones belonging to nearly three dozen journalists, activists, human rights lawyers, and civil society members in Jordan have been targeted with NSO Group's Pegasus spyware, according to joint findings from Access Now and the Citizen Lab.
Nine of the 35 individuals have been&nbsp;publicly confirmed&nbsp;as&nbsp;targeted, out of whom six had their devices compromised with the mercenary


feed_id: https://thehackernews.com/2024/02/new-mispadu-banking-trojan-exploiting.html
title: New Mispadu Banking Trojan Exploiting Windows SmartScreen Flaw
uri: New-Mispadu-Banking-Trojan-Exploiting-Windows-SmartScreen-Flaw
url: https://thehackernews.com/2024/02/new-mispadu-banking-trojan-exploiting.html
content:
The threat actors behind the Mispadu banking Trojan have become the latest to exploit a now-patched Windows SmartScreen security bypass flaw to compromise users in Mexico.
The attacks entail a new variant of the malware that was first observed in 2019, Palo Alto Networks Unit 42 said in a report published last week.
Propagated via phishing mails, Mispadu is a Delphi-based information stealer


feed_id: https://thehackernews.com/2024/02/us-sanctions-6-iranian-officials-for.html
title: U.S. Sanctions 6 Iranian Officials for Critical Infrastructure Cyber Attacks
uri: U-S-Sanctions-6-Iranian-Officials-for-Critical-Infrastructure-Cyber-A
url: https://thehackernews.com/2024/02/us-sanctions-6-iranian-officials-for.html
content:
The U.S. Treasury Department's Office of Foreign Assets Control (OFAC) announced sanctions against six officials associated with the Iranian intelligence agency for attacking critical infrastructure entities in the U.S. and other countries.
The&nbsp;officials&nbsp;include Hamid Reza Lashgarian, Mahdi Lashgarian, Hamid Homayunfal, Milad Mansuri, Mohammad Bagher Shirinkar, and Reza Mohammad Amin


feed_id: https://thehackernews.com/2024/02/mastodon-vulnerability-allows-hackers.html
title: Mastodon Vulnerability Allows Hackers to Hijack Any Decentralized Account
uri: Mastodon-Vulnerability-Allows-Hackers-to-Hijack-Any-Decentralized-Acco
url: https://thehackernews.com/2024/02/mastodon-vulnerability-allows-hackers.html
content:
The decentralized social network Mastodon has disclosed a critical security flaw that enables malicious actors to impersonate and take over any account.
"Due to insufficient origin validation in all Mastodon, attackers can impersonate and take over any remote account," the maintainers said in a terse advisory.
The vulnerability, tracked as&nbsp;CVE-2024-23832, has a severity rating of 9.4 out of


feed_id: https://thehackernews.com/2024/02/anydesk-hacked-popular-remote-desktop.html
title: AnyDesk Hacked: Popular Remote Desktop Software Mandates Password Reset
uri: AnyDesk-Hacked-Popular-Remote-Desktop-Software-Mandates-Password-Rese
url: https://thehackernews.com/2024/02/anydesk-hacked-popular-remote-desktop.html
content:
Remote desktop software maker AnyDesk disclosed on Friday that it suffered a cyber attack that led to a compromise of its production systems.
The German company said the incident, which it discovered following a security audit, is not a ransomware attack and that it has notified relevant authorities.
"We have revoked all security-related certificates and systems have been remediated or replaced


feed_id: https://thehackernews.com/2024/02/russian-apt28-hackers-targeting-high.html
title: Russian APT28 Hackers Targeting High-Value Orgs with NTLM Relay Attacks
uri: Russian-APT28-Hackers-Targeting-High-Value-Orgs-with-NTLM-Relay-Attack
url: https://thehackernews.com/2024/02/russian-apt28-hackers-targeting-high.html
content:
Russian state-sponsored actors have staged NT LAN Manager (NTLM) v2 hash relay attacks through various methods from April 2022 to November 2023, targeting high-value targets worldwide.
The attacks, attributed to an "aggressive" hacking crew called&nbsp;APT28, have set their eyes on organizations dealing with foreign affairs, energy, defense, and transportation, as well as those involved with


feed_id: https://thehackernews.com/2024/02/dirtymoe-malware-infects-2000-ukrainian.html
title: DirtyMoe Malware Infects 2,000+ Ukrainian Computers for DDoS and Cryptojacking
uri: DirtyMoe-Malware-Infects-2-000-Ukrainian-Computers-for-DDoS-and-Crypt
url: https://thehackernews.com/2024/02/dirtymoe-malware-infects-2000-ukrainian.html
content:
The Computer Emergency Response Team of Ukraine (CERT-UA) has warned that more than 2,000 computers in the country have been infected by a strain of malware called DirtyMoe.
The agency&nbsp;attributed&nbsp;the campaign to a threat actor it calls&nbsp;UAC-0027.
DirtyMoe, active since at least 2016, is capable of carrying out cryptojacking and distributed denial-of-service (DDoS) attacks. In March


feed_id: https://thehackernews.com/2024/02/former-cia-engineer-sentenced-to-40.html
title: Former CIA Engineer Sentenced to 40 Years for Leaking Classified Documents
uri: Former-CIA-Engineer-Sentenced-to-40-Years-for-Leaking-Classified-Docum
url: https://thehackernews.com/2024/02/former-cia-engineer-sentenced-to-40.html
content:
A former software engineer with the U.S. Central Intelligence Agency (CIA) has been sentenced to 40 years in prison by the Southern District of New York (SDNY) for transmitting classified documents to WikiLeaks and for possessing child pornographic material.
Joshua Adam Schulte, 35, was originally charged in June 2018. He was&nbsp;found guilty&nbsp;in July 2022. On September 13, 2023, he was&


feed_id: https://thehackernews.com/2024/02/cloudzy-elevates-cybersecurity.html
uri: Cloudzy-Elevates-Cybersecurity-Integrating-Insights-from-Recorded-Fut
url: https://thehackernews.com/2024/02/cloudzy-elevates-cybersecurity.html
title:
Cloudzy Elevates Cybersecurity: Integrating Insights from Recorded Future to Revolutionize Cloud Security

content:
Cloudzy, a prominent cloud infrastructure provider, proudly announces a significant enhancement in its cybersecurity landscape. This breakthrough has been achieved through a recent consultation with Recorded Future, a leader in providing real-time threat intelligence and cybersecurity analytics. This initiative, coupled with an overhaul of Cloudzy's cybersecurity strategies, represents a major


feed_id: https://thehackernews.com/2024/02/interpol-arrests-31-in-global-operation.html
title: INTERPOL Arrests 31 in Global Operation, Identifies 1,900+ Ransomware-Linked IPs
uri: INTERPOL-Arrests-31-in-Global-Operation-Identifies-1-900-Ransomware
url: https://thehackernews.com/2024/02/interpol-arrests-31-in-global-operation.html
content:
An INTERPOL-led collaborative operation targeting phishing, banking malware, and ransomware attacks has led to the identification of 1,300 suspicious IP addresses and URLs.
The&nbsp;law enforcement effort, codenamed&nbsp;Synergia, took place between September and November 2023 in an attempt to blunt the "growth, escalation and professionalization of transnational cybercrime."
Involving 60 law


feed_id: https://thehackernews.com/2024/02/cloudflare-breach-nation-state-hackers.html
title: Cloudflare Breach: Nation-State Hackers Access Source Code and Internal Docs
uri: Cloudflare-Breach-Nation-State-Hackers-Access-Source-Code-and-Interna
url: https://thehackernews.com/2024/02/cloudflare-breach-nation-state-hackers.html
content:
Cloudflare has revealed that it was the target of a likely nation-state attack in which the threat actor leveraged stolen credentials to gain unauthorized access to its Atlassian server and ultimately access some documentation and a limited amount of source code.
The intrusion, which took place between November 14 and 24, 2023, and detected on November 23, was carried out "with the goal of


