Researchers observed a malicious ad campaign targeting Facebook users via Google search. The ad, which appears at the top of Google search results for the keyword “Facebook,” redirects users to a scam page. This article has been indexed from Cyware…
Category: Cyware News – Latest Cyber News
Iran Dupes US Military Contractors, Gov’t Agencies in Cyber Campaign
An Iranian state-sponsored hacking group successfully infiltrated hundreds of thousands of employee accounts at US companies and government agencies, including the US Treasury and State Department, as part of a five-year cyber espionage campaign. This article has been indexed from…
Report: Attacker Dwell Time Down, Ransomware up in 2023
According to a new report by Mandiant, which is based on Mandiant Consulting investigations during 2023, the global median dwell time for attackers fell to its lowest point since the company began tracking the metric in 2011. This article has…
Major Security Flaws Expose Keystrokes of Over One Billion Chinese Keyboard App Users
The vulnerabilities could be exploited to “completely reveal the contents of users’ keystrokes in transit,” researchers Jeffrey Knockel, Mona Wang, and Zoë Reichert said. This article has been indexed from Cyware News – Latest Cyber News Read the original article:…
Hackers Publish Fake Story About Ukrainians Attempting To Assassinate Slovak President
An unidentified attacker hacked a Czech news service’s website and published a fake story on Tuesday claiming that an assassination attempt had been made against the newly elected Slovak president Petr Pellegrini. This article has been indexed from Cyware News…
Report: Fifth of UK Companies Admit Staff Leaked Data via GenAI
One in five UK companies has experienced sensitive corporate data exposure due to employees’ use of generative AI (GenAI), according to a report by cybersecurity services provider RiverSafe. This article has been indexed from Cyware News – Latest Cyber News…
US Gov Slaps Visa Restrictions on Spyware Honchos
The US State Department is imposing visa restrictions on 13 people involved in the development and sale of commercial spyware, as well as their spouses and children. The State Department can deny these people entrance to the United States. This…
Veeam Acquires Coveware to Boost its Ransomware Protection Capabilities
Veeam Software announced the acquisition of Coveware, a provider of cyber-extortion incident response. It brings ransomware recovery and first responder capabilities to further strengthen Veeam’s radical resilience solutions for customers. This article has been indexed from Cyware News – Latest…
FTC Commercial Surveillance Rules Could Arrive Within Months, Sources Say
According to two sources familiar with the FTC’s plans, the rules will emphasize data security and data minimization, or the idea that companies should only collect the data they need to conduct business with consumers and delete it when concluded.…
North Korean Hackers Targeted Dozens of South Korean Defense Companies
Local reports claimed that the hackers targeted as many as 83 defense contractors and subcontractors, and managed to steal sensitive information from 10 of them between October 2022 and July 2023, although the campaign lasted over a year. This article…
US Treasury Sanctions Iranians Linked to Government Cyberattacks
The Treasury Department’s Office of Foreign Assets Control (OFAC) has sanctioned four Iranian nationals for their involvement in cyberattacks against the U.S. government, defense contractors, and private companies. This article has been indexed from Cyware News – Latest Cyber News…
Siemens Working on Fix for Device Affected by Palo Alto Firewall Bug
Siemens is urging organizations using its Ruggedcom APE1808 devices configured with Palo Alto Networks (PAN) Virtual NGFW to implement workarounds for a maximum severity zero-day bug that PAN recently disclosed in its next-gen firewall product. This article has been indexed…
Swedish Signals Intelligence Agency to Take Over National Cybersecurity Center
After failing to achieve “expected results,” Sweden’s National Cyber Security Center (NCSC) is facing a range of reforms, including being brought under the control of the country’s cyber and signals intelligence agency. This article has been indexed from Cyware News…
People Doubt Their Own Ability to Spot AI-Generated Deepfakes
The actual number of people exposed to political and other deepfakes is expected to be much higher given many Americans are not able to decipher what is real versus fake, thanks to the sophistication of AI technologies. This article has…
Pentagon Launches DIB Vulnerability Disclosure Program
The DIB Vulnerability Disclosure Program (DIB-VDP), a joint venture between the DoD Cyber Crime Center (DC3), the Defense Counterintelligence and Security Agency (DCSA), and HackerOne, will bring better vulnerability disclosure practices to the DIB. This article has been indexed from…
Study: GPT-4 Agent can Exploit Unpatched Vulnerabilities
Academics at a U.S. university found that if you feed a GPT-4 artificial intelligence agent public security advisories, it can exploit unpatched “real-world” vulnerabilities without precise technical information. This article has been indexed from Cyware News – Latest Cyber News…
GuptiMiner: Hijacking Antivirus Updates for Distributing Backdoors and Casual Mining
The GuptiMiner malware campaign, discovered by Avast, involved hijacking an eScan antivirus update mechanism to distribute backdoors and coinminers. The campaign was orchestrated by a threat actor with possible ties to Kimsuky. This article has been indexed from Cyware News…
CISA to Issue List of Software Products Critical to Agency Security by End of September
The Cybersecurity and Infrastructure Security Agency is targeting a September 30 deadline to give federal agencies a list of example software products deemed critical for the federal government’s cyber posture. This article has been indexed from Cyware News – Latest…
Fraudsters Exploit Telegram’s Popularity for Toncoin Scam
The perpetrators attract unsuspecting Telegram users through a referral system, enticing them with promises of an “exclusive earning program” shared via contacts in their network. This article has been indexed from Cyware News – Latest Cyber News Read the original…
Microsoft Warns of North Korean Hackers Turning to AI-Fueled Cyber Espionage
Microsoft specifically highlighted a group named Emerald Sleet (aka Kimusky or TA427), which has been observed using LLMs to bolster spear-phishing efforts aimed at Korean Peninsula experts. This article has been indexed from Cyware News – Latest Cyber News Read…
Nespresso Domain Serves Up Steamy Cup of Phish, No Cream or Sugar
A phishing campaign exploiting a bug in Nespresso’s website has been able to evade detection by taking advantage of security tools that fail to look for malicious nested or hidden links. This article has been indexed from Cyware News –…
HHS Beefs Up Privacy Protection for Reproductive Health Info
Doctors, clinics and other providers are prohibited from disclosing protected health information related to lawful reproductive healthcare, according to a final rule released Monday by federal regulators to “strengthen” HIPAA privacy. This article has been indexed from Cyware News –…
Russian Sandworm Hackers Targeted 20 Critical Organizations in Ukraine
CERT-UA reports that in March 2024, APT44 conducted operations to disrupt information and communication systems at energy, water, and heating suppliers in 10 regions of Ukraine. This article has been indexed from Cyware News – Latest Cyber News Read the…
Behavioral Patterns of Ransomware Groups are Changing
The ransomware landscape has undergone significant changes in Q1 2024, with major shifts in the behavior of Ransomware-as-a-Service (RaaS) groups, according to GuidePoint Security’s GRIT Q1 2024 Ransomware Report. This article has been indexed from Cyware News – Latest Cyber…
GitLab Affected by GitHub-Style CDN Flaw Allowing Malware Hosting
Similar to a recently reported issue in GitHub, users can abuse the “comments” feature in GitLab to upload malware to any repository without the repository owner’s knowledge. This article has been indexed from Cyware News – Latest Cyber News Read…
Feds Issue Guide for Change Health Breach Reporting Duties
HHS’ Office for Civil Rights in new “frequently asked questions” guidance issued Friday night said it has not yet received breach reports from Change Healthcare, UHG, or any other affected covered entities pertaining to the incident. This article has been…
Cloud Console Cartographer: Open-Source Tool Helps Security Teams Transcribe Log Activity
Cloud Console Cartographer is an open-source tool that maps noisy log activity into highly consolidated, succinct events to help security practitioners cut through the noise and understand console behavior in their environment. This article has been indexed from Cyware News…
Majority of Businesses Worldwide are Implementing Zero Trust, Gartner Finds
Almost two-thirds of organizations across the globe have either fully or partially implemented zero-trust strategies, according to a report released Monday by Gartner based on a survey of 303 security leaders. This article has been indexed from Cyware News –…
GitHub Comments Abused to Push Malware via Microsoft Repository URLs
A GitHub flaw, or possibly a design decision, is being abused by threat actors to distribute malware using URLs associated with Microsoft repositories, making the files appear trustworthy. This article has been indexed from Cyware News – Latest Cyber News…
Uncertainty is the Most Common Driver of Noncompliance
Most compliance leaders tend to focus on building an ethical culture in their organizations to improve employee behavior, but it has a limited impact on addressing uncertainty about how to be compliant, according to a survey by Gartner. This article…
Cyber Insurance Gaps Stick Firms With Millions in Uncovered Losses
The majority of companies, 4 in 5, have suffered a cyberattack that wasn’t fully covered under their cyber insurance policy, according to an analysis by cyber risk quantification firm CYE. This article has been indexed from Cyware News – Latest…
Researchers Warn Windows Defender Attack can Delete Databases
Researchers at US-Israeli infosec outfit SafeBreach recently discussed flaws in Microsoft and Kaspersky endpoint security products that can potentially allow the remote deletion of files. This article has been indexed from Cyware News – Latest Cyber News Read the original…
Sharp Stealer: New Info-stealer Malware Targets Gamers, Crypto Enthusiasts
The malware does not try to hide its presence in the system from antivirus programs and has not gained much popularity in the underground yet, indicating that it is a new player in the market. This article has been indexed…
From Water to Wine: An Analysis of WINELOADER
A recent malware campaign used weaponized ZIP files to distribute the WINELOADER malware. The attackers send phishing emails with ZIP attachments that, when extracted, execute a PowerShell script to download and install the malware. This article has been indexed from…
Malicious PyPI Package Attacking Discord Users to Steal Credentials
A malicious PyPI package named “discordpy_bypass-1.7” was detected on March 12, 2024. This package is designed to extract sensitive information from user systems using a blend of persistence techniques, browser data extraction, and token harvesting. This article has been indexed…
Malware Developer Lures Child Exploiters Into Honeytrap to Extort Them
Threat actors created a website to impersonate UsenetClub, a subscription service for “uncensored” access to images and videos downloaded from Usenet. They claimed to provide free access to the site after the installation of a “CryptVPN” software. This article has…
UK Cyber Agency NCSC Announces Richard Horne as its Next Chief Executive
The hire marks another coup for the British public sector in poaching talent from the technology industry, particularly at the executive level, following the recruitment of Ollie Whitehouse as the NCSC’s chief technology officer earlier this year. This article has…
Ukrainian Soldiers’ Apps Increasingly Targeted for Spying, Cyber Agency Warns
The agency is attributing the surge to a group tracked as UAC-0184, which was spotted in February targeting an unnamed Ukrainian entity in Finland. CERT-UA does not attribute UAC-0184’s activity to any specific foreign cyber threat group. This article has…
Researchers Find Dozens of Fake E-Zpass Toll Websites After FBI Warning
Researchers from cybersecurity firm DomainTools told Recorded Future News that they have found nearly 30 newly created domains related to tolls, 15 of which have a “high chance of being weaponized for phishing, malware, or spam.” This article has been…
Report: 51% of Enterprises Experienced a Breach Despite Large Security Stacks
Threat actors are continuing to successfully breach across the entire attack surface. Around 93% of enterprises who admitted a breach reported unplanned downtime, data exposure, or financial loss as a result, according to a survey by Pentera. This article has…
Critical Flaw in the Forminator Plugin Impacts Hundreds of Thousands of WordPress Sites
Japan’s CERT warned that the WordPress plugin Forminator, developed by WPMU DEV, is affected by multiple vulnerabilities, including a flaw that allows unrestricted file uploads to the server. This article has been indexed from Cyware News – Latest Cyber News…
Rising Ransomware Issue: English-Speaking Western Affiliates
Security experts say Western teenagers comprise a number of active affiliate groups, many with ties to the cybercrime community that calls itself “The Community,” aka the Com or Comm. This article has been indexed from Cyware News – Latest Cyber…
JavaScript Malware Switches to Server-Side Redirects and Uses DNS TXT Records as TDS
A malware campaign was found injecting malicious JavaScript code into compromised WordPress sites to redirect site visitors to VexTrio domains, specifically using dynamic DNS TXT records of the tracker-cloud[.]com domain to obtain redirect URLs. This article has been indexed from…
NATO to Launch New Cyber Center to Contest Cyberspace ‘At All Times’
The new facility, details about which have not previously been reported, marks the fruition of a significant doctrinal shift in how the alliance approaches operations in cyberspace. This article has been indexed from Cyware News – Latest Cyber News Read…
HelloKitty Ransomware Rebrands, Releases CD Projekt and Cisco Data
An operator of the HelloKitty ransomware operation announced they changed the name to ‘HelloGookie,’ releasing passwords for previously leaked CD Projekt source code, Cisco network information, and decryption keys from old attacks. This article has been indexed from Cyware News…
Jury Dishes Out Guilty Verdict in Mango Markets Fraud Case
A New York federal jury found a hacker guilty of all charges that he masterminded and carried out a scheme to fraudulently obtain $110 million from cryptocurrency exchange Mango Markets and investors. This article has been indexed from Cyware News…
CrushFTP Warns Users to Patch Exploited Zero-Day “Immediately”
As the company also explains in a public security advisory published on Friday, this zero-day bug enables unauthenticated attackers to escape the user’s virtual file system (VFS) and download system files. This article has been indexed from Cyware News –…
Evil XDR: Researcher Turns Palo Alto Software Into Perfect Malware
In a briefing at Black Hat Asia, Shmuel Cohen, security researcher at SafeBreach, described how he not only reverse-engineered and cracked into the company’s signature Cortex product but also weaponized it to deploy a reverse shell and ransomware. This article…
Fake Cheat Lures Gamers Into Spreading Infostealer Malware
A new info-stealing malware linked to Redline poses as a game cheat called ‘Cheat Lab,’ promising downloaders a free copy if they convince their friends to install it too. This article has been indexed from Cyware News – Latest Cyber…
NSA Shares Best Practices for Secure AI Systems
The guidance offers a wide range of best practices, including that organizations adopt a zero trust mindset, actively monitor the AI model’s behavior, and require the primary developer of the AI system to provide a threat model for their system.…
Dark Web Sales Driving Major Rise in Credential Attacks
A rise in infostealer malware attacks over the past three years has enabled cybercriminal groups to turn credential stealing into a major money-making business, paving the way for new entrants in the field and sophisticated hacking techniques. This article has…
Hacking the Floodgates: US Dams Face Growing Cyber Threats
Could a hacker seize control of America’s dams, unleashing floods and chaos across vulnerable communities? Cybersecurity analysts and leading lawmakers warn it’s possible. This article has been indexed from Cyware News – Latest Cyber News Read the original article: Hacking…
Google Ad Impersonates Whales Market to Push Wallet Drainer Malware
A legitimate-looking Google Search advertisement for the crypto trading platform ‘Whales Market’ redirects visitors to a wallet-draining phishing site that steals all of your assets. This article has been indexed from Cyware News – Latest Cyber News Read the original…
Ransomware Victims Who Pay a Ransom Drops to Record Low
That downward trend comes thanks to “enterprises large and small” being “increasingly able to withstand an encryption attack, and restore their operations without the need for a threat actor decryption key,” Coveware said. This article has been indexed from Cyware…
Cybercriminals Pose as LastPass Staff to Hack Password Vaults
The attacker combines multiple social engineering techniques that involve contacting the potential victim (voice phishing) and pretending to be a LastPass employee trying to help with securing the account following unauthorized access. This article has been indexed from Cyware News…
92% of Enterprises Unprepared for AI Security Challenges
Most industries continue to run almost two or more months behind in patching software vulnerabilities, endpoints remain vulnerable to threats, and most enterprise PCs must be replaced to support AI-based technologies, according to a new report. This article has been…
Damn Vulnerable RESTaurant: Open-Source API Service Designed for Learning
Damn Vulnerable RESTaurant is an open-source project that allows developers to learn to identify and fix security vulnerabilities in their code through an interactive game. This article has been indexed from Cyware News – Latest Cyber News Read the original…
Novel Android Malware Targets Korean Banking Users
A new banking Trojan is targeting Korean users using obfuscation techniques that target the Android manifest, exploit vulnerabilities and take advantage of weaknesses in how Android apps interpret this file. This article has been indexed from Cyware News – Latest…
‘Crude’ Ransomware Tools Proliferating on the Dark Web for Cheap, Researchers Find
Researchers at the intelligence unit at the cybersecurity firm Sophos found 19 ransomware varieties being offered for sale or advertised as under development on four forums from June 2023 to February 2024. This article has been indexed from Cyware News…
IT and Security Professionals Demand More Workplace Flexibility
The concept of Everywhere Work is now much broader, encompassing where, when, and how professionals get their work done — and flexibility has become a key workplace priority, according to Ivanti. This article has been indexed from Cyware News –…
FIN7 Targets American Automaker’s IT Staff in Phishing Attacks
The financially motivated threat actor FIN7 targeted a large U.S. car maker with spear-phishing emails for employees in the IT department to infect systems with the Anunak backdoor. This article has been indexed from Cyware News – Latest Cyber News…
Malvertising Campaign Targeting IT Teams with MadMxShell Backdoor
The backdoor uses techniques such as multiple stages of DLL sideloading and DNS tunneling for command-and-control (C2) communication as a means to evade endpoint and network security solutions, respectively. This article has been indexed from Cyware News – Latest Cyber…
Russian Sandworm Hackers Pose as Hacktivists in Water Utility Breaches
In a report today, Mandiant says that Sandworm relied on three main hacktivist-branded Telegram channels named XakNet Team, CyberArmyofRussia_Reborn, and Solntsepek, all operating in parallel and independently of one another. This article has been indexed from Cyware News – Latest…
Moldovan Charged for Operating Botnet Used to Push Ransomware
The U.S. Justice Department charged Moldovan national Alexander Lefterov, the owner and operator of a large-scale botnet that infected thousands of computers across the United States. This article has been indexed from Cyware News – Latest Cyber News Read the…
Armis Buys Cyber Remediation Startup Silk Security for $150M
Armis has purchased a security prioritization and remediation vendor led by a Goldman Sachs veteran to more effectively address vulnerabilities and misconfigurations with AI and automation. This article has been indexed from Cyware News – Latest Cyber News Read the…
Possible Chinese Hackers Use OpenMetadata for Cryptomining
Hackers who appear to be Chinese are exploiting vulnerabilities in the OpenMetadata platform running as workloads on Kubernetes clusters to download cryptomining software, warns Microsoft. This article has been indexed from Cyware News – Latest Cyber News Read the original…
LockBit Knockoffs and Imposters Proliferate After LockBit 3.0 Builder Leak
Since September 2022, anyone has been able to use the LockBit version 3.0 – aka Black – builder thanks to a key developer leaking it after he fell out with group leader LockBitSupp. This article has been indexed from Cyware…
UnitedHealth Expects Up to $1.6B Hit From Change Healthcare Cyberattack This Year
The hit comes from direct response efforts like recovering Change’s clearinghouse platform and paying higher medical costs after its insurance arm suspended some utilization management processes, in addition to the loss of Change’s revenue. This article has been indexed from…
Food and Agriculture Sector Hit with More Than 160 Ransomware Attacks Last Year
In its first annual report, the Food and Agriculture-Information Sharing and Analysis Center (Food and Ag-ISAC) said the industry was the seventh most targeted sector in the country, behind manufacturing, financial services, and others. This article has been indexed from…
Cisco Warns of a Command Injection and Privilege Escalation Flaw in Its IMC
A local, authenticated attacker can exploit the vulnerability, tracked as CVE-2024-20295, to conduct command injection attacks on the underlying operating system and elevate privileges to root. This article has been indexed from Cyware News – Latest Cyber News Read the…
Ivanti Warns of Critical Flaws in Its Avalanche MDM Solution
Ivanti has released security updates to fix 27 vulnerabilities in its Avalanche mobile device management (MDM) solution, two of them critical heap overflows that can be exploited for remote command execution. This article has been indexed from Cyware News –…
Russia is Trying to Sabotage European Railways, Czech Minister Said
Czech transport minister Martin Kupka confirmed that Russia-linked threat actors conducted “thousands of attempts to weaken our systems” since the beginning of the Russian invasion of Ukraine. This article has been indexed from Cyware News – Latest Cyber News Read…
New Bill Would Create a Governing Body for Water System Cyber Standards
A measure led by two House Republicans would enable the Environmental Protection Agency to certify a governing body to develop and recommend cybersecurity requirements for water treatment and wastewater systems. This article has been indexed from Cyware News – Latest…
Russian Sandworm Group Using Novel Backdoor to Target Eastern and Central Europe
The previously unreported backdoor, dubbed ‘Kapeka’, has a high level of stealth and sophistication, designed to both serve as an early-stage toolkit for its operators, and also to provide long-term access to the victim estate. This article has been indexed…
Several GTKWave Vulnerabilities Fixed in Debian
Recently, the Debian security team fixed several issues in GTKWave, an open-source waveform viewer for VCD files. These vulnerabilities, if exploited, could result in the execution of arbitrary code, posing a significant risk to users. This article has been indexed…
T-Mobile, Verizon Workers Get Texts Offering $300 for SIM Swaps
According to many reports, this is part of a campaign targeted at current and former mobile carrier workers who could have access to the systems required to perform a SIM swap. This article has been indexed from Cyware News –…
Update: Researchers Released Exploit Code for Actively Exploited Palo Alto Networks PAN-OS Bug
Researchers at watchTowr Labs have released a technical analysis of the vulnerability CVE-2024-3400 in Palo Alto Networks’ PAN-OS and a proof-of-concept exploit that can be used to execute shell commands on vulnerable firewalls. This article has been indexed from Cyware…
Misinformation and Hacktivist Campaigns Targeting the Philippines Skyrocket
Amidst rising tensions with China in the South China Sea, Resecurity has observed a significant spike in malicious cyber activity targeting the Philippines in Q1 2024, increasing nearly 325% compared to the same period last year. This article has been…
BreachForums Down, But Not Out: Hackers Claim Attack, Admins Remain Unfazed
The domain of the notorious BreachForums data leak and hacking forum has been taken down by rival threat actors. The threat actor group, R00TK1T, along with the Cyber Army of Russia, announced a breach of user data following the takedown.…
From Social Engineering to DMARC Abuse: TA427’s Art of Information Gathering
To craftily pose as its chosen personas, TA427 uses a few tactics including DMARC abuse in concert with free email addresses, typosquatting, and private email account spoofing. This article has been indexed from Cyware News – Latest Cyber News Read…
Top Officials Again Push Back on Ransom Payment Ban
Due to multiple reasons, the Institute for Security and Technology’s Ransomware Task Force threw cold water on the need for a ransomware payment ban in a report released Wednesday. This article has been indexed from Cyware News – Latest Cyber…
Report: Bad Bots Drive 10% Annual Surge in Account Takeover Attacks
Internet traffic associated with malicious bots now accounts for a third (32%) of the total, driving a 10% year-on-year (YoY) increase in account takeover (ATO) attacks last year, according to Imperva. This article has been indexed from Cyware News –…
FTC Bans Online Mental Health Firm From Sharing Certain Data
The FTC in its complaint against Cerebral Inc. and the company’s former CEO Kyle Robertson, alleges unfair or deceptive practice violations of the FTC Act and the Opioid Act, which pertains to substance use disorder treatment services. This article has…
Microsoft will Limit Exchange Online Bulk Emails to Fight Spam
“Exchange Online enforces a Recipient Rate limit of 10,000 recipients. The 2,000 ERR limit will become a sub-limit within this 10,000 Recipient Rate limit,” the Exchange Team said on Monday. This article has been indexed from Cyware News – Latest…
Blackjack Group Used ICS Malware Fuxnet Against Russian Targets
The attack chain sees hackers targeting a list of sensor gateways IPs. Threat actors distributed their malware to each target, likely either through remote-access protocols such as SSH or the sensor protocol (SBK) over port 4321. This article has been…
Report: Microsoft Most Impersonated Brand in Phishing Scams
Microsoft was impersonated in 38% of all brand phishing attacks in Q1 2024, according to new data from Check Point. Google was the second most impersonated brand in Q1 2024, making up 11% of attempts. This article has been indexed…
New SteganoAmor Attacks Use Steganography to Target 320 Organizations Globally
The attacks begin with malicious emails containing seemingly innocuous document attachments (Excel and Word files) that exploit the CVE-2017-11882 flaw, a commonly targeted Microsoft Office Equation Editor vulnerability fixed in 2017. This article has been indexed from Cyware News –…
Law Firm to Pay $8M to Settle Health Data Hack Lawsuit
Orrick Herrington & Sutcliffe’s proposed agreement with plaintiffs, filed last week in a northern California federal court, settles four proposed consolidated class action lawsuits filed against it in the wake of the March 2023 hacking incident. This article has been…