Oktacron - Cyber Security RSS Feeds History

Russian Hackers Target Ukraine with XWorm RAT Malware Payload

cyberexpress Jun 26, 2024 Cybersecurity News

Cyble Research and Intelligence Labs (CRIL) researchers have observed the Russia-linked threat actor group UAC-0184 targeting Ukraine with the XWorm remote access trojan (RAT) through the use of Python-related files. Technical Overview of XWorm RAT Campaign The campaign begins with a malicious LNK shortcut file, show more ...

disguised as a legitimate Excel document, which executes a PowerShell script upon execution. The script downloads two files, "pkg.zip" and "NewCopy.xlsx", from a specified URL. The LNK shortcut file then executes "pythonw.exe" using the start command, which duplicates files and stores them in a new folder. The "pythonw.exe" loads a malicious DLL, "python310.dll", through DLL sideloading, injecting shellcode into the MSBuild process. [caption id="attachment_78917" align="alignnone" width="1529"] Source: Cyble[/caption] The hackers use a technique called DLL sideloading, where a malicious library file masquerades as a legitimate one. This allows the attackers to run their code under the guise of trusted software. Additionally, they employ a tool called Shadowloader to inject the XWorm RAT into a running process, further obscuring its presence. The XWorm RAT is then executed, offering a range of capabilities, including data theft, DDoS attacks, and cryptocurrency address manipulation. The malware attempts to connect to a Command-and-Control (C&C) server, but at the time of analysis, the server was inactive, resulting in no observed malicious activities. [caption id="attachment_78919" align="alignnone" width="537"] Source: Cyble[/caption] While the initial infection vector remains unclear, researchers suspect phishing emails may play a role. The intended victim could not be ascertained from accessing the the Excel lure used in the campaign. CRIL researchers had previously observed the UAC-0184 threat actor group employing lures tailored to appeal to Ukrainian targets, often mimicking official government or utility communications. Protecting Against XWorm RAT The XWorm RAT malware employed in the campaign is designed to be easily accessible even to to threat actors lacking sophistication and technical expertise. The versatile malware offers several functionalities, including data theft, DDoS attacks, cryptocurrency address manipulation, ransomware deployment, and downloading additional malware onto compromised systems. Cyble researchers have recommended several measures to defend against this campaign: Implement strong email filtering to block malicious attachments. Exercise caution with email attachments, especially from unknown senders. Limit execution of scripting languages where possible. Use application whitelisting to control which programs can run. Deploy robust antivirus and anti-malware solutions. Enforce strong, unique passwords and two-factor authentication. Monitor networks for unusual activity or data exfiltration attempts. The campaign demonstrates UAC-0184's relentless efforts at attacking Ukraine with evasive techniques. The use of the XWorm RAT as the final payload indicates the intent to establish remote access over compromised systems for strategic purposes. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

AzzaSec Reveals Advanced Windows Ransomware Builder, Threatens Cybersecurity

cyberexpress Jun 26, 2024 Firewall Daily

Hacktivist group AzzaSec has announced the release of a Windows ransomware builder. The builder was posted via the Telegram channel on June 23, 2024. Designed in .NET, this malicious software features sophisticated functionality including SHA 512 and AES encryption, ensuring its undetectable (FUD) status with minimal show more ...

risk of detection, as verified by its single hit on KleenScan. AzzaSec claims their ransomware can bypass major antivirus solutions such as Windows 10 / 11 Defender, Avast, Kaspersky, and AVG. In addition to its encryption prowess, the builder includes anti-virtual machine, anti-debugging, and anti-sandbox capabilities, as demonstrated in a revealing demo video shared alongside the announcement. This video showcases how decryption keys and victim information are stored securely on a centralized Command and Control (C2) server. AzzaSec Announces New Windows Ransomware Builder [caption id="attachment_78968" align="alignnone" width="373"] Source: Dark Web[/caption] Pricing for AzzaSec's ransomware varies, from $300 for a single-use stub to a subscription model costing up to $4500 for six months. The source code for this Windows ransomware builder is also available for purchase at a steep $8000. The development of AzzaSec's ransomware marks a new advancement in cyber threats, highlighting the evolution of ransomware-as-a-service (RaaS). This model not only empowers threat actors with turnkey tools but also commodifies cyber extortion, potentially increasing the frequency and impact of ransomware attacks globally. The group's announcement highlights a growing trend where malicious actors leverage sophisticated technologies and monetization strategies to maximize their impact on unsuspecting victims. As cybersecurity defenses evolve, so do the tactics of those seeking illicit gains through digital means. Features and Functionality of the Windows Ransomware Builder In their Telegram post, AzzaSec described their ransomware's capabilities in detail. Developed with VB.NET and weighing 10MB, the ransomware utilizes a unique algorithm for encryption. It operates with a fully undetectable structure, boasting a detection rate of only 1 out of 40 on KleenScan. Tested against various security solutions including Windows Defender, Avast, Kaspersky, and AVG, AzzaSec ensures its malware's effectiveness in compromising systems. The ransomware functions by connecting to a C2 server, where decryption keys and device information are stored. This approach allows the threat actors to monitor and control the ransomware's impact remotely. Furthermore, the ransomware includes anti-virtual machine, anti-debugging, and anti-sandbox features, making it resilient against common security countermeasures. AzzaSec also outlined its pricing strategy: $300 for a single-use stub, escalating to $4500 for a six-month subscription. For those seeking full control, the source code is available for $8000, enabling other threat actors to customize and deploy the ransomware independently. AzzaSec's emergence into the ransomware scene signals a reminder for organizations and individuals alike to upgrade their cybersecurity measures and remain vigilant against online threats. As ransomware-as-a-service models become more accessible, preemptive cybersecurity measures and incident response plans are essential defenses against these ever-present dangers.

Cyber Attack Forces South Africa’s National Health Laboratory Service To Shut Down Systems

cyberexpress Jun 26, 2024 Firewall Daily

The National Health Laboratory Service (NHLS), South Africa's primary diagnostic pathology service for public healthcare facilities, has fallen victim to a cyber attack. The incident, which occurred over the weekend, has forced the organization to shut down its IT systems, including emails, website, and patient show more ...

lab test results storage and retrieval systems. NHLS CEO Prof Koleka Mlisana confirmed the breach in a memo to staff, describing it as a "suspected incident" that compromised the security of their IT infrastructure. The attack comes amidst an Mpox outbreak that has already overwhelmed the country's healthcare services. However, the extent of the cyberattack has yet to be determined, even as restoration efforts are underway. Impact on South Africa's National Health Laboratory Service NHLS Chief Executive Officer Prof Koleka Mlisana informed staff of the incident in a memo, stating that the breach had caused damage and that the organization was treating the matter with extreme urgency and concern. Milsana stated, “I regret to inform you that our IT systems are unavailable due to a suspected incident that occurred over the weekend.” Mlisana assured staff that the organization's Incident Response Team was working around the clock to determine the scope of the intrusion and deploy the necessary safeguards to secure systems and data. The NHLS has implemented its "Downtime Protocol" to minimize disruption to services, prioritizing patients' samples and processing, with results communicated directly to clinicians whenever urgent. The cyber attack comes at a critical time for South Africa's healthcare system. The country is currently grappling with a Mpox outbreak, and the NHLS was already facing a significant backlog in toxicology tests as of March. The shutdown of IT systems is likely to exacerbate these challenges. Mzi Gcukumana, the NHLS Communication, Marketing, and PR officer, disclosed: “Preliminary investigation suggests that our Enterprise Resource Planning (Oracle) environment, Laboratory Information System (LIS) (TrakCare) database, and CDW are not affected. Therefore, no patient data has been lost or compromised. All patient data is safe." Response and Recovery Efforts “Please rest assured that our priority focus is on data security. We are determined to solve this issue swiftly and transparently,” Milsana stated to patients. In response to the breach, the NHLS has deployed its Incident Response Team to assess the scope of the intrusion and implement necessary safeguards. Mlisana assured staff that the team is working around the clock to secure systems and data. “I want to take this opportunity to thank you in advance as we all put in our efforts to ensure that disruption to our services is minimised,” Milsana added. The NHLS had determined that that certain sections of its systems, including its backup server were deleted, requiring the rebuilding of affected systems. Gcukumana stated, “All users will be aware that the NHLS networked laboratory system is heavily reliant on these information technology systems that have been disrupted.” He added, “Unfortunately, this will take time, and investigations thus far have not advanced enough for us to give a timeframe for the restoration of our systems and full service. All stakeholders and the public will be informed as soon as more information becomes available.” The National Department of Health, which oversees the NHLS, has been informed of the incident. A spokesperson for the department called for patience as efforts to resolve the issue continue. As the investigation unfolds, the NHLS has promised regular updates on the compromise and ongoing response activities. The organization emphasizes its commitment to data security and swift, transparent resolution of the issue. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

KillSec Unveils Feature-Rich RaaS Platform with Encryption, DDoS Tools, and Data Stealer

cyberexpress Jun 26, 2024 Firewall Daily

Hacktivist group KillSec has revealed a new weapon in their digital arsenal: a Ransomware as a Service (RaaS) program designed to empower aspiring cybercriminals with hacking capabilities. The threat actor revealed the RaaS program on June 24, 2024, sharing its features for those looking to deploy ransomware attacks show more ...

on their targets. The centerpiece of KillSec RaaS is its advanced locker, meticulously crafted in C++ for optimal performance and efficiency. This encryption tool is engineered to lock down files on victims' computers, rendering them inaccessible until a ransom is paid and a decryption key is provided. Operating through a user-friendly dashboard accessible via the Tor network, known for its anonymity features, KillSec ensures that its clients can operate discreetly. KillSec Announces New RaaS Program for Hackers [caption id="attachment_79012" align="alignnone" width="532"] Source: Dark Web[/caption] The dashboard boasts several essential features designed to streamline the ransomware deployment process. Users can track the success of their campaigns with detailed statistics, manage communications via an integrated chat function, and customize ransomware configurations using the built-in builder tool. In addition to its current capabilities, KillSec has announced forthcoming enhancements to its RaaS program. These include a stresser tool for launching distributed denial-of-service (DDoS) attacks, automated phone call capabilities to pressure victims into paying ransoms, and an advanced stealer for harvesting sensitive data such as passwords and financial information. Access to KillSec's RaaS program is available for a fee of $250, aimed at "trusted individuals," with KillSec taking a 12% commission from any ransom payments collected. This pricing model highlights the group's commitment to making advanced cyber weaponry accessible while maintaining a profitable partnership with their clients. Who is the KillSec Hacktivist Group? Founded in 2021, KillSec has emerged as a prominent force in the hacktivist community, often aligning itself with the ethos of the Anonymous movement. Their activities have included high-profile website defacements, data breaches, and ransomware attacks, including recent breaches affecting traffic police websites in Delhi and Kerala. Ransomware as a Service (RaaS) programs, similar to what KillSec has announced, represent an evolution in cybercrime tactics, democratizing access to powerful malicious software for a global audience. The RaaS program model allows less technically skilled individuals to engage in cyber extortion with relative ease, leveraging customizable ransomware variants to target businesses and individuals worldwide. The proliferation of RaaS platforms has contributed to the escalating frequency and severity of ransomware attacks, posing substantial challenges to law enforcement agencies worldwide. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

Neiman Marcus Alerts Customers After Data Breach Exposes Information of 64,472 Individuals

cyberexpress Jun 26, 2024 Firewall Daily

Neiman Marcus has issued a notification to its customers regarding a massive data breach that occurred in May 2024, potentially exposing sensitive personal information. The Neiman Marcus data breach, affecting approximately 64,472 customers, involved unauthorized access to a cloud database platform used by the luxury show more ...

retailer, which is operated by Snowflake, a third-party provider. In a conversation with The Cyber Express, a Neiman Marcus spokesperson confirmed the breach, stating, "Neiman Marcus Group (NMG) recently learned that an unauthorized party gained access to a cloud database platform used by NMG that is provided by a third party, Snowflake." Prompt action was taken, with the spokesperson adding, "Promptly after discovering the incident, NMG took steps to contain it, including by disabling access to the platform." Neiman Marcus Data Breach Confirmed The Neiman Marcus data breach compromised a range of personal data, including customer names, contact details, dates of birth, and Neiman Marcus gift card numbers. "Based on our investigation, the unauthorized party obtained certain personal information stored in the platform," the spokesperson continued, clarifying that "The types of personal information affected varied by individual, and included information such as name, contact information, date of birth, and Neiman Marcus or Bergdorf Goodman gift card numbers (but without gift card PINs)." Neiman Marcus has acted swiftly, launching an investigation with leading cybersecurity experts and notifying law enforcement authorities. In compliance with regulatory requirements, the company has begun notifying affected customers, including reaching out to the Maine Attorney General's office. The retailer has advised customers to monitor their financial statements for any suspicious activity and has provided resources for individuals concerned about identity theft. Mitigation Against the Neiman Marcus Data Leak "We also began an investigation with assistance from leading cybersecurity experts and notified law enforcement authorities," the spokesperson emphasized. Customers are encouraged to request free credit reports, report any suspected fraud to law enforcement and the Federal Trade Commission, and consider placing a security freeze on their credit files as precautionary measures. Neiman Marcus Group, Inc., based in Dallas, Texas, is a popular luxury retailer that oversees brands such as Neiman Marcus, Bergdorf Goodman, Horchow, and Last Call. Since September 2021, it has been under the ownership of a consortium of investment firms led by Davidson Kempner Capital Management, Sixth Street Partners, and Pacific Investment Management. Following this Neiman Marcus data leak, the firm has established a dedicated toll-free hotline (1-885-889-2743) for affected customers seeking further information or assistance related to the data breach incident.

Microsoft Engineer Accidentally Leaked 4GB of PlayReady DRM Internal Code Used To Protect Streaming Services

cyberexpress Jun 26, 2024 Cybersecurity News

A Microsoft software engineer accidentally published internal PlayReady DRM source code on a publicly accessible developer forum. The 4GB data leak contains sufficient information to compile the required DLL from the source code, potentially opening the door for reverse engineering or cracking of the DRM protection show more ...

technology. PlayReady, introduced in 2007, is Microsoft's platform-independent digital rights management (DRM) system used for protecting media files. It includes encryption, output protection, and digital rights management features. The leak could have significant implications for the security of this widely-used technology. PlayReady DRM Internal Code Leak In early June, a Microsoft engineer had published information about an Apple TV service crash on a Surface Pro 9 device in a public forum. The shared data included a 771MB file attachment that revealed 4GB of internal code related to Microsoft PlayReady upon extraction. [caption id="attachment_79066" align="alignnone" width="1920"] Original Post Before Deletion (Source: security-explorations.com)[/caption] The leaked PlayReady data is said to include: 1. WarBird configurations for creating the PlayReady library 2. WarBird libraries for code obfuscation functions 3. Libraries with symbolic information related to PlayReady [caption id="attachment_79063" align="alignnone" width="1428"] Partial Directory View of Leaked Data (Source: security-explorations.com)[/caption] HD Keys Could Be Decrypted Researchers from cybersecurity company AG Security Research Lab managed to successfully build the required Windows PlayReady DLL library from the leaked internal code, aided by step-by-step instructions provided by another user on the same forum. Their investigation uncovered several deficiencies in Protected Media Path (PMP) components of PlayReady, which could be exploited to access plaintext content keys secured by the system on Windows 10 and 11 systems. The researchers demonstrated that these extracted keys could successfully decrypt high-definition movies protected by PlayReady. Notably, the vulnerability persists even on systems with hardware DRM capabilities, as this feature can be easily disabled. The root cause appears to lie in the software DRM implementation used by default on Windows 10 systems without hardware DRM capability. Given that Windows 10 still holds a 69% market share worldwide, this vulnerability could potentially affect a significant number of users until the operating system's retirement in October 2025. The team also demonstrated that the technique used to extract plaintext values of content keys could work for other platforms relying on SW Microsoft PlayReady technology in a Windows OS environment. Implications and Microsoft's Response The researchers had notified Microsoft about the leak on June 12, 2024. While Microsoft removed the forum post within 12 hours, the download link reportedly remained active. On June 26, MSRC stated to the researchers that it had conducted an investigation and determined that the incident was not a vulnerability to service as the post had already been taken down. The researchers confirmed that the download link no longer remains active. The incident highlights the ongoing challenges in maintaining the security and secrecy of DRM implementations. It also underscores the importance of adhering to guidelines for handling sensitive information in public forums, as the leak violated Microsoft's own guidelines for posting link reproduction information publicly. These guidelines specify: All information in reports and any comments and replies are publicly visible by default. Don't put anything you want to keep private in the title or content of the initial report, which is public. To maintain your privacy and keep your sensitive information out of public view, exercise caution. Major Streaming Services Potentially Affected The same research team had earlier tested Microsoft's Protected Media Path and had discovered several streaming platforms were affected by vulnerabilities within the environment: Canal+ Online, Netflix, HBO Max, Amazon Prime Video, Sky Showtime, and others. DRM protection is crucial to the video streaming industry, which is valued at $544 billion, making this security breach a matter of serious concern. Microsoft reportedly demonstrated interest in a full disclosure of the stated vulnerabilities and technical details along with Proof of Concept over its MSRC channel, offering potential rewards for the disclosure. However, the researchers declined, as they felt a full disclosure would have to include a commercial agreement, would jeopardize their own confidential technology and tools along with future research on the Windows operating system. The researchers also believed that Microsoft should focus on conducting a more comprehensive review of its Protected Media Path environment, which could result in the discovery and fixing of additional issues rather than focusing on a single exploit. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

Russian Man Indicted for Cyberattacks Targeting Ukraine with WhisperGate Malware Ahead of 2022 Invasion

cyberexpress Jun 26, 2024 Threat Actors

A U.S. grand jury has indicted a Russian citizen, Amin Timovich Stigal, for allegedly conspiring with Russia's military intelligence agency (GRU) to launch cyberattacks crippling Ukrainian government systems and data ahead of Russia's full-scale invasion in February 2022. The indictment, unsealed yesterday in show more ...

Maryland, sheds light on a coordinated effort to disrupt critical Ukrainian infrastructure and sow panic among the population. “As alleged, the defendant conspired with Russian military intelligence on the eve of Russia’s unjust and unprovoked invasion of Ukraine to launch cyberattacks targeting the Ukrainian government and later targeting its allies, including the United States.” - Attorney General Merrick B. Garland Attacker Aimed for 'Complete Destruction' in Cyberattacks Targeting Ukraine Stigal, 22, who remains at large, was charged for his alleged role in using a deceptive malware strain called "WhisperGate" to infiltrate dozens of Ukrainian government networks, including ministries, state services, and critical infrastructure entities. Disguised as ransomware, WhisperGate reportedly went beyond data encryption, aiming for complete destruction of targeted systems and data. The attacks coincided with the defacement of Ukrainian websites displaying threatening messages designed to intimidate the public. Sensitive data, including patient health records, was exfiltrated and offered for sale online, further amplifying the chaos. U.S. Critical Infrastructure Targeted Too But the malicious campaign wasn't limited to cyberattacks targeting Ukraine. The indictment broadens the scope beyond Ukraine, revealing attempts to probe U.S. government networks in Maryland using similar tactics. “These GRU actors are known to have targeted U.S. critical infrastructure. During these malicious cyber activities, GRU actors launched efforts to scan for vulnerabilities, map networks, and identify potential website vulnerabilities in U.S.-based critical infrastructure – particularly the energy, government, and aerospace sectors.” - Rewards for Justice The scope of the malicious campaign highlights the potential wide-ranging objectives of the GRU cyber campaign and the ongoing threat posed by nation-state actors. Reward Offered for Info Leading to Capture The Justice Department emphasized its commitment to holding accountable those responsible for Russia's malicious cyber activity. The indictment carries a maximum sentence of five years, but international cooperation remains crucial to apprehend Stigal. The U.S. Department of State's Rewards for Justice program is offering a significant reward – up to $10 million – for information leading to Stigal's capture or the disruption of his cyber operations. This substantial reward underscores the seriousness of the charges and the international effort to dismantle Russia's cyber warfare apparatus. This case serves as a stark reminder of the evolving cyber threat landscape. The destructive capabilities of malware like WhisperGate, coupled with the targeting of critical infrastructure necessitates vigilance and collaboration between governments and security professionals to defend against nation-state cyberattacks. “Malicious cyber actors who attack our allies should know that we will pursue them to the full extent of the law,” said Erek L. Barron, U.S. Attorney for the District of Maryland. “Cyber intrusion schemes such as the one alleged threaten our national security, and we will use all the technologies and investigative measures at our disposal to disrupt and track down these cybercriminals.”

Cyble Recognized in Attack Surface Management Solutions Landscape Report

cyberexpress Jun 26, 2024 Cybersecurity News

ATLANTA — June TK, 2024 — Cyble, the leading provider of AI-driven cybersecurity solutions, has been recognized by Forrester (Nasdaq: FORR) in its report, The Attack Surface Management Solutions Landscape, Q2 2024 Report. This report offers valuable insights for organizations seeking to evaluate and select an show more ...

attack surface management (ASM) solution that aligns with their unique attack surfaces and threats. It provides an overview of the ASM solutions market, explores the value that security and risk (S&R) professionals can expect from ASM vendors, and offers guidance on vendor options based on company size and market focus. It also notes how ASM is essential for building a proactive program, offering valuable insights that enhance SecOps solutions. “We provide organizations with the tools and insights they need to proactively identify and mitigate potential cyber threats before they escalate. Our inclusion in the Forrester report will only further the resolve," said Beenu Arora, Founder and CEO of Cyble. “Cyble develops AI-powered solutions that help businesses protect their digital assets and maintain a strong security posture, and we’re constantly innovating to help customers keep pace with the rapidly evolving threat landscape.” Cyble Vision X, the successor to its award-winning Cyble Vision 2.0 threat intelligence platform elevates the user experience by empowering decision-makers with immediate access to critical information through its AI-powered insights and intuitive design. The platform covers the entire breach lifecycle, encompassing pre-breach, during-breach, and post-breach stages. Key Capabilities of Cyble Vision X include: Attack Surface Management: Ensures digital security by identifying and mitigating threats. Brand Intelligence: Comprehensive protection against online brand abuse, including brand impersonation, phishing, and fraudulent domains. Cyber Threat Intelligence: Helps organizations gain insights and enhance their defense with AI-driven analysis and continuous threat monitoring. Dark Web and Cyber Crime Monitoring: Helps organizations stay vigilant and ahead of cybercriminals Third-Party Risk Management (TPRM): Helps organizations identify, assess, and mitigate risks that may arise from a business's interactions with third parties. "By leveraging Cyble Vision X’s unmatched coverage, organizations gain total visibility and control over their attack surface, ensuring a robust security posture amid evolving cyber threats," added Arora. Cyble’s ASM is powered by ODIN, a groundbreaking attack surface monitoring capability that scans the entire IPv4 and IPv6 space. ODIN empowers infosec teams with an accurate map of the internet, enabling them to fortify their security perimeter and proactively hunt for threats on their attack surface. To learn more about ODIN, Cyble Vision X, and how Cyble can help you stay ahead of cyber threats, visit www.cyble.com. About Cyble: Cyble, a trailblazer in Cyber Threat Intelligence, is committed to democratizing Dark Web Threat Intelligence through advanced AI and Machine Learning solutions. Recognized as one of the most sought-after workplaces, Cyble’s culture fosters innovation, collaboration, and professional growth. With a proven track record in delivering cutting-edge research and proactive monitoring, Cyble stands at the forefront of the cybersecurity landscape. Headquartered in Atlanta, Georgia, with a global presence spanning Australia, Malaysia, Singapore, Dubai, Saudi Arabia, and India, Cyble is the trusted authority empowering organizations to proactively combat evolving cyber threats. Media Contact Matt McLoughlin matt@gregoryfca.com Cyble Inc. enquiries@cyble.com Ph: +1 678 379 3241

Don’t Fall for Fake Recovery: FBI Warns of Cryptocurrency Scam

cyberexpress Jun 26, 2024 Cybersecurity News

The Federal Bureau of Investigation (FBI) has warned the public about a new wave of cybercriminal activity targeting victims of cryptocurrency scams. These fraudsters are posing as lawyers and law firms, offering bogus cryptocurrency recovery services to steal funds and personal information from those already show more ...

defrauded. This latest cryptocurrency investment scam alert is an update to a previous warning from the FBI's Internet Crime Complaint Center (IC3), which had highlighted a surge in scams involving fake services for recovering digital assets. The updated Public Service Announcement (PSA), titled "Increase in Companies Falsely Claiming an Ability to Recover Funds Lost in Cryptocurrency Investment Scams," was originally published on August 11, 2023. Moreover, in April 2024, the FBI warned of financial risks tied to using unregistered cryptocurrency transfer services, highlighting potential law enforcement actions against these platforms. The announcement focused on crypto transfer services operating without registration as Money Services Businesses (MSBs) and non-compliance with U.S. anti-money laundering laws. These platforms are often targeted by law enforcement, especially when used by criminals to launder illegally obtained funds, such as ransomware payments. Cryptocurrency Scam: Emerging Criminal Tactic The FBI's announcement aims to inform the public about a new criminal tactic designed to exploit cryptocurrency scam victims further. Using social media and other messaging platforms, fraudsters posing as lawyers from fictitious law firms are contacting scam victims and offering their services. These "lawyers" claim they have the authority to investigate fund recovery cases and often assert that they are working with, or have received information from, the FBI, Consumer Financial Protection Bureau (CFPB), or other government agencies to validate their legitimacy. In some instances, victims have reached out to these scammers through fake websites that appear legitimate, hoping to recover their lost funds. The scammers use various methods to further the recovery scam, including: Verification Requests: They ask victims to verify their identities by providing personal identifying information or banking details. Judgment Amount Requests: They request that victims provide a judgment amount they are seeking from the initial fraudster. Upfront Fees: They demand a portion of the fees upfront, with the balance due upon recovery of the funds. Additional Payments: They direct victims to make payments for back taxes and other fees purportedly necessary to recover their funds. Credibility Building: They reference actual financial institutions and money exchanges to build credibility and further their schemes. Between February 2023 and February 2024, cryptocurrency scam victims who were further exploited by these fictitious law firms reported losses totaling over $9.9 million, according to the FBI Internet Crime Complaint Center (IC3). Tips to Protect Yourself The FBI offers several tips to help individuals protect themselves from falling victim to these scams: Be Wary of Advertisements: Be cautious of advertisements for cryptocurrency recovery services. Research the advertised company thoroughly and be suspicious if the company uses vague language, has a minimal online presence, and makes unrealistic promises about its ability to recover funds. Do Not Release Information: If an unknown individual contacts you claiming to be able to recover stolen cryptocurrency, do not release any financial or personal identifying information, and do not send money. No Fees from Law Enforcement: Remember that law enforcement does not charge victims a fee for investigating crimes. If someone claims an affiliation with the FBI, contact your local FBI field office to confirm their legitimacy. Victim Reporting The FBI urges victims to file a report with the Internet Crime Complaint Center. When filing a report, try to include the following information: Contact Information: Details about how the individual initially contacted you and how they identified themselves, including name, phone number, address, email address, and username. Financial Transaction Information: Details such as the date, type of payment, amount, account numbers involved (including cryptocurrency addresses), name and address of the receiving financial institution, and receiving cryptocurrency addresses. The FBI's announcement highlights the importance of vigilance and caution when dealing with unsolicited offers of assistance, particularly in the highly targeted and vulnerable area of cryptocurrency investments. By staying informed and following the FBI's guidelines, individuals can better protect themselves from becoming victims of these crypto scams.

Credit Suisse Data Breach Allegedly Exposes Info of 19,000 Indian Employees

cyberexpress Jun 26, 2024 Cybersecurity News

Credit Suisse, a global investment bank and financial services firm, has reportedly fallen victim to a cyberattack. The Credit Suisse data breach was allegedly masterminded by a threat actor (TA), operating under the alias “888,” on the data hack site BreachForums. The TA claims to have accessed highly sensitive show more ...

data of the bank and posted it on the dark web marketplace. According to the the threat actor, the data breach contains personal information of about 19,000 of the bank’s Indian employees. Credit Suisse Data Breach Details Credit Suisse was founded in 1856 and has approximately $15.21 Billion in revenue. It is one of the leading institutions in private banking and asset management, with strong expertise in investment banking. On June 25, 2024, the threat actor claimed to have carried out a cyberattack on the bank and exfiltrated details on 19,000 of its users. [caption id="attachment_79024" align="alignnone" width="1622"] Source: X[/caption] The breached data purportedly includes names of employees, 6,623 unique email addresses, their codes, date of birth, gender, policy name, relationships, dates of joining, effective dates, statuses, and entities. To substantiate the claim, the threat actor 888 provided a sample of the data breach, which contains details of Credit Suisse employees in India. [caption id="attachment_79025" align="alignnone" width="1362"] Source: X[/caption] The TA, however, did not provide a specific price for the sale of data and has requested potential buyers to quote a figure. The hacker commented that they are only accepting cryptocurrency as the mode of payment. More specifically, the hacker was open to payment on Monero (XMR), a digital currency renowned for its privacy and anonymity attributes. This method of payment is often utilized in illegal transactions to evade detection. Despite these claims by the threat actor, a closer inspection reveals that the bank’s website is currently functioning normally, showing no signs of a security breach. The Cyber Express has reached out to the bank to verify the alleged cyberattack. As of now, no official statements or responses have been received, leaving the claims unverified. Not the First Credit Suisse Data Breach This is not the first time that Credit Suisse has been involved in a security breach. According to a report published in The Economic Times, in 2023, the bank warned its staff that a former employee stole personal data of its employees, including salaries and bonuses. The information included salary and "variable compensation" for a period between 2013 and 2015. Another Bloomberg report said that a data breach in 2023 impacted numerous former Credit Suisse clients who collectively held a staggering $100 billion in accounts. Credit Suisse Hacker Targeted Big Multinationals Recently There are many concerns over the potential misuse of sensitive information found in the data breach, which includes customer names, dates of birth, and relationships. Credit Suisse should investigate the data breach claims considering the history of the threat actor. Earlier this month, the TA 888 claimed to have stolen data of over 32,000 current and former employees of Accenture. The company, however, denied the claims and said that the data set published by the hacker had only three employee names and email addresses. The hacker also claimed responsibility for leaking details about 8,174 employees of Heineken across several countries. Prior to this, 888 also staked claims for an attack on oil and gas multinational Shell. The TA posted sample information sharing personal details of Australian customers. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

California Privacy Watchdog Inks Deal with French Counterpart to Strengthen Data Privacy Protections

cyberexpress Jun 26, 2024 Policy Updates

In a significant move to bolster data privacy protections, the California Privacy Protection Agency (CPPA) inked a new partnership with France’s Commission Nationale de l'Informatique et des Libertés (CNIL). The collaboration aims to conduct joint research on data privacy issues and share investigative findings show more ...

that will enhance the capabilities of both organizations in safeguarding personal data. The partnership between CPPA and CNIL shows the growing emphasis on international collaboration in data privacy protection. Both California and France, along with the broader European Union (EU) through its General Data Protection Regulation (GDPR), recognize that effective data privacy measures require global cooperation. France’s membership in the EU brings additional regulatory weight to this partnership and highlights the necessity of cross-border collaboration to tackle the complex challenges of data protection in an interconnected world. What the CPPA-CNIL Data Privacy Protections Deal Means The CPPA on Tuesday outlined the goals of the partnership, stating, “This declaration establishes a general framework of cooperation to facilitate joint internal research and education related to new technologies and data protection issues, share best practices, and convene periodic meetings.” The strengthened framework is designed to enable both agencies to stay ahead of emerging threats and innovations in data privacy. Michael Macko, the deputy director of enforcement at the CPPA, said there were practical benefits of this collaboration. “Privacy rights are a commercial reality in our global economy,” Macko said. “We’re going to learn as much as we can from each other to advance our enforcement priorities.” This mutual learning approach aims to enhance the enforcement capabilities of both agencies, ensuring they can better protect consumers’ data in an ever-evolving digital landscape. CPPA’s Collaborative Approach The partnership with CNIL is not the CPPA’s first foray into international cooperation. The California agency also collaborates with three other major international organizations: the Asia Pacific Privacy Authorities (APPA), the Global Privacy Assembly, and the Global Privacy Enforcement Network (GPEN). These collaborations help create a robust network of privacy regulators working together to uphold high standards of data protection worldwide. The CPPA was established following the implementation of California's groundbreaking consumer privacy law, the California Consumer Privacy Act (CCPA). As the first comprehensive consumer privacy law in the United States, the CCPA set a precedent for other states and countries looking to enhance their data protection frameworks. The CPPA’s role as an independent data protection authority mirror that of the CNIL - France’s first independent data protection agency – which highlights the pioneering efforts of both regions in the field of data privacy. By combining their resources and expertise, the CPPA and CNIL aim to tackle a range of data privacy issues, from the implications of new technologies to the enforcement of data protection laws. This partnership is expected to lead to the development of innovative solutions and best practices that can be shared with other regulatory bodies around the world. As more organizations and governments recognize the importance of safeguarding personal data, the need for robust and cooperative frameworks becomes increasingly clear. The CPPA-CNIL partnership serves as a model for other regions looking to strengthen their data privacy measures through international collaboration.

BSNL Data Breached Yet Again? Millions of Users Face Risk of SIM Card Cloning, Financial Fraud

cyberexpress Jun 26, 2024 Cybersecurity News

India’s largest government-owned-telecommunications service provider, Bharat Sanchar Nigam Ltd (BSNL), has allegedly suffered a massive data breach, the second such instance in less than six months. The BSNL data breach reportedly involves critical data including international Mobile Subscriber Identity (IMSI) show more ...

numbers, SIM card information, Home Location Register (HLR) specifics, DP Card Data, and even snapshots of BSNL's SOLARIS servers which can be misused for SIM cloning. Exploring Claims of BSNL Data Breach The BSNL data leak was first disclosed by an Indian firm, Athenian Tech, in its threat intelligence report. According to the report, a threat actor, operating under the alias “kiberphant0m”, leaked a significant amount of sensitive data affecting millions of users. The threat actor posted this information on the data hack site BreachForums and shared samples of the breach to legitimize the claim. Overall, around 278GB of sensitive information could be compromised. The hacker also posted details of call log samples which leaked sensitive information like mobile numbers of users, the date and duration of calls, and the amount charged for the call in Indian Rupees. The call log samples were being leaked in two sets: one for the month of May 2024 and another from 2020. This indicates that the data breach was a recent attack raising questions over the security checks in place at BSNL. The threat actor was selling the alleged stolen data for $5,000. The steep price tag could indicate the significant value of the stolen data which is sensitive. The Cyber Express has yet to verify the authenticity of the recent BSNL data breach and has contacted the organization for an official response. This article will be updated based on their response. Potential Implications of BSNL Data Breach SIM Cloning and Identity Theft: Cloning a SIM involves creating a duplicate card that has the same IMSI and authentication keys, thus making it easy for the attackers to intercept messages/ calls, gain access to people’s bank accounts, and embezzle their finances. Privacy Violations: Identity theft means that one can gain unauthorized access to the individuals’ communication and breaches. Financial and Identity Theft: Illegal operations can defeat protective procedures in the financial portfolios, which entail substantial monetary losses and cases of identity theft. Targeted Attacks and Scams: The user could be exposed to major security risks and could be vulnerable to phishing schemes and other social engineering attacks, exploiting their trust in BSNL. The threat is not just limited to the consumers, but also to BSNL’s operations and security. Illegal access to servers can result in service disruptions, slow performance, and unauthorized access to telecom operations. Leaking of such information poses a severe threat to critical infrastructures and paves the way for future attacks on complex systems interconnectivity. BSNL users should remain vigilant and monitor any unusual activity on their phones and bank accounts and enable two-factor authentication (2FA) for added security on all accounts. BSNL too should take immediate action if the breach is confirmed, secure network endpoints, and audit access logs. They should enhance security measures, conduct frequent security audits, and adopt advanced threat detection technologies. Second BSNL Data Breach in Less Than Six Months If the data theft claims are proven, it would be the second instance of a cyberattack on BSNL in less than six months. In December 2023, a threat actor known as “Perell” claimed access to critical information about fiber and landline users of BSNL. The dataset contained about 32,000 lines of data allegedly impacting over 2.9 million users. However, BSNL did not validate the claims back then. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

BianLian Ransomware Targets Better Business Bureau, US Dermatology Partners

cyberexpress Jun 26, 2024 Cybersecurity News

Notorious ransomware group BianLian has claimed to have added two new organizations as its latest cyberattack victims. The BianLian ransomware attack was allegedly carried out on two US-based firms, namely, Better Business Bureau Inc and U.S. Dermatology Partners. The infamous actor has claimed to have accessed show more ...

sensitive data including financial, contract, and employee profiles from both its victims. BianLian Ransomware Attack: Critical Details The first organization targeted by hackers was Better Business Bureau (BBB), which is a private, nonprofit organization founded in 1912 in Arlington, Virginia. The firm maintains a massive database of accredited and non-accredited businesses, providing ratings based on several factors. The Better Business Bureau has a revenue of $430.6 Million. [caption id="attachment_79001" align="alignnone" width="1259"] Source: X[/caption] The threat actor claims to have accessed 1.2 TB of organization data, including accounting, budget, and financial data; contract data and NDAs; files from the CFO's computer; operational and business files; and email and PST archives. The group has also disclosed sensitive information such as the names, personal email addresses, and phone numbers of BBB’s CEO, vice president, chief accreditation officer, and chief activation officer. The other organization that has allegedly fallen victim to the ransomware group is US Dermatology Partners. The organization, with a revenue of $213.7 Million, is one of the premier dermatology practitioners in the USA, caring for over two million patients annually. [caption id="attachment_79002" align="alignnone" width="1259"] Source: X[/caption] The hackers claimed to have accessed 300 GB of organization data, including personal data, accounting and budget information, financial data, contract data and NDAs, and employee profiles. Potential Impact of BianLian Ransomware Attack If proven, the potential consequences of this ransomware attack could be critical as the accounting and financial details of both these firms could be leaked. The organizations should take appropriate measures to protect the privacy and security of the stakeholders involved. Financial data breaches can lead to identity theft, financial fraud, and a loss of trust among clients, potentially jeopardizing the company’s standing in the industry. Currently, details regarding the extent of the BianLian ransomware attack, data compromise, and the motive behind the cyber assault remain undisclosed. Despite the claims made by BianLian, the official websites of the targeted companies remain fully functional. This discrepancy has raised doubts about the authenticity of the BianLian group’s assertion. To ascertain the veracity of the claims, The Cyber Express has reached out to the officials of the affected organizations. As of the writing of this news report, no response has been received, leaving the ransomware attack claim unverified. History of BianLian Ransomware Group Attacks BianLian, a ransomware group, has been targeting critical infrastructure sectors in the U.S. and Australia since June 2022. They exploit RDP credentials, use open-source tools for discovery, and extort data via FTP or Rclone. FBI, CISA, and ACSC advise implementing mitigation strategies to prevent ransomware attacks. Initially employing a double-extortion model, they shifted to exfiltration-based extortion by 2023. According to a report by BlackBerry, BianLian ransomware showcases exceptional encryption speed and is coded in the Go programming language (Golang). This sophisticated approach has enabled the group to strike multiple organizations, leaving a trail of unverified claims in its wake. Earlier in 2024, the group targeted companies such as North Star Tax and Accounting, KC Pharmaceuticals, Martinaire. In its attack on MOOver, the group claimed to have accessed a staggering 1.1 terabytes of the firm’s data. Subsequently, Northeast Spine and Sports Medicine also found themselves on the list of victims. All these claims, similar to the recent attack, remain unverified. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

New Banking Trojan “Sniffthem” Emerges on Cybercrime Forums, Targeting Windows Devices

cyberexpress Jun 26, 2024 Firewall Daily

A newly surfaced banking trojan named "Sniffthem," also known as Tnaket has emerged on the dark web forums. This Sniffthem trojan, introduced by threat actor oliver909 on the XSS Russian language forum, targets a wide spectrum of Windows operating systems ranging from Windows 7 to the latest Windows 11. show more ...

Oliver909's forum post on June 24, 2024, detailed the capabilities of the banking trojan Sniffthem, highlighting its advanced functionalities designed for financial fraud. Among its notable features, Sniffthem possesses the ability to perform HTML injection, enabling it to compromise websites—even those secured with SSL certificates—by injecting malicious HTML code. This tactic undermines the integrity of supposedly secure web pages, facilitating the theft of sensitive information. Dark Web Actors Reveals Banking Trojan Sniffthem [caption id="attachment_78990" align="alignnone" width="1906"] Source: Dark Web[/caption] Another key feature of Sniffthem is its credit card grabber capability, allowing it to stealthily capture credit card details through the injection of fake web pages. This method operates covertly, ensuring that the theft of financial data goes unnoticed by users and security measures alike. Moreover, the trojan supports a wide range of web browsers including Firefox, Google Chrome, Edge, and Yandex, ensuring compatibility across various user environments. To evade detection, the banking trojan Sniffthem employs crypters, enhancing its stealth and persistence on infected systems. These crypters cloak the trojan's code, making it difficult for antivirus programs and security defenses to detect and remove the malware effectively. Oliver909 demonstrated the trojan's functionalities through a video shared on the forum, showcasing its management panel and user interface designed for seamless control over malicious activities. In terms of pricing, oliver909 offers Sniffthem on a subscription basis, setting a monthly rate of USD 600. This pricing strategy positions Sniffthem as a lucrative option within the cybercriminal marketplace, appealing to threat actors looking to capitalize on financial fraud opportunities. Technical Insights into Sniffthem Banking Trojan Sniffthem's technical specifications highlight its sophistication and potential impact on cybersecurity. The Sniffthem banking trojan operates persistently as a hidden process, evading detection and maintaining a covert presence on infected systems. Its integration with a web-based management panel allows threat actors to efficiently control compromised devices and orchestrate malicious activities remotely. Furthermore, Sniffthem's compatibility with a wide array of browsers—64 in total—highlights its versatility and ability to infiltrate diverse user environments. This capability extends its reach across various sectors, with a particular focus on the BFSI (Banking, Financial Services, and Insurance) industry where financial transactions and sensitive data are prime targets. The emergence of Sniffthem signifies a heightened threat to organizations and individuals alike, particularly within the financial sector. To mitigate risks associated with banking trojans like Sniffthem, cybersecurity best practices are essential. Organizations should prioritize regular software updates, endpoint protection, and employee training to recognize and respond to phishing attempts effectively. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

EU NIS 2 Directive: what it is and how to prepare for it | Kaspersky official blog

kaspersky Jun 26, 2024 Business

Todays topic is the NIS 2 Directive, which aims to improve the cyber-resilience of critical infrastructure and essential and important entities. NIS 2 looks set to do for information security in the EU what GDPR did for user data privacy. It wont be long now before the new directive will be transposed into national show more ...

law, so if your organization is not yet ready, nows the time to take steps. What is NIS 2? The revised Network and Information Security Directive (NIS 2) is the EU-wide legislation on cybersecurity. NIS 2 updates and complements the original NIS Directive, adopted in 2016, and creates a legal framework to enhance the overall level of cybersecurity across the EU. The updated NIS 2 Directive focuses on three main areas: Expanding the scope of application: the seven sectors covered by the original NIS Directive are supplemented by a number of new ones New mechanisms for incident reporting and information sharing: NIS 2 mandates the timely reporting of significant incidents Tighter enforcement of compliance: the updated NIS 2 introduces specific sanctions for non-compliance, including fines of up to 2% of global annual turnover What organizations does NIS 2 apply to? As mentioned above, the revised directive significantly broadens the scope of application compared to the original 2016 version. In addition, NIS 2 introduces a classification that divides the covered sectors into two categories: Sectors of high criticality (Annex I): Energy (electricity, district heating & cooling, gas, hydrogen, oil) Transport (air, rail, water, road) Banking Financial market infrastructure Health Drinking water Waste water Digital infrastructure ICT-service management (MSP, MSSP) Public administration entities Space Other critical sectors (Annex II): Postal and courier services Waste management Manufacture, production, and distribution of chemicals Production, processing, and distribution of food Manufacturing (medical devices, computer, electronic, or optical products, electrical equipment, machinery, motor vehicles, other transport equipment) Digital providers Research Besides classifying sectors, NIS 2 introduces an additional classification of specific entities. It too consists of two categories: Essential (Article 3.1): Large entities (annual revenue of over €50 million) in sectors of high criticality Certification authorities, top-level domain registrars, and DNS providers, regardless of size of the business Telecom providers, from medium-sized upwards (revenue over €10 million) Public administration institutions Any entity belonging to a highly critical or other critical sector thats defined by an EU Member State as essential Entities defined as critical under Directive (EU) 2022/2557 Important (Article 3.2): Medium-sized entities (annual revenue of €10-50 million) in highly critical sectors Medium and large entities in other critical sectors Any entity thats defined by an EU Member State as important The category an entity belongs to has significant practical implications. The activities of entities classified as essential will be subject to much stricter and proactive oversight, including random raids, special security checks, and requests for proof of compliance. For non-compliance with NIS 2, essential entities may face a fine of up to €10 million or 2% of global annual turnover. Entities classified as important can breathe a bit more easily — theyre subject to less stringent controls. For important entities, the penalties are slightly more modest: up to €7 million or 1.4% of global annual turnover. NIS 2 timeline Note that, unlike GDPR, NIS 2 is a directive, — not a regulation of the European Union. This means that EU Member States are legally required to amend their national legislation within the designated time frame. In the case of NIS 2, the deadline is set for October 17, 2024. In addition, EU Member States will have to draw up lists of essential and important entities subject to NIS 2 by April 17, 2025. It will be useful to revisit the timeline of the main stages of NIS 2: July 6, 2016: adoption of Directive (EU) 2016/1148, the original NIS May 9, 2018: deadline for EU Member States to transpose the NIS Directive into their national legislation July 7, 2020: start of European Commission (EC) consultations on the revision of NIS December 16, 2020: publication of the proposal for NIS2 by the EC May 13, 2022: European Parliament vote on adoption of the NIS 2 Directive November 10, 2022: approval of the NIS 2 Directive by the Council of the EU December 14, 2022: publication of the NIS 2 Directive in the Official Journal of the EU under the title Directive (EU) 2022/2555 January 16, 2023: entry into force of the NIS 2 Directive October 17, 2024: deadline for EU Member States to transpose the NIS 2 Directive into their national legislation April 17, 2025: deadline for EU Member States to draw up lists of essential and important These lists must be updated regularly thereafter — at least every two years October 17, 2027: review of the NIS 2 Directive How to prepare for NIS 2 implementation? Assess whether, and to what extent, the requirements of NIS 2 apply to your organization Investigate how the NIS Directive was transposed into the national legislation in your EU Member State Follow the recommendations of national cybersecurity authorities Assess and develop technical, operational, and organizational measures for managing network and information systems; security risks More information about the updated EU Network and Information Security Directive, and how organizations can prepare for its entry into force, is available on our dedicated NIS 2 site.

Transatlantic Cable podcast episode 353 | Kaspersky official blog

kaspersky Jun 26, 2024 News

Episode 353 of the Transatlantic Cable podcast kicks off with news around ransomware attacks, both in the UK and the US. From there, the team discuss updates around the EUs new DMA (Digital Markets Act) and how Apple could be a test case for record fines, if theyre found to have abused their market position. To wrap show more ...

up, the team look at how some of the biggest names in music are joining forces to sue start up generative A.I companies, who have alleged that theyre infringing copyright on a massive scale. If you liked what you heard, please consider subscribing. Dont blame us for people suffering London hospital hackers LockBit Ransomware Claims 33 TB of US Federal Reserve Data for Ransom Apple in breach of law on App Store, says EU Worlds biggest music labels sue over AI copyright

Dangerous AI Workaround: 'Skeleton Key' Unlocks Malicious Content

darkreading Jun 26, 2024 Feed

Microsoft, OpenAI, Google, Meta genAI models could be convinced to ditch their guardrails, opening the door to chatbots giving unfettered answers on building bombs, creating malware, and much more.

Neiman Marcus Customers Impacted by Snowflake Data Breach

darkreading Jun 26, 2024 Feed

The high-end retailer is the latest company to confirm it was affected by the wide-ranging Snowflake data breach, which impacted more than 165 organizations.

Apple AirPods Bug Allows Eavesdropping

darkreading Jun 26, 2024 Feed

The vulnerability affects not only AirPods, but also AirPods Max, Powerbeats Pro, Beats Fit Pro, and all models of AirPods Pro.

'ChamelGang' APT Disguises Espionage Activities With Ransomware

darkreading Jun 26, 2024 Feed

The China-nexus cyber-threat actor has been operating since at least 2019 and has notched victims in multiple countries.

Is Defense Winning? A Look at Decades of Playing Catch Up

darkreading Jun 26, 2024 Feed

In this Black Hat USA preview, scholar Jason Healey examines strategies for measuring and shifting the balance of cyber defense

Optiv Report Shows Nearly 60% Increase in Security Budgets as Most Organizations Report Cyber Breaches and Incidents

darkreading Jun 26, 2024 Feed

CISOs Growing More Comfortable With Risk, But Better C-Suite Alignment Needed

darkreading Jun 26, 2024 Feed

Akamai Completes Acquisition of API Security Company Noname

darkreading Jun 26, 2024 Feed

'Snowblind' Tampering Technique May Drive Android Users Adrift

darkreading Jun 26, 2024 Feed

As cybersecurity's cat-and-mouse game starts to look more like Tom and Jerry, attackers develop a method for undermining Android app security with no obvious fix.

Polyfill.io Supply Chain Attack Smacks Down 100K+ Websites

darkreading Jun 26, 2024 Feed

The site is supplying malicious code that delivers dynamically generated payloads and can lead to other attacks, after a Chinese organization bought it earlier this year.

Diverse Cybersecurity Workforce Act Offers More Than Diversity Benefits

darkreading Jun 26, 2024 Feed

Our adversaries certainly have diversity — so cybersecurity teams need it, too.

Russian Hackers Target Ukraine with XWorm RAT Malware Payload

cyware Jun 26, 2024 Malware and Vulnerabilities

Cyble Research and Intelligence Labs (CRIL) researchers have discovered that a Russia-linked threat group known as UAC-0184 is targeting Ukraine using the XWorm remote access trojan (RAT).

Authentication Bypasses in MOVEit Transfer and MOVEit Gateway

cyware Jun 26, 2024 Malware and Vulnerabilities

A critical security vulnerability, CVE-2024-5806, has been found in MOVEit Transfer, a popular file transfer software. The vulnerability allows attackers to bypass authentication checks and gain administrative access by sending manipulated requests.

The Growing Threat of Malware Concealed Behind Cloud Services

cyware Jun 26, 2024 Malware and Vulnerabilities

Cybersecurity threats are utilizing cloud services, such as AWS and DriveHQ, to store, distribute, and control malicious activities. This poses challenges for detection and prevention, as cloud services offer scalability and anonymity.

New Medusa Malware Variants Target Android Users in Seven Countries

cyware Jun 26, 2024 Malware and Vulnerabilities

The Medusa banking trojan (aka TangleBot) operates as a malware-as-a-service, providing keylogging, screen controls, and SMS manipulation. Note that this operation is different from the ransomware gang and the Mirai-based botnet with the same name.

UK and US Law Enforcement Put Qilin Ransomware Criminals in the Crosshairs

cyware Jun 26, 2024 Incident Response, Learnings

UK and US law enforcement agencies have collaborated to combat the Qilin ransomware gang, which has targeted the global healthcare industry through several recent attacks.

Malicious JavaScript Snippets Served Due to Supply Chain Attack on Polyfills Site

cyware Jun 26, 2024 Breaches and Incidents

The polyfill.io domain, which offers JavaScript code to add functionality to older browsers, has been compromised and is infecting over 100,000 websites with malware. The domain was purchased by a Chinese organization earlier this year.

Update: CISA Warns Chemical Facilities of Potential Data Theft

cyware Jun 26, 2024 Incident Response, Learnings

Although there was no evidence of data theft or lateral movement, the agency's investigation revealed that unauthorized access to various sensitive information, including security plans and user accounts, may have occurred.

Zeek: Open-Source Network Traffic Analysis, Security Monitoring

cyware Jun 26, 2024 Security Products & Services

Zeek is an open-source network analysis framework. Unlike an active security device such as a firewall, Zeek operates on a versatile ‘sensor’ that can be a hardware, software, virtual, or cloud platform.

Multiple Vulnerabilities in Siemens Power Automation Products

cyware Jun 26, 2024 Malware and Vulnerabilities

Siemens recently patched several vulnerabilities in its Sicam products that could be exploited to target the energy sector. The updates addressed two high-severity and one medium-severity flaws.

Apple Patches AirPods Bluetooth Vulnerability That Could Allow Eavesdropping

cyware Jun 26, 2024 Malware and Vulnerabilities

The vulnerability, tracked as CVE-2024-27867, affects various AirPods models, Powerbeats Pro, and Beats Fit Pro. An attacker in Bluetooth range could spoof the source device and gain access to the headphones, potentially allowing eavesdropping.

Microsoft Blamed For Million-Plus Patient Record Theft At US Hospital Giant

packetstormsecurity Jun 26, 2024 headline,privacy,microsoft,data loss,ide

Pentagon Taken To Task Over Background Check Security

packetstormsecurity Jun 26, 2024 headline,government,usa,fraud,military

Ebay Seller Offers Stingray Device For $100,000

packetstormsecurity Jun 26, 2024 headline,privacy,phone,spyware

P2Pinfect Worm Now Dropping Ransomware On Redis Servers

packetstormsecurity Jun 26, 2024 headline,hacker,malware,cryptography

Probllama: Ollama Remote Code Execution Vulnerability

packetstormsecurity Jun 26, 2024 headline,flaw