Oktacron - Cyber Security RSS Feeds History

Critical Vulnerabilities in Progress Software’s WhatsUp Gold Expose Systems to Severe Risks

cyberexpress Aug 30, 2024 Firewall Daily

Recent security findings reveal that Progress Software’s WhatsUp Gold, a prominent enterprise network monitoring and management solution, harbors significant vulnerabilities that could lead to full system compromise. This critical flaw, designated CVE-2024-4885, poses a severe threat to the security of affected show more ...

systems. WhatsUp Gold is renowned for providing comprehensive visibility into various aspects of network infrastructure, including devices, applications, servers, and traffic. This makes it an integral tool for organizations managing cloud and on-premises environments. However, a newly discovered vulnerability has raised concerns among cybersecurity experts and IT administrators alike. Decoding the WhatsUp Gold Vulnerability (CVE-2024-4885) On August 28, 2024, cybersecurity researchers reported that over 1,200 WhatsUp Gold instances are exposed to the internet. These instances may be vulnerable to CVE-2024-4885, a critical-severity flaw that allows unauthenticated remote attackers to execute arbitrary code on affected systems. The flaw has been assigned a CVSS score of 9.8, highlighting its severity. [caption id="attachment_88612" align="alignnone" width="1235"] Source: nvd.nist.gov[/caption] The vulnerability resides in WhatsUp Gold's GetFileWithoutZip method. This method fails to properly validate user input, allowing attackers to exploit it by sending specially crafted requests. Through this, an attacker could upload malicious files to arbitrary locations on the server, thereby achieving remote code execution (RCE) and potentially compromising the entire system. Progress Software promptly addressed this issue with the release of WhatsUp Gold version 23.1.3 in May 2024. This update not only patched CVE-2024-4885 but also resolved three other critical severity vulnerabilities and several high-severity bugs. In a June 2024 advisory, Progress Software urged users to upgrade to version 23.1.3 or later, emphasizing that versions up to 23.1.2 were susceptible to the vulnerability. Technical Details and Mitigation Despite the release of a patch, Progress Software has cautioned that the risk of exploitation remains significant. The company’s advisory noted, “These vulnerabilities can expose customers to exploitation. While we have not seen evidence of a known exploit, your system(s) could be compromised – including unauthorized access to a root account.” The implications of this flaw are profound. An attacker exploiting CVE-2024-4885 could gain unauthorized access to sensitive information, leading to data theft and potential system-wide compromise. This is particularly alarming given that the PoC code for the vulnerability has been made public, increasing the risk of exploitation. Researchers has been actively monitoring the situation and providing tools to identify potentially vulnerable WhatsUp Gold instances. For those seeking to verify the security of their systems, these search queries can help: Censys Search Query: services.software: (vendor: “Progress” and product: “WhatsUp Gold”) Censys ASM Query: host.services.software: (vendor: “Progress” and product: “WhatsUp Gold”) or web_entity.instances.software: (vendor: “Progress” and product: “WhatsUp Gold”) As of the latest reports, Censys has identified 1,207 exposed WhatsUp Gold devices. Organizations utilizing this software are strongly advised to update their installations to the latest patched version to mitigate the risks associated with CVE-2024-4885. In summary, the CVE-2024-4885 vulnerability highlights the critical need for vigilance in managing and securing enterprise network monitoring tools like WhatsUp Gold. The exposure of such vulnerabilities highlights the importance of timely updates and proactive security measures in safeguarding IT infrastructure from potential threats.

The Dumbest Thing in Security This Week: Worst. Phishing. Test. EVER.

cyberexpress Aug 30, 2024 Cybersecurity News

Employee cybersecurity training programs and phishing tests are usually a good thing for cyber preparedness, but one university went way too far and wound up causing a panic. Last week, students and staff at the University of California Santa Cruz (UCSC) received an email with the subject line “Emergency show more ...

Notification: Ebola Virus Case on Campus” that warned them that a staff member who had recently traveled to Africa had tested positive for the Ebola virus. The email came from a non-university email address and directed users to an information site that one recipient said on Reddit was a Proofpoint phishing training site. The university apologized for the misguided phishing test, but not before causing panic and outrage among some UCSC community members. The university deserves credit for educating students and staff about cyber risks, but phishing tests should be designed with a strategic organizational goal in mind, like protecting data and credentials. UCSC Ebola Phishing Email Breaks the Mold Phishing tests at most organizations tend to be aimed at training employees not to divulge sensitive information or click on harmful links or attachments that could trigger a malware attack or credential theft, so such tests typically take the form of, say, an urgent fake message from the CEO directing the recipient to an external link or document. If the employee stops to think, they’ll recognize the phishing attempt and report it to IT. If they click, they’ll politely be informed that they failed the test. Hoo boy did the UCSC email break the mold. UCSC assistant sociology professor Alicia Riley sent an email to the university’s security team criticizing the choice of a false Ebola claim for a phishing test, the Santa Cruz Lookout reported. “As a population health scientist who studies infectious disease mortality and teaches about Ebola, I find it irresponsible and in poor taste to use this topic for a simulated phishing attack email that went out to the university community on a Sunday morning, no less,” Riley wrote. UCSC CISO Brian Hall apologized in an email to the university community the day after the test. “The email content was not real and inappropriate as it caused unnecessary panic, potentially undermining trust in public health messaging,” Hall wrote. “We sincerely apologize for this oversight.” He added that the use of Ebola in the phishing test “inadvertently perpetuated harmful information about South Africa.” UCSC Phishing Test Served No Useful Purpose A phishing test should teach recipients about the value of information and the importance of inspecting links, addresses and other context before clicking or acting. While a sense of urgency is key, panicking recipients with fears of a highly fatal disease that hasn’t been seen in the U.S. in a decade doesn’t serve any useful purpose.

North Korean Hackers Exploited Chromium Zero-Day to Deploy Rootkit

cyberexpress Aug 30, 2024 Cybersecurity News

In a recent attack, a North Korean threat actor leveraged a zero-day vulnerability in Google's Chromium browser to deploy the FudModule rootkit, targeting cryptocurrency firms for financial gain. Microsoft uncovered a sophisticated cyber operation involving a North Korean threat actor exploiting a zero-day show more ...

vulnerability in Chromium, tracked as CVE-2024-7971. The attack, attributed to the notorious group known as Citrine Sleet, specifically targeted the cryptocurrency sector. Type Confusion Vulnerability Targeted Citrine Sleet, a threat actor with a history of targeting financial institutions, executed the attack using a type confusion vulnerability in the V8 JavaScript and WebAssembly engine, impacting versions of Chromium prior to 128.0.6613.84. Google released a patch for the vulnerability on August 21, but not before significant damage was done. The attack began with social engineering tactics—Citrine Sleet lured victims to a malicious domain, voyagorclub[.]space, where the zero-day RCE exploit for CVE-2024-7971 was deployed. This exploit allowed the attackers to execute code within the sandboxed Chromium renderer process, setting the stage for a more devastating follow-up. Once inside the target system, Citrine Sleet deployed the FudModule rootkit, an intriguing piece of malware designed to disrupt kernel security mechanisms through Direct Kernel Object Manipulation (DKOM). The rootkit's purpose is to provide persistent backdoor access to compromised systems, allowing attackers to steal sensitive data or deploy additional malware. The FudModule rootkit has been previously associated with another North Korean threat group, Diamond Sleet, indicating possible collaboration or shared resources between these state-sponsored actors. The attack didn’t stop there. Citrine Sleet exploited another vulnerability, CVE-2024-38106, in the Windows kernel, allowing the rootkit to escape the browser’s sandbox and gain deeper control over the system. Microsoft had patched this kernel vulnerability just days before the attack was discovered, but the timing suggests that the threat actors were well-prepared to exploit it. FudModule Rootkit Overview The FudModule rootkit is a sophisticated malware tool used primarily by the other notorious North Korean hackers, the Lazarus Group. The rootkit represents one of the most advanced tools in their arsenal and has seen continuous development aimed at improving its stealth and functionality. Key Features and Evolution Kernel-Level Access: The rootkit exploits a zero-day vulnerability (CVE-2024-21338) in the appid.sys AppLocker driver. This allows the Lazarus Group to achieve kernel-level access, enabling them to perform direct kernel object manipulation. Advanced Techniques: The latest version of the FudModule rootkit employs several advanced techniques, including: Handle Table Entry Manipulation: Used to suspend processes protected by Protected Process Light (PPL), targeting security tools like Microsoft Defender, CrowdStrike Falcon, and HitmanPro. Direct Kernel Object Manipulation (DKOM): To disable security products, hide malicious activities, and maintain persistence. Registry and Object Callback Removal: Disables security monitoring by removing registry and object callbacks, thus evading detection by security solutions. Stealth Enhancements: The rootkit avoids using traditional methods that might raise suspicion, such as using the NtWriteVirtualMemory syscall for both reading and writing kernel memory. This reduces the number of suspicious syscalls and detection opportunities. Historical Context and Previous Versions: Initially, the rootkit leveraged a Bring Your Own Vulnerable Driver (BYOVD) technique to exploit known vulnerabilities in drivers like dbutil_2_3.sys and later ene.sys. The shift to exploiting a zero-day vulnerability marks a significant evolution in their tactics. Earlier versions of the rootkit were capable of disabling security monitoring of all security solutions on infected hosts. The latest updates have focused on improved stealth and expanded capabilities. Cross-Platform Focus: The group has also been observed using bogus calendar meeting invite links to install malware on Apple macOS systems, indicating a cross-platform focus. Recommendations and Mitigations Citrine Sleet, also known as AppleJeus, Labyrinth Chollima, UNC4736, and Hidden Cobra, is a well-established North Korean threat actor with a history of targeting financial institutions. The group's primary goal is to steal cryptocurrency assets, and they often employ sophisticated social engineering techniques to achieve their objectives. The North Korean regime has long relied on cybercrime to fund its activities, including its sanctioned nuclear program. The details of the latest operation only reflect the rising threat posed by state-sponsored hacking groups. Microsoft recommends immediate updates to all systems, particularly to the latest versions of Chromium-based browsers, to mitigate the risk posed by CVE-2024-7971. In addition to patching, organizations should deploy security solutions that offer unified visibility across the cyberattack chain, allowing for the detection and blocking of post-compromise activity. Microsoft also advises strengthening the overall security posture by ensuring that operating systems and applications are consistently up-to-date. Recommended Mitigations: Keep Systems Updated: Ensure that all operating systems, applications, and web browsers are patched with the latest security updates. Use a Reputable Security Solution: Implement a robust security solution that can detect and block advanced threats, including rootkits and zero-day exploits. Train Employees: Educate employees about the risks of phishing and other social engineering attacks. Encourage them to be cautious of suspicious emails, websites, and attachments. Implement Network Segmentation: Divide your network into smaller segments to limit the potential damage of a successful attack. Monitor Network Traffic: Use network monitoring tools to detect unusual activity that may indicate a compromise. By following these recommendations, organizations can significantly reduce their risk of falling victim to similar attacks.

FBI Warns of RansomHub: Over 200 Victims Targeted

cyberexpress Aug 30, 2024 Cybersecurity News

The Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), Multi-State Information Sharing and Analysis Center (MS-ISAC), and the Department of Health and Human Services (HHS) have issued a joint advisory on a ransomware-as-a-service (RaaS) variant known as RansomHub. This new show more ...

variant has emerged as a major threat, already claiming at least 210 victims across multiple critical infrastructure sectors, including healthcare, financial services, and telecommunications. The Rise of RansomHub RansomHub, previously known as Cyclops and Knight, has quickly gained notoriety since its debut in February 2024. It operates under a ransomware-as-a-service model, which means that the developers of RansomHub offer their ransomware to affiliates who then deploy it against targets. This approach allows RansomHub to attract affiliates, including those previously associated with other prominent ransomware groups like LockBit and ALPHV, thereby expanding its reach and impact. According to the joint advisory, RansomHub affiliates have successfully encrypted and exfiltrated data from organizations in various sectors, including water and wastewater systems, government services, emergency services, food and agriculture, critical manufacturing, and transportation. [caption id="attachment_88535" align="aligncenter" width="448"] Source: X[/caption] High-Profile Attacks and Double-Extortion Tactics Among the notable victims of RansomHub's attacks are several high-profile organizations, such as Florida Health Dept., NTT Data, Patelco Credit Union, Rite Aid, Christie's auction house, McDowall and U.S. telecom provider Frontier Communications. RansomHub's affiliates utilize a double-extortion model to maximize their leverage over victims. This strategy involves both encrypting the victims' data and exfiltrating it, which is then used to coerce the victims into paying a ransom. The stolen data's exposure is threatened if the ransom demands are not met, which can lead to severe reputational damage and financial loss for the affected organizations. RansomHub's ransom notes typically do not specify an initial ransom demand or provide direct payment instructions. Instead, they guide victims to a unique .onion URL accessible via the Tor browser, where further negotiations and instructions are given. The timeline for ransom payment varies from three to ninety days, depending on the affiliate conducting the attack. Recommendations and Mitigations In response to the growing threat of RansomHub, the authoring organizations have outlined several critical mitigations for organizations to strengthen their cybersecurity posture. These recommendations align with the Cross-Sector Cybersecurity Performance Goals (CPGs) developed by CISA and the National Institute of Standards and Technology (NIST). Key mitigations include: Implement a Robust Data Recovery Plan: Organizations should maintain multiple copies of sensitive data in physically separate, secure locations to ensure recovery in the event of an attack. This step is crucial for minimizing downtime and data loss. Strengthen Password Policies: Accounts with password logins, particularly administrative accounts, should adhere to NIST standards for password management. This includes using complex passwords, avoiding password reuse, and employing hashed storage methods with added security measures such as “salts” for shared login credentials. Enforce Multi-Factor Authentication (MFA): Requiring phishing-resistant MFA for administrator accounts and standard MFA for all other accounts significantly reduces the risk of unauthorized access. This is especially important for services such as webmail, VPNs, and critical systems. Network Segmentation and Monitoring: Segmenting networks to control traffic flows and restrict adversary movement can prevent the spread of ransomware. Utilizing network monitoring tools to detect abnormal activity is also crucial for early detection and response. Regular Software Updates and Patching: Keeping all operating systems, software, and firmware up to date is one of the most cost-effective measures to protect against ransomware attacks. Prioritizing patches for known vulnerabilities in internet-facing systems is particularly important. Implement Secure Logging Practices: Organizations should follow best practices for logging to detect suspicious activity. This includes regularly reviewing domain controllers, servers, and workstations for any new or unrecognized accounts and auditing user accounts with administrative privileges. Maintain Offline Backups: Ensuring that backups are kept offline and regularly maintained helps organizations recover quickly after an attack. It’s essential that all backup data is encrypted and immutable to protect against alteration or deletion by ransomware actors. Call to Action for Software Manufacturers While the immediate focus is on enterprise mitigations, the joint advisory also calls upon software manufacturers to embed security throughout the software development lifecycle (SDLC). By implementing security measures like MFA by default, manufacturers can help reduce the prevalence of vulnerabilities that ransomware groups like RansomHub exploit. The advisory emphasizes the importance of continuous testing, exercising, and validating cybersecurity measures against threats mapped to the MITRE ATT&CK framework. This process helps organizations tune their security programs and ensure optimal performance against emerging threats.

Iranian APT Peach Sandstorm Deploys Custom Tickler Malware

cyberexpress Aug 30, 2024 Cybersecurity News

Researchers have uncovered a new wave of activity by the Iranian state-sponsored threat actor known as Peach Sandstorm. Between April and July 2024, the group deployed a custom multi-stage backdoor called Tickler in operations targeting the satellite, communications, oil and gas, and government sectors in the United show more ...

States and United Arab Emirates. Peach Sandstorm Operations and Iranian Association Peach Sandstorm, which Microsoft Threat Intelligence has assessed as operating on behalf of the Iranian Islamic Revolutionary Guard Corps (IRGC), has a history of using password spray attacks and LinkedIn-based intelligence gathering to target organizations in the higher education, satellite, and defense sectors. Between April and July 2024, the group deployed the Tickler backdoor, identified in two distinct samples by the researchers and was used to collect network information from compromised hosts and send it to attacker-controlled command-and-control (C2) servers. Peach Sandstorm has also been observed downloading additional payloads, including legitimate Windows binaries that could be used for DLL sideloading attacks. The researchers observed Peach Sandstorm had created fraudulent Azure subscriptions and resources to host this C2 infrastructure, such as Azure Students accounts. Tickler Malware Analysis The two identified samples of the Tickler malware were both 64-bit C/C++ based native PE files. The first sample was contained in an archive file alongside benign PDF documents used as decoys. Upon execution, the first Tickler variant performs process environment block (PEB) traversal to locate the in-memory address of the kernel32.dll library, which it then uses to collect network information from the host and send it to the C2 server. The second Tickler sample is a Trojan dropper that downloads additional payloads, including legitimate Windows binaries likely used for DLL sideloading, as well as a batch script that sets up persistence by adding a registry run key. These backdoor capabilities allow Peach Sandstorm to maintain access to compromised networks and carry out further malicious activities, such as lateral movement, data exfiltration, and deployment of additional tools. The company has taken action to disrupt this activity, including notifying affected organizations and shutting down the malicious Azure resources. Protecting Against Peach Sandstorm To help organizations defend against Peach Sandstorm's evolving tactics, the researchers recommend the following: Implement strong access controls, such as multi-factor authentication, to protect cloud and on-premises accounts. Monitor for suspicious activity, including password spray attacks and the use of compromised accounts to create cloud resources. Educate employees on social engineering threats, particularly those targeting the higher education, satellite, and defense sectors. Deploy threat protection solutions to detect and respond to potential Peach Sandstorm intrusions.

Telegram Founder’s Arrest Sparks Debate: Social Media, Freedom, and Russian Ties

cyberexpress Aug 30, 2024 Firewall Daily

The arrest of Pavel Durov, the founder and CEO of Telegram, on August 24, 2024, has ignited an international uproar with #FreeDurov and #OpDurov campaigns, focusing attention on the intersection of digital activism, social media governance, and freedom of speech. Durov’s apprehension, stemming from allegations that show more ...

Telegram has been utilized for illegal activities, has not only stirred global debates but also provoked a vigorous response from the hacktivist community. For these digital rebels, Durov represents more than a mere tech entrepreneur; he is the visionary behind two crucial platforms: Vkontakte, Russia's counterpart to Facebook, and the anonymous messaging app Telegram. The Role of Social Media in the #FreeDurov and #OpDurov Campaign Vkontakte, before being sold off by Durov, was a vital hub for communication and information exchange among Russian hacktivists. Its relatively lax stance on copyright enforcement made it a rich resource for illicit content and a key player in the hacktivist landscape. According to the latest Cyble's report, Telegram, Durov’s subsequent venture, continued this legacy by providing a secure platform for pro-Russian hacktivists to coordinate, share resources, and operate with minimal interference. Durov’s staunch support for privacy and free speech offered a conducive environment for hacktivist activities, making Telegram a haven for these groups. Durov's detention has brought together an unlikely coalition of supporters, including the Russian government, pro-Russian activists, and Russian opposition members in exile. Each group has expressed its discontent with the French authorities' decision, albeit in varied ways. The Russian government and opposition issued official statements, while pro-Russian hacktivists swiftly mobilized to launch the #FreeDurov and #OpDurov campaigns. The Emergence of #FreeDurov and #OpDurov Campaigns News of Pavel Durov’s arrest spread rapidly through Russian activist channels on Telegram, sparking immediate reactions from hacktivist groups. The Collective Response Intelligence Lab (CRIL) began tracking the responses and activities of prominent hacktivist groups, including: People’s Cyber Army UserSec CyberDragon EvilWeb Rootsploit CGPlnet Overflame ReconSploit RipperSec 62IX (supported the campaign without active participation) High Society (alliance) Holy League (alliance) UserSec was among the first to call for a collective response, urging other hacktivist groups to join the protest against France. [caption id="attachment_88545" align="alignnone" width="341"] On Sunday, UserSec called on other groups to join their attack on France (Source: Cyble)[/caption] The High Society and Holy League alliances amplified this call through their Telegram channels. By August 25, UserSec and the People’s Cyber Army had already launched attacks on the Court of Cassation and the Administrative Court of Paris. Escalation of Cyberattacks As the days progressed, the coordinated cyber attacks intensified. By August 26, Russian and pro-Russian hacktivist collectives such as Cyber Dragon, ReconSploit, Evilweb, Rootsploit, CGPlnet, and RipperSec joined forces, targeting various French websites and EU-affiliated organizations. [caption id="attachment_88547" align="alignnone" width="940"] Coordinated cyber-attacks by several hacktivist groups on French websites (Source: Cyble)[/caption] The following day, August 27, UserSec and the People’s Cyber Army claimed responsibility for attacks on the French financial giant AXA Group. They also targeted airports in Bayonne and Marseille-Provence, ferry services in Corsica, the French customs agency website, and the Agence Universitaire de la Francophonie (AUF). Despite initial claims of a massive cyber assault on the day of Durov’s court hearing, activities notably declined. However, on August 28, the People’s Cyber Army released a video claiming they had accessed the Industrial Control Systems (ICS) of a French dam, specifically targeting a power transmission control panel developed by ELEC-ENR at a wind farm in Brittany. Adding a layer of intrigue to the situation, a data leak surfaced in mid-August 2024, involving the Russian FSB Border Service database. This leak, discovered on a Telegram-based database leak channel, revealed sensitive information about individuals crossing Russia’s borders between 2014 and 2023, including Pavel Durov. The data contradicted Durov’s claims of severing ties with Russia, showing that he had traveled to Russia over 50 times since his emigration. Notably, he was present in Russia on the day Roskomnadzor lifted the ban on Telegram. The database, known as “Kordon 2023,” disappeared shortly after its appearance, raising questions about its origins and purpose.

Fota Wildlife Park Confirms Cyberattack, Investigates Data Exposure

cyberexpress Aug 30, 2024 Cybersecurity News

Fota Wildlife Park, one of Ireland's premier wildlife attractions, has fallen victim to a cyberattack that has potentially compromised the personal and financial information of its visitors. The Wildlife Park, renowned for its commitment to conservation and education, is now facing a different kind of show more ...

challenge—cybersecurity. Park announced that it is currently investigating a Fota Wildlife Park cyberattack that has targeted its online systems. In a statement released to the public, the park confirmed that it has notified the appropriate authorities and is fully cooperating with their ongoing investigation. "We are currently notifying impacted customers," reads the Fota Wildlife Park notice. Fota Wildlife Park Cyberattack Affected Transactions The cyberattack on Fota Wildlife Park specifically targeted online transactions made through the park's website. Fota Wildlife Park has informed its visitors that if they conducted any financial transactions on the park’s official website between 12 May 2024 and 27 August 2024, they should immediately contact their banks to cancel their credit or debit cards. The park reassured visitors that this incident only affects online transactions and does not involve any purchases made on-site during visits to the park. Visitors who used their financial details online during the specified period are urged to take precautionary measures to protect their financial information from potential misuse. The park is actively reaching out to affected customers to provide further guidance and support. [caption id="attachment_88595" align="aligncenter" width="1024"] Source: Fota Wildlife Park[/caption] Park Operations Continue Uninterrupted Despite the Fota Wildlife Park cyberattack, Park remains open to visitors. The park's management has confirmed that all in-person activities, including ticket purchases at the entrance, continue as usual. However, the park's official website is currently not operational due to the cyber incident. This temporary closure is part of the park's efforts to secure its digital infrastructure and prevent further unauthorized access. In the meantime, they encourage visitors to continue enjoying the wildlife experience in person, assuring them that their safety and the safety of the animals remain a top priority. Investigations and Response Fota Wildlife Park has taken swift action in response to the cyberattack. The park's team is working closely with cybersecurity experts and law enforcement agencies to investigate the breach and identify the perpetrators. The nature of the attack and the extent of the data compromised are still under investigation. However, Fota Wildlife Park has assured the public that they are doing everything possible to mitigate the impact of this incident and prevent future breaches. The Cyber Express Team has reached out to the authorities and Fota Wildlife Park for more detailed information regarding the cyberattack. However, as of the time of writing this news copy, no response has been received. The Cyber Express Team will keep its readers informed of any further developments regarding this incident. Stay tuned for updates as we learn more about the ongoing investigation and Fota Wildlife Park's efforts to address the situation and protect its visitors.

Durex India’s Security Lapse Reveals Personal Data of Customers

cyberexpress Aug 30, 2024 Cybersecurity News

Durex India, the local arm of the popular British condom and personal lubricants brand, has reportedly suffered a significant cyberattack that has exposed sensitive customer information online. The Durex India data breach reportedly involved a leak of sensitive customer data being accessible through an inadequately show more ...

secured order confirmation page on the Durex India website. The exposed information included full names, phone numbers, email addresses, shipping addresses, ordered items and payment details. The incident, discovered in late August 2024, raises concerns about data security practices and the potential consequences for consumers who shared their private details. Scope of Durex India Data Breach and Response Security researcher Sourajeet Majumder was the first to report this issue. on his X account. Majumder found that that over hundreds of customers were affected due to inefficient security measures on the brand’s order confirmation page. Although the exact number of customers affected and the duration of the vulnerability are still unknown, Majumder highlighted the gravity of the situation, given the intimate nature of the products involved. “A leak as such not only puts the customer's privacy at risk but also makes them prone to social harassment or moral policing,” he posted on X. [caption id="attachment_88605" align="alignnone" width="750"] Source: X[/caption] Following his discovery, Majumder shared that he reached out to India’s Computer Emergency Response Team (CERT-In) which acknowledged his email. If proven, the potential consequences of this data breach could be critical. Durex India should take appropriate measures to protect the privacy and security of the stakeholders involved. Data breaches of this nature can lead to identity theft, financial fraud, and a loss of trust among clients, potentially jeopardizing the company’s standing in the industry. As things stand, details regarding the extent of the Durex India data breach, data compromised, and the motive behind the cyber assault remain undisclosed. To ascertain the veracity of the data breach, The Cyber Express has reached out to the officials of Durex India and its parent company Reckitt. As of writing of this news report, no response has been received from Durex or Reckitt leaving the data breach claim unverified. Repercussions of Alleged Breach This kind of data leak can have serious repercussions for affected customers. Having personal details like names, addresses, and phone numbers exposed online can be a significant privacy violation. These details can be used for targeted marketing campaigns, spam calls, or even identity theft. In regions with conservative social norms surrounding sexual health, customers who purchased Durex products could be subjected to social stigma or embarrassment due to the exposed data. If payment information was also accessible, it could put customers at risk of fraudulent charges. The Durex India data breach highlights the importance of robust data security practices in the e-commerce industry. Businesses that collect sensitive customer information, especially personal details related to health and wellness, have a responsibility to ensure the highest levels of security. Practices like secure coding, data encryption, and regular security audits are crucial to prevent breaches and protect customer data. This incident also raises questions about data protection regulations in India. While the General Data Protection Regulation (GDPR) has been a driving force for data privacy in Europe, India is still in the process of finalizing its own comprehensive data protection framework. The potential effects of the exposed Durex India data on affected customers might highlight the need for stricter data security regulations in the country. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

Massive Mirai Botnet Exploited Zero-Day Vulnerability in AVTECH Cameras

cyberexpress Aug 30, 2024 Cybersecurity News

Researchers have discovered a botnet campaign that is exploiting several vulnerabilities, including a zero-day vulnerability (CVE-2024-7029) in AVTECH closed-circuit television (CCTV) cameras that could allow for remote code execution. CVE-2024-7029 has been known for five years but has only been assigned a CVE now, show more ...

showing the importance of monitoring even unassigned vulnerabilities. CVE-2024-7029 Flaw In AVTECH Cameras CVE-2024-7029 is a command injection vulnerability in the brightness function of AVTECH IP camera devices. This vulnerability allows an attacker to inject malicious code and execute it on a target system with elevated privileges. The botnet campaign spreads a Mirai variant with string names referencing the COVID-19 pandemic that began in 2020. CISA said in its advisory that the vulnerability is easily exploited, classifying it as 'Exploitable remotely/low attack complexity/public exploits are available/known public exploitation.' While the vulnerability was first observed in March 2024, analysis suggests that the threat actor has been active since December 2023. The proof of concept (PoC) for CVE-2024-7029 has been publicly available since 2019, but it did not receive a formal CVE assignment until August 2024. The researchers cite the campaign as an example of the weight of monitoring and reporting on threats, even if they have no formal CVE assignment, as an important precautionary measure. However, Akamai researchers clarified that the botnet campaign is not limited to just CVE-2024-7029, but also targets several other vulnerabilities, including several other AVTECH vulnerabilities, a Hadoop YARN RCE, CVE-2014-8361, and CVE-2017-17215. The tactic of using older, unpatched vulnerabilities remains a concerning but effective focus for botnet operators. Widespread Impact The CVE-2024-7029 vulnerability in AVTECH IP cameras affects up to and including AVM1203 firmware versions FullImg-1023-1007-1011-1009. The AVTECH CCTV devices affected by CVE-2024-7029 are still widely used, even though the models in question were discontinued years ago. These devices are found in various industries, including transportation authorities and other critical infrastructure entities. CISA recommends that users take defensive measures to minimize the risk of exploitation of this vulnerability, such as: Minimize the exposure of control system devices and/or systems to the network. Ensure they are not directly accessible from the internet, as this can increase the risk of unauthorized access. Isolate the control system networks and remote devices by placing them behind firewalls. This helps to segregate them from the business networks, reducing the potential attack surface. When remote access is necessary, use more secure methods, such as virtual private networks (VPNs). Recognize that VPNs may have their own vulnerabilities, so it is important to keep them updated to the most current version available. The exploitation of the CVE-2024-7029 Avtech vulnerability shows that vulnerabilities even without a formal CVE assignment may still pose a threat to your organization. There are many vulnerabilities with public exploits or available PoCs that lack formal CVE assignment, and, in some cases, the devices remain unpatched. If there is no way to remediate a threat, decommissioning the hardware and software is the recommended way to mitigate security risks and lower the risk of regulatory fines.

CISA Launches New Cyber Incident Reporting Portal for Easier Incident Reporting

cyberexpress Aug 30, 2024 Cybersecurity News

The Cybersecurity and Infrastructure Security Agency (CISA) announced the launch of its new CISA Services Portal, which includes an updated cyber incident reporting form. This move is part of CISA's ongoing efforts to enhance cyber incident reporting across the United States. As the nation's premier cyber show more ...

defense agency and the national coordinator for critical infrastructure security, CISA leads the effort to understand, manage, and reduce risks to the digital and physical infrastructure that Americans depend on every day. [caption id="attachment_88525" align="aligncenter" width="610"] Source: X[/caption] CISA Services Portal: A Secure and Enhanced Platform The new CISA Services Portal is a secure platform designed to make cyber incident reporting more efficient and accessible. One of the significant improvements in this new portal is its integration with login.gov credentials, providing a streamlined and secure login process for users. This enhancement ensures that the platform is both user-friendly and secure, maintaining high standards of data protection and privacy. The portal’s updated functionality offers several key features that simplify the reporting process. Users can now save and update their incident reports, a feature that was not available in the previous system. This allows organizations to provide ongoing updates about an incident without needing to start the reporting process from scratch. Additionally, the ability to share submitted reports with colleagues or clients is a new feature designed to facilitate third-party reporting, making it easier for organizations to collaborate with external partners and consultants. Another significant enhancement is the search and filter capabilities within the portal, enabling users to easily access and manage their reports. This functionality is particularly beneficial for organizations handling multiple incidents or those involved in managing cyber risk across several entities or departments. Collaboration and Communication A new feature of the portal is its collaboration tool, which allows users to engage in informal discussions with CISA. This tool is intended to foster a more dynamic exchange of information and insights between CISA and the organizations it serves. Through these informal discussions, organizations can receive guidance and share details that might help refine CISA's understanding of ongoing cyber threats and how best to respond to them. Jeff Greene, CISA’s Executive Assistant Director for Cybersecurity, highlighted the importance of this new platform in a statement: “Any organization experiencing a cyber attack or incident should report it – for its own benefit, and to help the broader community. CISA and our government partners have unique resources and tools to aid with response and recovery, but we can’t help if we don’t know about an incident. Sharing information allows us to work with our full breadth of partners so that the attackers can’t use the same techniques on other victims, and can provide insight into the scale of an adversary’s campaign. CISA is excited to make available our new portal with improved functionality and features for cyber reporting.” Voluntary Cyber Incident Reporting In conjunction with the launch of the new portal, CISA has also released a voluntary cyber incident reporting resource designed to guide organizations through the reporting process. This resource provides clear and concise information about who should report an incident, why and when reporting is critical, and what details should be included in a report. The aim is to encourage more organizations to proactively report cyber incidents, contributing to a more enhanced national defense against cyber threats. The voluntary reporting resource also offers several tools and guidelines to help organizations understand the impact of cyber incidents and how best to manage their response. By making these resources readily available, CISA hopes to reduce the overall cyber risk for organizations across various sectors. A Call to Action CISA is urging all organizations, regardless of size or industry, to take advantage of the new portal and the resources available to them. Voluntarily reporting cyber incidents not only benefits the reporting organization by enabling access to CISA’s support and resources, but it also contributes to the broader national effort to prevent cyberattacks. When organizations share information about incidents, they provide CISA and its partners with valuable data that can be used to protect other potential victims and enhance the overall resilience of the nation's digital infrastructure.

Cyberespionage Threat: APT-C-60 Targets East Asia with SpyGlace

cyberexpress Aug 30, 2024 Cybersecurity News

A sophisticated cyberespionage campaign targeting East Asian countries has been uncovered, with the APT-C-60 group exploiting a zero-day vulnerability in WPS Office to deploy the notorious SpyGlace backdoor. This incident highlights the ongoing threat posed by zero-day vulnerabilities and the importance of timely show more ...

patching for software users. Researchers at ESET discovered the campaign, which involved a carefully crafted attack chain. APT-C-60, a cyberespionage group believed to be linked to South Korea, leveraged a previously unknown vulnerability (zero-day) in WPS Office, a popular office suite application widely used in East Asia. The zero-day vulnerability, classified as CVE-2024-4167, resides in the WPS Office text rendering engine (ET Renderer). By exploiting this flaw, attackers could bypass security measures and execute arbitrary code on targeted systems. This granted APT-C-60 a foothold within the victim's network, allowing them to deploy the next stage of their attack. SpyGlace: Stealthy Backdoor for Espionage Following the successful exploitation of the zero-day vulnerability, APT-C-60 deployed the SpyGlace backdoor onto compromised systems. SpyGlace is a well-documented malware known for its stealthy data exfiltration capabilities. Once installed, it can gather sensitive information from the victim's machine, including: System information: Operating system details, hardware specifications, etc. User data: Documents, emails, browsing history, and other sensitive files. Network information: Network configuration details, potentially allowing lateral movement within the network. [caption id="attachment_88636" align="alignnone" width="728"] Source: Security Affairs[/caption] This stolen data can be used for various malicious purposes, such as: Corporate espionage: Stealing intellectual property and confidential business information. Targeted attacks: Gaining insights for future cyberattacks against the victim organization. Government surveillance: Gathering intelligence on targeted individuals or organizations. The deployment of SpyGlace indicates APT-C-60's intent to establish long-term persistence within compromised systems and conduct extensive espionage activities. WPS Office Users Urged to Update Immediately The discovery of this zero-day vulnerability and its exploitation by APT-C-60 underscores the critical need for users to prioritize software updates. Here's what users need to do: Update WPS Office: The developers of WPS Office have released a patch (version 11.2.0.10221) that addresses the CVE-2024-4167 vulnerability. All users are strongly advised to update their WPS Office installations to the latest patched version immediately. Enable automatic updates: Consider enabling automatic updates within the WPS Office settings to ensure you receive future security patches promptly. Maintain security awareness: Employees should be trained to identify suspicious emails and attachments, a common tactic used by attackers to distribute malware. Patching and Vigilance Are Key The APT-C-60 campaign exploiting the WPS Office zero-day serves as a stark reminder of the ever-evolving cyber threat landscape. Zero-day vulnerabilities are particularly dangerous because there's no known patch available at the time of exploitation. However, by staying vigilant and applying security updates promptly, organizations and individuals can significantly reduce their attack surface and mitigate the risks associated with such vulnerabilities. Beyond Patching: Additional Considerations While patching is crucial, it's not the only defense against sophisticated cyberattacks. Here are some additional security measures to consider: Deploy layered security: Implement a combination of security solutions, including antivirus, endpoint detection and response (EDR), and intrusion detection/prevention systems (IDS/IPS), to create a multi-layered defense. Segment your network: Segmenting your network can limit the attacker's ability to move laterally within the system if they gain initial access. Regular security assessments: Conduct regular security assessments to identify and address any vulnerabilities within your systems and infrastructure. By implementing these recommendations and staying informed about the latest cyber threats, organizations and individuals can better protect themselves from falling prey to sophisticated cyberespionage campaigns like the one orchestrated by APT-C-60.

NIST introduces first post-quantum encryption standards | Kaspersky official blog

kaspersky Aug 30, 2024 Business

After many years of research and testing, in mid-August 2023, the U.S. National Institute of Standards and Technology (NIST) finally introduced fully-fledged post-quantum encryption standards — FIPS 203, FIPS 204, and FIPS 205. So lets discuss them and see why they should be adopted as soon as possible. Why do we show more ...

need post-quantum cryptography? First, lets briefly outline the threat quantum computers pose to cryptography. The issue lies in the fact that quantum computing can be used to break asymmetric encryption. Why is this important? As a rule, todays communication encryption typically uses a dual system: All messages are encrypted using a symmetric algorithm (like AES), which involves a single key shared by all participants. Symmetric algorithms work well and fast, but theres a problem: the key must be somehow securely transmitted between interlocutors without being intercepted. Thats why asymmetric encryption is used to transmit this key (like RSA or ECDH). Here, each participant has a pair of keys — a private and a public one — which are mathematically related. Messages are encrypted with the public key, and decrypted only with the private one. Asymmetric encryption is slower, so its impractical to use it for all messages. The privacy of correspondence is ensured by the fact that calculating a private key from the corresponding public key is an extremely resource-intensive task — potentially taking decades, centuries, or even millions of years to solve. That is — if were using traditional computers. Quantum computers significantly speed up such calculations. Specifically, Shors quantum algorithm can crack private keys for asymmetrical encryption much faster than its creators expected — in minutes or hours rather than years and centuries. Once the private key for asymmetric encryption has been calculated, the symmetric key used to encrypt the main correspondence can also be obtained. Thus, the entire conversation can be read. In addition to communication protocols, this also puts digital signatures at risk. In the majority of cases, digital signatures rely on the same asymmetric encryption algorithms (RSA, ECDSA) that are vulnerable to attacks by quantum computers. Todays symmetric encryption algorithms, on the other hand, are much less at risk from quantum computers than asymmetric ones. For example, in the case of AES, finding a 256-bit key using Grovers quantum algorithm is like finding a 128-bit key on a regular computer. The same applies to hashing algorithms. The trio of post-quantum cryptography standards: FIPS 203, FIPS 204, and FIPS 205 The primary task for cryptographers has become the development of quantum-resistant asymmetric encryption algorithms, which could be used in key transfer and digital signature mechanisms. The result of this effort: the post-quantum encryption standards FIPS 203, FIPS 204, and FIPS 205, introduced by the U.S. National Institute of Standards and Technology (NIST). FIPS 203 FIPS 203 describes a key encapsulation mechanism based on lattice theory — ML-KEM (Module-Lattice-Based Key-Encapsulation Mechanism). This asymmetric cryptographic system — which is resistant to quantum algorithm attacks — is designed to transfer encryption keys between interlocutors. ML-KEM was developed as part of CRYSTALS (Cryptographic Suite for Algebraic Lattices) and is also known as CRYSTALS-Kyber, or simply Kyber. FIPS 203 features three parameter variants for ML-KEM: ML-KEM-512: Security level 1 (equivalent to AES-128); ML-KEM-768: Security level 3 (equivalent to AES-192); ML-KEM-1024: Security level 5 (equivalent to AES-256). FIPS 204 FIPS 204 defines a digital signature mechanism, also based on algebraic lattices, called ML-DSA (Module-Lattice-Based Digital Signature Algorithm). Previously known as CRYSTALS-Dilithium, this mechanism was developed within the same CRYSTALS project as Kyber. FIPS 204 has three parameter variants for ML-DSA: ML-DSA-44: Security level 2 (equivalent to SHA3-256); ML-DSA-65: Security level 3; ML-DSA-87: Security level 5. FIPS 205 The third standard, FIPS 205, describes an alternative digital signature mechanism: SLH-DSA (Stateless Hash-Based Digital Signature Algorithm). Unlike the other two cryptosystems, which are based on algebraic lattices, SLH-DSA is based on hashing. This mechanism is also known as SPHINCS+. This standard involves the use of both the SHA2 hash function with a fixed output length, as well as the SHAKE function with an arbitrary length. For each base cryptographic-strength level, SLH-DSA offers sets of parameters optimized for a higher speed (f — fast), or a smaller signature size (s — small). Thus, FIPS 205 has more variety — with as many as 12 parameter options: SLH-DSA-SHA2-128s, SLH-DSA-SHAKE-128s, SLH-DSA-SHA2-128f, SLH-DSA-SHAKE-128f: Security level 1; SLH-DSA-SHA2-192s, SLH-DSA-SHAKE-192s, SLH-DSA-SHA2-192f, SLH-DSA-SHAKE-192f: Security level 3; SLH-DSA-SHA2-256s, SLH-DSA-SHAKE-256s, SLH-DSA-SHA2-256f, SLH-DSA-SHAKE-256f: Security level 5. HNDL, and why its time to start using post-quantum encryption For now, the threat of quantum algorithms breaking asymmetric encryption is mostly theoretical. Existing quantum computers lack the power to actually do it in practice. Until last year, it was believed that sufficiently powerful quantum systems were still a decade away. However, a 2023 paper suggested ways to optimize hacking using a combination of classic and quantum computing. As a result, the timeline for achieving quantum supremacy seems to have shifted: RSA-2048 could very well be broken within a few years. Its also important to remember the concept of HNDL — harvest now, decrypt later (or SNDL — store now, decrypt later). Attackers with significant resources could already be collecting and storing data that cant currently be decrypted. Once quantum computers with sufficient power become available, theyll immediately begin retroactive decryption. Of course, when this fateful moment comes, it will already be too late, so quantum-resistant encryption standards should be implemented right now. The ideal approach to deploying post-quantum cryptography based on established IT industry practices is hybrid encryption; that is, encrypting data in two layers: first with a classical algorithm, then with a post-quantum one. This forces attackers to contend with both cryptosystems — significantly lowering the chances of a successful breach. This approach is already being used by Signal, Apple, Google, and Zoom.

Why Identity Teams Need to Start Reporting to the CISO

darkreading Aug 30, 2024 Feed

Identity management sits with IT for good reason, but now that identity is the common denominator in every attack, it's time identity security was owned by a leader with a security background, like the CISO.

'Voldemort' Malware Curses Orgs Using Global Tax Authorities

darkreading Aug 30, 2024 Feed

The global malware campaign (that must not be named?) is targeting organizations by impersonating tax authorities, and using custom tools like Google Sheets for command and control.

Commercial Spyware Vendors Have a Copycat in Top Russian APT

darkreading Aug 30, 2024 Feed

Russia's Midnight Blizzard infected Mongolian government websites to try to compromise the devices of visitors, using watering-hole tactics.

NASA Focuses on Cybersecurity of its Mission-Critical Software

darkreading Aug 30, 2024 Feed

The software verification and validation efforts helps NASA improve the safety and cost-effectiveness of its mission critical software. Cybersecurity is now part of the evaluation.

Buffer Overflow Flaw in TP-Link Routers Opens Door to RCE

cyware Aug 30, 2024 Malware and Vulnerabilities

A critical vulnerability, CVE-2024-42815, with a CVSS score of 9.8, has been discovered in TP-Link RE365 V1_180213 series routers, allowing for remote exploitation and potential takeover.

US Election-Themed Phishing Scams Rely on Fake Donation Sites

cyware Aug 30, 2024 Identity Theft, Fraud, Scams

The domain actsblue[.]com is posing as the legitimate actblue[.]com, a platform for Democratic Party donations. The malicious site is registered anonymously with Namecheap, making it difficult to trace back to the threat actors.

Manufacturing Sector Under Fire From Microsoft Credential Thieves

cyware Aug 30, 2024 Identity Theft, Fraud, Scams

The spear-phishing emails impersonate reputable companies like Periscope Holdings and R.S. Hughes, prompting victims to surrender their Microsoft credentials by clicking on a file attachment.

The NIS2 Directive: How Far Does it Reach?

cyware Aug 30, 2024 Expert Blogs and Opinion

Key aspects of the NIS2 Directive include a focus on proactive cybersecurity measures for entities within its scope, such as risk analysis, incident handling, and supply chain security.

PoorTry Windows Driver Deletes Crucial Files to Impairs Windows Computers

cyware Aug 30, 2024 Malware and Vulnerabilities

The PoorTry Windows driver, originally used to disable EDR solutions, has now evolved into an EDR wiper, deleting crucial files to make system restoration harder. Sophos has confirmed actual EDR wiping attacks in the wild.

California Passes Landmark Bill Requiring Easier Data Sharing Opt-Outs for Consumers

cyware Aug 30, 2024 Laws, Policy, Regulations

California has passed a landmark bill that requires internet browsers and mobile operating systems to make it easier for consumers to opt out of sharing their private data with websites for targeted advertising.

Philippines: Intel Fusion Center Eyed to Boost Cybersecurity

cyware Aug 30, 2024 Govt., Critical Infrastructure

The Department of Information and Communications Technology (DICT) is focusing on enhancing cybersecurity in the Philippines through the National CyberSecurity Plan (NCSP) 2023-2028.

Cisco Bolsters AI Security by Buying Robust Intelligence

cyware Aug 30, 2024 Companies to Watch

Cisco is strengthening its AI security by acquiring Robust Intelligence, a startup led by a former Harvard professor. This acquisition emphasizes the importance of AI security in modern IT infrastructure.

Unpatchable Zero-Day in Surveillance Cameras is Being Exploited to Install Mirai

cyware Aug 30, 2024 Malware and Vulnerabilities

The vulnerability, known as CVE-2024-7029, allows attackers to remotely execute commands on the compromised device. The targeted device is the AVM1203 surveillance camera from AVTECH.

LummaC2 Infostealer Resurfaces with Obfuscated PowerShell Tactics

cyware Aug 30, 2024 Malware and Vulnerabilities

The latest variant employs obfuscated PowerShell commands to download and execute malicious payloads, utilizing Windows binaries like Mshta.exe and Dllhost.exe for stealth.

New Tickler Malware Used to Backdoor US Government, Defense Organizations

cyware Aug 30, 2024 Malware and Vulnerabilities

APT33 used the new Tickler malware to infiltrate government and defense organizations in the US and the UAE. The group, known as Peach Sandstorm and Refined Kitten, is linked to the Iranian Revolutionary Guard Corps.

Third-Party Risk Management is Under the Spotlight

cyware Aug 30, 2024 Trends, Reports, Analysis

Third-party risk management is a critical issue in the wake of the CrowdStrike IT outage, revealing vulnerabilities within financial institutions related to supply chain resilience, especially in vital sectors like financial services.

UK Labour Party Reprimanded Over Cyberattack Backlog by Privacy Regulator

cyware Aug 30, 2024 Incident Response, Learnings

More than 150 people filed complaints to the Information Commissioner’s Office (ICO) regarding the delay in responding to subject access requests (SARs) after the cyberattack in October 2021.

Report: Ransomware Attacks on US Schools and Colleges Cost $9.45 Billion

cyware Aug 30, 2024 Trends, Reports, Analysis

Over the last few years, ransomware attacks have become a major concern for schools and colleges in the US, with an average of $500,000 being lost per day due to downtime from these attacks, according to Comparitech.

Integrity360 Expands to South Africa with Grove Acquisition

cyware Aug 30, 2024 Companies to Watch

Grove Group, a cybersecurity and cloud services company based in Cape Town, brings around 600 customers across 51 countries to Integrity360. This acquisition will also enhance Integrity360's security operations center (SOC) business.

US Offers $2.5 Million Reward for Hacker Linked to Angler Exploit Kit

cyware Aug 30, 2024 Incident Response, Learnings

The U.S. Department of State and the Secret Service are offering a reward of $2.5 million for information leading to the capture of Belarusian cybercriminal Volodymyr Kadariya, who is linked to the Angler Exploit Kit.

Cybercriminals Capitalize on Travel Industry’s Peak Season

cyware Aug 30, 2024 Trends, Reports, Analysis

Cequence Security found that cyberattacks against the travel industry surge during holidays, with 91% of severe vulnerabilities in the top 10 travel and hospitality sites enabling man-in-the-middle attacks.

‘Store Now, Decrypt Later’: US Leaders Prep for Quantum Cryptography Concerns

cyware Aug 30, 2024 Trends, Reports, Analysis

U.S. cybersecurity leaders are focusing on preparing for the potential risks posed by quantum cryptography tools that could threaten critical infrastructure and national security.

Employee Arrested for Locking Windows Admins Out of 254 Servers in Extortion Plot

cyware Aug 30, 2024 Incident Response, Learnings

The FBI investigation revealed that the suspect, Daniel Rhyne, had accessed the company's systems without authorization and changed passwords for various accounts. Rhyne's actions were intended to deny the company access to its systems and data.

Tired Of Airport Security Queues? SQL Inject Yourself Into The Cockpit, Claims Reseachers

packetstormsecurity Aug 30, 2024 headline,hacker,flaw,terror

US Government Issues Advisory On Ransomware Group Blamed For Halliburton Cyberattack

packetstormsecurity Aug 30, 2024 headline,hacker,malware,usa,cybercrime,d

Commercial Spyware Vendors, State Hackers Share Exploits

packetstormsecurity Aug 30, 2024 headline,government,privacy,malware,phon

Duo Busted For Swatting Spree That Targeted Election Officials

packetstormsecurity Aug 30, 2024 headline,government,usa,fraud