Latest Cybersecurity News and Articles

---

Wawa to pay up to $28.5M in data breach settlement

Convenience retailer Wawa has committed to pay up to $28.5 million to settle negligence claims stemming from a data breach that occurred in 2019, according to filings made in the U.S District Court, Eastern District of Pennsylvania.

---

UK: ICO Reprimands Metropolitan Police for Data Snafu

The UK’s data protection regulator has reprimanded the country’s largest police service for failing to properly maintain records on organized crime groups (OGCs), resulting in inaccurate information being stored on a key database.

---

Infamous BreachForums Mastermind 'Pompompurin' Arrested in New York

According to an affidavit filed by the Federal Bureau of Investigation (FBI), the suspect identified himself as Conor Brian Fitzpatrick and admitted to being the owner of the BreachForums website.

---

Emotet malware now distributed in Microsoft OneNote files to evade defenses

While Emotet was one of the most distributed malware in the past, over the past year, it would stop and start in spurts, ultimately taking a break towards the end of 2022.

---

Telerik Vulnerability Abused by Threat Actors - Warns CISA

Multiple threat groups were found abusing CVE-2023-26360, a high-severity three-year-old bug, in Progress Telerik to infiltrate an unnamed federal entity in the U.S. The successful exploitation of the bug allowed threat actors to remotely execute arbitrary code on an FCEB agency's Microsoft Internet Information Services (IIS) web server.

---

New Go-Based HinataBot Abuses Old Vulnerabilities for DDoS Attacks

HinataBot is the latest in the ever-growing list of emerging Go-based threats abusing old vulnerabilities and weak credentials and could launch massive 3.3 Tbps DDoS attacks. The threat actors behind HinataBot were originally distributing Mirai binaries before they began developing their own botnet in mid-January. Organizations are advised to update the firmware of the affected products. 

---

Emotet Rises Again: Evades Macro Security via OneNote Attachments

The notorious Emotet malware, in its return after a short hiatus, is now being distributed via Microsoft OneNote email attachments in an attempt to bypass macro-based security restrictions and compromise systems. Emotet, linked to a threat actor tracked as Gold Crestwood, Mummy Spider, or TA542, continues to be a potent and resilient threat despite attempts by law enforcement to take it down. A 

---

BBC urges staff to delete TikTok from company mobile phones

Move comes after UK government bans app on government devices over fears of data being accessed by Chinese stateThe BBC has urged its staff to delete the Chinese-own social media app TikTok from corporate mobile phones.Guidance to BBC staff circulated on Sunday said: “We don’t recommend installing TikTok on a BBC corporate device unless there is a justified business reason. If you do not need TikTok for business reasons, TikTok should be deleted.” Continue reading...

---

Actively Exploited Microsoft Outlook Vulnerability Imperils Microsoft 365 Apps

Discovered in or around the beginning of March, the Microsoft Outlook vulnerability was found to affect several applications from the Microsoft 365 Apps Enterprise stack, including MS Office 2019, 2016, 2013, and LTSC.

---

QBot Laying the Foundations for Black Basta Ransomware Activity

The attacker’s actions had the whiff of a Black Basta affiliate, with Qbot activity widely reported as being a cornerstone of Black Basta intrusions. Black Basta is a splinter group that emerged after the “Conti” ransomware syndicate was quelled.

---

Hitachi Energy breached by Clop gang through GoAnywhere Zero-Day exploitation

Hitachi Energy immediately launched an investigation into the incident and disconnected the compromised system. The company reported the data breach to law enforcement agencies and data protection watchdog.

---

Chinese Hackers Exploit Fortinet Zero-Day Flaw for Cyber Espionage Attack

The zero-day exploitation of a now-patched medium-security flaw in the Fortinet FortiOS operating system has been linked to a suspected Chinese hacking group. Threat intelligence firm Mandiant, which made the attribution, said the activity cluster is part of a broader campaign designed to deploy backdoors onto Fortinet and VMware solutions and maintain persistent access to victim environments.

---

US Government Warns Organizations of LockBit 3.0 Ransomware Attacks

Also referred to as LockBit Black, LockBit 3.0 has a more modular architecture compared to its previous variants, and supports various arguments that modify its behavior after deployment.

---

Chinese Hackers Targeting Security and Network Appliances With Custom Backdoors

Chinese hackers exploited a critical Fortinet bug and used custom networking malware to steal credentials and maintain network access, according to Mandiant. Victims include defense, telecom, and technology firms, as well as government agencies.

---

New GoLang-Based HinataBot Exploiting Router and Server Flaws for DDoS Attacks

"The malware binaries appear to have been named by the malware author after a character from the popular anime series, Naruto, with file name structures such as 'Hinata--,'" Akamai said in a technical report.

---

Bee-Ware of Trigona, An Emerging Ransomware Strain

By analyzing Trigona ransomware binaries and ransom notes from VirusTotal, as well as information from incident response, Unit 42 determined that Trigona was very active during December 2022, with at least 15 potential victims being compromised.

---

Pompompurin Unmasked: Infamous BreachForums Mastermind Arrested in New York

U.S. law enforcement authorities have arrested a New York man in connection with running the infamous BreachForums hacking forum under the online alias "Pompompurin." The development, first reported by Bloomberg Law, comes after News 12 Westchester, earlier this week, said that federal investigators "spent hours inside and outside of a home in Peekskill." "At one point, investigators were seen

---

LockBit 3.0 Ransomware: Inside the Cyberthreat That's Costing Millions

U.S. government agencies have released a joint cybersecurity advisory detailing the indicators of compromise (IoCs) and tactics, techniques, and procedures (TTPs) associated with the notorious LockBit 3.0 ransomware. "The LockBit 3.0 ransomware operations function as a Ransomware-as-a-Service (RaaS) model and is a continuation of previous versions of the ransomware, LockBit 2.0, and LockBit,"

---

Feds Charge NY Man as BreachForums Boss “Pompompurin”

The U.S. Federal Bureau of Investigation (FBI) this week arrested a New York man on suspicion of running BreachForums, a popular English-language cybercrime forum where some of the world biggest hacked databases routinely first show up for sale. The forum's administrator "Pompompurin" has been a thorn in the side of the FBI for years, and BreachForums is widely considered a reincarnation of RaidForums, a remarkably similar crime forum that the FBI infiltrated and dismantled in 2022.

---

2023 Power 100 honorees highlight women’s leadership in tech

EXECUTIVE SUMMARY: In a world that’s constantly changing, it’s important to recognize those who are making an impact in their field. That’s why it’s so exciting to hear that Rupal Hollenbeck and Nisha Holt have been named 2023 Power 100 honorees. These two women are at the forefront of the security industry, and their contributions […] The post 2023 Power 100 honorees highlight women’s leadership in tech appeared first on CyberTalk.