Latest Cybersecurity News and Articles

---

FakeCalls Vishing Malware Targets South Korean Users via Popular Financial Apps

An Android voice phishing (aka vishing) malware campaign known as FakeCalls has reared its head once again to target South Korean users under the guise of over 20 popular financial apps. "FakeCalls malware possesses the functionality of a Swiss army knife, able not only to conduct its primary aim but also to extract private data from the victim's device," cybersecurity firm Check Point said.

---

China-based Tick APT Deploys Custom Malware and Use Other Tools

ESET researchers found that the Tick cyberespionage group compromised an East Asian Data-Loss Prevention (DLP) company in 2021 and used a wide range of tools in similar attacks. In one of its campaigns, it used a tampered version of a legitimate app called Q-Dir to drop an open-source VBScript backdoor named ReVBShell.

---

Is Russia regrouping for renewed cyberwar?

As of late November 2022, Microsoft and other security firms identified a new form of ransomware, called “Sullivan”, deployed against Ukrainian targets, in addition to the “Prestige” ransomware Russia deployed in Ukraine and Poland in October 2022.

---

SVB account holders targeted with phishing, scams

After news broke late last week about Silicon Valley Bank’s bank run and collapse, security researchers started warning SVB account holders about incoming SVB-related scams and phishing attempts.

---

Why is TikTok banned from government phones – and should rest of us be worried?

UK has removed app over concerns data can be monitored by Chinese state, but public remain vulnerableTikTok is wildly popular, with more than 1 billion people consuming its short video posts around the world. But the app is less favoured by politicians in key markets such as the US and UK, where it has been banned from government-issued phones over security fears. We answer your questions about why TikTok has become a lightning rod for suspicion of Chinese state espionage – and whether nationwide bans are likely. Continue reading...

---

Microsoft shares script to fix WinRE BitLocker bypass flaw

This PowerShell script (KB5025175) simplifies the process of securing WinRE images against attempts to exploit the CVE-2022-41099 flaw that enables attackers to bypass the BitLocker Device Encryption feature system storage devices.

---

Cryptojacking Group TeamTNT Suspected of Using Decoy Miner to Conceal Data Exfiltration

The cryptojacking group known as TeamTNT is suspected to be behind a previously undiscovered strain of malware used to mine Monero cryptocurrency on compromised systems, according to Cado Security.

---

Will AI replace humans in phishing attacks?

Recent research from Hoxhunt analyzed effectiveness of ChatGPT-generated phishing attacks showing people are still better at deceiving other people.

---

Data Breach at Tuscaloosa's NorthStar Paramedic Services Could Impact 82,000 Patients

On Tuesday, NorthStar Emergency Paramedic Services took to its website to report the problem and mailed physical letters to patients who may have been impacted by the breach. The company said they became aware of the potential intrusion in September.

---

Meta Develops New Kill Chain Thesis

The Meta approach starts from the assumption that despite the asynchronous nature of attacks, there are still meaningful commonalities, especially where those commonalities can be abstracted from the platform or hardware being attacked.

---

Trojanized WhatsApp and Telegram Apps Go After Victims' Cryptocurrency Wallets

Threat actors are going after victims’ cryptocurrency funds using trojanized Telegram and WhatsApp applications for Android and Windows. The malware can switch cryptocurrency wallet addresses sent in chat messages with attackers' wallet addresses.

---

Senators write letter to CISA over drone manufacturer concerns

A group of senators led a bipartisan effort to urge CISA to assess the potential national security risks associated with a drone manufacturer.

---

BEC Volumes Double on Phishing Surge

The number of business email compromise (BEC) incidents doubled last year and replaced ransomware as the most prolific cybercrime category, according to Secureworks. Ransomware detections reportedly declined by 57%.

---

BianLian Ransomware Gang Evolves to Purely Focus on Data Extortion

The most notable shift observed in BianLian attacks recently is its move away from ransoming encrypted files, and towards data-leak extortion as a means to extract payments from victims.

---

What is Reverse Tabnabbing and What Can You Do to Stop It?

Tabnabbing is a phishing method in which attackers take advantage of victims’ unattended browser tabs. With reverse tabnabbing, on the other hand, attackers can actually rewrite the source page after a victim clicks a malicious link.

---

Cryptocurrency Exchange Fiatusdt Exposed Sensitive Customer KYC Records, Wallet Addresses Online

The exposed database contained users' sensitive information, including screenshots of "Chat Messages" showing deposits and withdrawal amounts, KYC compliance records, identification images, transaction hashes, and wallet addresses.

---

Why Security Practitioners Should Understand Their Business

The sooner security practitioners become proactive in understanding the business side of their organizations, and the industry overall, the better they will be able to do their jobs and build the innovations that change the industry for the better.

---

Chinese and Russian Hackers Using SILKLOADER Malware to Evade Detection

SILKLOADER joins other loaders such as KoboldLoader, MagnetLoader, and LithiumLoader that have been recently discovered incorporating Cobalt Strike components. It also shares overlaps with LithiumLoader in that both employ the DLL sideloading method.

---

THN Webinar: 3 Research-Backed Ways to Secure Your Identity Perimeter

Think of the typical portrayal of a cyberattack. Bad guy pounding furiously on a keyboard, his eyes peeking out from under a dark hoodie. At long last, his efforts pay off and he hits the right combination of keys. "I'm in!" he shouts in triumph. Clearly, there are many problems with this scenario – and it's not just the hoodie. What's even more inaccurate is that most cyber attackers today do

---

New GoLang-Based HinataBot Exploiting Router and Server Flaws for DDoS Attacks

A new Golang-based botnet dubbed HinataBot has been observed to leverage known flaws to compromise routers and servers and use them to stage distributed denial-of-service (DDoS) attacks. "The malware binaries appear to have been named by the malware author after a character from the popular anime series, Naruto, with file name structures such as 'Hinata--,'" Akamai said in a