Latest Cybersecurity News and Articles

---

Xenomorph Android Banking Trojan Returns with a New and More Powerful Variant

A new variant of the Android banking trojan named Xenomorph has surfaced in the wild, the latest findings from ThreatFabric reveal. Named "Xenomorph 3rd generation" by the Hadoken Security Group, the threat actor behind the operation, the updated version comes with new features that allow it to perform financial fraud in a seamless manner. "This new version of the malware adds many new

---

Vulnerability Exposes Cisco Enterprise Routers to Disruptive Attacks

Tracked as CVE-2023-20049 (CVSS score of 8.6), the vulnerability impacts the bidirectional forwarding detection (BFD) hardware offload feature for the platform and can be exploited remotely, without authentication.

---

Data protection vendor Acronis admits to data leak

The CISO of Swiss cybersecurity firm Acronis has acknowledged a breach of the company’s systems but stated the incident only impacted a single customer and that all other data remains safe.

---

Dozens of Exploited Vulnerabilities Missing From CISA ‘Must Patch’ List

Of the vulnerabilities that VulnCheck believes have been exploited in attacks but have not been added to CISA’s KEV catalog, 64% are related to botnets, followed by threat actors (12%) and ransomware (10%) — the rest are unattributed.

---

Virginia city claimed to be attacked by BianLian ransomware

BianLian noted in a post on its data leak site that it was able to exfiltrate 350GB worth of data from Waynesboro's network, including file server data and public relations documents, as well as internal police station file server files.

---

North Korean UNC2970 Hackers Expands Operations with New Malware Families

A North Korean espionage group tracked as UNC2970 has been observed employing previously undocumented malware families as part of a spear-phishing campaign targeting U.S. and European media and technology organizations since June 2022. Google-owned Mandiant said the threat cluster shares "multiple overlaps" with a long-running operation dubbed "Dream Job" that employs job recruitment lures in

---

OneNote Used as New Distribution Channel for Qakbot Malware

Researchers observed a notable spike in emails utilizing malicious OneNote attachments, especially to drop Qakbot or QBot. Operators have apparently reorganized its infrastructure to target specific regions and industries.

---

Who’s Behind the NetWire Remote Access Trojan?

A Croatian national has been arrested for allegedly operating NetWire, a Remote Access Trojan (RAT) marketed on cybercrime forums since 2012 as a stealthy way to spy on infected systems and siphon passwords. The arrest coincided with a seizure of the NetWire sales website by the U.S. Federal Bureau of Investigation (FBI). While the defendant in this case hasn’t yet been named publicly, the NetWire website has been leaking information about the likely true identity and location of its owner for the past 11 years.

---

EPA stresses the need for improved water cybersecurity

The EPA is stressing the need to improve the cybersecurity of drinking water systems to better defend critical infrastructure from cyberattacks.

---

Beware! AI Generates a Truly Polymorphic Malware BlackMamba

A BlackMamba proof-of-concept attack was demonstrated by researchers. The technology on which ChatGPT is built, the large language model (LLM), was used to create a polymorphic keylogger functionality on the fly. The malware was tested against a renowned EDR system and resulted in absolutely no alerts or detections.

---

Iran-linked hackers used fake Atlantic Council-affiliated persona to target human rights researchers

It’s not clear if this particular persona’s efforts resulted in any successful phishing attacks. The Twitter account, created in October 2022, remains active. An Instagram account associated with the name is unavailable.

---

Researchers Uncover Email Threats From Exotic Lily

Exotic Lily is an initial access broker who specializes in gathering credentials from high-value targets through employee impersonation, deep open-source intelligence (OSINT), and by creating convincing malicious documents.

---

Russian TA499 Targets North American and European Countries

Russia-linked TA499 threat actor has been aggressively conducting email campaigns to target high-profile European and North American government authorities and CEOs of reputable organizations. The attack begins with an email or phone call, masquerading as prominent political figures. The phone call recordings are then released to the public via YouTube and RuTube.

---

Hackers Exploiting Remote Desktop Software Flaws to Deploy PlugX Malware

In the attacks observed by ASEC, successful exploitation of the flaws is followed by the execution of a PowerShell command that retrieves an executable and a DLL file from a remote server.

---

Threat vectors converging, increasing damage

The threat intelligence vendor Flashpoint warned that threat actors are increasingly combining known vulnerabilities, stolen credentials, and exposed data to wreak maximum damage.

---

China-Linked UNC4540 Hackers Infect Unpatched SonicWall Appliances With Info-Stealer

Suspected Chinese cybercriminals have zeroed in on unpatched SonicWall gateways and are infecting the devices with credential-stealing malware that persists through firmware upgrades, according to Mandiant.

---

Anti-theft software solution developed for Hyundai and Kia users

Theft deterrent software has been developed by Hyundai and Kia following online videos detailing how to start and steal the vehicles without a key.

---

Cado Security Banks $20M in Series B Funding

The London-based company said Series B financing was led by Eurazeo, a French investment and asset management firm. Ten Eleven Ventures, a prior backer, also expanded its equity stake.

---

Bitwarden flaw can let hackers steal passwords using iframes

Bitwarden's credentials autofill feature contains a risky behavior that could allow malicious iframes embedded in trusted websites to steal people's credentials and send them to an attacker.

---

Empowering women in cyber security: A CEO’s perspectives

Meet the founder and CEO of ReynCon, Connie Matthews Reynolds. With more than two decades of experience in the cyber security industry, she has received much recognition for her work. As a founding member of EmpoWE-R Women of InfoSec, she encourages women and minorities to consider careers in cyber security and lives by the motto […] The post Empowering women in cyber security: A CEO’s perspectives appeared first on CyberTalk.