Latest Cybersecurity News and Articles

---

Update: Ransomware gang leaks data stolen from City of Oakland

The Play ransomware gang has begun to leak data from the City of Oakland, California. The initial data leak consists of a 10GB multi-part RAR archive allegedly containing confidential documents, employee information, passports, and IDs.

---

Shein's Android App Caught Transmitting Clipboard Data to Remote Servers

An older version of Shein's Android application suffered from a bug that periodically captured and transmitted clipboard contents to a remote server. The Microsoft 365 Defender Research Team said it discovered the problem in version 7.9.2 of the app that was released on December 16, 2021. The issue has since been addressed as of May 2022. Shein, originally named ZZKKO, is a Chinese online fast

---

LastPass Hack: Engineer's Failure to Update Plex Software Led to Massive Data Breach

The massive breach at LastPass was the result of one of its engineers failing to update Plex on their home computer, in what's a sobering reminder of the dangers of failing to keep software up-to-date. The embattled password management service last week revealed how unidentified actors leveraged information stolen from an earlier incident that took place prior to August 12, 2022, along with

---

The evolving sophistication of social engineering attacks

By Anas Baig, product manager and cyber security expert with Securiti. A social engineering attack is a type of cyber attack in which a threat actor attempts to manipulate people into performing certain actions or divulging confidential information, such as passwords and credit card details. These attacks often target unsuspecting users who do not realize […] The post The evolving sophistication of social engineering attacks appeared first on CyberTalk.

---

After Clasiopa, APT41 Targets Asian Materials Sector

Symantec warned against the Chinese state-sponsored Winnti, aka APT41 and Blackfly, hacker group targeting two subsidiaries of an Asian conglomerate in the materials sector. The operation ran from late 2022 to early 2023, with a focus on intellectual property theft. Symantec has provided IOCs to detect and mitigate any threat due to the malicious activity of the Blackfly group.

---

Digital Smoke: Massive Investment Fraud Scam

Resecurity identified Digital Smoke, one of the largest investment scam networks, that has been defrauding netizens mostly from Europe, Asia, and Australia. The attackers impersonate Fortune 100 firms from the U.S. and the U.K. Most of the fraudulent schemes pertained to financial services, EV and EV batteries, oil & gas, renewable energy, healthcare, semiconductors, as well as internationally renowned investment corporations and funds with global footprint.

---

Multi-Year Spearphihing Campaign Against Maritime Industry

EclecticIQ has revealed that a single connected threat cluster is most likely behind an attack campaign targeting the maritime industry with spearphishing emails to distribute different malware threats. In July 2022, the campaign shifted from Agent Tesla to Formbook using CAB file attachments. However, there’s not much clarity on why the cluster changed its tooling.

---

CISA red-teamed a ‘large critical infrastructure’ organization, no one noticed

EXECUTIVE SUMMARY: In recent years, protecting critical infrastructure entities has been synonymous with ensuring the continued operations of governments and economies. In the United States, a CISA Red Team was recently granted permission to conduct a stealthy three-month attack on a critical infrastructure organization to assess the group’s cyber security posture. The Red Team gained […] The post CISA red-teamed a ‘large critical infrastructure’ organization, no one noticed appeared first on CyberTalk.

---

LockBit Introduces New Method to Bypass MOTW Protection

Researchers uncovered a new LockBit ransomware campaign last December and January using a novel technique involving the use of a .img container to bypass the Mark of The Web (MOTW) protection mechanism. LockBit remained one of the most active ransomware families in successful RaaS and extortion attacks for the second and third quarters of 2022.

---

New Feature-Rich Post-Exploitation Tool 'Exfiltrator-22' Linked With LockBit

Hackers in the underground marketplace have introduced a new Exfiltrator-22, or EX-22, post-exploitation framework. According to the CYFIRMA team, LockBit 3.0 affiliates or its members are most probably behind its development. The developers have used the same C2 infrastructure previously exposed in a LockBit 3.0 sample. In the latest instance, criminals displayed lateral movement and ransomware-spreading capabilities.

---

Vulnerabilities of years past haunt organizations, aid attackers

According to a Tenable report, the number one group of most frequently exploited vulnerabilities represents a large pool of known vulnerabilities, some of which were originally disclosed as far back as 2017.

---

RIG EK Achieves Lifetime High Success Rate with Old IE Bugs

RIG EK continues to make its mark as a successful exploit kit as it attempted to make roughly 2,000 intrusions daily, with the highest attack success rate of its lifetime of 30%. By exploiting relatively old Internet Explorer vulnerabilities, the exploit kit has been seen distributing various types of malware such as Dridex, SmokeLoader, and Raccoon Stealer. 

---

Tracking device technology: A double-edged sword for CISOs

Tracking devices are a boon to organizations with vast logistical operations and anyone who has ever lost a set of car keys. But trackers can also be a nightmare for cybersecurity, opening up a whole new world of opportunity for intruders.

---

Attackers are developing and deploying exploits faster than ever

While there was a reduction in the widespread exploitation of new vulnerabilities in 2022, the risk remains significant as broad and opportunistic attacks continue to pose a threat, according to Rapid7.

---

Keith Anderson named CISO at JetBlue

Keith Anderson has been named CISO at JetBlue. Anderson will work to ensure the company’s data, systems and other assets remain protected.

---

Municipal CISOs grapple with challenges as cyber threats soar

Municipal CISOs grapple with challenges as they become targets for nation-state threat actors, cope with regulations, and pursue funding from resource-constrained governments.

---

DrayTek VPN routers hacked with new malware to steal data, evade detection

The new hacking campaign, which started in July 2022 and is still ongoing, relies on three components: a malicious bash script, a malware named "HiatusRAT," and the legitimate 'tcpdump,' used to capture network traffic flowing over the router.

---

Cloud exploitation grew by 95% in 2022

A global threat report analyzed the trends and behaviors of recent cyberattacks finding that attacks had increased in both number and complexity. 

---

557 CVEs Added to CISA’s Known Exploited Vulnerabilities Catalog in 2022

There were 311 vulnerabilities in the catalog at the beginning of 2022 and it reached 868 by the end of the year. On average, more than ten exploited flaws were added to the KEV list every week in 2022.

---

Check Point CEO talks emerging cyber threats & advancement strategies (2023)

EXECUTIVE SUMMARY: In this edited interview excerpt from CRN, a media brand of The Channel Company, Check Point CEO Gil Shwed discusses emerging cyber threats, corporate technological advancement strategies, and Check Point’s innovation around security products. Don’t miss this. And if you like what you read, please be sure to read the full interview. What is […] The post Check Point CEO talks emerging cyber threats & advancement strategies (2023) appeared first on CyberTalk.