Latest Cybersecurity News and Articles

---

Turning Jenkins Into a Cryptomining Machine From an Attacker's Perspective

Attackers can leverage the Jenkins Script Console to execute malicious Groovy scripts, leading to cybercriminal activities such as the deployment of cryptocurrency miners.

---

As Cyber Command Evolves, Its Novel Malware Alert System Fades Away

The shift away from public disclosure on Twitter is part of an evolution in how the CNMF communicates cyber threat information. The command now focuses on working closely with industry partners to share information effectively and efficiently.

---

CISA adds Cisco NX-OS Command Injection bug to its Known Exploited Vulnerabilities catalog

The flaw allows an attacker to execute arbitrary commands as root on the affected device's operating system. Only attackers with administrator credentials can successfully exploit this vulnerability.

---

Cybersecurity Agencies Warn of China-linked APT40's Rapid Exploit Adaptation

Cybersecurity agencies from Australia, Canada, Germany, Japan, New Zealand, South Korea, the U.K., and the U.S. have released a joint advisory about a China-linked cyber espionage group called APT40, warning about its ability to co-opt exploits for newly disclosed security flaws within hours or days of public release. "APT 40 has previously targeted organizations in various countries, including

---

Trojanized jQuery Packages Found on npm, GitHub, and jsDelivr Code Repositories

Unknown threat actors have been found propagating trojanized versions of jQuery on npm, GitHub, and jsDelivr in what appears to be an instance of a "complex and persistent" supply chain attack. "This attack stands out due to the high variability across packages," Phylum said in an analysis published last week. "The attacker has cleverly hidden the malware in the seldom-used 'end' function of

---

New APT Group "CloudSorcerer" Targets Russian Government Entities

A previously undocumented advanced persistent threat (APT) group dubbed CloudSorcerer has been observed targeting Russian government entities by leveraging cloud services for command-and-control (C2) and data exfiltration. Cybersecurity firm Kaspersky, which discovered the activity in May 2024, the tradecraft adopted by the threat actor bears similarities with that of CloudWizard, but pointed

---

Patelco announces ransomware attack

Patelco Credit Union announced that on June 29, 2024, the company faced a ransomware attack. Hackers gained access to its systems and blocked access.

---

Dark Web Malware Logs Expose 3,300 Users Linked to Child Abuse Sites

An analysis of information-stealing malware logs published on the dark web has led to the discovery of thousands of consumers of child sexual abuse material (CSAM), indicating how such information could be used to combat serious crimes. "Approximately 3,300 unique users were found with accounts on known CSAM sources," Recorded Future said in a proof-of-concept (PoC) report published last week. "

---

Indian Government Issues Serious Warning on Phishing Scams Alleging Sexual Offenses

The emails falsely accuse recipients of sexual offences, using names and seals of authorities to appear authentic. Citizens are advised not to respond to such emails and report them to authorities.

---

New Ransomware-as-a-Service 'Eldorado' Targets Windows and Linux Systems

An emerging ransomware-as-a-service (RaaS) operation called Eldorado comes with locker variants to encrypt files on Windows and Linux systems. Eldorado first appeared on March 16, 2024, when an advertisement for the affiliate program was posted on the ransomware forum RAMP, Singapore-headquartered Group-IB said. The cybersecurity firm, which infiltrated the ransomware group, noted that its

---

Decryptor for DoNex, Muse, DarkRace, (fake) LockBit 3.0 Ransomware Released

Avast researchers have identified a cryptographic weakness in the DoNex ransomware and its previous versions, enabling them to create a decryptor for files encrypted by these variants.

---

Nearly 800,000 affected by children’s hospital ransomware attack

Ann & Robert H. Lurie Children’s Hospital of Chicago was impacted by a ransomware attack. 

---

New Variation of WordFence Evasion Malware Discovered

A new variation of WordFence evasion malware has been discovered, concealing backdoors in infected WordPress environments. A suspicious plugin named "wp-engine-fast-action" was found tampering with the popular WordFence security plugin.

---

EU Opens Applications for Cybersecurity and Digital Skills Funding

The EU Commission is offering over €210m ($227.3m) in funding for cybersecurity and digital skills programs through the Digital Europe Programme (DEP). About $38m will go towards projects protecting critical infrastructures.

---

5 Key Questions CISOs Must Ask Themselves About Their Cybersecurity Strategy

Events like the recent massive CDK ransomware attack – which shuttered car dealerships across the U.S. in late June 2024 – barely raise public eyebrows anymore.  Yet businesses, and the people that lead them, are justifiably jittery. Every CISO knows that cybersecurity is an increasingly hot topic for executives and board members alike. And when the inevitable CISO/Board briefing rolls

---

Cyber budgets year-over-year have increased by 59%

A new report finds that organizations are increasing their cyber budgets in order to keep pace with the shifting threat landscape.

---

Europol Says Home Routing Mobile Encryption Feature Aids Criminals

Europol is proposing solutions to address challenges posed by privacy-enhancing technologies in Home Routing that impede law enforcement's ability to intercept communications in criminal investigations.

---

Report: 47% of Corporate Data Stored in the Cloud Is Sensitive

Cloud resources are increasingly targeted by cyberattacks, with SaaS applications, cloud storage, and cloud management infrastructure being the top categories of attack, according to Thales.

---

Experts Warn of Mekotio Banking Trojan Targeting Latin American Countries

Financial institutions in Latin America are being threatened by a banking trojan called Mekotio (aka Melcoz). That's according to findings from Trend Micro, which said it recently observed a surge in cyber attacks distributing the Windows malware. Mekotio, known to be actively put to use since 2015, is known to target Latin American countries like Brazil, Chile, Mexico, Spain, Peru, and Portugal

---

Gogs Vulnerabilities May Put Your Source Code at Risk

Exploiting these flaws could allow attackers to execute arbitrary commands, read source code, and gain unauthorized access. The vulnerabilities require authentication, with one flaw specifically requiring the built-in SSH server to be enabled.