Latest Cybersecurity News and Articles

---

Secator: Open-Source Pentesting Swiss Army Knife

Secator is an open-source task and workflow runner designed for security assessments to streamline the use of various security tools for pen testers and security researchers.

---

Vulnerabilities in CocoaPods: The Achilles' Heel of the Apple App Ecosystem

Recent discoveries have unveiled severe vulnerabilities within CocoaPods, a dependency manager essential for iOS and macOS application development. These security flaws could lead to significant supply chain attacks, jeopardizing numerous applications. The exploit allows attackers to alter the software update process, inserting harmful payloads into applications. Developers must remain vigilant and adopt robust security practices to safeguard their applications and users.

---

New Ransomware Group Uses Phone Calls to Pressure Victims, Researchers Say

Researchers have identified a new ransomware group called Volcano Demon responsible for two recent successful attacks on companies in the manufacturing and logistics sectors.

---

Understanding the FakeBat Loader: Distribution Tactics and Cybercriminal Infrastructure

In the early part of 2024, the FakeBat loader, also known as EugenLoader or PaykLoader, emerged as a significant threat utilizing the drive-by download technique to spread malware.

---

Feds Hit Health Entity With $950K Fine in Ransomware Attack

The US Department of Health and Human Services has levied a fine of $950,000 from the Heritage Valley Health System in Pennsylvania. It must address potential HIPAA violations after a ransomware attack in 2017.

---

Industry Groups Ask HHS for Guidance on Massive Change Breach Reports

Industry groups are seeking further clarification on delegation processes and want a clear statement that covered entities without a business associate relationship with Change Healthcare are not obliged to notify patients.

---

Dozens of Arrests Disrupt $2.7m Vishing Gang

The criminal gang targeted elderly Spanish citizens by posing as bank employees through voice phishing and then showing up unannounced at their homes to collect cards, bank details, and PINs.

---

Supposed Grasshopper Operators Impersonate Israeli Government and Private Companies to Deploy Open-Source Malware

The group uses a mix of publicly available malware and custom development to carry out their attacks. They have been using custom WordPress websites as a payload delivery mechanism.

---

The Emerging Role of AI in Open-Source Intelligence

Recently the Office of the Director of National Intelligence (ODNI) unveiled a new strategy for open-source intelligence (OSINT) and referred to OSINT as the “INT of first resort”. Public and private sector organizations are realizing the value that the discipline can provide but are also finding that the exponential growth of digital data in recent years has overwhelmed many traditional OSINT

---

PTC Releases Patch for Critical Flaw in Creo Elements/Direct License Server

The vulnerability, tracked as CVE-2024-6071, affects version 20.7.0.0 and earlier, and allows unauthenticated remote attackers to execute arbitrary OS commands on the server through a web interface.

---

APP Fraud Singled Out as Biggest Financial Crime Threat

Nearly two-thirds of payments professionals in the UK believe that fraud is the most urgent financial crime threat, with authorized push payment (APP) scams being the top concern, according to a survey by The Payments Association.

---

Chrome Update Will Block Entrust Certificates by November 2024

Google has announced that starting November 1, 2024, Chrome version 127 and higher will no longer trust new TLS server authentication certificates from Entrust and AffirmTrust.

---

Microsoft MSHTML Flaw Exploited to Deliver MerkSpy Spyware Tool

Unknown threat actors have been observed exploiting a now-patched security flaw in Microsoft MSHTML to deliver a surveillance tool called MerkSpy as part of a campaign primarily targeting users in Canada, India, Poland, and the U.S. "MerkSpy is designed to clandestinely monitor user activities, capture sensitive information, and establish persistence on compromised systems," Fortinet FortiGuard

---

Google Patches 25 Android Flaws, Including Critical Privilege Escalation Bug

Google has issued patches for 25 security vulnerabilities in the Android operating system. One critical bug, known as CVE-2024-31320, affects Android versions 12 and 12L, enabling privilege escalation.

---

The Impossibility of “Getting Ahead” in Cyber Defense

The nature of defense is inherently stacked against defenders, as cybercriminals aim to disrupt systems while defenders manage complex tech stacks. Additionally, the rapid evolution of technology means defenders are always playing catch-up.

---

FCC Drafts Rules to Strengthen Cyber of Emergency Systems

The Federal Communications Commission (FCC) has proposed draft final rules to enhance the security of public alert and warning systems in the face of emerging cybersecurity threats.

---

Cybersecurity is Now a Top Concern for Auto Industry, Report Finds

According to a survey by Rockwell Automation, vehicle and automotive supply manufacturers ranked cybersecurity as their biggest external concern. Cyberattacks resulted in $11.8 billion in damages during the first half of 2023 alone.

---

Polyglot Files Enable Cyber Attack Chains and Methods for Detection & Disarmament

Hackers are using polyglot files, which can fit into multiple file formats and evade detection by endpoint detection and response systems. Research indicates that some commercial EDR tools have a 0% detection rate for malicious polyglots.

---

US Supreme Court Ruling on Chevron Doctrine May Upend Future Cybersecurity Regulation

The ruling may lead to legal challenges against recent cybersecurity regulations, including the 2023 cyber incident reporting requirements by the Securities and Exchange Commission (SEC).

---

FakeBat Loader Malware Spreads Widely Through Drive-by Download Attacks

The loader-as-a-service (LaaS) known as FakeBat has become one of the most widespread loader malware families distributed using the drive-by download technique this year, findings from Sekoia reveal. "FakeBat primarily aims to download and execute the next-stage payload, such as IcedID, Lumma, RedLine, SmokeLoader, SectopRAT, and Ursnif," the company said in a Tuesday analysis. Drive-by attacks