Latest Cybersecurity News and Articles

---

Israeli Entities Targeted by Cyberattack Using Donut and Sliver Frameworks

Cybersecurity researchers have discovered an attack campaign that targets various Israeli entities with publicly-available frameworks like Donut and Sliver. The campaign, believed to be highly targeted in nature, "leverage target-specific infrastructure and custom WordPress websites as a payload delivery mechanism, but affect a variety of entities across unrelated verticals, and rely on

---

South Korean ERP Vendor's Server Hacked to Spread Xctdoor Malware

An unnamed South Korean enterprise resource planning (ERP) vendor's product update server has been found to be compromised to deliver a Go-based backdoor dubbed Xctdoor. The AhnLab Security Intelligence Center (ASEC), which identified the attack in May 2024, did not attribute it to a known threat actor or group, but noted that the tactics overlap with that of Andariel, a sub-cluster within the

---

Rapid7 To Acquire Attack Surface Management Startup Noetic Cyber

Cybersecurity firm Rapid7 has announced to acquired Noetic Cyber, a startup specializing in cyber asset attack surface management (CAASM). The terms of the deal were not disclosed.

---

Ransomware Attack Demands Reach a Staggering $5.2m in 2024

According to a new analysis by Comparitech, the average ransom demand per ransomware attack in the first half of 2024 was over $5.2m (£4.1m). This was calculated from 56 known ransom demands issued by threat actors during that period.

---

Cyber-Insurance Premiums Decline as Firms Build Resilience

Cyber insurance premiums have seen significant reductions in price due to improved cybersecurity measures implemented by organizations. Despite an 18% increase in ransomware incidents, premiums have decreased in 2023/24.

---

Preparing for Q-Day as NIST Nears Approval of PQC Standards

Q-Day, the day when a quantum computer can break modern encryption, is approaching rapidly, leaving our society vulnerable to cyberattacks. Recent advancements in quantum technology suggest that Q-Day is coming sooner than expected.

---

New Orcinius Trojan Uses VBA Stomping to Mask Infection

This multi-stage trojan utilizes Dropbox and Google Docs to update and deliver payloads. It uses the VBA stomping technique, removing the VBA source code in a Microsoft Office document, leaving only compiled p-code.

---

How Hacked YouTube Channels Spread Scams and Malware

The most common attack methods against YouTube channels involve phishing attacks to steal login credentials, exploiting weak or reused passwords, and even bypassing two-factor authentication by stealing session cookies.

---

CapraRAT Spyware Variant Disguised as Popular Apps to Target Android Users

The recent campaign shows updates to the group's techniques and social engineering tactics, as well as efforts to maximize the spyware's compatibility with older and modern versions of the Android operating system.

---

78% of organizations are tracking AI risks

A recent report found that 78 percent of organizations are tracking AI as an emerging risk while simultaneously adopting the technology themselves.

---

Dev Rejects CVE Severity, Makes his GitHub Repository Read-Only

The open source project 'ip' has been archived on GitHub due to a dubious CVE report filed against it. This is not an isolated incident, as open-source developers have seen an increase in unsubstantiated CVE reports for their projects.

---

Security leaders weigh in on Life360 data breach

Life360 was impacted by a data breach. Security leaders are sharing their insights.

---

Report: Cyber Workforce Grows 15% at Large Organizations

Large organizations have significantly bolstered their cybersecurity workforce in 2024, with an average of one expert dedicated to cybersecurity for every 1,086 employees in companies with over $1 billion in revenue, as per a report by Wavestone.

---

Latest Intel CPUs Impacted by New Indirector Side-Channel Attack

Researchers at the University of California, San Diego have discovered a new type of attack called 'Indirector' that targets modern Intel processors, including those from the Raptor Lake and Alder Lake generations.

---

How MFA Failures are Fueling a 500% Surge in Ransomware Losses

The cybersecurity threat landscape has witnessed a dramatic and alarming rise in the average ransomware payment, an increase exceeding 500%. Sophos, a global leader in cybersecurity, revealed in its annual "State of Ransomware 2024" report that the average ransom payment has increased 500% in the last year with organizations that paid a ransom reporting an average payment of $2 million, up from

---

Indonesia Arrests Over 100 Foreigners in Bali Suspected of Participating in Cybercrime

Over a hundred foreign nationals suspected of committing cybercrimes were arrested in a villa raid on Bali. Among the arrested, 14 were Taiwanese citizens, but the identities of the others are unknown, although all held Taiwanese passports.

---

New Intel CPU Vulnerability 'Indirector' Exposes Sensitive Data

Modern CPUs from Intel, including Raptor Lake and Alder Lake, have been found vulnerable to a new side-channel attack that could be exploited to leak sensitive information from the processors. The attack, codenamed Indirector by security researchers Luyi Li, Hosein Yavarzadeh, and Dean Tullsen, leverages shortcomings identified in Indirect Branch Predictor (IBP) and the Branch Target Buffer (BTB

---

CISOs Becoming More Comfortable With Risk Levels

The cyber threats landscape has led to changes in the way CISOs evaluate their business's risk appetite, causing tensions with CEO and C-suite members, according to Netskope.

---

Google Thwarts Over 10,000 Attempts by Chinese Influence Operator

Google has revealed that it blocked over 10,000 instances of Dragon Bridge activity in the first quarter of 2024, labeling it the most prolific influence operator it tracks.

---

Update: Hackers Copied Employee Directory Data and Encrypted Passwords in TeamViewer Intrusion

Software company TeamViewer has confirmed that a compromised employee account allowed hackers from a group tracked as APT29, linked to the Russian government, to breach its internal IT environment and steal encrypted passwords.