Latest Cybersecurity News and Articles

---

Cyberespionage Group Earth Hundun's Continuous Refinement of Waterbear and Deuterbear

In 2022, Earth Hundun began using the latest version of Waterbear (aka Deuterbear) which has several changes, including anti-memory scanning and decryption routines, that distinguish it from the original Waterbear.

---

Zero-Day Alert: Critical Palo Alto Networks PAN-OS Flaw Under Active Attack

Palo Alto Networks is warning that a critical flaw impacting its PAN-OS software used in its GlobalProtect gateways is being exploited in the wild. Tracked as CVE-2024-3400, the issue has a CVSS score of 10.0, indicating maximum severity. "A command injection vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature

---

IT Pros Targeted with Malicious Google Ads for PuTTY, FileZilla

An ongoing malvertising campaign is targeting IT administrators looking to download system utilities such as PuTTY (a free SSH and Telnet client) and FileZilla (a free cross-platform FTP application).

---

Sneaky Credit Card Skimmer Disguised as Harmless Facebook Tracker

Cybersecurity researchers have discovered a credit card skimmer that's concealed within a fake Meta Pixel tracker script in an attempt to evade detection. Sucuri said that the malware is injected into websites through tools that allow for custom code, such as WordPress plugins like Simple Custom CSS and JS or the "Miscellaneous Scripts" section of the Magento admin panel. "

---

U.S. Federal Agencies Ordered to Hunt for Signs of Microsoft Breach and Mitigate Risks

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday issued an emergency directive (ED 24-02) urging federal agencies to hunt for signs of compromise and enact preventive measures following the recent compromise of Microsoft's systems that led to the theft of email correspondence with the company. The attack, which came to light earlier this year, has been

---

Why CISA is Warning CISOs About a Breach at Sisense

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) said today it is investigating a breach at business intelligence company Sisense, whose products are designed to allow companies to view the status of multiple third-party online services in a single dashboard. CISA urged all Sisense customers to reset any credentials and secrets that may have been shared with the company, which is the same advice Sisense gave to its customers Wednesday evening.

---

Met police failed to act on Commons ‘honeytrap’ sexting reports last year

The force has said there was nothing to suggest at the time that the messages were part of a wider patternThe Metropolitan police first had reports of unsolicited messages targeting a number of MPs, staff and journalists in Westminster last year, but officers failed to notify politicians.After the former Conservative MP William Wragg said he was manipulated into giving the personal phone numbers of colleagues to a man he met on a dating app, Scotland Yard said it was working with other police forces, alongside its own investigation, amid concerns many other MPs could have been targeted. Continue reading...

---

X Fixes URL Blunder That Could Enable Social Media Phishing

Users started noticing on Monday that X's programmers implemented a rule on its iOS app that auto-changed Twitter.com links that appeared in Xeets (tweets) to X.com links.

---

New Spectre v2 Attack Impacts Linux Systems Running on Intel CPUs

Researchers have demonstrated the "first native Spectre v2 exploit" for a new speculative execution side-channel flaw that impacts Linux systems running on many modern Intel processors.

---

Rhadamanthys Malware Deployed By TA547 Against German Targets

What’s particularly intriguing according to the researchers is the actor’s apparent employment of a PowerShell script likely generated by large language models (LLMs) such as ChatGPT, Gemini or CoPilot.

---

UK's Attitude to Security Spotlit by Government Figures

The report from the Department for Science, Innovation and Technology (DSIT), painted security as more of an afterthought for UK businesses, especially when considering the figures about how breaches are handled.

---

CISO Role Shows Significant Gains Amid Corporate Recognition of Cyber Risk

CISOs and other management-level cybersecurity executives are gaining more influence and importance as companies have begun to recognize the need for strong cyber governance and oversight, according to a report from Moody’s Ratings.

---

A vulnerability in Linux distributions may allow unauthorized access

A recently detected vulnerability in many Linux distributions may open the door for malicious actors to gain unauthorized access. 

---

Python's PyPI Reveals Its Secrets

GitGuardian is famous for its annual State of Secrets Sprawl report. In their 2023 report, they found over 10 million exposed passwords, API keys, and other credentials exposed in public GitHub commits. The takeaways in their 2024 report did not just highlight 12.8 million new exposed secrets in GitHub, but a number in the popular Python package repository PyPI. PyPI,

---

TA547 Phishing Attack Hits German Firms with Rhadamanthys Stealer

A threat actor tracked as TA547 has targeted dozens of German organizations with an information stealer called Rhadamanthys as part of an invoice-themed phishing campaign. "This is the first time researchers observed TA547 use Rhadamanthys, an information stealer that is used by multiple cybercriminal threat actors," Proofpoint said. "Additionally, the actor appeared to

---

Python's PyPI Reveals Its Secrets

GitGuardian is famous for its annual State of Secrets Sprawl report. In their 2023 report, they found over 10 million exposed passwords, API keys, and other credentials exposed in public GitHub commits. The takeaways in their 2024 report did not just highlight 12.8 million new exposed secrets in GitHub, but a number in the popular Python package repository PyPI. PyPI,

---

New Google Workspace Feature Prevents Sensitive Security Changes if Two Admins Don’t Approve Them

If the feature is enabled, certain sensitive admin actions can be taken only if approved by an admin who did not initiate them and thus, in theory, preventing accidental or unauthorized changes made by either malicious insiders or outsiders

---

Wiz Buys Startup Gem Security for $350M to Spot Cloud Issues

Wiz purchased a cloud detection and response startup founded by a longtime Israeli Military Intelligence leader to address security operations and incident response use cases.

---

New Technique Detected in an Open Source Supply Chain Attack

Attackers create malicious GitHub repositories with popular names and topics, using techniques like automated updates and fake stars to boost search rankings and deceive users.

---

AI Data Security Startup Cyera Confirms $300M Raise at a $1.4B Valuation

The lead investor for the Series C funding is Coatue, which is new to the startup’s cap table. Other new investors include Spark Capital, Georgian, and strategic backer AT&T Ventures.