Latest Cybersecurity News and Articles

---

Jacksonville Beach Report Data Breach Following Cyberattacks

The city government of Jacksonville Beach was just the latest to report such an incident, disclosing Wednesday evening that 48,949 people had personal information accessed during a January cyberattack.

---

RaaS Groups Increasing Efforts to Recruit Affiliates

Smaller RaaS groups are trying to recruit new and “displaced” LockBit and Alphv/BlackCat affiliates by foregoing deposits and paid subscriptions, offering better payout splits, 24/7 support, and other “perks.”

---

China-Linked Group Breaches Networks via Connectwise, F5 Software Flaws

A China-linked threat cluster leveraged security flaws in Connectwise ScreenConnect and F5 BIG-IP software to deliver custom malware capable of delivering additional backdoors on compromised Linux hosts as part of an "aggressive" campaign. Google-owned Mandiant is tracking the activity under its uncategorized moniker UNC5174 (aka Uteus or Uetus), describing it as a "former

---

Massive Sign1 Campaign Infects 39,000+ WordPress Sites with Scam Redirects

A massive malware campaign dubbed Sign1 has compromised over 39,000 WordPress sites in the last six months, using malicious JavaScript injections to redirect users to scam sites. The most recent variant of the malware is estimated to have infected no less than 2,500 sites over the past two months alone, Sucuri said in a report published this week. The attacks entail injecting rogue

---

Implementing Zero Trust Controls for Compliance

The ThreatLocker® Zero Trust Endpoint Protection Platform implements a strict deny-by-default, allow-by-exception security posture to give organizations the ability to set policy-based controls within their environment and mitigate countless cyber threats, including zero-days, unseen network footholds, and malware attacks as a direct result of user error. With the capabilities of the

---

Chinese Government Hacker Exploiting Screenconnect, F5 Bugs To Attack Defense and Government Entities

A hacker allegedly connected to the People's Republic of China has been exploiting two popular vulnerabilities to attack U.S. defense contractors, U.K. government entities, and institutions in Asia.

---

Change Healthcare Cyberattack Could Damage Credit at Small Providers: Fitch

The cyberattack against Change Healthcare could damage the credit of smaller providers, pharmacies, and other healthcare organizations that rely on the UnitedHealth-owned technology company for financial services, as per a report from Fitch Ratings.

---

API Environments Becoming Hotspots for Exploitation

A total of 29% of web attacks targeted APIs over 12 months (January through December 2023), indicating that APIs are a focus area for cybercriminals, according to Akamai.

---

Windows 11, Tesla, and Ubuntu Linux Hacked at Pwn2Own Vancouver

On the first day of Pwn2Own Vancouver 2024, contestants demoed 19 zero-day vulnerabilities in Windows 11, Tesla, Ubuntu Linux, and other devices and software to win $732,500 and a Tesla Model 3 car.

---

Nemesis Darknet Marketplace Raided in Germany-Led Operation

Visitors to the cybercrime website were greeted on Thursday with a red banner announcing the takedown. At the bottom, the police placed an animated spaceship reminiscent of a 1990s video game called Nemesis.

---

Red Teaming in the AI Era

Unlike previous types of software, AI models become more intelligent over time. This constant change means new risks can emerge at any moment, making them incredibly difficult to anticipate. A one-and-done approach to red teaming simply won’t work.

---

FlowFixation Account Takeover Vulnerability Impacts AWS Managed Apache Airflow Service

The FlowFixation account-takeover vulnerability, now fixed by AWS, results from a combination of session fixation on the web management panel of the AWS MWAA together with an Amazon AWS domain misconfiguration that leads to cross-site scripting.

---

New Sysrv Botnet Variant Makes Use of Google Subdomain to Spread XMRig Miner

Sysrv is a well-documented botnet first identified in 2020, with the main payload being a worm written in Golang. It drops a cryptominer onto infected hosts before attempting to propagate itself using network vulnerabilities and other methods.

---

U.S. Justice Department Sues Apple Over Monopoly and Messaging Security

The U.S. Department of Justice (DoJ), along with 16 other state and district attorneys general, on Thursday accused Apple of illegally maintaining a monopoly over smartphones, thereby undermining, among others, security and privacy of users when messaging non-iPhone users. "Apple wraps itself in a cloak of privacy, security, and consumer preferences to justify its anticompetitive

---

Russian Hackers Target Ukrainian Telecoms with Upgraded 'AcidPour' Malware

The data wiping malware called AcidPour may have been deployed in attacks targeting four telecom providers in Ukraine, new findings from SentinelOne show. The cybersecurity firm also confirmed connections between the malware and AcidRain, tying it to threat activity clusters associated with Russian military intelligence. "AcidPour's expanded capabilities would enable it to better

---

International Freight Tech Firm Isolates Canada Operations After Cyberattack

In documents filed with U.S. regulators, the company explained that on March 14 it detected “the initial stages of a cybersecurity incident related to its Canadian operations.”

---

India's Android Users Hit by Malware-as-a-Service Campaign

According to Broadcom, the campaign distributes malicious APK packages and seeks out banking information, SMS messages, and other sensitive information from a victim's device.

---

Fake Obituary Sites Send Grievers to Adult Sites and Scareware Pages

Security researchers have warned of a slew of fake obituaries designed to make money for their creators by redirecting visitors to adult entertainment sites and initiating antivirus (AV) popups.

---

Sign1 Malware: Analysis, Campaign History & Indicators of Compromise

The malware injects JavaScript to perform unwanted redirects by using sophisticated obfuscation techniques, including time-based randomization and XOR encoding, to evade detection.

---

Tax Hackers Blitz Small Business With Phishing Emails

Worryingly, the social engineering scammers are likely operating with little more than a cheap email list of self-employed US residents, according to the latest advisory from Malwarebytes Labs.