Latest Cybersecurity News and Articles

---

How to Use Tines's SOC Automation Capability Matrix

Created by John Tuckner and the team at workflow and automation platform Tines, the SOC Automation Capability Matrix (SOC ACM) is a set of techniques designed to help security operations teams understand their automation capabilities and respond more effectively to incidents.  A customizable, vendor-agnostic tool featuring lists of automation opportunities, it's been shared

---

New Malware-as-a-Service Info-Stealer Malware Targets Oil and Gas Companies

An advanced phishing campaign targeting the Oil and Gas industry is distributing the Rhadamanthys Stealer, an uncommon and sophisticated Malware-as-a-Service information stealer.

---

Chinese Duo Found Guilty of $3m Apple Fraud Plot

Two Chinese nationals, Haotian Sun and Pengfei Xue, have been found guilty of running a fraudulent scheme targeting Apple. They sent thousands of fake iPhones to Apple for repair, hoping to receive genuine replacements.

---

Law Enforcement Dismantled LockBit Before Latest Variant Hit Market

The new variant, referred to as LockBit-NG-Dev, was being designed to succeed the most recent LockBit 3.0 iteration, using .NET and CoreRT for cross-platform compatibility.

---

Russia Arrests Three Alleged SugarLocker Ransomware Members

The group has been involved in deploying ransomware and receiving profits from cyberattacks. The arrest may be a PR move by Russia, and there are speculations about the suspects' continued operations.

---

Russian Cyberattackers Launch Multiphase PsyOps Campaign

Russian-linked threat actors conducted a multiwave campaign, Operation Texonto, using a combination of pysops and spear-phishing to spread misinformation in Ukraine and target Microsoft 365 credentials across Europe.

---

Update: UnitedHealth Says Change Healthcare Hacked by Nation State, as Pharmacy Outages Drag On

The ongoing cyberattack on Change Healthcare has resulted in widespread disruption, affecting patient billing processes, prescription fulfillment, and causing downtime for healthcare professionals.

---

Linux Malware ‘Migo’ Targets Redis for Cryptojacking Attacks

Researchers spotted a new Migo malware targeting Redis servers to mine cryptocurrency and utilizing system-weakening commands to disable security features. Migo is distributed as a Golang ELF binary, with compile-time obfuscation and the ability to persist on Linux hosts. Organizations are expected to expedite their threat-hunting and investigation processes by leveraging IOCs associated with the malware.

---

Update: Plant Production Still on Hold for German Battery Manufacturer After Cyberattack

The company has informed customers of potential email loss and is working with experts to investigate the cyberattack, which was carried out by an organized group of hackers.

---

Researchers Detail Apple's Recent Zero-Click Shortcuts Vulnerability

Details have emerged about a now-patched high-severity security flaw in Apple's Shortcuts app that could permit a shortcut to access sensitive information on the device without users' consent. The vulnerability, tracked as CVE-2024-23204 (CVSS score: 7.5), was addressed by Apple on January 22, 2024, with the release of iOS 17.3, iPadOS 17.3, macOS Sonoma 14.3, and 

---

FTC Slams Avast with $16.5 Million Fine for Selling Users' Browsing Data

The U.S. Federal Trade Commission (FTC) has hit antivirus vendor Avast with a $16.5 million fine over charges that the firm sold users' browsing data to advertisers after claiming its products would block online tracking. In addition, the company has been banned from selling or licensing any web browsing data for advertising purposes. It will also have to notify users whose browsing data was

---

Year-over-year, the median initial ransom has risen by 20%

A recent report reveals an increase in initial ransom demand amounts. Furthermore, vulnerabilities detected in 2022 are continuing to be exploited. 

---

Multiple FreeImage Vulnerabilities Fixed in Ubuntu

On 16th January 2024, the Ubuntu security team released critical security updates addressing several FreeImage vulnerabilities in different Ubuntu releases, including Ubuntu 16.04 and Ubuntu 18.04.

---

Russian Consular Software Installer Backdoored to Deploy Konni RAT

This activity is linked to actors from North Korea targeting Russia. The trojan is being distributed through backdoored software installers and is capable of file transfers and command execution.

---

Apple Unveils PQ3 Protocol - Post-Quantum Encryption for iMessage

Apple has announced a new post-quantum cryptographic protocol called PQ3 that it said will be integrated into iMessage to secure the messaging platform against future attacks arising from the threat of a practical quantum computer. "With compromise-resilient encryption and extensive defenses against even highly sophisticated quantum attacks, PQ3 is the first messaging protocol to reach

---

New Open-Source Self-Modifying Worm Tool SSH-Snake Threatens Networks

The worm autonomously searches for SSH credentials, modifies itself to remain fileless, and uses a variety of methods to collect private keys, making it difficult to detect statically.

---

Hack at Healthcare Services Firm Hits 2.4 Million Eye Doctor Patients

The breach affected nearly 2.4 million patients and compromised sensitive information such as names, contact details, medical records, and in some cases, Social Security numbers and insurance information.

---

Resilience Acquires Incident Response Provider BreachQuest

Resilience, a cyber insurance startup, has acquired BreachQuest, a cybersecurity company specializing in incident response solutions, to enhance its cyber risk management software and incident management solution.

---

Report finds blocklists are still effective in mitigating attacks

Web application attacks were analyzed in a recent report by Edgio. The report found that the most prevalent attack mitigated was path traversal. 

---

NCA Exposes Nearly 200 LockBit Affiliates, Data Theft Malware

The UK's National Crime Agency (NCA) has gained control of LockBit's site and has exposed the identities of the affiliates, disrupted the affiliate infrastructure, and destroyed the servers used for data exfiltration.