Latest Cybersecurity News and Articles

---

Dutch Intelligence Finds Chinese Hackers Spying on Secret Defence Ministry Network

Chinese state-sponsored hackers breached the internal computer network of the Dutch Ministry of Defence using a vulnerability in FortiGate devices. The breach was for espionage purposes and the malware was found in a compartmentalized network.

---

Fortinet FortiSIEM Hit by Two 10/10 Severity Vulnerabilities

The FortiSIEM product from Fortinet has been found to have two new critical vulnerabilities, CVE-2024-23108 and CVE-2024-23109, which allow for remote code execution by unauthenticated attackers.

---

Update: Equilend Back in Action as Ransom Payment Rumors Swirl

While it is unclear whether a ransom was paid, the company stated that client transaction data was not accessed during the attack. The attack occurred amidst a major business deal, but experts predicted minimal disruption to EquiLend's operations

---

Python Info-stealer Distributed by Malicious Excel Document

The threat actors behind the campaign utilized multiple stages and techniques, including obfuscation and leveraging open platforms, to carry out the attack and steal sensitive information.

---

Ov3r_Stealer Malware Spreads via Phishing and Facebook Advertising

The malware is distributed through a multi-stage infection chain involving weaponized PDF files, internet shortcuts, and PowerShell loaders, with similarities to the previously disclosed Phemedrone Stealer.

---

Airbus NAVBLUE Flysmart+ Manager Susceptible to Data Manipulation Attacks

Airbus Navblue Flysmart+ Manager had a vulnerability that allowed attackers to tamper with engine performance calculations and intercept data, posing a serious risk to flight safety.

---

Beware: Fake Facebook Job Ads Spreading 'Ov3r_Stealer' to Steal Crypto and Credentials

Threat actors are leveraging bogus Facebook job advertisements as a lure to trick prospective targets into installing a new Windows-based stealer malware codenamed Ov3r_Stealer. "This malware is designed to steal credentials and crypto wallets and send those to a Telegram channel that the threat actor monitors," Trustwave SpiderLabs said in a report shared with The Hacker News. Ov3r_Stealer

---

Experts Detail New Flaws in Azure HDInsight Spark, Kafka, and Hadoop Services

Three new security vulnerabilities have been discovered in Azure HDInsight's Apache Hadoop, Kafka, and Spark services that could be exploited to achieve privilege escalation and a regular expression denial-of-service (ReDoS) condition. "The new vulnerabilities affect any authenticated user of Azure HDInsight services such as Apache Ambari and Apache Oozie," Orca security

---

Pennsylvania Courts’ Website Disrupted by DoS Attack

The Pennsylvania Courts system has been hit by a cyberattack, taking down parts of its website. The Administrative Office of Pennsylvania Courts revealed via social media that the service had suffered a denial of service (DoS) attack.

---

ResumeLooters Gang Steals User Information from Retail and Job Sites

The stolen data, including over two million unique email addresses, was put up for sale in Chinese-speaking hacking-themed Telegram groups, with the majority of the focus on India, Taiwan, Thailand, and Vietnam.

---

Latio Application Security Tester Uses AI to Scan Your Code

Latio Application Security Tester simplifies code scanning with OpenAI, offering easy code change submission and GitHub Actions templates. The tool's future plans include support for non-OpenAI models, improved handling of large files, and more.

---

A shadowy hacker group brought the British Library to its knees. Is there any way to stop them? | Lamorna Ash

The future of cybercrime resembles an arms race between an industry of hackers-for-hire and the UK’s weak defences It is not quite accurate to say that the cyber-attack against the British Library took place on 28 October 2023. Most probably, Rhysida, the hacker gang that orchestrated the attack and is thought to be Russian, had already been creeping undetected through the digital territories of the British Library for months, Enrico Mariconti, a lecturer in security and crime science at UCL, told me.Once it broke through to the library’s virtual private network (VPN) – the remote connection that allows employees to access its network from any location – it could in theory start making its way through locked door after locked door of the library’s many online systems, trawling until it discovered emails and documents containing details such as employees’ passport scans and work contracts. It hoped these documents might tempt a single bidder to pay 20 bitcoins (about £600,000) for privileged access to all that personal information.Lamorna Ash is the author of Dark, Salt, Clear: Life in a Cornish Fishing Town Continue reading...

---

HPE Investigates New Breach After Data for Sale on Hacking Forum

Hewlett Packard Enterprise (HPE) is investigating a potential breach after a threat actor claimed to have stolen HPE credentials and sensitive data and put it up for sale on a hacking forum.

---

How a $10B Enterprise Customer Drastically Increased their SaaS Security Posture with 201% ROI by Using SSPM

SaaS applications are the darlings of the software world. They enable work from anywhere, facilitate collaboration, and offer a cost-effective alternative to owning the software outright. At the same time, the very features that make SaaS apps so embraced – access from anywhere and collaboration – can also be exploited by threat actors. Recently, Adaptive Shield commissioned a Total Economic

---

Cyberattack Targets Maine Healthcare Provider’s Computer Servers

A cyberattack over the weekend targeted the computer servers of Northern Light Health, a major Maine healthcare provider. As a precaution, it temporarily took all patient records offline, although the records were not on the affected servers.

---

Hackers Exploit Job Boards in APAC, Steal Data of Millions of Job Seekers

Employment agencies and retail companies chiefly located in the Asia-Pacific (APAC) region have been targeted by a previously undocumented threat actor known as ResumeLooters since early 2023 with the goal of stealing sensitive data. Singapore-headquartered Group-IB said the hacking crew's activities are geared towards job search platforms and the theft of resumes, with as many as 65

---

US announces visa ban on those linked to commercial spyware

The Commerce Department has sanctioned several European, Israeli, Russian, and Singaporean companies involved in the trafficking and development of spyware tools used for repression and human rights abuses.

---

Update: Classified Japanese Diplomatic Documents Leaked in Chinese Cyberattacks

The leak compromised highly confidential documents exchanged between the Ministry of Foreign Affairs and its international diplomatic missions, prompting discussions between Tokyo and Washington on countermeasures.

---

Judge Allows Case Against Geolocation Data Broker Kochava To Proceed

The court ruling allows the FTC to continue its enforcement action against data broker Kochava for selling non-anonymized, granular location data, setting the stage for potential limitations on data brokers' activities.

---

Researchers Discover Exposed API Secrets, Impacting Major Tech Tokens

The security research team at Escape scanned 189.5 million URLs and discovered over 18,000 exposed API secrets, with 41% of them being highly critical and posing financial risks.