Latest Cybersecurity News and Articles

---

India-Linked Hackers Target Pakistan With Spyware in New Campaign

The campaign, attributed to the Patchwork APT group, targeted mostly Pakistani users through a honey-trap romance scam, with some apps reaching over 1,400 installs on Google Play and revealing 148 compromised devices in Pakistan and India.

---

FBI and DOJ Disrupt Chinese Hacking Operation

The hacking group's activities included compromising vulnerable Cisco routers and using Netgear ProSafe firewalls as relay nodes for networks compromised by Chinese state hackers.

---

Russian Spies Impersonating Western Researchers in Ongoing Hacking Campaign

The hackers, believed to be state-sponsored, have successfully compromised researchers by using sophisticated techniques to solicit feedback on academic articles and harvest credentials through fake Google Drive links.

---

FTC Blasts Blackbaud's 'Shoddy' Practices in Ransomware Hack

Blackbaud's lax security practices allowed a hacker to access and steal massive amounts of unencrypted consumer data, including personal, financial, and medical information, leading to regulatory actions from multiple government agencies.

---

Cloudflare Hacked Using Authentication Tokens Stolen in Okta Attack

Cloudflare's internal Atlassian server was breached by a suspected nation-state attacker in November 2023. The attacker gained access to Confluence, Jira, and Bitbucket systems, using stolen credentials from Okta's breach.

---

Multiple Malware Used in Attacks Exploiting Ivanti VPn Flaws

The attackers exploit known vulnerabilities to execute arbitrary commands and have been observed using various malware, including a custom web shell and open-source tools for post-exploitation activities.

---

Update: December Cyberattack on Chicago Community Hospital Claimed by LockBit Gang

Saint Anthony Hospital in Chicago experienced a cyberattack by the LockBit ransomware gang, with patient information being copied from the network. The gang demanded a $900,000 ransom, but the hospital refused to pay, prioritizing patient care.

---

DarkGate Malware Delivered via Microsoft Teams

Threat actors have been spotted exploiting Microsoft Teams’ external access feature—enabled by default—allowing users to add external members to Teams chats. An AT&T customer identified an unsolicited Teams chat from an external user, suspected to be a phishing lure. It is recommended to disable External Access in Microsoft Teams unless it is necessary for daily business use.

---

Cloudflare Breach: Nation-State Hackers Access Source Code and Internal Docs

Cloudflare has revealed that it was the target of a likely nation-state attack in which the threat actor leveraged stolen credentials to gain unauthorized access to its Atlassian server and ultimately access some documentation and a limited amount of source code. The intrusion, which took place between November 14 and 24, 2023, and detected on November 23, was carried out "with the goal of

---

UK: City Cyber Task Force Launches to Secure Corporate Finance

The Institute of Chartered Accountants in England and Wales (ICAEW) and the National Cyber Security Centre (NCSC) are leading a task force with other organizations to improve the security of corporate finance deals.

---

Protect AI Acquires Laiyer AI to Better Secure AI Models

The acquisition will enable organizations to benefit from Laiyer AI's LLM Guard software, which detects, redacts, and sanitizes inputs and outputs from LLMs with lower latency, while also supporting open source contributions.

---

Does CVSS 4.0 Solve the Exploitability Problem?

The new system introduces changes such as splitting attack complexity into two parameters and categorizing user interaction into three levels, offering a more nuanced and comprehensive assessment of vulnerabilities.

---

Arrests in $400M SIM-Swap Tied to Heist at FTX?

Three Americans were charged this week with stealing more than $400 million in a November 2022 SIM-swapping attack. The U.S. government did not name the victim organization, but there is every indication that the money was stolen from the now-defunct cryptocurrency exchange FTX, which had just filed for bankruptcy on that same day.

---

Europcar Denies Data Breach of 50 Million Users, Says Data is Fake

Security researchers suggest that the fake data may not have been generated using artificial intelligence, as claimed, but rather through existing projects that can create realistic-looking data.

---

Incognia Raises $31M in Series B Funding

Incognia, a San Jose-based company specializing in location identity solutions, has raised $31M in Series B funding led by Bessemer Venture Partners, with participation from FJ Labs and existing investors.

---

Zero-Day Vulnerability can Blind Defenses Relying on Windows Event Logs

The vulnerability can be leveraged by an attacker with local network access, and until Microsoft issues a patch, users can implement micropatches provided by Acros to mitigate the risk.

---

Aim Security Raises $10M for its GenAI Security Platform

Tel Aviv-based Aim Security has raised $10 million in seed funding for its new GenAI security platform, led by YL Ventures and including participation from Cyber Club London and angel investors.

---

Exploit Released for Android Local Elevation Flaw Impacting Seven OEMs

A local privilege elevation flaw (CVE-2023-45779) affecting several Android OEMs was discovered and addressed in the December 2023 security update, highlighting weaknesses in APEX module signing using test keys.

---

US Charges Two More Suspects With DraftKings Account Hacks

The defendants used credential stuffing techniques to compromise accounts, sell access to them, and devised a method for buyers to withdraw funds, resulting in millions of dollars in illicit gains.

---

Global Affairs Canada Hit by Cyberattack, Shuts Down Computer Systems to Fix

The Foreign Ministry of Canada has been hit by a cyberattack, leading to the closure of remote access to its network. Hackers gained access to personal data, and experts suspect a foreign country, possibly Russia or China, to be behind the attack.