Latest Cybersecurity News and Articles

---

Riding the AI Waves: The Rise of Artificial Intelligence to Combat Cyber Threats

In nearly every segment of our lives, AI (artificial intelligence) now makes a significant impact: It can deliver better healthcare diagnoses and treatments; detect and reduce the risk of financial fraud; improve inventory management; and serve up the right recommendation for a streaming movie on Friday night. However, one can also make a strong case that some of AI’s most significant impacts

---

Albabat, Kasseika, Kuiper: New Ransomware Gangs Rise with Rust and Golang

Cybersecurity researchers have detected in the wild yet another variant of the Phobos ransomware family known as Faust. Fortinet FortiGuard Labs, which detailed the latest iteration of the ransomware, said it's being propagated by means of an infection that delivers a Microsoft Excel document (.XLAM) containing a VBA script. "The attackers utilized the Gitea service to store several files

---

Malicious PyPI Packages Slip WhiteSnake InfoStealer Malware onto Windows Machines

These packages target Windows systems and Linux hosts, with the Windows payload being a variant of WhiteSnake malware capable of stealing information and executing commands.

---

Using Google Search to Find Software can be Risky

Despite Google's efforts to enforce abuse policies and remove malicious ads, cybercrooks are finding new ways to evade detection and continue to lead users to malware-infected websites.

---

Update: Hack Wiped Two Petabytes of Data From Russian Research Center

The Ukrainian Ministry of Defense's Main Intelligence Directorate claims that pro-Ukrainian hacktivists breached the Russian Center for Space Hydrometeorology, known as "Planeta," and wiped 2 petabytes of data.

---

Popular Washington, DC Latino Theater Whole Again After Hack Emptied Accounts

Hackers stole over $250,000 from the GALA Hispanic Theatre in Washington, D.C. by compromising their bank account in a BEC attack. An accountant was locked out of the system after initiating a wire transfer, and the entire account was emptied.

---

ScarCruft Returns to Target High-Profile Experts in N.Korea

SentinelLabs observed a campaign by ScarCruft actors targeting media organizations and high-profile experts in North Korean affairs. As part of the attack, the group impersonated a North Korea Research Institute member, used the RokRAT backdoor, and harvested threat intelligence from their targets. A modern-day TIP providing contextual and operational intelligence by automatically enriching, and correlating the IOCs, shall help organizations protect their network proactively.

---

Multiple PoC Exploits Released for Jenkins Flaw CVE-2024-23897

With over 75,000 internet-facing instances of Jenkins vulnerable to exploitation, the availability of PoC exploits is likely to lead to widespread attacks by threat actors.

---

Another Phobos Ransomware Variant Launches Attack – FAUST

The FAUST ransomware, a Phobos variant, employs a fileless attack to deploy shellcode, injects the final payload, and creates multiple threads for efficient execution while maintaining exclusion lists to avoid damaging the system.

---

NSA Admits Secretly Buying Your Internet Browsing Data without Warrants

The U.S. National Security Agency (NSA) has admitted to buying internet browsing records from data brokers to identify the websites and apps Americans use that would otherwise require a court order, U.S. Senator Ron Wyden said last week. "The U.S. government should not be funding and legitimizing a shady industry whose flagrant violations of Americans' privacy are not just unethical, but illegal

---

Malicious PyPI Packages Slip WhiteSnake InfoStealer Malware onto Windows Machines

Cybersecurity researchers have identified malicious packages on the open-source Python Package Index (PyPI) repository that deliver an information stealing malware called WhiteSnake Stealer on Windows systems. The malware-laced packages are named nigpal, figflix, telerer, seGMM, fbdebug, sGMM, myGens, NewGends, and TestLibs111. They have been uploaded by a threat actor named "WS." "These

---

Update: Nearly 800 GoAnywhere Instances are Unpatched, Exposed to Critical CVE

The majority of GoAnywhere MFT admin interfaces running on default port settings are hosted in the U.S., with more than 3 in 5 publicly exposed instances hosted on cloud networks operated by Amazon, Microsoft, and Google.

---

Therapy Provider Notifying 4 Million Patients of PJ&A Hack

The breach has impacted at least 14 million patients across various organizations. The hack prompted a warning from New York's attorney general about potential identity theft and fraud risks.

---

AllaKore RAT Malware Targeting Mexican Firms with Financial Fraud Tricks

Mexican financial institutions are under the radar of a new spear-phishing campaign that delivers a modified version of an open-source remote access trojan called AllaKore RAT. The BlackBerry Research and Intelligence Team attributed the activity to an unknown Latin American-based financially motivated threat actor. The campaign has been active since at least 2021. "Lures use Mexican Social

---

Pegasus Spyware Targets Togolese Journalists' Mobile Devices

The spyware intrusions occurred on the phones of multiple journalists, including the publisher of an independent weekly paper, raising concerns about press freedom and privacy violations in the country.

---

Update: Akira Ransomware Gang Says It Stole Passport Scans From Lush

The Akira ransomware gang has claimed responsibility for a cybersecurity incident at a British bath bomb merchant. They have stolen 110 GB of data, including personal documents such as passport scans, from the global cosmetics giant.

---

Mexican Banks and Cryptocurrency Platforms Targeted With AllaKore RAT

A financially motivated threat actor based in Latin America is targeting large Mexican companies with custom packaged installers delivering a modified version of AllaKore RAT for financial fraud.

---

Data Privacy Day 2024: Security leaders share AI concerns

With the ever-changing threat landscape, Data Privacy Day looks a little different each year as technology such as artificial intelligence develops.

---

iPhone Apps Abuse iOS Push Notifications to Collect User Data

Many apps abuse the background processing feature to transmit device data to their servers, potentially enabling fingerprinting and persistent tracking, which is strictly prohibited in iOS.

---

Microsoft Warns of Widening APT29 Espionage Attacks Targeting Global Firms

The threat actor, known as APT29 or BlueBravo, uses diverse methods including compromised accounts, OAuth applications, and password spraying to gain and maintain access, making traditional indicators of compromise-based detection ineffective.