Latest Cybersecurity News and Articles

---

Who is Alleged Medibank Hacker Aleksandr Ermakov?

Authorities in Australia, the United Kingdom and the United States this week levied financial sanctions against a Russian man accused of stealing data on nearly 10 million customers of the Australian health insurance giant Medibank. 33-year-old Aleksandr Ermakov allegedly stole and leaked the Medibank data while working with one of Russia's most destructive ransomware groups, but little more is shared about the accused. Here's a closer look at the activities of Mr. Ermakov's alleged hacker handles.

---

Abu Dhabi Investment Firm Warns About Scam Efforts

The National Investor in Abu Dhabi has issued a warning about fraudulent investment schemes misusing its name, logo, and employees' identities to solicit personal and financial information.

---

Update: Hackers Stole Raw Genotype Data, Health Reports in 23andMe Data Breach

The stolen data includes raw genotype data, health reports, and information from DNA Relatives and Family Tree profiles, potentially exposing personal and ancestral information of affected customers.

---

40% of litigators say data privacy disputes increased in 2023

Growing cybersecurity and data privacy concerns have influenced recent litigation, according to a recent survey by Norton Rose Fulbright.

---

Feds Warn Healthcare Sector of ConnectWise ScreenConnect Threats

Federal authorities warn that a self-hosted version of ConnectWise's ScreenConnect remote access tool was compromised at a large pharmacy services firm, posing a significant risk to other healthcare organizations.

---

Hackers Target WordPress Database Plugin Active on One Million Sites

The vulnerability, tracked as CVE-2023-6933, allows unauthenticated attackers to inject a PHP object, potentially leading to code execution, data access, file manipulation, or denial of service.

---

Malicious Ads for Restricted Messaging Applications Target Chinese Users

A campaign of malicious ads is targeting Chinese-speaking users with lures for popular messaging applications like Telegram and LINE, despite the fact that these apps are heavily restricted or banned in China.

---

Critical Cisco Flaw Lets Hackers Remotely Take Over Unified Comms Systems

Admins are advised to implement access control lists (ACLs) as a mitigation strategy and evaluate their impact before deployment, while Cisco is not aware of any public announcements or malicious use of the vulnerability.

---

Pakistan-based Threat Actor Targets Indians with Fake Loan Android Application

These actors create fake loan apps, obtain personal details through a KYC process, and then extort money by threatening to distribute manipulated photos. The apps exploit minimal permissions to avoid detection.

---

US Data Compromises Surged to Record High in 2023

The number of data compromises in the U.S. reached a record high in 2023, impacting over 353 million victims, with a 78% increase from the previous year, according to the Identity Theft Resource Center’s annual data breach report.

---

Ukrainian Energy Giant, Postal Service, Transportation Agencies Hit by Cyberattacks

The attacks on transportation, postal services, and energy companies in Ukraine may be part of a larger cyber war between Ukraine and Russia, with previous attacks on telecom and banking sectors.

---

LODEINFO Fileless Malware Evolves with Anti-Analysis and Remote Code Tricks

The malware has evolved with new features and anti-analysis techniques. It is linked to a Chinese nation-state actor known as Stone Panda and has been used in attacks targeting Japanese political establishments.

---

Perfecting the Defense-in-Depth Strategy with Automation

Medieval castles stood as impregnable fortresses for centuries, thanks to their meticulous design. Fast forward to the digital age, and this medieval wisdom still echoes in cybersecurity. Like castles with strategic layouts to withstand attacks, the Defense-in-Depth strategy is the modern counterpart — a multi-layered approach with strategic redundancy and a blend of passive and active security

---

Local Governments in Colorado, Pennsylvania, and Missouri Dealing with Ransomware Incidents

The cyber incidents have affected emergency communication systems, court services, public transit agencies, and library operations, prompting responses from state and federal agencies as well as cybersecurity professionals.

---

US Regulators Have Done Little to Address Firmware Vulnerabilities, Think Tank Argues

Firmware connects the hardware and software of a device, but efforts to protect it have been absent in many of the government’s recent cybersecurity initiatives, according to a new report by the Foundation for Defense of Democracies.

---

Malicious Ads on Google Target Chinese Users with Fake Messaging Apps

Chinese-speaking users have been targeted by malicious Google ads for restricted messaging apps like Telegram as part of an ongoing malvertising campaign. "The threat actor is abusing Google advertiser accounts to create malicious ads and pointing them to pages where unsuspecting users will download Remote Administration Trojan (RATs) instead," Malwarebytes' Jérôme Segura said in a

---

Watching the Watchdog: Learning from HHS' Grant Payment Mess

The U.S. Department of Health and Human Services (HHS) lost $7.5 million in a cyberattack last year, leading to speculation about the hacking methods used. The incident was not publicly disclosed by HHS.

---

UK Mulls Rollout of New Software Vulnerability Rules

The U.K. government is considering implementing voluntary rules for software vendors to disclose vulnerabilities in their systems. This initiative follows successful hacks targeting the country's infrastructure.

---

Tesla Hacked, 24 Zero-Days Demoed at Pwn2Own Automotive 2024

The Synacktiv Team earned $100,000 for chaining three zero-day bugs to gain root permissions on a Tesla Modem and an additional $120,000 for hacking other EV charging stations.

---

SystemBC Malware's C2 Server Analysis Exposes Payload Delivery Tricks

SystemBC malware allows threat actors to control compromised hosts, deliver additional payloads, and use SOCKS5 proxies to mask network traffic to and from the command-and-control (C2) infrastructure.