Latest Cybersecurity News and Articles

---

Update: Staples Confirms Cyberattack Behind Service Outages, Delivery Issues

Additionally, there are unconfirmed reports that Staples employees have been instructed to avoid logging into Microsoft 365 using single sign-on (SSO) and that call center employees have been sent home for two consecutive days.

---

37% of adults change passwords following a scam

According to a survey by Citi, 27% of U.S. adults have fallen victim to a financial scam despite 90% feeling confident that they could detect scams.

---

Associated Press, ESPN, CBS among top sites serving fake virus alerts

Threat actors dabbles in obfuscation and evasion techniques. However, as previously detailed by Confiant, they are using much more advanced tricks. Their JavaScript uses obfuscation with changing variable names, making identification harder.

---

68% of US Websites Exposed to Bot Attacks

As per DataDome’s report shared with Hackread.com ahead of publication on Tuesday, 72.3% of e-commerce websites and 65.2% of classified ad websites failed the bot tests, whereas 85% of DataDome’s fake Chrome bots remained undetected.

---

NCSC statement following exploitation of Unitronics programmable logic controllers

NCSC supports US advisory regarding exploitation of Unitronics programmable logic controllers used in the water sector.

---

Hackers Using Weaponized Invoice To Deliver LUMMA Malware

Cybersecurity analysts identified that the attacker, posing as a financial services company in this campaign, tricks the target with a fake invoice email. The attacker dodges detection using a fake page and a real link.

---

Booking.com Customers Scammed in Novel Social Engineering Campaign

The scam is proving so fruitful that sales of Booking.com portal credentials are commanding sale prices of up to $2000 in two cybercrime forums, according to the researchers.

---

Thanksgiving Hack on North Carolina City Caused Leak of Employee Data

The attack on Hendersonville is the latest incident affecting a North Carolina government institution since the state became the first in the nation to ban payments to ransomware gangs.

---

Mississippi received the most spam calls per month in 2023

A recent Truecaller report found that Americans receive an average of six spam calls a month, with Mississippi receiving the highest number of calls.

---

New Jersey, Pennsylvania Hospitals Affected by Cyberattacks

The company’s IT team said it is working to restore hospital systems and data but noted that its emergency rooms are still open to those in need of care. Some elective surgeries have been moved to later dates.

---

88% of IT leaders have met compliance requirements

According to a recent report by AppDirect, 45% of IT leaders faced a security breach within the last year and 49% consider human error as top concern.

---

CISA Warns of Unitronics PLC Exploitation Following Water Utility Hack

In the case of the Municipal Water Authority of Aliquippa, CISA noted that the attackers likely accessed the ICS device “by exploiting cybersecurity weaknesses, including poor password security and exposure to the internet”.

---

Claiming Zoom Rooms Service Accounts to Gain Access to Tenants

The finding highlights the potential misuse of service accounts to gain unauthorized access to SaaS systems. Abusing the bug enabled attackers to predict service account email addresses, hijack the accounts, and collect sensitive information.

---

Zyxel Security Advisory for Authentication Bypass and Command Injection Vulnerabilities in NAS products

Three Command injection vulnerabilities have been discovered in Zyxel NAS (Network Attached Storage) products, which could allow a threat actor to execute system commands on successful exploitation of these vulnerabilities.

---

Survey shows AI-powered cybersecurity tools adoption uncertainty

A new survey reveals that although security leaders see AI as superior at identifying threats, the widespread adoption of large language models is not likely on the horizon.

---

Google Unveils RETVec - Gmail's New Defense Against Spam and Malicious Emails

Google has revealed a new multilingual text vectorizer called RETVec (short for Resilient and Efficient Text Vectorizer) to help detect potentially harmful content such as spam and malicious emails in Gmail. "RETVec is trained to be resilient against character-level manipulations including insertion, deletion, typos, homoglyphs, LEET substitution, and more," according to the project's

---

Qlik Sense Vulnerabilities Exploited in Ransomware Attacks

Qlik Sense vulnerabilities CVE-2023-41266, CVE-2023-41265 and CVE-2023-48365 exploited for initial access in Cactus ransomware attacks.  The post Qlik Sense Vulnerabilities Exploited in Ransomware Attacks appeared first on SecurityWeek.

---

Dollar Tree Hit by Third-Party Data Breach Impacting Two Million People

Dollar Tree's service provider, Zeroed-In, suffered a security incident between August 7 and 8, 2023. As part of this cyberattack, the threat actors managed to steal data containing the personal information of Dollar Tree and Family Dollar employees.

---

Black Basta Ransomware Group Received Over $100 Million From 90 Victims

The Black Basta ransomware group has infected over 300 victims and received more than $100 million in ransom payments. The post Black Basta Ransomware Group Received Over $100 Million From 90 Victims appeared first on SecurityWeek.

---

US Sanctions Cryptocurrency Mixer Sinbad for Aiding North Korean Hackers

US Treasury sanctions Sinbad, saying the cryptocurrency mixer is laundering funds for North Korean hacking group Lazarus. The post US Sanctions Cryptocurrency Mixer Sinbad for Aiding North Korean Hackers appeared first on SecurityWeek.