Latest Cybersecurity News and Articles

---

Two Job-Related Campaigns Bear Hallmarks of North Korean Threat Actors

Researchers from Unit 42 have discovered two separate campaigns, named Contagious Interview and Wagemole, targeting job seekers. These campaigns are linked to state-sponsored threat actors associated with North Korea.

---

Kansas Officials Blame 5-Week Disruption of Court System on ‘Sophisticated Foreign Cyberattack’

Cybercriminals hacked into the Kansas court system, stole sensitive data and threatened to post it on the dark web in a ransomware attack that has hobbled access to records. The post Kansas Officials Blame 5-Week Disruption of Court System on ‘Sophisticated Foreign Cyberattack’ appeared first on SecurityWeek.

---

Retailers Brace for Cyber Threat Feast Ahead of Thanksgiving Shopping Weekend

Retailers are preparing for a surge in cyber threats during the Thanksgiving holiday and Black Friday weekend. Phishing attacks are a major concern, with threat groups using social engineering to bypass security measures.

---

AI Solutions Are the New Shadow IT

Ambitious Employees Tout New AI Tools, Ignore Serious SaaS Security RisksLike the SaaS shadow IT of the past, AI is placing CISOs and cybersecurity teams in a tough but familiar spot.  Employees are covertly using AI with little regard for established IT and cybersecurity review procedures. Considering ChatGPT’s meteoric rise to 100 million users within 60 days of launch, especially with little

---

Citrix, Gov Agencies Issue Fresh Warnings on CitrixBleed Vulnerability

Administrators are urged to patch the recent CitrixBleed NetScaler vulnerability as LockBit starts exploiting it. The post Citrix, Gov Agencies Issue Fresh Warnings on CitrixBleed Vulnerability appeared first on SecurityWeek.

---

Crypto Trading Firm Kronos Research Says $26 Million Stolen After Cyberattack

The attack on Kronos Research involved unauthorized access to the company's API keys, highlighting the importance of robust security measures in protecting against modern API attacks.

---

Smaller Businesses Embrace Generative AI Tools, Overlook Security Measures

With a significant increase in interest expected, organizations must quickly bridge the gap between generative AI tool usage and security by implementing measures such as zero-trust architecture and thorough security risk assessments.

---

CISA Orders Federal Agencies to Patch Looney Tunables Linux Bug

The vulnerability, known as "Looney Tunables" and tracked as CVE-2023-4911, allows attackers to gain root privileges on major Linux distributions. It affects popular platforms like Fedora, Ubuntu, and Debian.

---

How Multi-Stage Phishing Attacks Exploit QRs, CAPTCHAs, and Steganography

Attackers are exploiting CAPTCHA-based attacks by using CloudFlare's CAPTCHAs and randomized domain names to mask credential-harvesting forms on fake websites, making it difficult for automated security systems to identify them.

---

CISA Urges Federal Agencies to Patch Sophos Web Appliance Vulnerability Exploited in the Wild

CISA has added a critical pre-auth command injection vulnerability in Sophos Web Appliance to its Known Exploited Vulnerabilities catalog, which was patched by the company in April 2023.

---

SMBs Hit by Rise in Legitimate Tool-Based Attacks

Threat actors targeting small- and medium-sized businesses are increasingly using legitimate tools like remote monitoring and management software to evade detection and gain unauthorized access to networks.

---

CISA, FBI, MS-ISAC, and ASD’s ACSC Release Advisory on LockBit Affiliates Exploiting Citrix Bleed

The Cybersecurity and Infrastructure Security Agency (CISA), FBI, MS-ISAC, and ASD's ACSC have released a joint advisory in response to LockBit 3.0 ransomware affiliates exploiting a vulnerability in Citrix's NetScaler web application control.

---

ClearFake Campaign Expands to Deliver Atomic Stealer on Macs Systems

The macOS information stealer known as Atomic is now being delivered to target via a bogus web browser update chain tracked as ClearFake. "This may very well be the first time we see one of the main social engineering campaigns, previously reserved for Windows, branch out not only in terms of geolocation but also operating system," Malwarebytes' Jérôme Segura said in a Tuesday analysis. Atomic

---

LockBit Ransomware Exploiting Critical Citrix Bleed Vulnerability to Break In

Multiple threat actors, including LockBit ransomware affiliates, are actively exploiting a recently disclosed critical security flaw in Citrix NetScaler application delivery control (ADC) and Gateway appliances to obtain initial access to target environments. The joint advisory comes from the U.S. Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI),

---

UK: Secretary Fined For Accessing Scores of Patient Records

The Information Commissioner’s Office (ICO) said that a complaint was first lodged back in June 2019, after a patient raised concerns that their records had been improperly accessed by Loretta Alborghetti, from Redditch.

---

Play Ransomware Goes Commercial - Now Offered as a Service to Cybercriminals

Play ransomware attacks have shown little variation, suggesting that affiliates are following predefined playbooks provided with the RaaS, using identical tactics and commands.

---

CISA Releases Cybersecurity Guidance for Healthcare, Public Health Organizations

The guide incorporates vulnerability data, known exploited vulnerabilities, and the MITRE ATT&CK framework. It covers topics such as asset management, identity management, device security, vulnerabilities, patching, and secure design principles.

---

VX-Underground Malware Sharing Collective Framed by Phobos Ransomware

A new variant of the Phobos ransomware has been discovered, which attempts to frame VX-Underground. Phobos ransomware, which emerged in 2018, operates as a ransomware-as-a-service and has seen wide distribution through affiliated threat actors.

---

8Base Group Found Deploying a New Phobos Ransomware Variant

The 8Base ransomware attackers have incorporated a new variant of the Phobos ransomware and publicly available tools for financially motivated attacks. The variant used by the 8Base group includes features that can enable attackers to establish persistence on victims’ systems, perform speedy encryption, and remove backup and shadow copies. Organizations are recommended to keep track of the threats by following the latest IOCs associated with the ransomware.

---

Greater Paris Wastewater Agency Dealing with Cyberattack

The attack prompted SIAAP to file a complaint with authorities and take immediate measures to secure their systems to prevent further spread. It has prioritized maintaining the public sanitation service and is working to ensure a return to normalcy.