Latest Cybersecurity News and Articles

---

Meet Rhysida, a New Ransomware Strain That Deletes Itself

The Rhysida ransomware-as-a-service (RaaS) operation has targeted Brazil's popular PIX payment system since December 2022, using a unique self-deletion mechanism and compatibility with older versions of Windows.

---

Unmasking Vacum Stealer: The Malware Plotting Cryptocurrency Plunder

Vacum Stealer is a dangerous malware that can transfer cryptocurrency from users' wallets without requiring any additional confirmation, posing a significant risk to unsuspecting individuals.

---

Cybercriminals Leak Patient Pictures in Low Blow Bid to Win Ransom

A newly emerged ransomware gang, Hunters International, is resorting to morally questionable tactics by leaking patients' pre-operation pictures in order to hasten ransom negotiations.

---

Iranian Group Tortoiseshell Launches New Wave of IMAPLoader Malware Attacks

The Iranian threat actor known as Tortoiseshell has been attributed to a new wave of watering hole attacks that are designed to deploy a malware dubbed IMAPLoader. "IMAPLoader is a .NET malware that has the ability to fingerprint victim systems using native Windows utilities and acts as a downloader for further payloads," the PwC Threat Intelligence said in a Wednesday analysis. "It uses email

---

Update: Grammarly Says It Corrected Sign-in Vulnerabilities After Alert From Cyber Researchers

The vulnerabilities could have allowed attackers to leak credentials and take over user accounts. No Grammarly accounts were compromised, and the company thanked the researchers for reporting the issue.

---

Critical Flaw in NextGen's Mirth Connect Could Expose Healthcare Data

Users of Mirth Connect, an open-source data integration platform from NextGen HealthCare, are being urged to update to the latest version following the discovery of an unauthenticated remote code execution vulnerability. Tracked as CVE-2023-43208, the vulnerability has been addressed in version 4.4.1 released on October 6, 2023. "This is an easily exploitable, unauthenticated remote code

---

YoroTrooper: Researchers Warn of Kazakhstan's Stealthy Cyber Espionage Group

A relatively new threat actor known as YoroTrooper is likely made of operators originating from Kazakhstan. The assessment, which comes from Cisco Talos, is based on their fluency in Kazakh and Russian, use of Tenge to pay for operating infrastructure, and very limited targeting of Kazakhstani entities, barring the government's Anti-Corruption Agency. "YoroTrooper attempts to obfuscate the

---

78% of fintech leaders report concern over compliance training

The current risks within the financial technology (fintech) sector and new compliance regulations were analyzed in a recent report by Fenergo. 

---

‘YoroTrooper’ Espionage Group Linked to Kazakhstan

Cisco links the espionage-focused ‘YoroTrooper’ threat actor to Kazakhstan. The post ‘YoroTrooper’ Espionage Group Linked to Kazakhstan appeared first on SecurityWeek.

---

Apple Ships Major iOS, macOS Security Updates

Apple patches dozens of serious security flaws in its macOS and iOS platforms, warning that hackers could launch code execution exploits. The post Apple Ships Major iOS, macOS Security Updates appeared first on SecurityWeek.

---

Firefox, Chrome Updates Patch High-Severity Vulnerabilities

Firefox and Chrome updates released this week resolve multiple high-severity memory safety vulnerabilities. The post Firefox, Chrome Updates Patch High-Severity Vulnerabilities appeared first on SecurityWeek.

---

Alleged Airbnb Data Breach Allegedly Exposes 1.2 Million User Records

This breach raises concerns about the security and privacy of Airbnb's user base, as the stolen data can be used for malicious purposes such as identity theft and phishing.

---

10% of organizations have a formal AI policy in place

Security leaders were surveyed by ISACA on generative AI uses and policies within the workplace, finding 10% of organizations have a formal policy.

---

Over 9,500 Bank of Canton Customers May Have had Personal Information Exposed Due to Vendor Breach

The breach was caused by a vulnerability in Fiserv's MOVEit managed file transfer application. Fiserv has patched the vulnerability, and the bank is monitoring for unusual activity.

---

VMware Releases Patch for Critical vCenter Server RCE Vulnerability

VMware has released security updates to address a critical vulnerability in their vCenter Server software. The flaw, known as CVE-2023-34048, allows for remote code execution and is of critical severity (CVSS score: 9.8).

---

Cl0p named 'nastiest' malware of 2023

Malware threat actors in 2023 were ranked in a report by OpenText Cybersecurity, finding that the list was topped by four new ransomware groups.

---

Kazakhstan-Associated Yorotrooper Disguises Origin of Attacks as Azerbaijan

The threat actor attempts to disguise their origin by hosting infrastructure in Azerbaijan and using the Azerbaijani language in their operations, despite not being fluent in Azerbaijani.

---

Ukrainian Cyber Officials Warn of Surge in SmokeLoader Attacks on Financial, Government Entities

Smokeloader malware is a highly complex tool that can perform various malicious functions, such as stealing credentials and executing DDoS attacks, with prices ranging from $400 to $1,650 depending on the package.

---

CoinFlip Data Breach Exposes Personal Information of Over 36,000 Customers

The breach, which occurred on August 7, 2023, was discovered a day later and the cybercriminals were removed from CoinFlip's systems with the assistance of their IT team.

---

Mandiant Intelligence Chief Raises Alarm Over China’s ‘Volt Typhoon’ Hackers in US Critical Infrastructure

Mandiant's Chief analyst urges critical infrastructure defenders to work on finding and removing traces of Volt Typhoon, a Chinese government-backed hacking team caught in a series of eyebrow-raising attacks against targets in Guam and the United States. The post Mandiant Intelligence Chief Raises Alarm Over China’s ‘Volt Typhoon’ Hackers in US Critical Infrastructure appeared first on SecurityWeek.