Latest Cybersecurity News and Articles

---

'Gold Melody' Group Sells Access to Compromised Networks to Ransomware Attackers

GOLD MELODY uses a variety of tools and techniques, including web shells, RATs, and tunneling tools, to facilitate their malicious activities within compromised environments.

---

Solarium Commission Wants Action on Stalled Cybersecurity Recommendations

Three years since its release, nearly 70% of the congressionally mandated Solarium Commission’s 80 initial recommendations have been implemented or are close to it, a testament to the report’s influence.

---

Researchers Raise Red Flag on P2PInfect Malware with 600x Activity Surge

The peer-to-peer (P2) worm known as P2PInfect has witnessed a surge in activity since late August 2023, witnessing a 600x jump between September 12 and 19, 2023. "This increase in P2PInfect traffic has coincided with a growing number of variants seen in the wild, suggesting that the malware's developers are operating at an extremely high development cadence," Cado Security researcher Matt Muir

---

Critical Infrastructure Organizations Warned of Snatch Ransomware Attacks

Prior to ransomware deployment, the Snatch threat actors spend up to three months on victims’ networks, searching for valuable data to exfiltrate and identifying systems they can encrypt. They also attempt to disable security software.

---

The Rise of the Malicious App

Security teams are familiar with threats emanating from third-party applications that employees add to improve their productivity. These apps are inherently designed to deliver functionality to users by connecting to a “hub” app, such as Salesforce, Google Workspace, or Microsoft 365. Security concerns center on the permission scopes that are granted to the third party apps, and the potential

---

UK Passes the Online Safety Bill — And No, It Doesn’t Ban End-to-End Encryption

The UK's Online Safety Bill does not ban end-to-end encryption but includes provisions for messaging platforms to use accredited technology to identify specific types of content.

---

LLM Guard: Open-Source Toolkit for Securing Large Language Models

The open-source toolkit provides evaluators for inputs and outputs of LLMs, offering features such as sanitization, detection of harmful language, data leakage prevention, and protection against prompt injection and jailbreak attacks.

---

China Accuses U.S. of Decade-Long Cyber Espionage Campaign Against Huawei Servers

China's Ministry of State Security (MSS) has accused the U.S. of breaking into Huawei's servers, stealing critical data, and implanting backdoors since 2009, amid mounting geopolitical tensions between the two countries. In a message posted on WeChat, the government authority said U.S. intelligence agencies have "done everything possible" to conduct surveillance, secret theft, and intrusions on

---

T-Mobile App Glitch Let Users See Other People’s Account Info

According to user reports on social media, the exposed information included customers' names, phone numbers, addresses, account balances, and credit card details like the expiration dates and the last four digits.

---

Australia to Build ‘Six Cyber Shields’ to Defend Nation

Australia is rolling out a six-pillar cyber security strategy to safeguard its digital interests, covering education, technology safety, threat-sharing, infrastructure protection, infosec capability, and global coordination.

---

Cyber Group 'Gold Melody' Selling Compromised Access to Ransomware Attackers

A financially motivated threat actor has been outed as an initial access broker (IAB) that sells access to compromised organizations for other adversaries to conduct follow-on attacks such as ransomware. SecureWorks Counter Threat Unit (CTU) has dubbed the e-crime group Gold Melody, which is also known by the names Prophet Spider (CrowdStrike) and UNC961 (Mandiant). "This financially motivated

---

Update: Transunion Denies it Was Hacked, Links Leaked Data to Third Party

The investigation into the claims found that the information leaked by USDoD was likely obtained from another organization's systems, given that the data and its formatting are different than TransUnion's.

---

Ukrainian Hacker Suspected to be Behind "Free Download Manager" Malware Attack

The maintainers of Free Download Manager (FDM) have acknowledged a security incident dating back to 2020 that led to its website being used to distribute malicious Linux software. "It appears that a specific web page on our site was compromised by a Ukrainian hacker group, exploiting it to distribute malicious software," it said in an alert last week. "Only a small subset of users, specifically

---

CIO Accuses Penn State of Faking Cybersecurity Compliance

Pennsylvania State University (Penn State) is facing a lawsuit filed by a former chief information officer (CIO) who alleges that the university falsified government security compliance reports.

---

White House Grapples With Harmonizing Thicket of Cybersecurity Rules

Recently, the White House has begun streamlining the myriad of cybersecurity regulations and technical standards that corporations and critical infrastructure must follow.

---

Another $40m Dispersed to Western Union Fraud Victims

The new $40m tranche of money was forfeited by the Colorado-headquartered financial services giant to the Department of Justice (DoJ) to reimburse 25,000 victims in the US and abroad.

---

Fake CVE-2023-40477 Proof of Concept Leads to VenomRAT

Threat actors are repurposing older proof of concept code to create fake PoCs for newly released vulnerabilities, aiming to compromise other miscreants rather than specifically targeting researchers.

---

AMBERSQUID Cryptojacking Operation: Unusual AWS Services Under Attack

The AMBERSQUID cryptojacking operation targets obscure AWS services like AWS Amplify, AWS Fargate, and Amazon SageMaker, effectively bypassing AWS's resource approval process to mine cryptocurrency covertly. If AMBERSQUID were to expand its scope to target all AWS regions, it could potentially lead to daily losses exceeding $10,000. To counter such threats, organizations must intensify vigilance, deploy robust monitoring systems, and enforce strict access controls. 

---

Beware: Fake Exploit for WinRAR Vulnerability on GitHub Infects Users with VenomRAT

A malicious actor released a fake proof-of-concept (PoC) exploit for a recently disclosed WinRAR vulnerability on GitHub with an aim to infect users who downloaded the code with VenomRAT malware. "The fake PoC meant to exploit this WinRAR vulnerability was based on a publicly available PoC script that exploited a SQL injection vulnerability in an application called GeoServer, which is tracked as

---

Ransomware cyber insurance claims rose by 27%

Cyber insurance claims and trends were analyzed in a recent report finding a 12% increase in cyber claims over the first six months of the year.