Latest Cybersecurity News and Articles

---

Regional Transportation Authority in New Zealand Hit by Suspected Ransomware Attack

The company has announced today that it's experiencing issues with its HOP services (integrated ticketing and fares system) as a cyber incident has impacted parts of its network.

---

Lockbit Ransomware Gang Hit the Carthage Area Hospital and the Clayton-Hepburn Medical Center in New York

The Lockbit ransomware group claims to have hacked two major hospitals, the Carthage Area Hospital and Claxton-Hepburn Medical Center. The two hospitals serve hundreds of thousands of people in upstate New York.

---

CISA announces open source software security roadmap

New roadmap articulates how CISA will enable the secure usage of open source software within the federal government.

---

Iranian APT Group Hits Thousands of Organizations With Password Spraying Attacks

The group used AzureHound and Roadtools to conduct reconnaissance in Microsoft Entra ID (formerly Azure Active Directory) environments and deployed multiple persistence mechanisms including the use of Azure Arc.

---

LokiBot Information Stealer Packs Fresh Infection Strategies

The malware targets Microsoft users and steals various types of data, including email credentials, payment card information, and cryptocurrency passwords. It is particularly appealing to less technically skilled individuals due to its ease of use.

---

Developer Platform Retool Breached in Vishing Attack

A threat actor impersonating an IT staff member conducted SMS-based phishing and a successful vishing attack to obtain authentication logins that led to the total account takeover of one Retool employee.

---

Mobile Verification Toolkit Enables Forensic analysis of Android and iOS Devices to Identify Compromise

MVT offers features like decrypting encrypted iOS backups, extracting installed applications from Android devices, and generating unified chronological timelines of extracted records.

---

Manchester Police Officers’ Data Stolen Following Ransomware Attack on Supplier

A ransomware attack on a third-party supplier has compromised the personal details of thousands of police officers with Greater Manchester Police (GMP) in North West England.

---

The Interdependence between Automated Threat Intelligence Collection and Humans

The volume of cybersecurity vulnerabilities is rising, with close to 30% more vulnerabilities found in 2022 vs. 2018. Costs are also rising, with a data breach in 2023 costing $4.45M on average vs. $3.62M in 2017. In Q2 2023, a total of 1386 victims were claimed by ransomware attacks compared with just 831 in Q1 2023. The MOVEit attack has claimed over 600 victims so far and that number is still

---

Google Agrees to $93 Million Settlement in California's Location-Privacy Lawsuit

Google has agreed to pay $93 million to settle a lawsuit filed by the U.S. state of California over allegations that the company's location-privacy practices misled consumers and violated consumer protection laws. "Our investigation revealed that Google was telling its users one thing – that it would no longer track their location once they opted out – but doing the opposite and continuing to

---

Microsoft Uncovers Flaws in ncurses Library Affecting Linux and macOS Systems

A set of memory corruption flaws have been discovered in the ncurses (short for new curses) programming library that could be exploited by threat actors to run malicious code on vulnerable Linux and macOS systems.

---

California Enacts First-of-its-Kind Bill Targeting Data Brokers

California lawmakers enacted unprecedented legislation late Wednesday allowing state residents to compel data brokers to delete their personal information with the push of a button.

---

Redline and Vidar Stealers Abuse EV Certificates, Deploy Ransomware

Threat actors behind RedLine and Vidar have streamlined their operations by adding well-established tactics to deceive victims. The victim initially receives an info stealer with Extended Validation (EV) code signing certificates, but later starts receiving ransomware payloads through the same channel. Experts advise organizations to adopt a proactive approach to thwart attacks early in the threat cycle.

---

DDoS 2.0: IoT Sparks New DDoS Alert

The Internet of Things (IoT) is transforming efficiency in various sectors like healthcare and logistics but has also introduced new security risks, particularly IoT-driven DDoS attacks. This article explores how these attacks work, why they’re uniquely problematic, and how to mitigate them. What Is IoT? IoT (Internet of Things) refers to online, interconnected devices that collect and exchange

---

NodeStealer Malware Now Targets Facebook Business Accounts on Multiple Browsers

An ongoing campaign is targeting Facebook Business accounts with bogus messages to harvest victims' credentials using a variant of the Python-based NodeStealer and potentially take over their accounts for follow-on malicious activities.  "The attacks are reaching victims mainly in Southern Europe and North America across different segments, led by the manufacturing services and technology

---

Windows 11 ‘ThemeBleed’ RCE Flaw Gets Proof-of-Concept Exploit

Proof-of-concept exploit code has been published for a Windows Themes vulnerability tracked as CVE-2023-38146 that allows remote attackers to execute code. The vulnerability has a high-severity score of 8.8.

---

Update: MGM Resorts Disruption Linked to Recent Attacks Against Hospitality Industry

The MGM Resorts cyber disruption may be part of a larger wave of malicious activity targeting the hospitality industry in recent weeks, including a late August ransomware attack against Caesars Entertainment, according to security researchers.

---

Watch Out, This LastPass Email With “Important Information About Your Account” is a Phish

LastPass users who were affected by the data breach last year are now being targeted by highly convincing phishing emails. The phishing emails ask users to verify their personal data or risk losing access to certain features on their accounts.

---

N-Able's Take Control Agent Vulnerability Exposes Windows Systems to Privilege Escalation

Tracked as CVE-2023-27470 (CVSS score: 8.8), the issue relates to a Time-of-Check to Time-of-Use (TOCTOU) race condition vulnerability, which, when successfully exploited, could be leveraged to delete arbitrary files on a Windows system.

---

Cybercriminals Combine Phishing and EV Certificates to Deliver Ransomware Payloads

The threat actors behind RedLine and Vidar information stealers have been observed pivoting to ransomware through phishing campaigns that spread initial payloads signed with Extended Validation (EV) code signing certificates. "This suggests that the threat actors are streamlining operations by making their techniques multipurpose," Trend Micro researchers said in a new analysis published this