Latest Cybersecurity News and Articles
11 September 2023
A new cyber attack campaign is leveraging the PowerShell script associated with a legitimate red teaming tool to plunder NTLMv2 hashes from compromised Windows systems primarily located in Australia, Poland, and Belgium.
The activity has been codenamed Steal-It by Zscaler ThreatLabz.
"In this campaign, the threat actors steal and exfiltrate NTLMv2 hashes using customized versions of Nishang's
11 September 2023
A new malware loader called HijackLoader is gaining traction among the cybercriminal community to deliver various payloads such as DanaBot, SystemBC, and RedLine Stealer.
"Even though HijackLoader does not contain advanced features, it is capable of using a variety of modules for code injection and execution since it uses a modular architecture, a feature that most loaders do not have," Zscaler
11 September 2023
W3LL, an initially obscure threat group, has transformed into a significant player in the cyber underworld, selling a phishing kit called W3LL Panel and 16 specialized tools for BEC attacks. Group-IB identified close to 850 unique phishing websites attributed to the W3LL Panel. Phishing kits remain a potential threat in today’s dynamic threat landscape, which emphasizes the importance of staying up-to-date about changing TTPs used by threat actors.
11 September 2023
Cybercriminals were observed exploiting Google Looker Studio to create counterfeit cryptocurrency phishing websites. Through this, attackers aim to deceive recipients into revealing their crypto wallet login details. Check Point recommends implementing a comprehensive security posture with document and file scanning abilities and deploying a solid URL protection system.
11 September 2023
In this edition of Security’s Top 5 from Security magazine, we showcase the top stories and new developments from across the security industry throughout August.
10 September 2023
Joint white paper from the NCSC and NCA details how organised criminal groups have evolved as ransomware and extortion attacks have grown.
09 September 2023
The CISA added CVE-2023-33246 to its Known Exploited Vulnerabilities Catalog. It means government agencies have until September 27 to apply a vendor patch to affected systems, although private enterprises are encouraged to follow suit.
09 September 2023
As part of the observed attacks, threat actors are using Google Looker Studio to create fake crypto pages that are then delivered to the intended victims in emails sent from the legitimate tool itself.
09 September 2023
Notepad++ version 8.5.7 has been released with fixes for multiple buffer overflow zero-days, with one marked as potentially leading to code execution by tricking users into opening specially crafted files.
09 September 2023
Spyware masquerading as modified versions of Telegram have been spotted in the Google Play Store that’s designed to harvest sensitive information from compromised Android devices.
According to Kaspersky security researcher Igor Golovin, the apps come with nefarious features to capture and exfiltrate names, user IDs, contacts, phone numbers, and chat messages to an actor-controlled server.
The
09 September 2023
The individuals targeted by the sanctions “include key actors involved in management and procurement for the Trickbot group, which has ties to Russian intelligence services,” according to the U.S. Treasury.
09 September 2023
A new campaign has been discovered with similarities to a previous campaign, including the use of social media sites to build rapport with targets. The threat actors then engage in encrypted messaging and send a malicious file with a 0-day exploit.
09 September 2023
Researchers at Akamai have unearthed a concerning shift in the behavior of dynamically seeded Domain Generation Algorithm (DGA) families within Domain Name System (DNS) traffic data.
09 September 2023
A legitimate Windows tool used for creating software packages called Advanced Installer is being abused by threat actors to drop cryptocurrency-mining malware on infected machines since at least November 2021.
"The attacker uses Advanced Installer to package other legitimate software installers, such as Adobe Illustrator, Autodesk 3ds Max, and SketchUp Pro, with malicious scripts and uses
09 September 2023
CISA, FBI, and CNMF confirmed that nation-state APT actors exploited CVE-2022-47966 to gain unauthorized access to a public-facing application (Zoho ManageEngine ServiceDesk Plus), establish persistence, and move laterally through the network.
09 September 2023
Attackers execute malicious scripts through a feature of the installer called Custom Action, dropping several payloads — including the M3_Mini_Rat client stub backdoor, Ethereum mining malware PhoenixMiner, and multi-coin mining threat lolMiner.
08 September 2023
The API threat landscape, including data breaches, sprawl, DDoS attacks and zero trust, was analyzed in a recent report by Traceable AI.
08 September 2023
The U.K. and U.S. governments on Thursday sanctioned 11 individuals who are alleged to be part of the notorious Russia-based TrickBot cybercrime gang.
“Russia has long been a safe haven for cybercriminals, including the TrickBot group,” the U.S. Treasury Department said, adding it has “ties to Russian intelligence services and has targeted the U.S. Government and U.S. companies, including
08 September 2023
Apple on Thursday released emergency security updates for iOS, iPadOS, macOS, and watchOS to address two zero-day flaws that have been exploited in the wild to deliver NSO Group's Pegasus mercenary spyware.
08 September 2023
A series of unfortunate events allowed the China-backed adversary, which Microsoft tracks as Storm-0558, to gain ‘lawful’ access to the Exchange Online and Azure Active Directory (now called Microsoft Entra ID) accounts of 25 organizations.