Latest Cybersecurity News and Articles

---

Why is .US Being Used to Phish So Many of Us?

Domain names ending in “.US” — the top-level domain for the United States — are among the most prevalent in phishing scams, new research shows. This is noteworthy because .US is overseen by the U.S. government, which is frequently the target of phishing domains ending in .US. Also, .US domains are only supposed to be available to U.S. citizens and to those who can demonstrate that they have a physical presence in the United States.

---

Malware top consumer threat from May to July 2023

According to a cybersecurity trends report, malware was the top online consumer threat from May to July 2023, accounting for 58% of all detections.

---

Classiscam Scam-as-a-Service Raked in $64.5 Million During the COVID-19 Pandemic

Among the methods employed by cybercriminals to carry out the scheme is to trick users into buying falsely-advertised goods or services via social engineering schemes and directing potential victims to the automatically generated phishing sites.

---

CISA report: Russian cyber actors using “Infamous Chisel” malware

CISA recently published a joint report on a malware campaign conducted by Russian cyber actors against the Ukrainian military.

---

Russian GRU Hacking Tools Dubbed 'Infamous Chisel' Targeting Ukrainian Military Devices

Western intelligence and cybersecurity agencies published a report on Thursday highlighting a collection of hacking tools being used by Russia’s military intelligence service against Android devices operated by the Ukrainian Armed Forces.

---

Rising Cyber Incidents Challenge Healthcare Organizations

Healthcare organizations are facing many cybersecurity challenges that require them to increasingly prioritize cybersecurity and compliance, according to a report by Claroty.

---

Open-Source Information Stealer 'SapphireStealer' Enables Credential and Data Theft

Multiple actors are using SapphireStealer, modifying and improving the original code to create several variants. The malware is often delivered through multi-stage infection processes, with attackers using open-source loaders like FUD-Loader.

---

Russian State-Backed 'Infamous Chisel' Android Malware Targets Ukrainian Military

Cybersecurity and intelligence agencies from Australia, Canada, New Zealand, the U.K., and the U.S. on Thursday disclosed details of a mobile malware strain targeting Android devices used by the Ukrainian military. The malicious software, dubbed Infamous Chisel and attributed to a Russian state-sponsored actor called Sandworm, has capabilities to “enable unauthorized access to compromised

---

"Smishing Triad" Targeted USPS and US Citizens for Data Theft

The campaign, conducted by a group called "Smishing Triad," impersonates various postal services and government agencies to deceive victims into providing personal and financial information.

---

New SuperBear Trojan Emerges in Targeted Phishing Attack on South Korean Activists

A new phishing attack likely targeting civil society groups in South Korea has led to the discovery of a novel remote access trojan called SuperBear. The intrusion singled out an unnamed activist, who was contacted in late August 2023 and received a malicious LNK file from an address impersonating a member of the organization, non-profit entity Interlabs said in a new report. The LNK file, upon

---

It's a Zero-day? It's Malware? No! It's Username and Password

As cyber threats continue to evolve, adversaries are deploying a range of tools to breach security defenses and compromise sensitive data. Surprisingly, one of the most potent weapons in their arsenal is not malicious code but simply stolen or weak usernames and passwords. This article explores the seriousness of compromised credentials, the challenges they present to security solutions, and the

---

Update: ALPHV Group Takes Credit for Ransomware Attack on Georgia County

Forsyth County officials had acknowledged an attack in June, but offered few details about what happened. On Tuesday, AlphV took credit for the attack and added the county to its leak site, threatening to expose 350GB of allegedly stolen data.

---

Prime Therapeutics LLC (Prime)/Magellan Rx Issues Notification of Data Security Incident

On July 11, 2023, Prime became aware that an unauthorized actor obtained access to an employee's mobile email account containing documents that included members' PHI, including name, address, date of birth, member ID number, and medication(s).

---

Multiple Threats Target Adobe ColdFusion Vulnerabilities

Attackers are using the ColdFusion vulnerability to probe, establish reverse shells, and distribute malware, including XMRig Miner, Satan DDoS/Lucifer, RudeMiner, and BillGates/Setag backdoor.

---

Peeling Back the Layers of RemcosRAT Malware

The Remcos RAT utilizes complex obfuscation techniques to evade detection and deliver a sophisticated remote access payload. It has multiple stages of execution, including VBS and PowerShell scripts, to download and execute the final payload.

---

Classiscam Scam-as-a-Service Raked $64.5 Million During the COVID-19 Pandemic

The Classiscam scam-as-a-service program has reaped the criminal actors $64.5 million in illicit earnings since its emergence in 2019. "Classiscam campaigns initially started out on classified sites, on which scammers placed fake advertisements and used social engineering techniques to convince users to pay for goods by transferring money to bank cards," Group-IB said in a new report. "Since

---

The NCSC announces Ollie Whitehouse as new CTO

Ollie Whitehouse has been announced as the new CTO of the National Cyber Security Centre.

---

Earth Estries Group Targets Government and IT Organizations

A new cyberespionage campaign called Earth Estries has been discovered, targeting governments and organizations in the technology sector. Active since at least 2020, the campaign shows similarities with another APT group called FamousSparrow. It is essential for organizations to track and analyze the tactics and techniques used by Earth Estries to set their security preferences and protect their digital assets. 

---

Unmasking Trickbot, One of the World’s Top Cybercrime Gangs

Maksim Sergeevich Galochkin, a member of the Russian cybercrime syndicate Trickbot, has been identified by cybercrime researchers. The identification of Galochkin comes after a comprehensive investigation into leaked data from the Trickbot group.

---

BadBazaar Espionage Tool Targets Android Users

ESET discovered two active campaigns distributing trojanized Signal and Telegram apps that aim to exfiltrate user data and spy on victims’ communications. They have been spreading the BadBazaar Android spyware. Mitigation includes cautious app selection, avoiding suspicious sources, and maintaining up-to-date security measures.