Latest Cybersecurity News and Articles

---

Meta Fights Sprawling Chinese ‘Spamouflage’ Operation

The network typically posted praise for China and its Xinjiang province and criticisms of the United States, Western foreign policies, and critics of the Chinese government including journalists and researchers, the Meta report says.

---

80% of organizations expect ransomware spending to increase

Ransomware was analyzed in a recent report by Enterprise Strategy Group (ESG) finding that ransomware is seen as a top threat for organizations.

---

Chinese Hacking Group Exploits Barracuda Zero-Day to Target Government, Military, and Telecom

A suspected Chinese-nexus hacking group exploited a recently disclosed zero-day flaw in Barracuda Networks Email Security Gateway (ESG) appliances to breach government, military, defense and aerospace, high-tech industry, and telecom sectors as part of a global espionage campaign. Mandiant, which is tracking the activity under the name UNC4841, described the threat actor as "highly responsive to

---

DarkGate Malware Activity Spikes as Developer Rents Out Malware to Affiliates

A new malspam campaign has been observed deploying an off-the-shelf malware called DarkGate. "The current spike in DarkGate malware activity is plausible given the fact that the developer of the malware has recently started to rent out the malware to a limited number of affiliates," Telekom Security said in a report published last week. The latest findings build on recent findings from security

---

86% of organizations using AI agree on need for clear AI guidelines

Organizations' leadership and workforce were surveyed by Conversica on artificial intelligence (AI) use and opinions, including data security.

---

Compromised OpenCart Payment Module Steals Credit Card Information

Attackers are increasingly using backend PHP infections, making it more challenging to detect Magecart infections without access to the compromised website's backend code.

---

Is the Cybersecurity Community’s Obsession With Compliance Counter-Productive?

Cybersecurity professionals should focus on effectively defending their organizations against common breach types, rather than prioritizing compliance and checking boxes on audit forms.

---

Android Banking Trojan MMRat Carries Out Bank Fraud via Fake App Stores

MMRat uses customized command-and-control protocols and remains undetected on VirusTotal, highlighting its ability to evade detection and exploit large volumes of data transfer.

---

CISA publishes resource for migrating to post-quantum cryptography  

CISA urges organizations to begin early planning for migration to post-quantum cryptographic standards by developing quantum-readiness roadmaps.

---

Web Control, Crime Patrol or Real Pawns in Cybercrime

A group of young employees in Hyderabad ran a sophisticated scam using VOIP to target unsuspecting people in the U.S. and trick them into buying gift cards, which were then converted into cryptocurrency and Indian Rupees.

---

Study finds increase in cybersecurity attacks fueled by generative AI

A new report analyzes stressors caused by generative AI, with 51% of security professionals saying they are likely to leave their job over the next year.

---

Spainish Police Warns of LockBit Locker Ransomware Phishing Attacks

"A wave of sending emails to architecture companies has been detected, although it is not ruled out that they extend their action to other sectors," reads the machine-translated police announcement.

---

Survey Provides Takeaways for Security Pros to Operationalize their Remediation Life Cycle

Ask any security professional and they’ll tell you that remediating risks from various siloed security scanning tools requires a tedious and labor-intensive series of steps focused on deduplication, prioritization, and routing of issues to an appropriate “fixer” somewhere in the organization. This burden on already resource-strapped security teams is an efficiency killer.  A new study,

---

IT Leaders Alarmed by Generative Ai’s SAAS Security Implications

IT leaders are grappling with anxiety over the risks of generative AI despite continued confidence in their software-as-a-service (SaaS) security posture, according to Snow Software.

---

Global Cybercrime Treaty Could be ‘Disastrous for Human Rights,’ NGOs Warn

Human rights organizations are sounding alarm about a United Nations cybercrime treaty being negotiated this week in New York, warning that the rules could expand government surveillance powers and give dictatorships further tools of repression.

---

Phishing-as-a-Service Gets Smarter: Microsoft Sounds Alarm on AiTM Attacks

Microsoft is warning of an increase in adversary-in-the-middle (AiTM) phishing techniques, which are being propagated as part of the phishing-as-a-service (PhaaS) cybercrime model.

---

Privacy Regulators Tell Social Media Companies to Fear the Scrapers

Social media companies and other businesses have an obligation to protect users’ publicly available information from data scrapers that gather it for unintended purposes, an international group of privacy regulators said last week.

---

Japan's JPCERT Warns of New 'MalDoc in PDF' Attack Technique

Japan’s computer emergency response team (JPCERT) has recently observed a new attack technique, called ‘MalDoc in PDF’, that bypasses detection by embedding a malicious Word file into a PDF file.

---

Citrix NetScaler Alert: Ransomware Hackers Exploiting Critical Vulnerability

Unpatched Citrix NetScaler systems exposed to the internet are being targeted by unknown threat actors in what's suspected to be a ransomware attack. Cybersecurity company Sophos is tracking the activity cluster under the moniker STAC4663. Attack chains involve the exploitation of CVE-2023-3519, a critical code injection vulnerability impacting NetScaler ADC and Gateway servers that could

---

Corporate Boards Expand Cybersecurity Risk Oversight, Report Finds

With new Securities and Exchange Commission disclosure rules set to take effect in early September, a study from the EY Center for Board Matters shows director oversight of cybersecurity at Fortune 100 companies is rapidly evolving.