Latest Cybersecurity News and Articles

---

New TZW Ransomware Unlocked; Belongs to Adhubllka Family

Security researchers at Netenrich laid bare a previously misclassified strain of ransomware, TZW, as part of the Adhubllka ransomware family. Unlike other high-profile ransomware campaigns, TZW targets individuals and small businesses, demanding small ransoms ranging from $800 to $1,600. This study underscores how ransomware is intricately designed to confuse those seeking to counter cybercriminals.

---

Attackers can Discover IP Addresses by Sending Links Over the Skype Mobile App

A security researcher discovered that it's possible to discover a target’s IP address by sending a link over the Skype mobile app. The researcher pointed out that the attack only requires the target to open the message.

---

Update: Two Men Arrested Following Poland Railway Hacking

Polish police on Sunday arrested two men suspected of illegally hacking into the national railway’s communications network, which destabilized traffic in some areas of the country this weekend.

---

Cyber Info-Sharing Guide for Healthcare Sector Updated

Public-private cybersecurity councils urged the healthcare industry to be more expansive in sharing signs of hacking, warning that traditional indicators aren't enough to defend against modern cybersecurity threats.

---

Ransomware Attack Cleanup Costs: $10M So Far for Rackspace

The San Antonio, Texas, company's multi-million expenditure includes "costs to investigate and remediate, legal and other professional services, and supplemental staff resources that were deployed to provide support to customers."

---

Attacks on Citrix NetScaler Systems Linked to Ransomware Actor

A threat actor believed to be tied to the FIN8 hacking group exploits the CVE-2023-3519 remote code execution flaw to compromise unpatched Citrix NetScaler systems in domain-wide attacks.

---

Cybercriminals Used Just Three Malware Loaders to Launch 80% of Attacks, Deets Inside

ReliaQuest has identified the top malware loaders that have been causing trouble for SOC teams. These loaders are often used by threat actors to gain initial access to a network and drop payloads for further exploitation. The top seven most observed malware loaders from January 1 to July 31, 2023, include QakBot, SocGholish, Raspberry Robin, Gootloader, Guloader, Chromeloader, and Ursnif.

---

Phishing-as-a-Service Gets Smarter: Microsoft Sounds Alarm on AiTM Attacks

Microsoft is warning of an increase in adversary-in-the-middle (AiTM) phishing techniques, which are being propagated as part of the phishing-as-a-service (PhaaS) cybercrime model. In addition to an uptick in AiTM-capable PhaaS platforms, the tech giant noted that existing phishing services like PerSwaysion are incorporating AiTM capabilities. "This development in the PhaaS ecosystem enables

---

Gregory Thompson appointed as first CISO at Vantage Data Centers

Gregory Thompson has been appointed as Chief Information Security Officer at Vantage Data Centers. Thompson is the first CISO at the company. 

---

Key takeaways from BlackHat 2023

The best cyber defenses will only go so far. As Ukraine has shown, cyberattacks are not the only way to take down critical infrastructure.

---

Signs of Malware Attack Targeting Rust Developers Found on Crates.io

The Rust Foundation was notified and it quickly removed the packages and locked the uploader’s account. GitHub was also notified and took action against the associated account.

---

Uncovering a Privacy-Preserving Approach to Machine Learning

In the era of data-driven decision making, businesses are harnessing the power of machine learning (ML) to unlock valuable insights, gain operational efficiencies, and solidify competitive advantage.

---

Experts Uncover How Cybercriminals Could Exploit Microsoft Entra ID for Elevated Privilege

Cybersecurity researchers have discovered a case of privilege escalation associated with a Microsoft Entra ID (formerly Azure Active Directory) application by taking advantage of an abandoned reply URL. "An attacker could leverage this abandoned URL to redirect authorization codes to themselves, exchanging the ill-gotten authorization codes for access tokens," Secureworks Counter Threat Unit (

---

Mom’s Meals Service Discloses Data Breach Impacting 1.2 Million People

PurFoods, which conducts business in the U.S. as 'Mom's Meals,' is warning of a data breach after the personal information of 1.2 million customers and employees was stolen in a ransomware attack.

---

Developers Beware: Malicious Rust Libraries Caught Transmitting OS Info to Telegram Channel

In yet another sign that developers continue to be targets of software supply chain attacks, a number of malicious packages have been discovered on the Rust programming language's crate registry. The libraries, uploaded between August 14 and 16, 2023, were published by a user named "amaperf," Phylum said in a report published last week. The names of the packages, now taken down, are as follows:

---

Vendors Training AI With Customer Data Is an Enterprise Risk

Zoom received some flak recently for planning to use customer data to train its machine learning models. The reality, however, is that the video conferencing company is not the first, nor will it be the last, to have similar plans.

---

PoC for Unauthenticated RCE on Juniper Networks Firewalls Released

Researchers have released additional details about the recently patched four vulnerabilities affecting Juniper Networks’ SRX firewalls and EX switches that could allow remote code execution (RCE), as well as a proof-of-concept (PoC) exploit.

---

UK Privacy Regulator Warns of Surging Number of “Text Pest” Cases

The UK’s data protection watchdog is urging victims of so-called “text pests” to come forward after revealing that nearly a third (29%) of 18–34-year-olds have had their personal information misused.

---

University of Tulsa opens cyber research institute

The growing significance of cybercrime and the deficit of cybersecurity workforce fuel the launch of the Oklahoma Cyber Innovation Institute.

---

Leaseweb Reports Cloud Disruptions Due to Cyberattack

“The issue had an impact on a specific portion of our cloud-based infrastructure leading to downtime for a small number of cloud customers,” Leaseweb told customers in an email notification.