Latest Cybersecurity News and Articles

---

New BlackCat Ransomware Variant Adopts Advanced Impacket and RemCom Tools

Microsoft on Thursday disclosed that it found a new version of the BlackCat ransomware (aka ALPHV and Noberus) that embeds tools like Impacket and RemCom to facilitate lateral movement and remote code execution. "The Impacket tool has credential dumping and remote service execution modules that could be used for broad deployment of the BlackCat ransomware in target environments," the company's

---

Hackers Ask $120,000 for Access to Multi-Billion Auction House

Researchers at threat intelligence company Flare poured through three months of IAB offers on the Russian-language hacker forum Exploit to better understand who they target, their ask prices, and who are the most active.

---

Report: 30% of Phishing Threats Involve Newly Registered Domains

Phishing remains the most dominant and fastest-growing internet crime, largely due to the ubiquity of email and the ceaseless issue of human error that is preyed upon by today’s threat actors, according to Cloudflare.

---

New Apple iOS 16 Exploit Enables Stealthy Cellular Access Under Fake Airplane Mode

Cybersecurity researchers have documented a novel post-exploit persistence technique on iOS 16 that could be abused to fly under the radar and maintain access to an Apple device even when the victim believes it is offline.

---

Mass-Spreading Campaign Targeting Zimbra Users

ESET researchers have discovered a widespread phishing campaign targeting users of the Zimbra Collaboration email server. The campaign, which has been active since April 2023, aims to collect Zimbra account users' credentials.

---

Banks Defending Their Right to Security are Missing the Point About Consumer Trust

When businesses override a customer's security decision, does it make them fully liable when a breach occurs? That's a question banks like those in Singapore need to consider before they roll out their next security feature.

---

Sneaky 'NoFilter' Privilege Escalation Attack Bypasses Windows Security

A previously undetected attack method called NoFilter has been found to abuse the Windows Filtering Platform (WFP) to achieve privilege escalation in the Windows operating system.

---

German Police Warn of Increased Foreign Cybercrime Threat

In a report published on Wednesday, the Federal Criminal Police Office of Germany, or BKA, said the country had recorded 136,865 cases of cybercrime in 2022, resulting in an estimated loss of 203 billion euros.

---

Federal Judge Inclined to Grant Claims in Meta Pixel Case

The consolidated proposed class action lawsuit filed last year alleges that Facebook and Instagram parent Meta violated privacy laws by obtaining the sensitive data of millions of patients through its web tracking Pixel tool.

---

Google Chrome's New Feature Alerts Users About Auto-Removal of Malicious Extensions

Google has announced plans to add a new feature in the upcoming version of its Chrome web browser to alert users when an extension they have installed has been removed from the Chrome Web Store. The feature, set for release alongside Chrome 117, allows users to be notified when an add-on has been unpublished by a developer, taken down for violating Chrome Web Store policy, or marked as malware.

---

Innovative QR Code Phishing Scheme Hits U.S. Energy Firm

Cofense detected a significant phishing campaign that employed QR codes to target Microsoft credentials across various industries. Among the targets, a major U.S.-based energy company stood out, with around 29% of over 1,000 malicious QR code emails directed at it. Organizations should consider bolstering their security protocols by implementing advanced email filtering solutions capable of detecting embedded QR codes.

---

Karma Catches Up to Global Phishing Service 16Shop

You've probably never heard of "16Shop," but there's a good chance someone using it has tried to phish you. Last week, the international police organization INTERPOL said it had shuttered the notorious 16Shop, a popular phishing-as-a-service platform launched in 2017 that made it simple for even complete novices to conduct complex and convincing phishing scams. INTERPOL said authorities in Indonesia arrested the 21-year-old proprietor and one of his alleged facilitators, and that a third suspect was apprehended in Japan.

---

Stealthy LABRAT Operation Runs Cryptojacking and Proxyjacking Campaign Targeting GitLab

The Sysdig Threat Research Team (TRT) recently discovered a new, financially motivated operation, dubbed LABRAT. This operation set itself apart from others due to the attacker’s emphasis on stealth and defense evasion in their attacks.

---

NoFilter Attack: Sneaky Privilege Escalation Method Bypasses Windows Security

A previously undetected attack method called NoFilter has been found to abuse the Windows Filtering Platform (WFP) to achieve privilege escalation in the Windows operating system. "If an attacker has the ability to execute code with admin privilege and the target is to perform LSASS Shtinkering, these privileges are not enough," Ron Ben Yizhak, a security researcher at Deep Instinct, told The

---

NYC Finance Department Sent Every Employee Their Colleagues’ Personal Info

The New York City’s tax collection agency accidentally shared the home addresses, cell phone numbers, and personal email addresses of more than 1,700 workers with all those employees.

---

White House holds roundtable on data protection

Participants at a White House roundtable shared insights and concerns about the harms and risks of companies sharing and selling consumer data.

---

China-Linked Bronze Starlight Group Targeting Gambling Sector with Cobalt Strike Beacons

An ongoing cyber attack campaign originating from China is targeting the Southeast Asian gambling sector to deploy Cobalt Strike beacons on compromised systems.  Cybersecurity firm SentinelOne said the tactics, techniques, and procedures point to the involvement of a threat actor tracked as Bronze Starlight (aka Emperor Dragonfly or Storm-0401), which has been linked to the use of short-lived 

---

Play Ransomware Found Using Security MSPs and N-Day Exploits to Attack

The Play ransomware group is targeting managed security service providers (MSSPs) to gain initial access and use up to a half-decade-old vulnerabilities in security appliances, warn security researchers with Adlumin.

---

New LABRAT Campaign Exploits GitLab Flaw for Cryptojacking and Proxyjacking Activities

A new, financially motivated operation dubbed LABRAT has been observed weaponizing a now-patched critical flaw in GitLab as part of a cryptojacking and proxyjacking campaign. "The attacker utilized undetected signature-based tools, sophisticated and stealthy cross-platform malware, command-and-control (C2) tools which bypassed firewalls, and kernel-based rootkits to hide their presence," Sysdig 

---

New Apple iOS 16 Exploit Enables Stealthy Cellular Access Under Fake Airplane Mode

Cybersecurity researchers have documented a novel post-exploit persistence technique on iOS 16 that could be abused to fly under the radar and main access to an Apple device even when the victim believes it is offline. The method "tricks the victim into thinking their device's Airplane Mode works when in reality the attacker (following successful device exploit) has planted an artificial