Latest Cybersecurity News and Articles

---

UK: Cumbria Police Admit Huge Breach of Data of Officers and Staff

Cumbria police have admitted accidentally publishing the names and salaries of every one of its more than 2,000 employees and have apologized. The data breach happened in March and has not previously been publicized.

---

Magento Shopping Cart Attack Targets Critical Vulnerability

Security researchers at Akamai say they have identified a server-side template injection campaign aimed at Magneto 2 shops that have yet to address CVE-2022-24086, an input validation flaw with a CVSS score of 9.8.

---

Data leaks have given Irish republican groups ‘upper hand’ against police, analysts warn

Breaches hurt police morale and may help republican paramilitaries intimidate officers and their familiesPolice data breaches in Northern Ireland have given republican paramilitaries a powerful tool to intimidate, demoralise and target officers and their families for years to come, according to security experts.The New IRA and other groups have gained the “upper hand” and will be able to use the unprecedented leaks of officers’ personal information to carry out psychological and possibly physical attacks, the analysts warned. Continue reading...

---

16 New CODESYS SDK Flaws Expose OT Environments to Remote Attacks

The remote code execution bugs, in particular, could be abused to backdoor OT devices and interfere with the functioning of programmable logic controllers (PLCs) in a manner that could pave the way for information theft.

---

Gafgyt Malware Exploits Five-Years-Old Flaw in EoL Zyxel Router

Fortinet has issued an alert warning that the Gafgyt botnet malware is actively trying to exploit a vulnerability in the end-of-life Zyxel P660HN-T1A router in thousands of daily attacks.

---

Charming Kitten Hackers Target Iranian Dissidents in Germany

The Federal Office for the Protection of the Constitution (BfV) reported it had found concrete attempts by the group known as Charming Kitten to target the Iranian opposition and exiles based in Germany.

---

Ukrainian Official Touts Country’s Wartime Cyber Intelligence Efforts

Intelligence gathered in cyberspace is helping Ukraine understand Russia's plans and stop the enemy from carrying them out, according to the country’s top cyber and information security official.

---

Researchers Uncover Decade-Long Cyber Espionage on Foreign Embassies in Belarus

A hitherto undocumented threat actor operating for nearly a decade and codenamed MoustachedBouncer has been attributed to cyber espionage attacks aimed at foreign embassies in Belarus. "Since 2020, MoustachedBouncer has most likely been able to perform adversary-in-the-middle (AitM) attacks at the ISP level, within Belarus, in order to compromise its targets," ESET security researcher Matthieu

---

Dell Compellent Hardcoded Key Exposes Vmware vCenter Admin Credentials

The flaw, tracked as CVE-2023-39250, is caused by a static AES encryption key, shared across all installs, that is used to encrypt the vCenter credentials stored in the program's configuration file.

---

US National Security Agency Announces Codebreaker Challenge Theme

The NSA Codebreaker Challenge is a competition for high school and university students across the US that started in 2013 to explain what the missions of NSA agents are using fictitious scenarios.

---

New Whirlpool Backdoor Used in Barracuda ESG Campaign

The US Cybersecurity and Infrastructure Security Agency (CISA) has released a new advisory detailing the malware, dubbed “Whirlpool.” It claimed the backdoor established a TLS reverse shell to a command-and-control (C2) server.

---

Cumbria police admits huge breach of data of officers and staff

Exclusive: Accidental publishing of names and salaries happened in March and follows scandal over PSNI leakAnother British police force has experienced a huge breach of the data of all its officers and staff, the Guardian has learned.Cumbria police has admitted accidentally publishing the names and salaries of every one of its more than 2,000 employees and has apologised. Continue reading...

---

India Passes Data Protection Legislation in Parliament. Critics Fear Privacy Violation

Indian lawmakers Wednesday approved a data protection legislation that “seeks to better regulate big tech firms and penalize companies for data breaches” as several groups expressed concern over citizens’ privacy rights.

---

California City Investigating Data Theft After Ransomware Group’s Claims

The LockBit gang added 15 victims to its leak site on Wednesday including El Cerrito, which is home to more than 25,000 residents and is about 10 minutes north of Oakland.

---

Enhancing TLS Security: Google Adds Quantum-Resistant Encryption in Chrome 116

Google has announced plans to add support for quantum-resistant encryption algorithms in its Chrome browser, starting with version 116. "Chrome will begin supporting X25519Kyber768 for establishing symmetric secrets in TLS, starting in Chrome 116, and available behind a flag in Chrome 115," Devon O'Brien said in a post published Thursday. Kyber was chosen by the U.S. Department of Commerce's

---

New York Introduces First-Ever Statewide Cybersecurity Strategy

The strategy’s primary pillars – unification, resilience, and preparedness – are designed to enable New York State to not only deter cyberattacks but also neutralize potential threats effectively.

---

MustachedBouncer Hackers Compromised Foreign Embassies in Belarus

Anewly identified cyberespionage group in Belarus is targeting foreign embassies often with the assistance of local internet service providers, researchers with the cybersecurity firm ESET said Thursday.

---

PSNI and UK voter breaches show data risks should be taken more seriously

There were 9,000 breaches of personal information last year but experts say not enough is being done to stop them“It’s brutal. People are wondering if they should resign, or move house, or get fortified gates. You can feel the anger.”The comment from a former officer in the Police Service of Northern Ireland (PSNI) underlines the real-life consequences of an all-too frequent occurrence: a data breach. Continue reading...

---

Check Point Buys Perimeter 81 for $490M to Enhance its Security Tools for Hybrid and Remote Workers

The acquisition comes amid a major funding crunch for startups. Perimeter 81’s exit is coming at a big discount to its last valuation: It raised $100 million in June 2022 at a $1 billion valuation, according to PitchBook data.

---

Researchers Discover New Sophisticated Info-Stealing Malware Called Statc Stealer

Researchers observed that Statc Stealer can steal user’s cookies data, web data, local state, data preferences, login data, various different wallets information, FileZilla, browser autofills, Anydesk, ronin_edge, Metamask, and Telegram data.