Latest Cybersecurity News and Articles

---

Poor access management besets most cloud compromises, Google says

About 55% of all cloud compromises analyzed by Google Cloud’s incident response teams during the quarter were the result of weak or nonexistent passwords, the company said in its Threat Horizons Report.

---

Decommissioned Medical Infusion Pumps Expose Wi-Fi Configuration Data

Most medical infusion pumps sold via secondary market sources still contain Wi-Fi configuration settings from the original organization that deployed them, cybersecurity firm Rapid7 has discovered.

---

670 ICS Vulnerabilities Disclosed by CISA in First Half of 2023: Analysis

SynSaber’s analysis, conducted in collaboration with the ICS Advisory Project, shows that CISA published 185 ICS advisories in the first half of 2023, down from 205 in the first half of 2022.

---

Dozens of RCE Vulnerabilities Impact Milesight Industrial Router

Dozens of vulnerabilities impacting the Milesight UR32L industrial router could be exploited to execute arbitrary code or commands, Cisco’s Talos security researchers warn.

---

New hVNC Malware Targets macOS Devices

Researchers warned of a new hVNC malware targeting macOS devices. The malware, advertised on a Russian hacker forum, has been available since April 2023. It provides threat actors with stealthy remote control over infected machines with reverse shell, file management, and browser detection capabilities. to protect your systems, updating to the versions above 13.2 is suggested.

---

Major Cybersecurity Agencies Collaborate to Unveil 2022's Most Exploited Vulnerabilities

A four-year-old critical security flaw impacting Fortinet FortiOS SSL has emerged as one of the most routinely and frequently exploited vulnerabilities in 2022. "In 2022, malicious cyber actors exploited older software vulnerabilities more frequently than recently disclosed vulnerabilities and targeted unpatched, internet-facing systems," cybersecurity and intelligence agencies from the Five

---

97% of execs expect firms will be highly impacted by AI in a year

A new report shows that three in four business leaders find generative AI will be a top three emerging technology over the next 12-18 months.  

---

Microsoft Flags Growing Cybersecurity Concerns for Major Sporting Events

"Information on athletic performance, competitive advantage, and personal information is a lucrative target," the company said in a Cyber Signals report shared with The Hacker News.

---

Google Chrome 115 Update Patches V8 JavaScript and WebAssembly Engine Vulnerabilities

The browser update resolves three high-severity type confusion bugs in the V8 JavaScript and WebAssembly engine that earned the reporting researchers over $60,000 in bug bounties, Google notes in its advisory.

---

"Mysterious Team Bangladesh" Targets India with DDoS Attacks and Data Breaches

A hacktivist group known as Mysterious Team Bangladesh has been linked to over 750 distributed denial-of-service (DDoS) attacks and 78 website defacements since June 2022.

---

TSA updates gas pipeline cybersecurity guidelines

The Transportation Security Administration (TSA) is updating its security directive and guidelines for oil and natural gas pipeline cybersecurity.

---

Fake Flipper Zero Sites Promise Free Devices After Completing Offer

Last week, BleepingComputer was alerted to a website at flipperzero[.]at promoted on social media and Reddit, claiming to offer free Flipper Zero devices by simply filling out an offer.

---

Malicious Apps Use Sneaky Versioning Technique to Bypass Google Play Store Scanners

Threat actors are leveraging a technique called versioning to evade Google Play Store's malware detections and target Android users. "Campaigns using versioning commonly target users' credentials, data, and finances," Google Cybersecurity Action Team (GCAT) said in its August 2023 Threat Horizons Report shared with The Hacker News. While versioning is not a new phenomenon, it's sneaky and hard

---

Canadian Healthcare Workers’ Private Information Subject to Data Breach

Hackers had access to the HEABC system from May 9 to June 10 and the breach wasn’t detected until July 13, according to the association, after staff “identified a potential anomaly” but did not provide further explanation.

---

Threat Intelligence Provider Cyble Raises $24 Million in Series B Funding

The new funding round was co-led by Blackbird Ventures and King River Capital, with participation from January Capital, Spider Capital, Summit Peak Ventures, and other investors.

---

Pennsylvania County Says Data Breach May Have Exposed 690,000 People's Personal Information

The county says it, along with 22 million people worldwide, has been targeted by a global cyber security breach. The breach gave a group of cybercriminals access to personal information like driver's license numbers and Social Security numbers.

---

The Emergence of Threat Intelligence-as-a-Service

Managed security services providers (MSSPs) are evolving to offer more advanced technologies and solutions to help organizations manage and make sense of threat intelligence.

---

71% of organizations are using a multi-cloud environment

Cloud use and migration was analyzed in a recent report showing that 59% of organizations moved workloads back on-premises from the cloud.

---

New Version of Rilide Data Theft Malware Adapts to Chrome Extension Manifest V3

Cybersecurity researchers have discovered a new version of malware called Rilide that targets Chromium-based web browsers to steal sensitive data and steal cryptocurrency. "It exhibits a higher level of sophistication through modular design, code obfuscation, adoption to the Chrome Extension Manifest V3, and additional features such as the ability to exfiltrate stolen data to a Telegram channel

---

Russian Hacker Group NoName057(16) Claim Attacks on Italian Banks, Government Agencies

A pro-Russian hacking group has claimed responsibility for cyberattacks on Italian banks, businesses, and government agencies which flooded networks and disrupted services.