Latest Cybersecurity News and Articles

---

Volt Typhoon Employs Custom Web Shells for Persistent Access in Critical Infrastructure Attacks

An analysis of the group's modus operandi has revealed its emphasis on operational security, carefully using an extensive set of open-source tools against a limited number of victims to carry out long-term malicious acts.

---

Uncovering attacker tactics through cloud honeypots

As per a study by Orca Security, misconfigured and vulnerable assets are literally discovered within minutes. Exposed secrets on GitHub, HTTP, and SSH were all discovered in under five minutes. The AWS S3 Buckets were discovered in under one hour.

---

Federal Regulator Warns of Rising SEO Poisoning Attacks on Healthcare Sector

Search engine optimization poisoning attacks, which involve intentionally manipulating search results to lead users onto malware-laced websites, are on the rise in the healthcare sector, U.S. federal regulators warn.

---

Japanese Cryptocurrency Exchange Falls Victim to JokerSpy macOS Backdoor Attack

An unknown cryptocurrency exchange located in Japan was the target of a new attack earlier this month to deploy an Apple macOS backdoor called JokerSpy. Elastic Security Labs, which is monitoring the intrusion set under the name REF9134, said the attack led to the installation of Swiftbelt, a Swift-based enumeration tool inspired by an open-source utility called SeatBelt. JokerSky was first

---

Lawmakers renew effort to force data brokers to delete private information on request

A bipartisan bill to protect Americans’ private online data by establishing a system for people to compel data brokers and companies to stop collecting it was reintroduced in Congress last week after a similar measure died last year.

---

American Airlines, Southwest Airlines Disclose Data Breaches Affecting Thousands of Pilots

According to breach notifications filed on Friday with Maine's Office of the Attorney General, American Airlines said the data breach affected 5745 pilots and applicants, while Southwest reported a total of 3009.

---

SEC Alleges SolarWinds CFO, CISO Violated US Securities Laws

The Securities and Exchange Commission accused SolarWinds CFO Bart Kalsu and CISO Tim Brown of violating securities laws in their response to a high-profile software supply chain cyberattack in 2020.

---

Trojanized Super Mario Bros Game Installer Spreads Malware

Researchers from Cyble discovered a trojanized Super Mario Bros game installer for Windows that was used to deliver multiple malware, including an XMR miner, SupremeBot mining client, and the Open-source Umbral stealer.

---

How Generative AI Can Dupe SaaS Authentication Protocols — And Effective Ways To Prevent Other Key AI Risks in SaaS

Security and IT teams are routinely forced to adopt software before fully understanding the security risks. And AI tools are no exception. Employees and business leaders alike are flocking to generative AI software and similar programs, often unaware of the major SaaS security vulnerabilities they're introducing into the enterprise. A February 2023 generative AI survey of 1,000 executives 

---

Microsoft Warns of Widescale Credential Stealing Attacks by Russian Hackers

Microsoft has disclosed that it's detected a spike in credential-stealing attacks conducted by the Russian state-affiliated hacker group known as Midnight Blizzard. The intrusions, which made use of residential proxy services to obfuscate the source IP address of the attacks, target governments, IT service providers, NGOs, defense, and critical manufacturing sectors, the tech giant's threat

---

ChatGPT shows promise in detecting phishing sites

ChatGPT can be used to detect phishing sites based on URLs, but its false positive rate is too high to be reliable on its own. ChatGPT can assist analysts by highlighting suspicious parts of the URL and suggesting possible attack targets.

---

A Cyber Force for the military? Senators want to know

The Senate's annual defense policy bill includes a provision that would require the Department of Defense to study the feasibility of establishing a separate Cyber Force.

---

Operationalizing zero trust in the cloud

Migrating to the cloud does not alleviate an organization's cyber risk, and cloud security is a shared responsibility. Misconfigurations can magnify the risk of security issues in cloud environments.

---

High-severity vulnerabilities patched in popular domain name software BIND

With the recently discovered vulnerabilities remote attackers could launch denial-of-service attacks, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) said in an advisory released Friday.

---

Hacker responsible for 2020 Twitter breach sentenced to prison

Three years after one of the most visible hacks in recent history played out in real-time in front of millions of Twitter users, one of the hackers responsible for the breach will now serve time in federal prison.

---

Feds seize notorious and shuttered hacking site BreachForums

Three months after arresting its administrator, U.S. federal authorities seized the domain of the notorious hacking site BreachForums. For a time, the forum was the go-to community for English-speaking cybercriminals

---

Grafana warns of critical auth bypass due to Azure AD integration

Grafana has released security fixes for multiple versions of its application, addressing a vulnerability that enables attackers to bypass authentication and take over any Grafana account that uses Azure Active Directory for authentication.

---

HWL Ebsworth hack: sensitive information from dozens of government agencies may be compromised

Hundreds of law firm’s clients waiting on confirmation of whether they are affected by data leaked in cyberattackFollow our Australia news live blog for the latest updatesGet our morning and afternoon news emails, free app or daily news podcastHundreds of clients of law firm HWL Ebsworth, including dozens of government agencies, have been in discussions with the firm over whether highly sensitive legal information has been exposed – while a NSW court injunction prevents those potentially affected from searching through the data posted on the dark web to check.The Russian-linked ALPHV/Blackcat ransomware group hacked the law firm in April. Earlier this month, the group published 1.1TB of the data it claimed to have stolen, later established to be 3.6TB worth of data.Sign up for Guardian Australia’s free morning and afternoon email newsletters for your daily news roundup Continue reading...

---

Chinese Hackers Using Never-Before-Seen Tactics for Critical Infrastructure Attacks

The newly discovered Chinese nation-state actor known as Volt Typhoon has been observed to be active in the wild since at least mid-2020, with the hacking crew linked to never-before-seen tradecraft to retain remote access to targets of interest. The findings come from CrowdStrike, which is tracking the adversary under the name Vanguard Panda. "The adversary consistently employed ManageEngine

---

Self Propagating Chinese Malware Inadvertently Affects Networked Storage Devices

Check Point laid bare a Chinese APT operation using a self-propagating USB malware called WispRider. A European healthcare institution fell victim to it after an employee used an infected USB drive on the hospital’s system. The USB drives were further found to affect networked storage devices, significantly amplifying the scope and potential impact of this threat.