Latest Cybersecurity News and Articles

---

Review your on-prem ADCS infrastructure before attackers do it for you

Attacks through Active Directory Certificate Services are fairly easy for bad actors to perform but basic vigilance and built-in Windows protections can help mitigate the risk of a breach.

---

CERT-UA Warns of an Ongoing SmokeLoader Malware Campaign

SmokeLoader acts as a loader for other malware, once it is executed it will inject malicious code into the currently running explorer process (explorer.exe) and downloads another payload to the system.

---

How to Set Up a Threat Hunting and Threat Intelligence Program

Threat hunting is an essential component of your cybersecurity strategy. Whether you're getting started or in an advanced state, this article will help you ramp up your threat intelligence program. What is Threat Hunting? The cybersecurity industry is shifting from a reactive to a proactive approach. Instead of waiting for cybersecurity alerts and then addressing them, security organizations are

---

New Cactus Ransomware Encrypts Itself to Evade Antivirus

Researchers at Kroll corporate investigation and risk consulting firm believe that Cactus obtains initial access into the victim network by exploiting known vulnerabilities in Fortinet VPN appliances.

---

FluHorse: New Android Threat Stealing 2FA Codes and Passwords

Check Point spotted a new malware strain, named FluHorse, masquerading as popular Android apps from East Asia. Each of these apps has been installed over 100,000 times. FluHorse is created to pilfer personal information such as usernames, passwords, and 2FA codes. Individuals and organizations must take proactive measures to safeguard against these threats. 

---

New PaperCut RCE exploit created that bypasses existing detections

VulnCheck explains that Sysmon-based detections relying on process creation analysis are already beaten by existing PoCs that use alternate child process creation pathways.

---

Universal Data Permissions Scanner: Open-source tool to overcome data authorization blindspots

Satori released the free, open-source tool that enables companies to understand which employees have access to what data, reducing the risks associated with overprivileged or unauthorized users and streamlining compliance reporting.

---

Your voice could be your biggest vulnerability

McAfee surveyed 7,054 people from seven countries and found that a quarter of adults had previously experienced some kind of AI voice scam, with 1 in 10 targeted personally and 15% saying it happened to someone they know.

---

Update: San Bernardino County Sheriff’s Department paid a $1.1M ransom

The ransomware attack forced the Police department to temporarily shut down some of its systems to prevent the threat from spreading. Impacted systems include email, in-car computers, and some law enforcement databases.

---

Ukrainian Forces Shutter Bot Farms and Illicit VPN Provider

Ukrainian law enforcement agencies dismantled more than half a dozen bot farms and a virtual private network infrastructure spreading disinformation and fake Russian propaganda.

---

Update: Western Digital says hackers stole customer data in March cyberattack

Western Digital has taken its store offline and sent customers data breach notifications after confirming that hackers stole sensitive personal information in a March cyberattack.

---

CERT-UA Warns of SmokeLoader and RoarBAT Malware Attacks Against Ukraine

An ongoing phishing campaign with invoice-themed lures is being used to distribute the SmokeLoader malware in the form of a polyglot file, according to the Computer Emergency Response Team of Ukraine (CERT-UA). The emails, per the agency, are sent using compromised accounts and come with a ZIP archive that, in reality, is a polyglot file containing a decoy document and a JavaScript file. The

---

Kimsuky Enhances its BabyShark Recon Tool in a Global Campaign

North Korean hacking group Kimsuky is distributing a new version of its reconnaissance malware called ReconShark. The cyberespionage campaign involves sending emails containing a link to a password-protected doc hosted on Microsoft OneDrive. The malware can steal sensitive data from the infected system, including running processes, connected batteries, and endpoint threat detection mechanisms.

---

Drone Goggles Maker Orqa Hit with 'Time-bomb' Ransomware Attack

Orqa, a maker of FPV drone racing goggles, claimed that a contractor introduced code into the firmware of the devices, designed to brick them as a time bomb. Findings say that the contractor had been in business relations with Orqa for several years and had waited for the code bomb to detonate. Orqa has issued a warning, urging users not to install the unofficial firmware version, as it may be another piece of malicious code.

---

Russian actor Uses WinRAR and DD Command to Destroy Ukrainian Data

CERT-UA confirmed the discovery of a malicious script dubbed RoarBat that is most probably being used by the Russian threat group Sandworm to wipe off data from Ukrainian state networks. The script uses the WinRaR application for archiving and compressing applications and then deleting specific files. However, Ukrainian defenders attributed the attack to Sandworm with moderate confidence.

---

Dragon Breath APT Group Using Double-Clean-App Technique to Target Gambling Industry

An advanced persistent threat (APT) actor known as Dragon Breath has been observed adding new layers of complexity to its attacks by adopting a novel DLL side-loading mechanism. "The attack is based on a classic side-loading attack, consisting of a clean application, a malicious loader, and an encrypted payload, with various modifications made to these components over time," Sophos researcher

---

Twitter admits to ‘security incident’ involving Circles tweets

Feature allows users to set a list of friends and post tweets that only they are supposed to be able to readA privacy breach at Twitter published tweets that were never supposed to be seen by anyone but the poster’s closest friends to the site at large, the company has admitted after weeks of stonewalling reports.The site’s Circles feature allows users to set an exclusive list of friends and post tweets that only they can read. Similar to Instagram’s Close Friends setting, it allows users to share private thoughts, explicit images or unprofessional statements without risking sharing them with their wider network. Continue reading...

---

"Kekw" Malware in Python Packages Could Steal Data and Hijack Crypto

According to new data by Cyble Research and Intelligence Labs (CRIL), Kekw malware can steal sensitive information from infected systems and perform clipper activities that can hijack cryptocurrency transactions.

---

Meta Cracks Down on South Asian Cyberespionage Groups

Social media giant Meta took down hundreds of fake Facebook and Instagram accounts used by South Asia advanced persistent threat groups to glean sensitive information and coax users into installing malware.

---

ALPHV gang claims ransomware attack on Constellation Software

Canadian diversified software company Constellation Software confirmed on Thursday that some of its systems were breached by threat actors who also stole personal information and business data.