Latest Cybersecurity News and Articles

---

The costly threat that many businesses fail to address

Insider attacks such as fraud, sabotage, and data theft plague 71% of U.S. businesses, according to Capterra. These schemes can cost companies hundreds of thousands of dollars.

---

Apple releases first 'rapid' security fixes for iPhones, iPads and Macs

The "rapid security patch" rollout on Monday hasn’t gone so smoothly. Some customers said that they could not install the update. When TechCrunch tested on an iPhone, iPad, and Mac, the updates downloaded but did not immediately install.

---

North Korea's ScarCruft Deploys RokRAT Malware via LNK File Infection Chains

The North Korean threat actor known as ScarCruft began experimenting with oversized LNK files as a delivery route for RokRAT malware as early as July 2022, the same month Microsoft began blocking macros across Office documents by default.

---

Alert: Active Exploitation of TP-Link, Apache, and Oracle Vulnerabilities Detected

The three flaws added to the Known Exploited Vulnerabilities (KEV) catalog are CVE-2023-1389 in TP-Link Archer AX-21, CVE-2021-45046 in Apache Log4j2, and CVE-2023-21839 in Oracle WebLogic Server.

---

LOBSHOT: A Stealthy, Financial Trojan and Info Stealer Delivered through Google Ads

In yet another instance of how threat actors are abusing Google Ads to serve malware, a threat actor has been observed leveraging the technique to deliver a new Windows-based financial trojan and information stealer called LOBSHOT. "LOBSHOT continues to collect victims while staying under the radar," Elastic Security Labs researcher Daniel Stepanic said in an analysis published last week. "One

---

North Korea's ScarCruft Deploys RokRAT Malware via LNK File Infection Chains

The North Korean threat actor known as ScarCruft began experimenting with oversized LNK files as a delivery route for RokRAT malware as early as July 2022, the same month Microsoft began blocking macros across Office documents by default. "RokRAT has not changed significantly over the years, but its deployment methods have evolved, now utilizing archives containing LNK files that initiate

---

Alert: Active Exploitation of TP-Link, Apache, and Oracle Vulnerabilities Detected

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added three flaws to the Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation. The security vulnerabilities are as follows - CVE-2023-1389 (CVSS score: 8.8) - TP-Link Archer AX-21 Command Injection Vulnerability CVE-2021-45046 (CVSS score: 9.0) - Apache Log4j2 Deserialization of Untrusted

---

Australian law firm HWL Ebsworth hit by Russian-linked ransomware attack

Cyberattack resulted in hacking of 4TB of data including IDs, finance reports, accounting data, client documents and credit card detailsFollow our Australia news live blog for the latest updatesGet our morning and afternoon news emails, free app or daily news podcastThe Australian commercial law firm HWL Ebsworth has fallen victim to a ransomware attack, with Russian-linked hackers claiming to have obtained client information and employee data.Late last week, the ALPHV/Blackcat ransomware group posted on its website that 4TB of company data had been hacked, including employee CVs, IDs, financial reports, accounting data, client documentation, credit card information, and a complete network map.Sign up for Guardian Australia’s free morning and afternoon email newsletters for your daily news roundup Continue reading...

---

US Wellness confirms data security incident

US Wellness announced it was the victim of a ransomware attack that may have involved protected health information belonging to members of its wellness clients.

---

Update: UK pension funds warned to check on clients’ data after Capita breach

Capita, the country’s largest outsourcing company, holds contracts to administer the payment systems for pension funds used by more than 4 million individuals in Britain.

---

Nashua School District hit by 'sophisticated' cyberattack

"We are working diligently to investigate the incident, confirm its impact on our systems, and securely restore functionality to our environment as soon as possible," the district said in a statement.

---

DeFi Protocol 0VIX Loses Nearly $2M in Flash-Loan Exploit

A total of 1.45 million USDC, along with other tokens, was stolen before being bridged to the Ethereum mainnet on Stargate Finance, where it was eventually swapped for ether (ETH).

---

Microsoft’s next-level nomenclature, naming hacking groups

EXECUTIVE SUMMARY: Last week, Microsoft’s cyber security division announced that it is changing its taxonomy for naming hacking groups. Previously, Microsoft assigned cyber criminal organizations the names of chemical elements, as listed in the periodic table. In the new system, Microsoft will assign hacker groups two-word names, including a weather-based descriptor. The new names The […] The post Microsoft’s next-level nomenclature, naming hacking groups appeared first on CyberTalk.

---

Google Blocks 1.43 Million Malicious Apps, Bans 173,000 Bad Accounts in 2022

In addition, the company said it banned 173,000 bad accounts and fended off over $2 billion in fraudulent and abusive transactions through developer-facing features like Voided Purchases API, Obfuscated Account ID, and Play Integrity API.

---

Court Records Expose Private Information for Thousands of Missouri Residents

Documents containing Social Security numbers and other private information for thousands of Missourians are accessible to anyone using the Casenet website, the state’s judicial records system, the Post-Dispatch recently discovered.

---

Sensitive Data Leaked From Servers Running Salesforce Community Software

Servers running software sold by Salesforce are leaking sensitive data managed by government agencies, banks, and other organizations, according to a post published Friday by KrebsOnSecurity.

---

Using multiple solutions adds complexity to your zero trust strategy

Companies are also now increasingly reliant on their supply chain, which means partners, suppliers, and shippers are now typically directly connected to a company’s systems.

---

Update: Hackers leak images to taunt Western Digital's cyberattack response

The ALPHV ransomware crew, aka BlackCat, has published screenshots of internal emails and video conferences stolen from Western Digital, indicating they likely had continued access to the company's systems even as the company responded to the breach.

---

Cybercriminals use proxies to legitimize fraudulent requests

Bot attacks were previously seen as a relatively inconsequential type of online fraud, and that mentality has persisted even as threat actors have gained the ability to cause significant damage to revenue and brand reputation, according to HUMAN.

---

Report shows nearly 600% annual growth in vulnerable cloud attack surface

A new report reveals security organizations experienced 133% year-over-year growth in cyber assets, resulting in increased security complexity for cloud enterprises.