Latest Cybersecurity News and Articles

---

As the west tries to limit TikTok’s reach, what about China’s other apps?

With government concerns over national security growing, Beijing’s influence over platforms such as WeChat and Shein could come under scrutinyAs TikTok, the world’s most popular app, comes under increasing scrutiny in response to data privacy and security concerns, lawmakers in the west may soon set their sights on other Chinese platforms that have gone global.TikTok was built by ByteDance as a foreign version of its popular domestic video-sharing platform, Douyin. But it is far from being ByteDance’s only overseas moneymaker. The Chinese company owns dozens of apps that are available overseas, many of them English-language versions of Chinese offerings. Continue reading...

---

Microsoft (& Apple) Patch Tuesday, April 2023 Edition

Microsoft today released software updates to plug 100 security holes in its Windows operating systems and other software, including a zero-day vulnerability that is already being used in active attacks. Not to be outdone, Apple has released a set of important updates addressing two zero-day vulnerabilities that are being used to attack iPhones, iPads and Macs.

---

Color1337 Cryptojacking Campaign Churns Juices From Linux Servers

Cybersecurity company Tehtris analyzed a cryptojacking campaign targeting Linux systems and infecting those with a malware bot called uhQCCSpB. With the bot, attackers use two strategies to launch a Monero miner on the infected machine. The "diicot" cryptominer is activated on machines that have more than four cores, whereas the "SlowAndSteady" option is executed on machines with four or fewer cores.

---

Update: 3CX confirms North Korean hackers behind supply chain attack

The North Korea-linked attackers infected 3CX systems with malware known as Taxhaul (or TxRLoader), which deployed a second-stage malware downloader named Coldcat by Mandiant.

---

Celebrate Identity Management Day with these best practices

EXECUTIVE SUMMARY: Happy Identity Management Day! Established in 2021, in partnership with the National Cybersecurity Alliance, Identity Management Day is held on the second Tuesday of April. The day is intended to advance the education of business leaders and to create general awareness around the importance of identity management.  Key insights A recent survey of […] The post Celebrate Identity Management Day with these best practices appeared first on CyberTalk.

---

Siemens, Schneider Electric Address Dozens of ICS Vulnerabilities

The total number of vulnerabilities patched this month is significantly smaller than in February and March, when the industrial giants addressed roughly 100 security issues.

---

Malware Disguised as Document from Ukraine's Energoatom Delivers Havoc Demon Backdoor

When opened, it displays an image instructing the user to enable Word’s macro code execution to reveal information supposedly protected by M.E. Doc (My Electronic Document).

---

Belgium Anti-Phishing Shield (BAPS) Stops 14 Million Dangerous Clicks in 2022

The Belgium Anti-Phishing Shield (BAPS) has prevented a staggering 14 million clicks to suspicious websites in 2022, thanks to the unique collaboration between the Centre for Cybersecurity Belgium (CCB) and the general public.

---

Battle could be brewing over new FCC data breach reporting rules

An expanded data breach definition and the telcos’ desire to link notifications to “concrete harm” are among the most controversial aspects of the proposed FCC data breach reporting rules.

---

Miscreants could use Azure access keys as backdoors

A design flaw in Microsoft Azure – that shared key authorization is enabled by default when creating storage accounts – could give attackers full access to your environment, according to Orca Security researchers.

---

Over 40% of cybersecurity teams told to keep breaches confidential

New report reveals phishing and ransomware attacks are on the rise with half of companies experiencing some form of cyber threat in the past year.

---

Over 40% of cybersecurity teams told to keep breeches confidential

New report reveals phishing and ransomware attacks are on the rise with half of companies experiencing some form of cyber threat in the past year.

---

Credit union fraud rates increased by more than 70% in 2022

A recent report focused on the rise and adoption of artificial intelligence, an impending recession and the return of pre-pandemic fraud techniques.

---

Fivecast Completes Series A Raise With New US and Existing Australian VC Investors

The Australian open-source intelligence (OSINT) software company has closed its Series A funding round with almost US$20 million raised to fuel its expansion and service contracts in key markets.

---

CISA Issues Advisories on Critical ICS and SCADA Vulnerabilities

Multiple advisories have been released by the CISA covering bugs found in ICS and SCADA software from several vendors including Rockwell Automation, Hitachi Energy, JTEKT Electronics, Korenix, mySCADA Technologies, and Industrial Control Links. ScadaFlex II series controllers by Industrial Control Links suffered a critical bug with a CVSS score of 9.1, enabling attackers to modify, delete, or create files on the system.

---

Why reporting an incident only makes the cybersecurity community stronger

CISOs and cyber leaders may not see reporting a breach as the most pleasant of tasks, but experts say mandatory and voluntary sharing of intelligence around incidents can only improve the readiness and resilience of responders.

---

US Government Scrambles to Investigate Military Intel Leak on Russia-Ukraine Conflict

A series of video game servers have emerged as key distribution points for a cache of perhaps as many as 100 intelligence documents containing secret and top-secret information about the war in Ukraine.

---

Newly Discovered "By-Design" Flaw in Microsoft Azure Could Expose Storage Accounts to Hackers

A "by-design flaw" uncovered in Microsoft Azure could be exploited by attackers to gain access to storage accounts, move laterally in the environment, and even execute remote code. "It is possible to abuse and leverage Microsoft Storage Accounts by manipulating Azure Functions to steal access-tokens of higher privilege identities, move laterally, potentially access critical business assets, and

---

Mike Johnson hired as Rivian Chief Information Security Officer

Mike Johnson has been hired has Rivian Automotive's Chief Information Security Officer. Johnson’s cybersecurity career spans more than 25 years.

---

Potential Outcomes of the US National Cybersecurity Strategy

On March 1, 2023, the Biden administration published its National Cybersecurity Strategy. This is not an executive order, but an outline of how the administration will guide the evolution of cybersecurity at the national level.