Cybersecurity Center

Cybersecurity News

  • LockBit Developer Rostislav Panev Charged for Billions in Global Ransomware Damages (Saturday December 21, 2024)
    A dual Russian and Israeli national has been charged in the United States for allegedly being the developer of the now-defunct LockBit ransomware-as-a-service (RaaS) operation since its inception in or around 2019 through at least February 2024. Rostislav Panev, 51, was arrested in Israel earlier this August and is currently awaiting extradition, the U.S. Department of Justice (DoJ) said in a (HackerNews)
  • Lazarus Group Spotted Targeting Nuclear Engineers with CookiePlus Malware (Friday December 20, 2024)
    The Lazarus Group, an infamous threat actor linked to the Democratic People's Republic of Korea (DPRK), has been observed leveraging a "complex infection chain" targeting at least two employees belonging to an unnamed nuclear-related organization within the span of one month in January 2024. The attacks, which culminated in the deployment of a new modular backdoor referred to as CookiePlus, are (HackerNews)
  • Rspack npm Packages Compromised with Crypto Mining Malware in Supply Chain Attack (Friday December 20, 2024)
    The developers of Rspack have revealed that two of their npm packages, @rspack/core and @rspack/cli, were compromised in a software supply chain attack that allowed a malicious actor to publish malicious versions to the official package registry with cryptocurrency mining malware. Following the discovery, versions 1.1.7 of both libraries have been unpublished from the npm registry. The latest (HackerNews)
  • Sophos Issues Hotfixes for Critical Firewall Flaws: Update to Prevent Exploitation (Friday December 20, 2024)
    Sophos has released hotfixes to address three security flaws in Sophos Firewall products that could be exploited to achieve remote code execution and allow privileged system access under certain conditions. Of the three, two are rated Critical in severity. There is currently no evidence that the shortcomings have been exploited in the wild. The list of vulnerabilities is as follows - (HackerNews)
  • Hackers Exploiting Critical Fortinet EMS Vulnerability to Deploy Remote Access Tools (Friday December 20, 2024)
    A now-patched critical security flaw impacting Fortinet FortiClient EMS is being exploited by malicious actors as part of a cyber campaign that installed remote desktop software such as AnyDesk and ScreenConnect.  The vulnerability in question is CVE-2023-48788 (CVSS score: 9.3), an SQL injection bug that allows attackers to execute unauthorized code or commands by sending specially crafted (HackerNews)
  • CISA Adds Critical Flaw in BeyondTrust Software to Exploited Vulnerabilities List (Friday December 20, 2024)
    The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added a critical security flaw impacting BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) products to the Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation in the wild. The vulnerability, tracked as CVE-2024-12356 (CVSS score: 9.8), is a command injection flaw that (HackerNews)
  • Web Hacking Service ‘Araneida’ Tied to Turkish IT Firm (Thursday December 19, 2024)
    Cybercriminals are selling hundreds of thousands of credential sets stolen with the help of a cracked version of Acunetix, a powerful commercial web app vulnerability scanner, new research finds. The cracked software is being resold as a cloud-based attack tool by at least two different services, one of which KrebsOnSecurity traced to an information technology firm based in Turkey. (KrebsOnSecurity)
  • Thousands Download Malicious npm Libraries Impersonating Legitimate Tools (Thursday December 19, 2024)
    Threat actors have been observed uploading malicious typosquats of legitimate npm packages such as typescript-eslint and @types/node that have racked up thousands of downloads on the package registry. The counterfeit versions, named @typescript_eslinter/eslint and types-node, are engineered to download a trojan and retrieve second-stage payloads, respectively. "While typosquatting attacks are (HackerNews)
  • Juniper Warns of Mirai Botnet Targeting SSR Devices with Default Passwords (Thursday December 19, 2024)
    Juniper Networks is warning that Session Smart Router (SSR) products with default passwords are being targeted as part of a malicious campaign that deploys the Mirai botnet malware. The company said it's issuing the advisory after "several customers" reported anomalous behavior on their Session Smart Network (SSN) platforms on December 11, 2024. "These systems have been infected with the Mirai (HackerNews)
  • Fortinet Warns of Critical FortiWLM Flaw That Could Lead to Admin Access Exploits (Thursday December 19, 2024)
    Fortinet has issued an advisory for a now-patched critical security flaw impacting Wireless LAN Manager (FortiWLM) that could lead to disclosure of sensitive information. The vulnerability, tracked as CVE-2023-34990, carries a CVSS score of 9.6 out of a maximum of 10.0. It was originally fixed by Fortinet back in September 2023, but without a CVE designation. "A relative path traversal [CWE-23] (HackerNews)
  • CISA Mandates Cloud Security for Federal Agencies by 2025 Under Binding Directive 25-01 (Thursday December 19, 2024)
    The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued Binding Operational Directive (BOD) 25-01, ordering federal civilian agencies to secure their cloud environments and abide by Secure Cloud Business Applications (SCuBA) secure configuration baselines. "Recent cybersecurity incidents highlight the significant risks posed by misconfigurations and weak security controls, (HackerNews)
  • Dutch DPA Fines Netflix €4.75 Million for GDPR Violations Over Data Transparency (Thursday December 19, 2024)
    The Dutch Data Protection Authority (DPA) on Wednesday fined video on-demand streaming service Netflix €4.75 million ($4.93 million) for not giving consumers enough information about how it used their data between 2018 and 2020. An investigation launched by the DPA in 2019 found that the tech giant did not inform customers clearly enough in its privacy statement about what it does with the data (HackerNews)
  • UAC-0125 Abuses Cloudflare Workers to Distribute Malware Disguised as Army+ App (Thursday December 19, 2024)
    The Computer Emergency Response Team of Ukraine (CERT-UA) has disclosed that a threat actor it tracks as UAC-0125 is leveraging Cloudflare Workers service to trick military personnel in the country into downloading malware disguised as Army+, a mobile app that was introduced by the Ministry of Defence back in August 2024 in an effort to make the armed forces go paperless. Users who visit the (HackerNews)
  • HubPhish Abuses HubSpot Tools to Target 20,000 European Users for Credential Theft (Wednesday December 18, 2024)
    Cybersecurity researchers have disclosed a new phishing campaign that has targeted European companies with an aim to harvest account credentials and take control of the victims' Microsoft Azure cloud infrastructure. The campaign has been codenamed HubPhish by Palo Alto Networks Unit 42 owing to the abuse of HubSpot tools in the attack chain. Targets include at least 20,000 automotive, chemical, (HackerNews)
  • Patch Alert: Critical Apache Struts Flaw Found, Exploitation Attempts Detected (Wednesday December 18, 2024)
    Threat actors are attempting to exploit a recently disclosed security flaw impacting Apache Struts that could pave the way for remote code execution. The issue, tracked as CVE-2024-53677, carries a CVSS score of 9.5 out of 10.0, indicating critical severity. The vulnerability shares similarities with another critical bug the project maintainers addressed in December 2023 (CVE-2023-50164, CVSS (HackerNews)
  • How to Lose a Fortune with Just One Bad Click (Wednesday December 18, 2024)
    Adam Griffin is still in disbelief over how quickly he was robbed of nearly $500,000 in cryptocurrencies. A scammer called using a real Google phone number to warn his Gmail account was being hacked, sent email security alerts directly from google.com, and ultimately seized control over the account by convincing him to click "yes" to a Google prompt on his mobile device. (KrebsOnSecurity)
  • Not Your Old ActiveState: Introducing our End-to-End OS Platform (Wednesday December 18, 2024)
    Having been at ActiveState for nearly eight years, I’ve seen many iterations of our product. However, one thing has stayed true over the years: Our commitment to the open source community and companies using open source in their code. ActiveState has been helping enterprises manage open source for over a decade. In the early days, open source was in its infancy. We focused mainly on the (HackerNews)
  • APT29 Hackers Target High-Value Victims Using Rogue RDP Servers and PyRDP (Wednesday December 18, 2024)
    The Russia-linked APT29 threat actor has been observed repurposing a legitimate red teaming attack methodology as part of cyber attacks leveraging malicious Remote Desktop Protocol (RDP) configuration files. The activity, which has targeted governments and armed forces, think tanks, academic researchers, and Ukrainian entities, entails adopting a "rogue RDP" technique that was previously (HackerNews)
  • ONLY Cynet Delivers 100% Protection and 100% Detection Visibility in the 2024 MITRE ATT&CK Evaluation (Wednesday December 18, 2024)
    Across small-to-medium enterprises (SMEs) and managed service providers (MSPs), the top priority for cybersecurity leaders is to keep IT environments up and running. To guard against cyber threats and prevent data breaches, it’s vital to understand the current cybersecurity vendor landscape and continually assess the effectiveness of available solutions. Luckily, the 2024 MITRE ATT&CK (HackerNews)
  • BeyondTrust Issues Urgent Patch for Critical Vulnerability in PRA and RS Products (Wednesday December 18, 2024)
    BeyondTrust has disclosed details of a critical security flaw in Privileged Remote Access (PRA) and Remote Support (RS) products that could potentially lead to the execution of arbitrary commands. Privileged Remote Access controls, manages, and audits privileged accounts and credentials, offering zero trust access to on-premises and cloud resources by internal, external, and third-party users. (HackerNews)
  • INTERPOL Pushes for "Romance Baiting" to Replace "Pig Butchering" in Scam Discourse (Wednesday December 18, 2024)
    INTERPOL is calling for a linguistic shift that aims to put to an end to the term "pig butchering," instead advocating for the use of "romance baiting" to refer to online scams where victims are duped into investing in bogus cryptocurrency schemes under the pretext of a romantic relationship. "The term 'pig butchering' dehumanizes and shames victims of such frauds, deterring people from coming (HackerNews)
  • Meta Fined €251 Million for 2018 Data Breach Impacting 29 Million Accounts (Wednesday December 18, 2024)
    Meta Platforms, the parent company of Facebook, Instagram, WhatsApp, and Threads, has been fined €251 million (around $263 million) for a 2018 data breach that impacted millions of users in the bloc, in what's the latest financial hit the company has taken for flouting stringent privacy laws. The Irish Data Protection Commission (DPC) said the data breach impacted approximately 29 million (HackerNews)
  • Attackers Exploit Microsoft Teams and AnyDesk to Deploy DarkGate Malware (Tuesday December 17, 2024)
    A new social engineering campaign has leveraged Microsoft Teams as a way to facilitate the deployment of a known malware called DarkGate. "An attacker used social engineering via a Microsoft Teams call to impersonate a user's client and gain remote access to their system," Trend Micro researchers Catherine Loveria, Jovit Samaniego, and Gabriel Nicoleta said. "The attacker failed to install a (HackerNews)
  • Hackers Use Microsoft MSC Files to Deploy Obfuscated Backdoor in Pakistan Attacks (Tuesday December 17, 2024)
    A new phishing campaign has been observed employing tax-themed lures to deliver a stealthy backdoor payload as part of attacks targeting Pakistan. Cybersecurity company Securonix, which is tracking the activity under the name FLUX#CONSOLE, said it likely starts with a phishing email link or attachment, although it said it couldn't obtain the original email used to launch the attack. "One of the (HackerNews)
  • Even Great Companies Get Breached — Find Out Why and How to Stop It (Tuesday December 17, 2024)
    Even the best companies with the most advanced tools can still get hacked. It’s a frustrating reality: you’ve invested in the right solutions, trained your team, and strengthened your defenses. But breaches still happen. So, what’s going wrong? The truth is, that attackers are constantly finding new ways to slip through cracks that often go unnoticed—even in well-prepared organizations. The good (HackerNews)
  • Bitter APT Targets Turkish Defense Sector with WmRAT and MiyaRAT Malware (Tuesday December 17, 2024)
    A suspected South Asian cyber espionage threat group known as Bitter targeted a Turkish defense sector organization in November 2024 to deliver two C++-malware families tracked as WmRAT and MiyaRAT. "The attack chain used alternate data streams in a RAR archive to deliver a shortcut (LNK) file that created a scheduled task on the target machine to pull down further payloads," Proofpoint (HackerNews)
  • 5 Practical Techniques for Effective Cyber Threat Hunting (Tuesday December 17, 2024)
    Addressing cyber threats before they have a chance to strike or inflict serious damage is by far the best security approach any company can embrace. Achieving this takes a lot of research and proactive threat hunting. The problem here is that it is easy to get stuck in endless arrays of data and end up with no relevant intel.  To avoid this, use these five battle-tested techniques that are (HackerNews)
  • Hackers Exploit Webview2 to Deploy CoinLurker Malware and Evade Security Detection (Tuesday December 17, 2024)
    Bogus software update lures are being used by threat actors to deliver a new stealer malware called CoinLurker. "Written in Go, CoinLurker employs cutting-edge obfuscation and anti-analysis techniques, making it a highly effective tool in modern cyber attacks," Morphisec researcher Nadav Lorber said in a technical report published Monday. The attacks make use of fake update alerts that employ (HackerNews)
  • The Mask APT Resurfaces with Sophisticated Multi-Platform Malware Arsenal (Tuesday December 17, 2024)
    A little-known cyber espionage actor known as The Mask has been linked to a new set of attacks targeting an unnamed organization in Latin America twice in 2019 and 2022. "The Mask APT is a legendary threat actor that has been performing highly sophisticated attacks since at least 2007," Kaspersky researchers Georgy Kucherin and Marc Rivero said in an analysis published last week. "Their targets (HackerNews)
  • CISA and FBI Raise Alerts on Exploited Flaws and Expanding HiatusRAT Campaign (Tuesday December 17, 2024)
    The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added two security flaws to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation in the wild. The list of flaws is below - CVE-2024-20767 (CVSS score: 7.4) - Adobe ColdFusion contains an improper access control vulnerability that could allow an attacker to access or modify restricted (HackerNews)
  • DeceptionAds Delivers 1M+ Daily Impressions via 3,000 Sites, Fake CAPTCHA Pages (Monday December 16, 2024)
    Cybersecurity researchers have shed light on a previously undocumented aspect associated with ClickFix-style attacks that hinge on taking advantage of a single ad network service as part of a malvertising-driven information stealer campaign dubbed DeceptionAds. "Entirely reliant on a single ad network for propagation, this campaign showcases the core mechanisms of malvertising — delivering over (HackerNews)
  • NoviSpy Spyware Installed on Journalist's Phone After Unlocking It With Cellebrite Tool (Monday December 16, 2024)
    A Serbian journalist had his phone first unlocked by a Cellebrite tool and subsequently compromised by a previously undocumented spyware codenamed NoviSpy, according to a new report published by Amnesty International. "NoviSpy allows for capturing sensitive personal data from a target's phone after infection and provides the ability to turn on the phone's microphone or camera remotely," the (HackerNews)
  • ⚡ THN Weekly Recap: Top Cybersecurity Threats, Tools and Tips (Monday December 16, 2024)
    This past week has been packed with unsettling developments in the world of cybersecurity. From silent but serious attacks on popular business tools to unexpected flaws lurking in everyday devices, there’s a lot that might have flown under your radar. Attackers are adapting old tricks, uncovering new ones, and targeting systems both large and small. Meanwhile, law enforcement has scored wins (HackerNews)
  • Data Governance in DevOps: Ensuring Compliance in the AI Era (Monday December 16, 2024)
    With the evolution of modern software development, CI/CD pipeline governance has emerged as a critical factor in maintaining both agility and compliance. As we enter the age of artificial intelligence (AI), the importance of robust pipeline governance has only intensified. With that said, we’ll explore the concept of CI/CD pipeline governance and why it's vital, especially as AI becomes (HackerNews)
  • New Investment Scam Leverages AI, Social Media Ads to Target Victims Worldwide (Monday December 16, 2024)
    Cybersecurity researchers are calling attention to a new kind of investment scam that leverages a combination of social media malvertising, company-branded posts, and artificial intelligence (AI) powered video testimonials featuring famous personalities, ultimately leading to financial and data loss. "The main goal of the fraudsters is to lead victims to phishing websites and forms that harvest (HackerNews)
  • New Glutton Malware Exploits Popular PHP Frameworks Like Laravel and ThinkPHP (Monday December 16, 2024)
    Cybersecurity researchers have discovered a new PHP-based backdoor called Glutton that has been put to use in cyber attacks targeting China, the United States, Cambodia, Pakistan, and South Africa. QiAnXin XLab, which discovered the malicious activity in late April 2024, attributed the previously unknown malware with moderate confidence to the prolific Chinese nation-state group tracked Winnti ( (HackerNews)
  • Ukrainian Minors Recruited for Cyber Ops and Reconnaissance in Russian Airstrikes (Monday December 16, 2024)
    The Security Service of Ukraine (SBU or SSU) has exposed a novel espionage campaign suspected to be orchestrated by Russia's Federal Security Service (FSB) that involves recruiting Ukrainian minors for criminal activities under the guise of "quest games." Law enforcement officials said that it detained two FSB agent groups following a special operation in Kharkiv. These groups, per the agency, (HackerNews)
  • Germany Disrupts BADBOX Malware on 30,000 Devices Using Sinkhole Action (Saturday December 14, 2024)
    Germany's Federal Office of Information Security (BSI) has announced that it has disrupted a malware operation called BADBOX that came preloaded on at least 30,000 internet-connected devices sold across the country. In a statement published earlier this week, authorities said they severed the communications between the devices and their command-and-control (C2) servers by sinkholing the domains (HackerNews)
  • Thai Officials Targeted in Yokai Backdoor Campaign Using DLL Side-Loading Techniques (Saturday December 14, 2024)
    Thai government officials have emerged as the target of a new campaign that leverages a technique called DLL side-loading to deliver a previously undocumented backdoor dubbed Yokai. "The target of the threat actors were Thailand officials based on the nature of the lures," Nikhil Hegde, senior engineer for Netskope's Security Efficacy team, told The Hacker News. "The Yokai backdoor itself is not (HackerNews)
  • 390,000+ WordPress Credentials Stolen via Malicious GitHub Repository Hosting PoC Exploits (Friday December 13, 2024)
    A now-removed GitHub repository that advertised a WordPress tool to publish posts to the online content management system (CMS) is estimated to have enabled the exfiltration of over 390,000 credentials. The malicious activity is part of a broader attack campaign undertaken by a threat actor, dubbed MUT-1244 (where MUT refers to "mysterious unattributed threat") by Datadog Security Labs, that (HackerNews)
  • Critical OpenWrt Vulnerability Exposes Devices to Malicious Firmware Injection (Friday December 13, 2024)
    A security flaw has been disclosed in OpenWrt's Attended Sysupgrade (ASU) feature that, if successfully exploited, could have been abused to distribute malicious firmware packages. The vulnerability, tracked as CVE-2024-54143, carries a CVSS score of 9.3 out of a maximum of 10, indicating critical severity. Flatt Security researcher RyotaK has been credited with discovering and reporting the (HackerNews)
  • DoJ Indicts 14 North Koreans for $88M IT Worker Fraud Scheme Over Six Years (Friday December 13, 2024)
    The U.S. Department of Justice (DoJ) has indicted 14 nationals belonging to the Democratic People's Republic of Korea (DPRK or North Korea) for their alleged involvement in a long-running conspiracy to violate sanctions and commit wire fraud, money laundering, and identity theft by illegally seeking employment in U.S. companies and non-profit organizations. "The conspirators, who worked for (HackerNews)
  • Iran-Linked IOCONTROL Malware Targets SCADA and Linux-Based IoT Platforms (Friday December 13, 2024)
    Iran-affiliated threat actors have been linked to a new custom malware that's geared toward IoT and operational technology (OT) environments in Israel and the United States. The malware has been codenamed IOCONTROL by OT cybersecurity company Claroty, highlighting its ability to attack IoT and supervisory control and data acquisition (SCADA) devices such as IP cameras, routers, programmable (HackerNews)
  • How to Generate a CrowdStrike RFM Report With AI in Tines (Friday December 13, 2024)
    Run by the team at orchestration, AI, and automation platform Tines, the Tines library contains pre-built workflows shared by real security practitioners from across the community, all of which are free to import and deploy via the Community Edition of the platform.  Their bi-annual “You Did What with Tines?!” competition highlights some of the most interesting workflows submitted by their (HackerNews)
  • New Linux Rootkit PUMAKIT Uses Advanced Stealth Techniques to Evade Detection (Friday December 13, 2024)
    Cybersecurity researchers have uncovered a new Linux rootkit called PUMAKIT that comes with capabilities to escalate privileges, hide files and directories, and conceal itself from system tools, while simultaneously evading detection. "PUMAKIT is a sophisticated loadable kernel module (LKM) rootkit that employs advanced stealth mechanisms to hide its presence and maintain communication with (HackerNews)
  • FBI Busts Rydox Marketplace with 7,600 PII Sales, Cryptocurrency Worth $225K Seized (Friday December 13, 2024)
    The U.S. Department of Justice (DoJ) on Thursday announced the shutdown of an illicit marketplace called Rydox ("rydox[.]ru" and "rydox[.]cc") for selling stolen personal information, access devices, and other tools for conducting cybercrime and fraud. In tandem, three Kosovo nationals and administrators of the service, Ardit Kutleshi, Jetmir Kutleshi, and Shpend Sokoli, have been arrested. (HackerNews)
  • Over 300K Prometheus Instances Exposed: Credentials and API Keys Leaking Online (Thursday December 12, 2024)
    Cybersecurity researchers are warning that thousands of servers hosting the Prometheus monitoring and alerting toolkit are at risk of information leakage and exposure to denial-of-service (DoS) as well as remote code execution (RCE) attacks. "Prometheus servers or exporters, often lacking proper authentication, allowed attackers to easily gather sensitive information, such as credentials and API (HackerNews)
  • Gamaredon Deploys Android Spyware "BoneSpy" and "PlainGnome" in Former Soviet States (Thursday December 12, 2024)
    The Russia-linked state-sponsored threat actor tracked as Gamaredon has been attributed to two new Android spyware tools called BoneSpy and PlainGnome, marking the first time the adversary has been discovered using mobile-only malware families in its attack campaigns. "BoneSpy and PlainGnome target former Soviet states and focus on Russian-speaking victims," Lookout said in an analysis. "Both (HackerNews)
  • Researchers Uncover Symlink Exploit Allowing TCC Bypass in iOS and macOS (Thursday December 12, 2024)
    Details have emerged about a now-patched security vulnerability in Apple's iOS and macOS that, if successfully exploited, could sidestep the Transparency, Consent, and Control (TCC) framework and result in unauthorized access to sensitive information. The flaw, tracked as CVE-2024-44131 (CVSS score: 5.3), resides in the FileProvider component, per Apple, and has been addressed with improved (HackerNews)
  • SaaS Budget Planning Guide for IT Professionals (Thursday December 12, 2024)
    SaaS services are one of the biggest drivers of OpEx (operating expenses) for modern businesses. With Gartner projecting $247.2 billion in global SaaS spending this year, it’s no wonder SaaS budgets are a big deal in the world of finance and IT. Efficient SaaS utilization can significantly affect both the bottom line and employee productivity.  In this article, we’ll break down this topic (HackerNews)
  • WordPress Hunk Companion Plugin Flaw Exploited to Silently Install Vulnerable Plugins (Thursday December 12, 2024)
    Malicious actors are exploiting a critical vulnerability in the Hunk Companion plugin for WordPress to install other vulnerable plugins that could open the door to a variety of attacks. The flaw, tracked as CVE-2024-11972 (CVSS score: 9.8), affects all versions of the plugin prior to 1.9.0. The plugin has over 10,000 active installations. "This flaw poses a significant security risk, as it (HackerNews)
  • Europol Dismantles 27 DDoS Attack Platforms Across 15 Nations; Admins Arrested (Thursday December 12, 2024)
    A global law enforcement operation has failed 27 stresser services that were used to conduct distributed denial-of-service (DDoS) attacks and took them offline as part of a multi-year international exercise called PowerOFF. The effort, coordinated by Europol and involving 15 countries, dismantled several booter and stresser websites, including zdstresser.net, orbitalstress.net, and (HackerNews)
  • How Cryptocurrency Turns to Cash in Russian Banks (Wednesday December 11, 2024)
    A financial firm registered in Canada has emerged as the payment processor for dozens of Russian cryptocurrency exchanges and websites hawking cybercrime services aimed at Russian-speaking customers, new research finds. Meanwhile, an investigation into the Vancouver street address used by this company shows it is home to dozens of foreign currency dealers, money transfer businesses, and cryptocurrency exchanges -- none of which are physically located there. (KrebsOnSecurity)
  • Patch Tuesday, December 2024 Edition (Wednesday December 11, 2024)
    Microsoft today released updates to plug at least 70 security holes in Windows and Windows software, including one vulnerability that is already being exploited in active attacks. The zero-day seeing exploitation involves CVE-2024-49138, a security weakness in the Windows Common… Read More » (KrebsOnSecurity)
  • U.S. Offered $10M for Hacker Just Arrested by Russia (Wednesday December 04, 2024)
    In January 2022, KrebsOnSecurity identified a Russian man named Mikhail Matveev as "Wazawaka," a cybercriminal who was deeply involved in the formation and operation of multiple ransomware groups. The U.S. government indicted Matveev as a top ransomware purveyor a year later, offering $10 million for information leading to his arrest. Last week, the Russian government reportedly arrested Matveev and charged him with creating malware used to extort companies. (KrebsOnSecurity)
  • Why Phishers Love New TLDs Like .shop, .top and .xyz (Tuesday December 03, 2024)
    Phishing attacks increased nearly 40 percent in the year ending August 2024, with much of that growth concentrated at a small number of new generic top-level domains (gTLDs) -- such as .shop, .top, .xyz -- that attract scammers with rock-bottom prices and no meaningful registration requirements, new research finds. Meanwhile, the nonprofit entity that oversees the domain name industry is moving forward with plans to introduce a slew of new gTLDs. (KrebsOnSecurity)
  • Hacker in Snowflake Extortions May Be a U.S. Soldier (Wednesday November 27, 2024)
    Two men have been arrested for allegedly stealing data from and extorting dozens of companies that used the cloud data storage company Snowflake, but a third suspect -- a prolific hacker known as Kiberphant0m -- remains at large and continues to publicly extort victims. However, this person's identity may not remain a secret for long: A careful review of Kiberphant0m's daily chats across multiple cybercrime personas suggests they are a U.S. Army soldier who is or was recently stationed in South Korea. (KrebsOnSecurity)
  • Feds Charge Five Men in ‘Scattered Spider’ Roundup (Thursday November 21, 2024)
    Federal prosecutors in Los Angeles this week unsealed criminal charges against five men alleged to be members of a hacking group responsible for dozens of cyber intrusions at major U.S. technology companies between 2021 and 2023, including LastPass, MailChimp, Okta, T-Mobile and Twilio. (KrebsOnSecurity)
  • Fintech Giant Finastra Investigating Data Breach (Wednesday November 20, 2024)
    The financial technology firm Finastra is investigating the alleged large-scale theft of information from its internal file transfer platform, KrebsOnSecurity has learned. Finastra, which provides software and services to 45 of the world's top 50 banks, notified customers of a potential breach after a cybercriminal began selling more than 400 gigabytes of data purportedly stolen from the company.  (KrebsOnSecurity)
  • An Interview With the Target & Home Depot Hacker (Friday November 15, 2024)
    In December 2023, KrebsOnSecurity revealed the real-life identity of Rescator, the nickname used by a Russian cybercriminal who sold more than 100 million payment cards stolen from Target and Home Depot between 2013 and 2014. Moscow resident Mikhail Shefel, who confirmed using the Rescator identity in a recent interview, also admitted reaching out because he is broke and seeking publicity for several new money making schemes. (KrebsOnSecurity)

Disclaimer: Some Links listed are external-links and are not managed by Western Illinois University. Western Illinois University or any of its employees shall not be held liable for any improper or incorrect use of the information described and/or contained herein and assumes no responsibility for anyone's use of the information.