TECHZONE™

Russian APT28 Hackers Targeting 13 Nations in Ongoing Cyber Espionage Campaign https://thehackernews.com/2023/12/russian-apt28-hackers-targeting-13.html The Russian nation-state threat actor known as APT28 has been observed making use of lures related to the ongoing Israel-Hamas war to facilitate the delivery of a custom backdoor called HeadLace. IBM X-Force is tracking the adversary under the name ITG05, which is also known as BlueDelta, Fancy Bear, Forest Blizzard (formerly Strontium), FROZENLAKE, Iron Twilight, Sednit, Sofacy, and

Non-Human Access is the Path of Least Resistance: A 2023 Recap https://thehackernews.com/2023/12/non-human-access-is-path-of-least.html 2023 has seen its fair share of cyber attacks, however there’s one attack vector that proves to be more prominent than others - non-human access. With 11 high-profile attacks in 13 months and an ever-growing ungoverned attack surface, non-human identities are the new perimeter, and 2023 is only the beginning.  Why non-human access is a cybercriminal’s paradise  People always

New MrAnon Stealer Malware Targeting German Users via Booking-Themed Scam https://thehackernews.com/2023/12/new-mranon-stealer-targeting-german-it.html A phishing campaign has been observed delivering an information stealer malware called MrAnon Stealer to unsuspecting victims via seemingly benign booking-themed PDF lures. "This malware is a Python-based information stealer compressed with cx-Freeze to evade detection," Fortinet FortiGuard Labs researcher Cara Lin said. "MrAnon Stealer steals its victims' credentials, system

Apple Releases Security Updates to Patch Critical iOS and macOS Security Flaws https://thehackernews.com/2023/12/apple-releases-security-updates-to.html Apple on Monday released security patches for iOS, iPadOS, macOS, tvOS, watchOS, and Safari web browser to address multiple security flaws, in addition to backporting fixes for two recently disclosed zero-days to older devices. This includes updates for 12 security vulnerabilities in iOS and iPadOS spanning AVEVideoEncoder, ExtensionKit, Find My, ImageIO, Kernel, Safari

Black Hat Europe 2023: Should we regulate AI? https://www.welivesecurity.com/en/we-live-progress/black-hat-europe-2023-should-we-regulate-ai/ ChatGPT would probably say "Definitely not!", but will we learn any lessons from the rush to regulate IoT in the past?

Silent but deadly: The rise of zero-click attacks https://www.welivesecurity.com/en/mobile-security/silent-but-deadly-the-rise-of-zero-click-attacks/ A security compromise so stealthy that it doesn’t even require your interaction? Yes, zero-click attacks require no action from you – but this doesn’t mean you’re left vulnerable.

New Critical RCE Vulnerability Discovered in Apache Struts 2 - Patch Now https://thehackernews.com/2023/12/new-critical-rce-vulnerability.html Apache has released a security advisory warning of a critical security flaw in the Struts 2 open-source web application framework that could result in remote code execution. Tracked as CVE-2023-50164, the vulnerability is rooted in a flawed "file upload logic" that could enable unauthorized path traversal and could be exploited under the circumstances to upload a malicious file

Researchers Unmask Sandman APT's Hidden Link to China-Based KEYPLUG Backdoor https://thehackernews.com/2023/12/researchers-unmask-sandman-apts-hidden.html Tactical and targeting overlaps have been discovered between the enigmatic advanced persistent threat (APT) called Sandman and a China-based threat cluster that's known to use a backdoor known as KEYPLUG. The assessment comes jointly from SentinelOne, PwC, and the Microsoft Threat Intelligence team based on the fact that the adversary's Lua-based malware LuaDream and KEYPLUG have been

Lazarus Group Using Log4j Exploits to Deploy Remote Access Trojans https://thehackernews.com/2023/12/lazarus-group-using-log4j-exploits-to.html The notorious North Korea-linked threat actor known as the Lazarus Group has been attributed to a new global campaign that involves the opportunistic exploitation of security flaws in Log4j to deploy previously undocumented remote access trojans (RATs) on compromised hosts. Cisco Talos is tracking the activity under the name Operation Blacksmith, noting the use of three DLang-based

Playbook: Your First 100 Days as a vCISO - 5 Steps to Success https://thehackernews.com/2023/12/playbook-your-first-100-days-as-vciso-5.html In an increasingly digital world, no organization is spared from cyber threats. Yet, not every organization has the luxury of hiring a full-time, in-house CISO. This gap in cybersecurity leadership is where you, as a vCISO, come in. You are the person who will establish, develop, and solidify the organization's cybersecurity infrastructure, blending strategic guidance with actionable

SpyLoan Scandal: 18 Malicious Loan Apps Defraud Millions of Android Users https://thehackernews.com/2023/12/spyloan-scandal-18-malicious-loan-apps.html Cybersecurity researchers have discovered 18 malicious loan apps for Android on the Google Play Store that have been collectively downloaded over 12 million times. "Despite their attractive appearance, these services are in fact designed to defraud users by offering them high-interest-rate loans endorsed with deceitful descriptions, all while collecting their victims' personal and

New PoolParty Process Injection Techniques Outsmart Top EDR Solutions https://thehackernews.com/2023/12/new-poolparty-process-injection.html A new collection of eight process injection techniques, collectively dubbed PoolParty, could be exploited to achieve code execution in Windows systems while evading endpoint detection and response (EDR) systems. SafeBreach researcher Alon Leviev said the methods are "capable of working across all processes without any limitations, making them more flexible than existing process

Surge in deceptive loan apps – Week in security with Tony Anscombe https://www.welivesecurity.com/en/videos/increase-deceptive-loan-apps-week-security-tony-anscombe/ ESET Research reveals details about a growth in the number of deceptive loan apps on Android, their origins and modus operandi

Black Hat Europe 2023: The past could return to haunt you https://www.welivesecurity.com/en/critical-infrastructure/black-hat-europe-2023-the-past-could-return-to-haunt-you/ Legacy protocols in the healthcare industry present dangers that can make hospitals extremely vulnerable to cyberattacks.

SLAM Attack: New Spectre-based Vulnerability Impacts Intel, AMD, and Arm CPUs https://thehackernews.com/2023/12/slam-attack-new-spectre-based.html Researchers from the Vrije Universiteit Amsterdam have disclosed a new side-channel attack called SLAM that could be exploited to leak sensitive information from kernel memory on current and upcoming CPUs from Intel, AMD, and Arm. The attack is an end-to-end exploit for Spectre based on a new feature in Intel CPUs called Linear Address Masking (LAM) as well as its analogous

Researchers Unveal GuLoader Malware's Latest Anti-Analysis Techniques https://thehackernews.com/2023/12/researchers-unveal-guloader-malwares.html Threat hunters have unmasked the latest tricks adopted by a malware strain called GuLoader in an effort to make analysis more challenging. "While GuLoader's core functionality hasn't changed drastically over the past few years, these constant updates in their obfuscation techniques make analyzing GuLoader a time-consuming and resource-intensive process," Elastic Security Labs

To tap or not to tap: Are NFC payments safer? https://www.welivesecurity.com/en/cybersecurity/to-tap-or-not-to-tap-are-nfc-payments-safer/ Contactless payments are quickly becoming ubiquitous – but are they more secure than traditional payment methods?

New 5G Modems Flaws Affect iOS Devices and Android Models from Major Brands https://thehackernews.com/2023/12/new-5g-modems-flaws-affect-ios-devices.html A collection of security flaws in the firmware implementation of 5G mobile network modems from major chipset vendors such as MediaTek and Qualcomm impact USB and IoT modems as well as hundreds of smartphone models running Android and iOS. Of the 14 flaws – collectively called 5Ghoul (a combination of "5G" and "Ghoul") – 10 affect 5G modems from the two companies, out of which three

N. Korean Kimsuky Targeting South Korean Research Institutes with Backdoor Attacks https://thehackernews.com/2023/12/n-korean-kimsuky-targeting-south-korean.html The North Korean threat actor known as Kimsuky has been observed targeting research institutes in South Korea as part of a spear-phishing campaign with the ultimate goal of distributing backdoors on compromised systems. "The threat actor ultimately uses a backdoor to steal information and execute commands," the AhnLab Security Emergency Response Center (ASEC) said in an

Ransomware-as-a-Service: The Growing Threat You Can't Ignore https://thehackernews.com/2023/12/ransomware-as-service-growing-threat.html Ransomware attacks have become a significant and pervasive threat in the ever-evolving realm of cybersecurity. Among the various iterations of ransomware, one trend that has gained prominence is Ransomware-as-a-Service (RaaS). This alarming development has transformed the cybercrime landscape, enabling individuals with limited technical expertise to carry out devastating attacks.