TECHZONE™

Trusted Apps Sneak a Bug Into the UEFI Boot Process https://www.darkreading.com/vulnerabilities-threats/trusted-apps-bug-uefi-boot-process

CISA's AI Playbook Pushes For More Information Sharing https://www.darkreading.com/cyber-risk/cisa-s-ai-playbook-pushes-for-more-information-sharing

The $10 Cyber Threat Responsible for the Biggest Breaches of 2024 https://thehackernews.com/2025/01/the-10-cyber-threat-responsible-for.html You can tell the story of the current state of stolen credential-based attacks in three numbers: Stolen credentials were the #1 attacker action in 2023/24, and the breach vector for 80% of web app attacks. (Source: Verizon). Cybersecurity budgets grew again in 2024, with organizations now spending almost $1,100 per user (Source: Forrester).  Stolen credentials on criminal forums cost as

New UEFI Secure Boot Vulnerability Could Allow Attackers to Load Malicious Bootkits https://thehackernews.com/2025/01/new-uefi-secure-boot-vulnerability.html Details have emerged about a now-patched security vulnerability that could allow a bypass of the Secure Boot mechanism in Unified Extensible Firmware Interface (UEFI) systems. The vulnerability, assigned the CVE identifier CVE-2024-7344 (CVSS score: 6.7), resides in a UEFI application signed by Microsoft's "Microsoft Corporation UEFI CA 2011" third-party UEFI certificate, according to a new

Researchers Find Exploit Allowing NTLMv1 Despite Active Directory Restrictions https://thehackernews.com/2025/01/researchers-find-exploit-allowing.html Cybersecurity researchers have found that the Microsoft Active Directory Group Policy that's designed to disable NT LAN Manager (NTLM) v1 can be trivially bypassed by a misconfiguration. "A simple misconfiguration in on-premise applications can override the Group Policy, effectively negating the Group Policy designed to stop NTLMv1 authentications," Silverfort researcher Dor Segal said in a

Hackers Hide Malware in Images to Deploy VIP Keylogger and 0bj3ctivity Stealer https://thehackernews.com/2025/01/hackers-hide-malware-in-images-to.html Threat actors have been observed concealing malicious code in images to deliver malware such as VIP Keylogger and 0bj3ctivity Stealer as part of separate campaigns. "In both campaigns, attackers hid malicious code in images they uploaded to archive[.]org, a file-hosting website, and used the same .NET loader to install their final payloads," HP Wolf Security said in its Threat Insights Report

Python-Based Malware Powers RansomHub Ransomware to Exploit Network Flaws https://thehackernews.com/2025/01/python-based-malware-powers-ransomhub.html Cybersecurity researchers have detailed an attack that involved a threat actor utilizing a Python-based backdoor to maintain persistent access to compromised endpoints and then leveraged this access to deploy the RansomHub ransomware throughout the target network. According to GuidePoint Security, initial access is said to have been facilitated by means of a JavaScript malware downloaded named

Researcher Uncovers Critical Flaws in Multiple Versions of Ivanti Endpoint Manager https://thehackernews.com/2025/01/researcher-uncovers-critical-flaws-in.html Ivanti has rolled out security updates to address several security flaws impacting Avalanche, Application Control Engine, and Endpoint Manager (EPM), including four critical bugs that could lead to information disclosure. All the four critical security flaws, rated 9.8 out of 10.0 on the CVSS scale, are rooted in EPM, and concern absolute path traversal flaws that allow a remote unauthenticated

Attackers Hijack Google Advertiser Accounts to Spread Malware https://www.darkreading.com/vulnerabilities-threats/attackers-hijack-google-advertiser-accounts-malware

CISA: Second BeyondTrust Vulnerability Added to KEV Catalog https://www.darkreading.com/vulnerabilities-threats/cisa-warns-of-second-vuln-found-in-beyondtrust-breach-investigation

Extension Poisoning Campaign Highlights Gaps in Browser Security https://www.darkreading.com/endpoint-security/extension-poisoning-campaign-gaps-browser-security

North Korea's Lazarus APT Evolves Developer-Recruitment Attacks https://www.darkreading.com/threat-intelligence/north-korea-lazarus-apt-developer-recruitment-attacks

OWASP's New LLM Top 10 Shows Emerging AI Threats https://www.darkreading.com/vulnerabilities-threats/owasps-llm-top-10-shows-emerging-ai-threats

Google Ads Users Targeted in Malvertising Scam Stealing Credentials and 2FA Codes https://thehackernews.com/2025/01/google-ads-users-targeted-in.html Cybersecurity researchers have alerted to a new malvertising campaign that's targeting individuals and businesses advertising via Google Ads by attempting to phish for their credentials via fraudulent ads on Google. "The scheme consists of stealing as many advertiser accounts as possible by impersonating Google Ads and redirecting victims to fake login pages," Jérôme Segura, senior director of

Lazarus Group Targets Web3 Developers with Fake LinkedIn Profiles in Operation 99 https://thehackernews.com/2025/01/lazarus-group-targets-web3-developers.html The North Korea-linked Lazarus Group has been attributed to a new cyber attack campaign dubbed Operation 99 that targeted software developers looking for freelance Web3 and cryptocurrency work to deliver malware. "The campaign begins with fake recruiters, posing on platforms like LinkedIn, luring developers with project tests and code reviews," Ryan Sherstobitoff, senior vice president of Threat

North Korean IT Worker Fraud Linked to 2016 Crowdfunding Scam and Fake Domains https://thehackernews.com/2025/01/north-korean-it-worker-fraud-linked-to.html Cybersecurity researchers have identified infrastructure links between the North Korean threat actors behind the fraudulent IT worker schemes and a 2016 crowdfunding scam. The new evidence suggests that Pyongyang-based threamoret groups may have pulled off illicit money-making scams that predate the use of IT workers, SecureWorks Counter Threat Unit (CTU) said in a report shared with The Hacker

Google Cloud Researchers Uncover Flaws in Rsync File Synchronization Tool https://thehackernews.com/2025/01/google-cloud-researchers-uncover-flaws.html As many as six security vulnerabilities have been disclosed in the popular Rsync file-synchronizing tool for Unix systems, some of which could be exploited to execute arbitrary code on a client. "Attackers can take control of a malicious server and read/write arbitrary files of any connected client," the CERT Coordination Center (CERT/CC) said in an advisory. "Sensitive data, such as SSH keys,

The High-Stakes Disconnect For ICS/OT Security https://thehackernews.com/2025/01/the-high-stakes-disconnect-for-icsot.html Why does ICS/OT need specific controls and its own cybersecurity budget today? Because treating ICS/OT security with an IT security playbook isn’t just ineffective—it’s high risk. In the rapidly evolving domain of cybersecurity, the specific challenges and needs for Industrial Control Systems (ICS) and Operational Technology (OT) security distinctly stand out from traditional IT security. ICS/OT

New Startups Focus on Deepfakes, Data-in-Motion & Model Security https://www.darkreading.com/cybersecurity-operations/startups-focus-deepfakes-data-motion-model-security

CISA Releases the Cybersecurity Performance Goals Adoption Report https://www.darkreading.com/cybersecurity-operations/cisa-releases-the-cybersecurity-performance-goals-adoption-report