TECHZONE™

⚡ THN Weekly Recap: Top Cybersecurity Threats, Tools and Tips https://thehackernews.com/2024/12/thn-recap-top-cybersecurity-threats_16.html This past week has been packed with unsettling developments in the world of cybersecurity. From silent but serious attacks on popular business tools to unexpected flaws lurking in everyday devices, there’s a lot that might have flown under your radar. Attackers are adapting old tricks, uncovering new ones, and targeting systems both large and small. Meanwhile, law enforcement has scored wins

Data Governance in DevOps: Ensuring Compliance in the AI Era https://thehackernews.com/2024/12/data-governance-in-devops-ensuring.html With the evolution of modern software development, CI/CD pipeline governance has emerged as a critical factor in maintaining both agility and compliance. As we enter the age of artificial intelligence (AI), the importance of robust pipeline governance has only intensified. With that said, we’ll explore the concept of CI/CD pipeline governance and why it's vital, especially as AI becomes

New Investment Scam Leverages AI, Social Media Ads to Target Victims Worldwide https://thehackernews.com/2024/12/new-investment-scam-leverages-ai-social.html Cybersecurity researchers are calling attention to a new kind of investment scam that leverages a combination of social media malvertising, company-branded posts, and artificial intelligence (AI) powered video testimonials featuring famous personalities, ultimately leading to financial and data loss. "The main goal of the fraudsters is to lead victims to phishing websites and forms that harvest

New Glutton Malware Exploits Popular PHP Frameworks Like Laravel and ThinkPHP https://thehackernews.com/2024/12/new-glutton-malware-exploits-popular.html Cybersecurity researchers have discovered a new PHP-based backdoor called Glutton that has been put to use in cyber attacks targeting China, the United States, Cambodia, Pakistan, and South Africa. QiAnXin XLab, which discovered the malicious activity in late April 2024, attributed the previously unknown malware with moderate confidence to the prolific Chinese nation-state group tracked Winnti (

Ukrainian Minors Recruited for Cyber Ops and Reconnaissance in Russian Airstrikes https://thehackernews.com/2024/12/ukrainian-minors-recruited-for-cyber.html The Security Service of Ukraine (SBU or SSU) has exposed a novel espionage campaign suspected to be orchestrated by Russia's Federal Security Service (FSB) that involves recruiting Ukrainian minors for criminal activities under the guise of "quest games." Law enforcement officials said that it detained two FSB agent groups following a special operation in Kharkiv. These groups, per the agency,

Germany Disrupts BADBOX Malware on 30,000 Devices Using Sinkhole Action https://thehackernews.com/2024/12/germany-disrupts-badbox-malware-on.html Germany's Federal Office of Information Security (BSI) has announced that it has disrupted a malware operation called BADBOX that came preloaded on at least 30,000 internet-connected devices sold across the country. In a statement published earlier this week, authorities said they severed the communications between the devices and their command-and-control (C2) servers by sinkholing the domains

Thai Officials Targeted in Yokai Backdoor Campaign Using DLL Side-Loading Techniques https://thehackernews.com/2024/12/thai-officials-targeted-in-yokai.html Thai government officials have emerged as the target of a new campaign that leverages a technique called DLL side-loading to deliver a previously undocumented backdoor dubbed Yokai. "The target of the threat actors were Thailand officials based on the nature of the lures," Nikhil Hegde, senior engineer for Netskope's Security Efficacy team, told The Hacker News. "The Yokai backdoor itself is not

390,000+ WordPress Credentials Stolen via Malicious GitHub Repository Hosting PoC Exploits https://thehackernews.com/2024/12/390000-wordpress-credentials-stolen-via.html A now-removed GitHub repository that advertised a WordPress tool to publish posts to the online content management system (CMS) is estimated to have enabled the exfiltration of over 390,000 credentials. The malicious activity is part of a broader attack campaign undertaken by a threat actor, dubbed MUT-1244 (where MUT refers to "mysterious unattributed threat") by Datadog Security Labs, that

Critical OpenWrt Vulnerability Exposes Devices to Malicious Firmware Injection https://thehackernews.com/2024/12/critical-openwrt-vulnerability-exposes.html A security flaw has been disclosed in OpenWrt's Attended Sysupgrade (ASU) feature that, if successfully exploited, could have been abused to distribute malicious firmware packages. The vulnerability, tracked as CVE-2024-54143, carries a CVSS score of 9.3 out of a maximum of 10, indicating critical severity. Flatt Security researcher RyotaK has been credited with discovering and reporting the

DoJ Indicts 14 North Koreans for $88M IT Worker Fraud Scheme Over Six Years https://thehackernews.com/2024/12/doj-indicts-14-north-koreans-for-88m-it.html The U.S. Department of Justice (DoJ) has indicted 14 nationals belonging to the Democratic People's Republic of Korea (DPRK or North Korea) for their alleged involvement in a long-running conspiracy to violate sanctions and commit wire fraud, money laundering, and identity theft by illegally seeking employment in U.S. companies and non-profit organizations. "The conspirators, who worked for

Iran-Linked IOCONTROL Malware Targets SCADA and Linux-Based IoT Platforms https://thehackernews.com/2024/12/iran-linked-iocontrol-malware-targets.html Iran-affiliated threat actors have been linked to a new custom malware that's geared toward IoT and operational technology (OT) environments in Israel and the United States. The malware has been codenamed IOCONTROL by OT cybersecurity company Claroty, highlighting its ability to attack IoT and supervisory control and data acquisition (SCADA) devices such as IP cameras, routers, programmable

How to Generate a CrowdStrike RFM Report With AI in Tines https://thehackernews.com/2024/12/how-to-generate-crowdstrike-rfm-report.html Run by the team at orchestration, AI, and automation platform Tines, the Tines library contains pre-built workflows shared by real security practitioners from across the community, all of which are free to import and deploy via the Community Edition of the platform.  Their bi-annual “You Did What with Tines?!” competition highlights some of the most interesting workflows submitted by their

New Linux Rootkit PUMAKIT Uses Advanced Stealth Techniques to Evade Detection https://thehackernews.com/2024/12/new-linux-rootkit-pumakit-uses-advanced.html Cybersecurity researchers have uncovered a new Linux rootkit called PUMAKIT that comes with capabilities to escalate privileges, hide files and directories, and conceal itself from system tools, while simultaneously evading detection. "PUMAKIT is a sophisticated loadable kernel module (LKM) rootkit that employs advanced stealth mechanisms to hide its presence and maintain communication with

FBI Busts Rydox Marketplace with 7,600 PII Sales, Cryptocurrency Worth $225K Seized https://thehackernews.com/2024/12/fbi-busts-rydox-marketplace-with-7600.html The U.S. Department of Justice (DoJ) on Thursday announced the shutdown of an illicit marketplace called Rydox ("rydox.ru" and "rydox[.]cc") for selling stolen personal information, access devices, and other tools for conducting cybercrime and fraud. In tandem, three Kosovo nationals and administrators of the service, Ardit Kutleshi, Jetmir Kutleshi, and Shpend Sokoli, have been arrested. Ardit

Over 300K Prometheus Instances Exposed: Credentials and API Keys Leaking Online https://thehackernews.com/2024/12/296000-prometheus-instances-exposed.html Cybersecurity researchers are warning that thousands of servers hosting the Prometheus monitoring and alerting toolkit are at risk of information leakage and exposure to denial-of-service (DoS) as well as remote code execution (RCE) attacks. "Prometheus servers or exporters, often lacking proper authentication, allowed attackers to easily gather sensitive information, such as credentials and API

Gamaredon Deploys Android Spyware "BoneSpy" and "PlainGnome" in Former Soviet States https://thehackernews.com/2024/12/gamaredon-deploys-android-spyware.html The Russia-linked state-sponsored threat actor tracked as Gamaredon has been attributed to two new Android spyware tools called BoneSpy and PlainGnome, marking the first time the adversary has been discovered using mobile-only malware families in its attack campaigns. "BoneSpy and PlainGnome target former Soviet states and focus on Russian-speaking victims," Lookout said in an analysis. "Both

Researchers Uncover Symlink Exploit Allowing TCC Bypass in iOS and macOS https://thehackernews.com/2024/12/researchers-uncover-symlink-exploit.html Details have emerged about a now-patched security vulnerability in Apple's iOS and macOS that, if successfully exploited, could sidestep the Transparency, Consent, and Control (TCC) framework and result in unauthorized access to sensitive information. The flaw, tracked as CVE-2024-44131 (CVSS score: 5.3), resides in the FileProvider component, per Apple, and has been addressed with improved

SaaS Budget Planning Guide for IT Professionals https://thehackernews.com/2024/12/saas-budget-planning-guide-for-it.html SaaS services are one of the biggest drivers of OpEx (operating expenses) for modern businesses. With Gartner projecting $247.2 billion in global SaaS spending this year, it’s no wonder SaaS budgets are a big deal in the world of finance and IT. Efficient SaaS utilization can significantly affect both the bottom line and employee productivity.  In this article, we’ll break down this topic

WordPress Hunk Companion Plugin Flaw Exploited to Silently Install Vulnerable Plugins https://thehackernews.com/2024/12/wordpress-hunk-companion-plugin-flaw.html Malicious actors are exploiting a critical vulnerability in the Hunk Companion plugin for WordPress to install other vulnerable plugins that could open the door to a variety of attacks. The flaw, tracked as CVE-2024-11972 (CVSS score: 9.8), affects all versions of the plugin prior to 1.9.0. The plugin has over 10,000 active installations. "This flaw poses a significant security risk, as it

Europol Dismantles 27 DDoS Attack Platforms Across 15 Nations; Admins Arrested https://thehackernews.com/2024/12/europol-dismantles-27-ddos-attack.html A global law enforcement operation has failed 27 stresser services that were used to conduct distributed denial-of-service (DDoS) attacks and took them offline as part of a multi-year international exercise called PowerOFF. The effort, coordinated by Europol and involving 15 countries, dismantled several booter and stresser websites, including zdstresser.net, orbitalstress.net, and