TECHZONE™

Ransomware Gangs Use LockBit's Fame to Intimidate Victims in Latest Attacks https://thehackernews.com/2024/10/ransomware-gangs-use-lockbits-fame-to.html Threat actors have been observed abusing Amazon S3 (Simple Storage Service) Transfer Acceleration feature as part of ransomware attacks designed to exfiltrate victim data and upload them to S3 buckets under their control. "Attempts were made to disguise the Golang ransomware as the notorious LockBit ransomware," Trend Micro researchers Jaromir Horejsi and Nitesh Surana said. "However, such is

Gophish Framework Used in Phishing Campaigns to Deploy Remote Access Trojans https://thehackernews.com/2024/10/gophish-framework-used-in-phishing.html Russian-speaking users have become the target of a new phishing campaign that leverages an open-source phishing toolkit called Gophish to deliver DarkCrystal RAT (aka DCRat) and a previously undocumented remote access trojan dubbed PowerRAT. "The campaign involves modular infection chains that are either Maldoc or HTML-based infections and require the victim's intervention to trigger the

Security Flaw in Styra's OPA Exposes NTLM Hashes to Remote Attackers https://thehackernews.com/2024/10/security-flaw-in-styras-opa-exposes.html Details have emerged about a now-patched security flaw in Styra's Open Policy Agent (OPA) that, if successfully exploited, could have led to leakage of New Technology LAN Manager (NTLM) hashes. "The vulnerability could have allowed an attacker to leak the NTLM credentials of the OPA server's local user account to a remote server, potentially allowing the attacker to relay the authentication or

Cybercriminals Exploiting Docker API Servers for SRBMiner Crypto Mining Attacks https://thehackernews.com/2024/10/cybercriminals-exploiting-docker-api.html Bad actors have been observed targeting Docker remote API servers to deploy the SRBMiner crypto miner on compromised instances, according to new findings from Trend Micro. "In this attack, the threat actor used the gRPC protocol over h2c to evade security solutions and execute their crypto mining operations on the Docker host," researchers Abdelrahman Esmail and Sunil Bharti said in a technical

A Comprehensive Guide to Finding Service Accounts in Active Directory https://thehackernews.com/2024/10/a-comprehensive-guide-to-finding.html Service accounts are vital in any enterprise, running automated processes like managing applications or scripts. However, without proper monitoring, they can pose a significant security risk due to their elevated privileges. This guide will walk you through how to locate and secure these accounts within Active Directory (AD), and explore how Silverfort’s solutions can help enhance your

Bumblebee and Latrodectus Malware Return with Sophisticated Phishing Strategies https://thehackernews.com/2024/10/bumblebee-and-latrodectus-malware.html Two malware families that suffered setbacks in the aftermath of a coordinated law enforcement operation called Endgame have resurfaced as part of new phishing campaigns. Bumblebee and Latrodectus, which are both malware loaders, are designed to steal personal data, along with downloading and executing additional payloads onto compromised hosts. Tracked under the names BlackWidow, IceNova, Lotus,

Malicious npm Packages Target Developers' Ethereum Wallets with SSH Backdoor https://thehackernews.com/2024/10/malicious-npm-packages-target.html Cybersecurity researchers have discovered a number of suspicious packages published to the npm registry that are designed to harvest Ethereum private keys and gain remote access to the machine via the secure shell (SSH) protocol. The packages attempt to "gain SSH access to the victim's machine by writing the attacker’s SSH public key in the root user’s authorized_keys file," software supply

Google Voice scams: What are they and how do I avoid them? https://www.welivesecurity.com/en/scams/google-voice-scams-what-how-avoid/ Watch out for schemes where fraudsters trick people into sharing verification codes so they can gain access to their phone numbers

VMware Releases vCenter Server Update to Fix Critical RCE Vulnerability https://thehackernews.com/2024/10/vmware-releases-vcenter-server-update.html VMware has released software updates to address an already patched security flaw in vCenter Server that could pave the way for remote code execution. The vulnerability, tracked as CVE-2024-38812 (CVSS score: 9.8), concerns a case of heap-overflow vulnerability in the implementation of the DCE/RPC protocol. "A malicious actor with network access to vCenter Server may trigger this vulnerability by

CISA Adds ScienceLogic SL1 Vulnerability to Exploited Catalog After Active Zero-Day Attack https://thehackernews.com/2024/10/cisa-adds-sciencelogic-sl1.html The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a critical security flaw impacting ScienceLogic SL1 to its Known Exploited Vulnerabilities (KEV) catalog, following reports of active exploitation as a zero-day. The vulnerability in question, tracked as CVE-2024-9537 (CVSS v4 score: 9.3), refers to a bug involving an unspecified third-party component that could

Chinese Nation-State Hackers APT41 Hit Gambling Sector for Financial Gain https://thehackernews.com/2024/10/chinese-nation-state-hackers-apt41-hit.html The prolific Chinese nation-state actor known as APT41 (aka Brass Typhoon, Earth Baku, Wicked Panda, or Winnti) has been attributed to a sophisticated cyber attack targeting the gambling and gaming industry. "Over a period of at least six months, the attackers stealthily gathered valuable information from the targeted company including, but not limited to, network configurations, user passwords,

Guide:  The Ultimate Pentest Checklist for Full-Stack Security https://thehackernews.com/2024/10/guide-ultimate-pentest-checklist-for.html Pentest Checklists Are More Important Than Ever Given the expanding attack surface coupled with the increasing sophistication of attacker tactics and techniques, penetration testing checklists have become essential for ensuring thorough assessments across an organization’s attack surface, both internal and external. By providing a structured approach, these checklists help testers systematically

THN Cybersecurity Recap: Top Threats, Tools and News (Oct 14 - Oct 20) https://thehackernews.com/2024/10/thn-cybersecurity-recap-top-threats_21.html Hi there! Here’s your quick update on the latest in cybersecurity. Hackers are using new tricks to break into systems we thought were secure—like finding hidden doors in locked houses. But the good news? Security experts are fighting back with smarter tools to keep data safe. Some big companies were hit with attacks, while others fixed their vulnerabilities just in time. It's a constant battle.

Researchers Discover Severe Security Flaws in Major E2EE Cloud Storage Providers https://thehackernews.com/2024/10/researchers-discover-severe-security.html Cybersecurity researchers have discovered severe cryptographic issues in various end-to-end encrypted (E2EE) cloud storage platforms that could be exploited to leak sensitive data. "The vulnerabilities range in severity: in many cases a malicious server can inject files, tamper with file data, and even gain direct access to plaintext," ETH Zurich researchers Jonas Hofmann and Kien Tuong Truong

Hackers Exploit Roundcube Webmail XSS Vulnerability to Steal Login Credentials https://thehackernews.com/2024/10/hackers-exploit-roundcube-webmail-xss.html Unknown threat actors have been observed attempting to exploit a now-patched security flaw in the open-source Roundcube webmail software as part of a phishing attack designed to steal user credentials. Russian cybersecurity company Positive Technologies said it discovered last month that an email was sent to an unspecified governmental organization located in one of the Commonwealth of

Threat actors exploiting zero-days faster than ever – Week in security with Tony Anscombe https://www.welivesecurity.com/en/videos/threat-actors-exploiting-zero-days-faster-ever-week-security-tony-anscombe/ The average time it takes attackers to weaponize a vulnerability, either before or after a patch is released, shrank from 63 days in 2018-2019 to just five days last year

Acronym Overdose – Navigating the Complex Data Security Landscape https://thehackernews.com/2024/10/acronym-overdose-navigating-complex.html In the modern enterprise, data security is often discussed using a complex lexicon of acronyms—DLP, DDR, DSPM, and many others. While these acronyms represent critical frameworks, architectures, and tools for protecting sensitive information, they can also overwhelm those trying to piece together an effective security strategy. This article aims to demystify some of the most important acronyms

Crypt Ghouls Targets Russian Firms with LockBit 3.0 and Babuk Ransomware Attacks https://thehackernews.com/2024/10/crypt-ghouls-targets-russian-firms-with.html A nascent threat actor known as Crypt Ghouls has been linked to a set of cyber attacks targeting Russian businesses and government agencies with ransomware with the twin goals of disrupting business operations and financial gain. "The group under review has a toolkit that includes utilities such as Mimikatz, XenAllPasswordPro, PingCastle, Localtonet, resocks, AnyDesk, PsExec, and others,"

North Korean IT Workers in Western Firms Now Demanding Ransom for Stolen Data https://thehackernews.com/2024/10/north-korean-it-workers-in-western.html North Korean information technology (IT) workers who obtain employment under false identities in Western companies are not only stealing intellectual property, but are also stepping up by demanding ransoms in order to not leak it, marking a new twist to their financially motivated attacks. "In some instances, fraudulent workers demanded ransom payments from their former employers after gaining

The Ultimate DSPM Guide: Webinar on Building a Strong Data Security Posture https://thehackernews.com/2024/10/the-ultimate-dspm-guide-webinar-on.html Picture your company's data as a vast, complex jigsaw puzzle—scattered across clouds, devices, and networks. Some pieces are hidden, some misplaced, and others might even be missing entirely. Keeping your data secure in today’s fast-evolving landscape can feel like an impossible challenge. But there’s a game-changing solution: Data Security Posture Management (DSPM). Think of it as a high-tech,