TECHZONE™

5 Techniques for Collecting Cyber Threat Intelligence https://thehackernews.com/2024/10/5-techniques-for-collecting-cyber.html To defend your organization against cyber threats, you need a clear picture of the current threat landscape. This means constantly expanding your knowledge about new and ongoing threats. There are many techniques analysts can use to collect crucial cyber threat intelligence. Let’s consider five that can greatly improve your threat investigations. Pivoting on С2 IP addresses to pinpoint malware

Astaroth Banking Malware Resurfaces in Brazil via Spear-Phishing Attack https://thehackernews.com/2024/10/astaroth-banking-malware-resurfaces-in.html A new spear-phishing campaign targeting Brazil has been found delivering a banking malware called Astaroth (aka Guildma) by making use of obfuscated JavaScript to slip past security guardrails. "The spear-phishing campaign's impact has targeted various industries, with manufacturing companies, retail firms, and government agencies being the most affected," Trend Micro said in a new analysis. "

Quishing attacks are targeting electric car owners: Here’s how to slam on the brakes https://www.welivesecurity.com/en/scams/quishing-attacks-targeting-electric-car-owners-slam-on-brakes/ Ever alert to fresh money-making opportunities, fraudsters are blending physical and digital threats to steal drivers’ payment details

GitHub Patches Critical Flaw in Enterprise Server Allowing Unauthorized Instance Access https://thehackernews.com/2024/10/github-patches-critical-flaw-in.html GitHub has released security updates for Enterprise Server (GHES) to address multiple issues, including a critical bug that could allow unauthorized access to an instance. The vulnerability, tracked as CVE-2024-9487, carries a CVS score of 9.5 out of a maximum of 10.0 "An attacker could bypass SAML single sign-on (SSO) authentication with the optional encrypted assertions feature, allowing

CISA Warns of Active Exploitation in SolarWinds Help Desk Software Vulnerability https://thehackernews.com/2024/10/cisa-warns-of-active-exploitation-in.html The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added a critical security flaw impacting SolarWinds Web Help Desk (WHD) software to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. Tracked as CVE-2024-28987 (CVSS score: 9.1), the vulnerability relates to a case of hard-coded credentials that could be abused to gain

Aspiring digital defender? Explore cybersecurity internships, scholarships and apprenticeships https://www.welivesecurity.com/en/cybersecurity/aspiring-digital-defender-explore-cybersecurity-internships-scholarships-apprenticeships/ The world needs more cybersecurity professionals – here are three great ways to give you an ‘in’ to the ever-growing and rewarding security industry

TrickMo Banking Trojan Can Now Capture Android PINs and Unlock Patterns https://thehackernews.com/2024/10/trickmo-banking-trojan-can-now-capture.html New variants of an Android banking trojan called TrickMo have been found to harbor previously undocumented features to steal a device's unlock pattern or PIN. "This new addition enables the threat actor to operate on the device even while it is locked," Zimperium security researcher Aazim Yaswant said in an analysis published last week. First spotted in the wild in 2019, TrickMo is so named for

New Malware Campaign Uses PureCrypter Loader to Deliver DarkVision RAT https://thehackernews.com/2024/10/new-malware-campaign-uses-purecrypter.html Cybersecurity researchers have disclosed a new malware campaign that leverages a malware loader named PureCrypter to deliver a commodity remote access trojan (RAT) called DarkVision RAT. The activity, observed by Zscaler ThreatLabz in July 2024, involves a multi-stage process to deliver the RAT payload. "DarkVision RAT communicates with its command-and-control (C2) server using a custom network

New Linux Variant of FASTCash Malware Targets Payment Switches in ATM Heists https://thehackernews.com/2024/10/new-linux-variant-of-fastcash-malware.html North Korean threat actors have been observed using a Linux variant of a known malware family called FASTCash to steal funds as part of a financially-motivated campaign. The malware is "installed on payment switches within compromised networks that handle card transactions for the means of facilitating the unauthorized withdrawal of cash from ATMs," a security researcher who goes by HaxRob said.

The Rise of Zero-Day Vulnerabilities: Why Traditional Security Solutions Fall Short https://thehackernews.com/2024/10/rise-of-zero-day-vulnerabilities.html In recent years, the number and sophistication of zero-day vulnerabilities have surged, posing a critical threat to organizations of all sizes. A zero-day vulnerability is a security flaw in software that is unknown to the vendor and remains unpatched at the time of discovery. Attackers exploit these flaws before any defensive measures can be implemented, making zero-days a potent weapon for

China Accuses U.S. of Fabricating Volt Typhoon to Hide Its Own Hacking Campaigns https://thehackernews.com/2024/10/china-accuses-us-of-fabricating-volt.html China's National Computer Virus Emergency Response Center (CVERC) has doubled down on claims that the threat actor known as the Volt Typhoon is a fabrication of the U.S. and its allies. The agency, in collaboration with the National Engineering Laboratory for Computer Virus Prevention Technology, went on to accuse the U.S. federal government, intelligence agencies, and Five Eyes countries of

Researchers Uncover Hijack Loader Malware Using Stolen Code-Signing Certificates https://thehackernews.com/2024/10/researchers-uncover-hijack-loader.html Cybersecurity researchers have disclosed a new malware campaign that delivers Hijack Loader artifacts that are signed with legitimate code-signing certificates. French cybersecurity company HarfangLab, which detected the activity at the start of the month, said the attack chains aim to deploy an information stealer known as Lumma. Hijack Loader, also known as DOILoader, IDAT Loader, and

WordPress Plugin Jetpack Patches Major Vulnerability Affecting 27 Million Sites https://thehackernews.com/2024/10/wordpress-plugin-jetpack-patches-major.html The maintainers of the Jetpack WordPress plugin have released a security update to remediate a critical vulnerability that could allow logged-in users to access forms submitted by others on a site. Jetpack, owned by WordPress maker Automattic, is an all-in-one plugin that offers a comprehensive suite of tools to improve site safety, performance, and traffic growth. It's used on 27 million

Nation-State Attackers Exploiting Ivanti CSA Flaws for Network Infiltration https://thehackernews.com/2024/10/nation-state-attackers-exploiting.html A suspected nation-state adversary has been observed weaponizing three security flaws in Ivanti Cloud Service Appliance (CSA) a zero-day to perform a series of malicious actions. That's according to findings from Fortinet FortiGuard Labs, which said the vulnerabilities were abused to gain unauthenticated access to the CSA, enumerate users configured in the appliance, and attempt to access the

5 Steps to Boost Detection and Response in a Multi-Layered Cloud https://thehackernews.com/2024/10/5-steps-to-boost-detection-and-response.html The link between detection and response (DR) practices and cloud security has historically been weak. As global organizations increasingly adopt cloud environments, security strategies have largely focused on "shift-left" practices—securing code, ensuring proper cloud posture, and fixing misconfigurations. However, this approach has led to an over-reliance on a multitude of DR tools spanning

Supply Chain Attacks Can Exploit Entry Points in Python, npm, and Open-Source Ecosystems https://thehackernews.com/2024/10/supply-chain-attacks-exploit-entry.html Cybersecurity researchers have found that entry points could be abused across multiple programming ecosystems like PyPI, npm, Ruby Gems, NuGet, Dart Pub, and Rust Crates to stage software supply chain attacks. "Attackers can leverage these entry points to execute malicious code when specific commands are run, posing a widespread risk in the open-source landscape," Checkmarx researchers Yehuda

THN Cybersecurity Recap: Top Threats, Tools and Trends (Oct 7 - Oct 13) https://thehackernews.com/2024/10/thn-cybersecurity-recap-top-threats.html Hey there, it's your weekly dose of "what the heck is going on in cybersecurity land" – and trust me, you NEED to be in the loop this time. We've got everything from zero-day exploits and AI gone rogue to the FBI playing crypto kingpin – it's full of stuff they don't 🤫 want you to know. So let's jump in before we get FOMO. ⚡ Threat of the Week GoldenJackal Hacks Air-Gapped Systems: Meet

Critical Veeam Vulnerability Exploited to Spread Akira and Fog Ransomware https://thehackernews.com/2024/10/critical-veeam-vulnerability-exploited.html Threat actors are actively attempting to exploit a now-patched security flaw in Veeam Backup & Replication to deploy Akira and Fog ransomware. Cybersecurity vendor Sophos said it has been tracking a series of attacks in the past month leveraging compromised VPN credentials and CVE-2024-40711 to create a local account and deploy the ransomware. CVE-2024-40711, rated 9.8 out of 10.0 on the

OilRig Exploits Windows Kernel Flaw in Espionage Campaign Targeting UAE and Gulf https://thehackernews.com/2024/10/oilrig-exploits-windows-kernel-flaw-in.html The Iranian threat actor known as OilRig has been observed exploiting a now-patched privilege escalation flaw impacting the Windows Kernel as part of a cyber espionage campaign targeting the U.A.E. and the broader Gulf region. "The group utilizes sophisticated tactics that include deploying a backdoor that leverages Microsoft Exchange servers for credentials theft, and exploiting vulnerabilities

GoldenJackal jumps the air gap … twice – Week in security with Tony Anscombe https://www.welivesecurity.com/en/videos/goldenjackal-jumps-air-gap-twice-week-security-tony-anscombe/ ESET research dives deep into a series of attacks that leveraged bespoke toolsets to compromise air-gapped systems belonging to governmental and diplomatic entities