TECHZONE™

Critical Veeam Vulnerability Exploited to Spread Akira and Fog Ransomware https://thehackernews.com/2024/10/critical-veeam-vulnerability-exploited.html Threat actors are actively attempting to exploit a now-patched security flaw in Veeam Backup & Replication to deploy Akira and Fog ransomware. Cybersecurity vendor Sophos said it has been tracking a series of attacks in the past month leveraging compromised VPN credentials and CVE-2024-40711 to create a local account and deploy the ransomware. CVE-2024-40711, rated 9.8 out of 10.0 on the

OilRig Exploits Windows Kernel Flaw in Espionage Campaign Targeting UAE and Gulf https://thehackernews.com/2024/10/oilrig-exploits-windows-kernel-flaw-in.html The Iranian threat actor known as OilRig has been observed exploiting a now-patched privilege escalation flaw impacting the Windows Kernel as part of a cyber espionage campaign targeting the U.A.E. and the broader Gulf region. "The group utilizes sophisticated tactics that include deploying a backdoor that leverages Microsoft Exchange servers for credentials theft, and exploiting vulnerabilities

GoldenJackal jumps the air gap … twice – Week in security with Tony Anscombe https://www.welivesecurity.com/en/videos/goldenjackal-jumps-air-gap-twice-week-security-tony-anscombe/ ESET research dives deep into a series of attacks that leveraged bespoke toolsets to compromise air-gapped systems belonging to governmental and diplomatic entities

FBI Creates Fake Cryptocurrency to Expose Widespread Crypto Market Manipulation https://thehackernews.com/2024/10/fbi-creates-fake-cryptocurrency-to.html The U.S. Department of Justice (DoJ) has announced arrests and charges against several individuals and entities in connection with allegedly manipulating digital asset markets as part of a widespread fraud operation. The law enforcement action – codenamed Operation Token Mirrors – is the result of the U.S. Federal Bureau of Investigation (FBI) taking the "unprecedented step" of creating its own

GitHub, Telegram Bots, and QR Codes Abused in New Wave of Phishing Attacks https://thehackernews.com/2024/10/github-telegram-bots-and-qr-codes.html A new tax-themed malware campaign targeting insurance and finance sectors has been observed leveraging GitHub links in phishing email messages as a way to bypass security measures and deliver Remcos RAT, indicating that the method is gaining traction among threat actors. "In this campaign, legitimate repositories such as the open-source tax filing software, UsTaxes, HMRC, and InlandRevenue were

Telekopye transitions to targeting tourists via hotel booking scam https://www.welivesecurity.com/en/eset-research/telekopye-hits-new-hunting-ground-hotel-booking-scams/ ESET Research shares new findings about Telekopye, a scam toolkit used to defraud people on online marketplaces, and newly on accommodation booking platforms

How Hybrid Password Attacks Work and How to Defend Against Them https://thehackernews.com/2024/10/how-hybrid-password-attacks-work-and.html Threat actors constantly change tactics to bypass cybersecurity measures, developing innovative methods to steal user credentials. Hybrid password attacks merge multiple cracking techniques to amplify their effectiveness. These combined approaches exploit the strengths of various methods, accelerating the password-cracking process.  In this post, we’ll explore hybrid attacks — what they are

CISA Warns of Threat Actors Exploiting F5 BIG-IP Cookies for Network Reconnaissance https://thehackernews.com/2024/10/cisa-warns-of-threat-actors-exploiting.html The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is warning that it has observed threat actors leveraging unencrypted persistent cookies managed by the F5 BIG-IP Local Traffic Manager (LTM) module to conduct reconnaissance of target networks. It said the module is being used to enumerate other non-internet-facing devices on the network. The agency, however, did not disclose who

New Critical GitLab Vulnerability Could Allow Arbitrary CI/CD Pipeline Execution https://thehackernews.com/2024/10/new-critical-gitlab-vulnerability-could.html GitLab has released security updates for Community Edition (CE) and Enterprise Edition (EE) to address eight security flaws, including a critical bug that could allow running Continuous Integration and Continuous Delivery (CI/CD) pipelines on arbitrary branches. Tracked as CVE-2024-9164, the vulnerability carries a CVSS score of 9.6 out of 10. "An issue was discovered in GitLab EE

Bohemia and Cannabia Dark Web Markets Taken Down After Joint Police Operation https://thehackernews.com/2024/10/bohemia-and-cannabia-dark-web-markets.html The Dutch police have announced the takedown of Bohemia and Cannabia, which has been described as the world's largest and longest-running dark web market for illegal goods, drugs, and cybercrime services. The takedown is the result of a collaborative investigation with Ireland, the United Kingdom, and the United States that began towards the end of 2022, the Politie said. The marketplace

OpenAI Blocks 20 Global Malicious Campaigns Using AI for Cybercrime and Disinformation https://thehackernews.com/2024/10/openai-blocks-20-global-malicious.html OpenAI on Wednesday said it has disrupted more than 20 operations and deceptive networks across the world that attempted to use its platform for malicious purposes since the start of the year. This activity encompassed debugging malware, writing articles for websites, generating biographies for social media accounts, and creating AI-generated profile pictures for fake accounts on X. "Threat

Experts Warn of Critical Unpatched Vulnerability in Linear eMerge E3 Systems https://thehackernews.com/2024/10/experts-warn-of-critical-unpatched.html Cybersecurity security researchers are warning about an unpatched vulnerability in Nice Linear eMerge E3 access controller systems that could allow for the execution of arbitrary operating system (OS) commands. The flaw, assigned the CVE identifier CVE-2024-9441, carries a CVSS score of 9.8 out of a maximum of 10.0, according to VulnCheck. "A vulnerability in the Nortek Linear eMerge E3 allows

6 Simple Steps to Eliminate SOC Analyst Burnout https://thehackernews.com/2024/10/6-simple-steps-to-eliminate-soc-analyst.html The current SOC model relies on a scarce resource: human analysts. These professionals are expensive, in high demand, and increasingly difficult to retain. Their work is not only highly technical and high-risk, but also soul-crushingly repetitive, dealing with a constant flood of alerts and incidents. As a result, SOC analysts often leave in search of better pay, the opportunity to move beyond

Cybercriminals Use Unicode to Hide Mongolian Skimmer in E-Commerce Platforms https://thehackernews.com/2024/10/cybercriminals-use-unicode-to-hide.html Cybersecurity researchers have shed light on a new digital skimmer campaign that leverages Unicode obfuscation techniques to conceal a skimmer dubbed Mongolian Skimmer. "At first glance, the thing that stood out was the script's obfuscation, which seemed a bit bizarre because of all the accented characters," Jscrambler researchers said in an analysis. "The heavy use of Unicode characters, many

CISA Warns of Critical Fortinet Flaw as Palo Alto and Cisco Issue Urgent Security Patches https://thehackernews.com/2024/10/cisa-warns-of-critical-fortinet-flaw-as.html The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a critical security flaw impacting Fortinet products to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vulnerability, tracked as CVE-2024-23113 (CVSS score: 9.8), relates to cases of remote code execution that affects FortiOS, FortiPAM, FortiProxy, and FortiWeb. "A

Firefox Zero-Day Under Attack: Update Your Browser Immediately https://thehackernews.com/2024/10/mozilla-warns-of-active-exploitation-in.html Mozilla has revealed that a critical security flaw impacting Firefox and Firefox Extended Support Release (ESR) has come under active exploitation in the wild. The vulnerability, tracked as CVE-2024-9680, has been described as a use-after-free bug in the Animation timeline component. "An attacker was able to achieve code execution in the content process by exploiting a use-after-free in

Cyber insurance, human risk, and the potential for cyber-ratings https://www.welivesecurity.com/en/business-security/cyber-insurance-human-risk-potential-cyber-ratings/ Could human risk in cybersecurity be managed with a cyber-rating, much like credit scores help assess people’s financial responsibility?

Google Joins Forces with GASA and DNS RF to Tackle Online Scams at Scale https://thehackernews.com/2024/10/google-joins-forces-with-gasa-and-dns.html Google on Wednesday announced a new partnership with the Global Anti-Scam Alliance (GASA) and DNS Research Federation (DNS RF) to combat online scams. The initiative, which has been codenamed the Global Signal Exchange (GSE), is designed to create real-time insights into scams, fraud, and other forms of cybercrime pooling together threat signals from different data sources in order to create

Researchers Uncover Major Security Vulnerabilities in Industrial MMS Protocol Libraries https://thehackernews.com/2024/10/researchers-uncover-major-security.html Details have emerged about multiple security vulnerabilities in two implementations of the Manufacturing Message Specification (MMS) protocol that, if successfully exploited, could have severe impacts in industrial environments. "The vulnerabilities could allow an attacker to crash an industrial device or in some cases, enable remote code execution," Claroty researchers Mashav Sapir and Vera

N. Korean Hackers Use Fake Interviews to Infect Developers with Cross-Platform Malware https://thehackernews.com/2024/10/n-korean-hackers-use-fake-interviews-to.html Threat actors with ties to North Korea have been observed targeting job seekers in the tech industry to deliver updated versions of known malware families tracked as BeaverTail and InvisibleFerret. The activity cluster, tracked as CL-STA-0240, is part of a campaign dubbed Contagious Interview that Palo Alto Networks Unit 42 first disclosed in November 2023. "The threat actor behind CL-STA-0240