TECHZONE™

Fortinet Warns of Critical Vulnerability in FortiManager Under Active Exploitation https://thehackernews.com/2024/10/fortinet-warns-of-critical.html Fortinet has confirmed details of a critical security flaw impacting FortiManager that has come under active exploitation in the wild. Tracked as CVE-2024-47575 (CVSS score: 9.8), the vulnerability is also known as FortiJump and is rooted in the FortiGate to FortiManager (FGFM) protocol. "A missing authentication for critical function vulnerability [CWE-306] in FortiManager fgfmd daemon may

Embargo ransomware: Rock’n’Rust https://www.welivesecurity.com/en/eset-research/embargo-ransomware-rocknrust/ Novice ransomware group Embargo is testing and deploying a new Rust-based toolkit

New Grandoreiro Banking Malware Variants Emerge with Advanced Tactics to Evade Detection https://thehackernews.com/2024/10/new-grandoreiro-banking-malware.html New variants of a banking malware called Grandoreiro have been found to adopt new tactics in an effort to bypass anti-fraud measures, indicating that the malicious software is continuing to be actively developed despite law enforcement efforts to crack down on the operation. "Only part of this gang was arrested: the remaining operators behind Grandoreiro continue attacking users all over the

Permiso State of Identity Security 2024: A Shake-up in Identity Security Is Looming Large https://thehackernews.com/2024/10/permiso-state-of-identity-security-2024.html Identity security is front, and center given all the recent breaches that include Microsoft, Okta, Cloudflare and Snowflake to name a few. Organizations are starting to realize that a shake-up is needed in terms of the way we approach identity security both from a strategic but also a technology vantage point.  Identity security is more than just provisioning access  The conventional view

CISA Warns of Active Exploitation of Microsoft SharePoint Vulnerability (CVE-2024-38094) https://thehackernews.com/2024/10/cisa-warns-of-active-exploitation-of.html A high-severity flaw impacting Microsoft SharePoint has been added to the Known Exploited Vulnerabilities (KEV) catalog by the U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday, citing evidence of active exploitation. The vulnerability, tracked as CVE-2024-38094 (CVSS score: 7.2), has been described as a deserialization vulnerability impacting SharePoint that could result

Researchers Reveal 'Deceptive Delight' Method to Jailbreak AI Models https://thehackernews.com/2024/10/researchers-reveal-deceptive-delight.html Cybersecurity researchers have shed light on a new adversarial technique that could be used to jailbreak large language models (LLMs) during the course of an interactive conversation by sneaking in an undesirable instruction between benign ones. The approach has been codenamed Deceptive Delight by Palo Alto Networks Unit 42, which described it as both simple and effective, achieving an average

Think You’re Secure? 49% of Enterprises Underestimate SaaS Risks https://thehackernews.com/2024/10/think-youre-secure-49-of-enterprises.html It may come as a surprise to learn that 34% of security practitioners are in the dark about how many SaaS applications are deployed in their organizations. And it’s no wonder—the recent AppOmni 2024 State of SaaS Security Report reveals that only 15% of organizations centralize SaaS security within their cybersecurity teams. These statistics not only highlight a critical security blind spot,

Ransomware Gangs Use LockBit's Fame to Intimidate Victims in Latest Attacks https://thehackernews.com/2024/10/ransomware-gangs-use-lockbits-fame-to.html Threat actors have been observed abusing Amazon S3 (Simple Storage Service) Transfer Acceleration feature as part of ransomware attacks designed to exfiltrate victim data and upload them to S3 buckets under their control. "Attempts were made to disguise the Golang ransomware as the notorious LockBit ransomware," Trend Micro researchers Jaromir Horejsi and Nitesh Surana said. "However, such is

Gophish Framework Used in Phishing Campaigns to Deploy Remote Access Trojans https://thehackernews.com/2024/10/gophish-framework-used-in-phishing.html Russian-speaking users have become the target of a new phishing campaign that leverages an open-source phishing toolkit called Gophish to deliver DarkCrystal RAT (aka DCRat) and a previously undocumented remote access trojan dubbed PowerRAT. "The campaign involves modular infection chains that are either Maldoc or HTML-based infections and require the victim's intervention to trigger the

Security Flaw in Styra's OPA Exposes NTLM Hashes to Remote Attackers https://thehackernews.com/2024/10/security-flaw-in-styras-opa-exposes.html Details have emerged about a now-patched security flaw in Styra's Open Policy Agent (OPA) that, if successfully exploited, could have led to leakage of New Technology LAN Manager (NTLM) hashes. "The vulnerability could have allowed an attacker to leak the NTLM credentials of the OPA server's local user account to a remote server, potentially allowing the attacker to relay the authentication or

Cybercriminals Exploiting Docker API Servers for SRBMiner Crypto Mining Attacks https://thehackernews.com/2024/10/cybercriminals-exploiting-docker-api.html Bad actors have been observed targeting Docker remote API servers to deploy the SRBMiner crypto miner on compromised instances, according to new findings from Trend Micro. "In this attack, the threat actor used the gRPC protocol over h2c to evade security solutions and execute their crypto mining operations on the Docker host," researchers Abdelrahman Esmail and Sunil Bharti said in a technical

A Comprehensive Guide to Finding Service Accounts in Active Directory https://thehackernews.com/2024/10/a-comprehensive-guide-to-finding.html Service accounts are vital in any enterprise, running automated processes like managing applications or scripts. However, without proper monitoring, they can pose a significant security risk due to their elevated privileges. This guide will walk you through how to locate and secure these accounts within Active Directory (AD), and explore how Silverfort’s solutions can help enhance your

Bumblebee and Latrodectus Malware Return with Sophisticated Phishing Strategies https://thehackernews.com/2024/10/bumblebee-and-latrodectus-malware.html Two malware families that suffered setbacks in the aftermath of a coordinated law enforcement operation called Endgame have resurfaced as part of new phishing campaigns. Bumblebee and Latrodectus, which are both malware loaders, are designed to steal personal data, along with downloading and executing additional payloads onto compromised hosts. Tracked under the names BlackWidow, IceNova, Lotus,

Malicious npm Packages Target Developers' Ethereum Wallets with SSH Backdoor https://thehackernews.com/2024/10/malicious-npm-packages-target.html Cybersecurity researchers have discovered a number of suspicious packages published to the npm registry that are designed to harvest Ethereum private keys and gain remote access to the machine via the secure shell (SSH) protocol. The packages attempt to "gain SSH access to the victim's machine by writing the attacker’s SSH public key in the root user’s authorized_keys file," software supply

Google Voice scams: What are they and how do I avoid them? https://www.welivesecurity.com/en/scams/google-voice-scams-what-how-avoid/ Watch out for schemes where fraudsters trick people into sharing verification codes so they can gain access to their phone numbers

VMware Releases vCenter Server Update to Fix Critical RCE Vulnerability https://thehackernews.com/2024/10/vmware-releases-vcenter-server-update.html VMware has released software updates to address an already patched security flaw in vCenter Server that could pave the way for remote code execution. The vulnerability, tracked as CVE-2024-38812 (CVSS score: 9.8), concerns a case of heap-overflow vulnerability in the implementation of the DCE/RPC protocol. "A malicious actor with network access to vCenter Server may trigger this vulnerability by

CISA Adds ScienceLogic SL1 Vulnerability to Exploited Catalog After Active Zero-Day Attack https://thehackernews.com/2024/10/cisa-adds-sciencelogic-sl1.html The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a critical security flaw impacting ScienceLogic SL1 to its Known Exploited Vulnerabilities (KEV) catalog, following reports of active exploitation as a zero-day. The vulnerability in question, tracked as CVE-2024-9537 (CVSS v4 score: 9.3), refers to a bug involving an unspecified third-party component that could

Chinese Nation-State Hackers APT41 Hit Gambling Sector for Financial Gain https://thehackernews.com/2024/10/chinese-nation-state-hackers-apt41-hit.html The prolific Chinese nation-state actor known as APT41 (aka Brass Typhoon, Earth Baku, Wicked Panda, or Winnti) has been attributed to a sophisticated cyber attack targeting the gambling and gaming industry. "Over a period of at least six months, the attackers stealthily gathered valuable information from the targeted company including, but not limited to, network configurations, user passwords,

Guide:  The Ultimate Pentest Checklist for Full-Stack Security https://thehackernews.com/2024/10/guide-ultimate-pentest-checklist-for.html Pentest Checklists Are More Important Than Ever Given the expanding attack surface coupled with the increasing sophistication of attacker tactics and techniques, penetration testing checklists have become essential for ensuring thorough assessments across an organization’s attack surface, both internal and external. By providing a structured approach, these checklists help testers systematically

THN Cybersecurity Recap: Top Threats, Tools and News (Oct 14 - Oct 20) https://thehackernews.com/2024/10/thn-cybersecurity-recap-top-threats_21.html Hi there! Here’s your quick update on the latest in cybersecurity. Hackers are using new tricks to break into systems we thought were secure—like finding hidden doors in locked houses. But the good news? Security experts are fighting back with smarter tools to keep data safe. Some big companies were hit with attacks, while others fixed their vulnerabilities just in time. It's a constant battle.