TECHZONE™

Banking Trojans Target Latin America and Europe Through Google Cloud Run https://thehackernews.com/2024/02/banking-trojans-target-latin-america.html Cybersecurity researchers are warning about a spike in email phishing campaigns that are weaponizing the Google Cloud Run service to deliver various banking trojans such as Astaroth (aka Guildma), Mekotio, and Ousaban (aka Javali) to targets across Latin America (LATAM) and Europe. "The infection chains associated with these malware families feature the use of malicious

LockBit Ransomware Group Resurfaces After Law Enforcement Takedown https://thehackernews.com/2024/02/lockbit-ransomware-group-resurfaces.html The threat actors behind the LockBit ransomware operation have resurfaced on the dark web using new infrastructure, days after an international law enforcement exercise seized control of its servers. To that end, the notorious group has moved its data leak portal to a new .onion address on the TOR network, listing 12 new victims as of writing. The administrator behind LockBit, in a&

Authorities Claim LockBit Admin "LockBitSupp" Has Engaged with Law Enforcement https://thehackernews.com/2024/02/authorities-claim-lockbit-admin.html LockBitSupp, the individual(s) behind the persona representing the LockBit ransomware service on cybercrime forums such as Exploit and XSS, "has engaged with law enforcement," authorities said. The development comes following the takedown of the prolific ransomware-as-a-service (RaaS) operation as part of a coordinated international operation codenamed Cronos. Over 14,000 rogue

PSYOP campaigns targeting Ukraine – Week in security with Tony Anscombe https://www.welivesecurity.com/en/videos/psyop-campaigns-targeting-ukraine-week-security-tony-anscombe/ Coming in two waves, the campaign sought to demoralize Ukrainians and Ukrainian speakers abroad with disinformation messages about war-related subjects

Microsoft Expands Free Logging Capabilities for all U.S. Federal Agencies https://thehackernews.com/2024/02/microsoft-expands-free-logging.html Microsoft has expanded free logging capabilities to all U.S. federal agencies using Microsoft Purview Audit irrespective of the license tier, more than six months after a China-linked cyber espionage campaign targeting two dozen organizations came to light. "Microsoft will automatically enable the logs in customer accounts and increase the default log retention period from 90 days to 180 days,"

Dormant PyPI Package Compromised to Spread Nova Sentinel Malware https://thehackernews.com/2024/02/dormant-pypi-package-compromised-to.html A dormant package available on the Python Package Index (PyPI) repository was updated nearly after two years to propagate an information stealer malware called Nova Sentinel. The package, named django-log-tracker, was first published to PyPI in April 2022, according to software supply chain security firm Phylum, which detected an anomalous update to the library on February 21,

Everything you need to know about IP grabbers https://www.welivesecurity.com/en/cybersecurity/everything-you-need-to-know-about-ip-grabbers/ You would never give your personal ID to random strangers, right? So why provide the ID of your computer? Unsuspecting users beware, IP grabbers do not ask for your permission.

Operation Texonto: Information operation targeting Ukrainian speakers in the context of the war https://www.welivesecurity.com/en/eset-research/operation-texonto-information-operation-targeting-ukrainian-speakers-context-war/ A mix of PSYOPs, espionage and … fake Canadian pharmacies!

Microsoft Releases PyRIT - A Red Teaming Tool for Generative AI https://thehackernews.com/2024/02/microsoft-releases-pyrit-red-teaming.html Microsoft has released an open access automation framework called PyRIT (short for Python Risk Identification Tool) to proactively identify risks in generative artificial intelligence (AI) systems. The red teaming tool is designed to "enable every organization across the globe to innovate responsibly with the latest artificial intelligence advances," Ram Shankar Siva Kumar, AI red team

How to Use Tines's SOC Automation Capability Matrix https://thehackernews.com/2024/02/how-to-use-tiness-soc-automation.html Created by John Tuckner and the team at workflow and automation platform Tines, the SOC Automation Capability Matrix (SOC ACM) is a set of techniques designed to help security operations teams understand their automation capabilities and respond more effectively to incidents.  A customizable, vendor-agnostic tool featuring lists of automation opportunities, it's been shared

Researchers Detail Apple's Recent Zero-Click Shortcuts Vulnerability https://thehackernews.com/2024/02/researchers-detail-apples-recent-zero.html Details have emerged about a now-patched high-severity security flaw in Apple's Shortcuts app that could permit a shortcut to access sensitive information on the device without users' consent. The vulnerability, tracked as CVE-2024-23204 (CVSS score: 7.5), was addressed by Apple on January 22, 2024, with the release of iOS 17.3, iPadOS 17.3, macOS Sonoma 14.3, and 

FTC Slams Avast with $16.5 Million Fine for Selling Users' Browsing Data https://thehackernews.com/2024/02/ftc-slams-avast-with-165-million-fine.html The U.S. Federal Trade Commission (FTC) has hit antivirus vendor Avast with a $16.5 million fine over charges that the firm sold users' browsing data to advertisers after claiming its products would block online tracking. In addition, the company has been banned from selling or licensing any web browsing data for advertising purposes. It will also have to notify users whose browsing data was

Apple Unveils PQ3 Protocol - Post-Quantum Encryption for iMessage https://thehackernews.com/2024/02/apple-unveils-pq3-protocol-post-quantum.html Apple has announced a new post-quantum cryptographic protocol called PQ3 that it said will be integrated into iMessage to secure the messaging platform against future attacks arising from the threat of a practical quantum computer. "With compromise-resilient encryption and extensive defenses against even highly sophisticated quantum attacks, PQ3 is the first messaging protocol to reach

A New Age of Hacktivism https://thehackernews.com/2024/02/a-new-age-of-hacktivism.html In the past 2 years, we have observed a significant surge in hacktivism activity due to ongoing wars and geopolitical conflicts in various regions. Since the war against Ukraine began, we have witnessed a notable mobilization of non-state and state-backed actors alike, forming new groups or joining existing hacker collectives.  We understand hacktivism as a form of computer hacking that is

Cybercriminals Weaponizing Open-Source SSH-Snake Tool for Network Attacks https://thehackernews.com/2024/02/cybercriminals-weaponizing-open-source.html A recently open-sourced network mapping tool called SSH-Snake has been repurposed by threat actors to conduct malicious activities. "SSH-Snake is a self-modifying worm that leverages SSH credentials discovered on a compromised system to start spreading itself throughout the network," Sysdig researcher Miguel Hernández said. "The worm automatically searches through known credential

Russian Government Software Backdoored to Deploy Konni RAT Malware https://thehackernews.com/2024/02/russian-government-software-backdoored.html An installer for a tool likely used by the Russian Consular Department of the Ministry of Foreign Affairs (MID) has been backdoored to deliver a remote access trojan called Konni RAT (aka UpDog). The findings come from German cybersecurity company DCSO, which linked the activity as originating from the Democratic People's Republic of Korea (DPRK)-nexus actors targeting Russia. The

U.S. Offers $15 Million Bounty to Hunt Down LockBit Ransomware Leaders https://thehackernews.com/2024/02/us-offers-15-million-bounty-to-hunt.html The U.S. State Department has announced monetary rewards of up to $15 million for information that could lead to the identification of key leaders within the LockBit ransomware group and the arrest of any individual participating in the operation. "Since January 2020, LockBit actors have executed over 2,000 attacks against victims in the United States, and around the world, causing costly

Watching out for the fakes: How to spot online disinformation https://www.welivesecurity.com/en/how-to/watching-out-for-the-fakes-how-to-spot-online-disinformation/ Why and how are we subjected to so much disinformation nowadays, and is there a way to spot the fakes?

New Wi-Fi Vulnerabilities Expose Android and Linux Devices to Hackers https://thehackernews.com/2024/02/new-wi-fi-vulnerabilities-expose.html Cybersecurity researchers have identified two authentication bypass flaws in open-source Wi-Fi software found in Android, Linux, and ChromeOS devices that could trick users into joining a malicious clone of a legitimate network or allow an attacker to join a trusted network without a password. The vulnerabilities, tracked as CVE-2023-52160 and CVE-2023-52161, have been discovered following a

Mustang Panda Targets Asia with Advanced PlugX Variant DOPLUGS https://thehackernews.com/2024/02/mustang-panda-targets-asia-with.html The China-linked threat actor known as Mustang Panda has targeted various Asian countries using a variant of the PlugX (aka Korplug) backdoor dubbed DOPLUGS. "The piece of customized PlugX malware is dissimilar to the general type of the PlugX malware that contains a completed backdoor command module, and that the former is only used for downloading the latter," Trend Micro researchers Sunny Lu