TECHZONE™

Identity in the Shadows: Shedding Light on Cybersecurity's Unseen Threats https://thehackernews.com/2024/04/identity-in-shadows-shedding-light-on.html In today's rapidly evolving digital landscape, organizations face an increasingly complex array of cybersecurity threats. The proliferation of cloud services and remote work arrangements has heightened the vulnerability of digital identities to exploitation, making it imperative for businesses to fortify their identity security measures. Our recent research report, The Identity Underground

FTC Fines Mental Health Startup Cerebral $7 Million for Major Privacy Violations https://thehackernews.com/2024/04/ftc-fines-mental-health-startup.html The U.S. Federal Trade Commission (FTC) has ordered the mental telehealth company Cerebral from using or disclosing personal data for advertising purposes. It has also been fined more than $7 million over charges that it revealed users' sensitive personal health information and other data to third parties for advertising purposes and failed to honor its easy cancellation policies. "Cerebral and

Hive RAT Creators and $3.5M Cryptojacking Mastermind Arrested in Global Crackdown https://thehackernews.com/2024/04/hive-rat-creators-and-35m-cryptojacking.html Two individuals have been arrested in Australia and the U.S. in connection with an alleged scheme to develop and distribute a remote access trojan called Hive RAT (previously Firebird). The U.S. Justice Department (DoJ) said the malware "gave the malware purchasers control over victim computers and enabled them to access victims' private communications, their login credentials, and

Intel and Lenovo BMCs Contain Unpatched Lighttpd Server Flaw https://thehackernews.com/2024/04/intel-and-lenovo-bmcs-contain-unpatched.html A security flaw impacting the Lighttpd web server used in baseboard management controllers (BMCs) has remained unpatched by device vendors like Intel and Lenovo, new findings from Binarly reveal. While the original shortcoming was discovered and patched by the Lighttpd maintainers way back in August 2018 with version 1.4.51, the lack of a CVE identifier or an advisory meant that

AI Copilot: Launching Innovation Rockets, But Beware of the Darkness Ahead https://thehackernews.com/2024/04/ai-copilot-launching-innovation-rockets.html Imagine a world where the software that powers your favorite apps, secures your online transactions, and keeps your digital life could be outsmarted and taken over by a cleverly disguised piece of code. This isn't a plot from the latest cyber-thriller; it's actually been a reality for years now. How this will change – in a positive or negative direction – as artificial intelligence (AI) takes on

Muddled Libra Shifts Focus to SaaS and Cloud for Extortion and Data Theft Attacks https://thehackernews.com/2024/04/muddled-libra-shifts-focus-to-saas-and.html The threat actor known as Muddled Libra has been observed actively targeting software-as-a-service (SaaS) applications and cloud service provider (CSP) environments in a bid to exfiltrate sensitive data. "Organizations often store a variety of data in SaaS applications and use services from CSPs," Palo Alto Networks Unit 42 said in a report published last week. "The threat

Timing is Everything: The Role of Just-in-Time Privileged Access in Security Evolution https://thehackernews.com/2024/04/timing-is-everything-role-of-just-in.html To minimize the risk of privilege misuse, a trend in the privileged access management (PAM) solution market involves implementing just-in-time (JIT) privileged access. This approach to privileged identity management aims to mitigate the risks associated with prolonged high-level access by granting privileges temporarily and only when necessary, rather than providing users with

Chinese-Linked LightSpy iOS Spyware Targets South Asian iPhone Users https://thehackernews.com/2024/04/chinese-linked-lightspy-ios-spyware.html Cybersecurity researchers have discovered a "renewed" cyber espionage campaign targeting users in South Asia with the aim of delivering an Apple iOS spyware implant called LightSpy. "The latest iteration of LightSpy, dubbed 'F_Warehouse,' boasts a modular framework with extensive spying features," the BlackBerry Threat Research and Intelligence Team said in a report published last

Palo Alto Networks Releases Urgent Fixes for Exploited PAN-OS Vulnerability https://thehackernews.com/2024/04/palo-alto-networks-releases-urgent.html Palo Alto Networks has released hotfixes to address a maximum-severity security flaw impacting PAN-OS software that has come under active exploitation in the wild. Tracked as CVE-2024-3400 (CVSS score: 10.0), the critical vulnerability is a case of command injection in the GlobalProtect feature that an unauthenticated attacker could weaponize to execute arbitrary code with root

Ex-Security Engineer Jailed 3 Years for $12.3 Million Crypto Exchange Thefts https://thehackernews.com/2024/04/ex-security-engineer-jailed-3-years-for.html A former security engineer has been sentenced to three years in prison in the U.S. for charges relating to hacking two decentralized cryptocurrency exchanges in July 2022 and stealing over $12.3 million. Shakeeb Ahmed, the defendant in question, pled guilty to one count of computer fraud in December 2023 following his arrest in July. "At the time of both attacks,

U.S. Treasury Hamas Spokesperson for Cyber Influence Operations https://thehackernews.com/2024/04/us-treasury-hamas-spokesperson-for.html The U.S. Treasury Department's Office of Foreign Assets Control (OFAC) on Friday announced sanctions against an official associated with Hamas for his involvement in cyber influence operations. Hudhayfa Samir ‘Abdallah al-Kahlut, 39, also known as Abu Ubaida, has served as the public spokesperson of Izz al-Din al-Qassam Brigades, the military wing of Hamas, since at least 2007. "He publicly

Hackers Deploy Python Backdoor in Palo Alto Zero-Day Attack https://thehackernews.com/2024/04/hackers-deploy-python-backdoor-in-palo.html Threat actors have been exploiting the newly disclosed zero-day flaw in Palo Alto Networks PAN-OS software dating back to March 26, 2024, nearly three weeks before it came to light yesterday. The network security company's Unit 42 division is tracking the activity under the name Operation MidnightEclipse, attributing it as the work of a single threat actor of

Popular Rust Crate liblzma-sys Compromised with XZ Utils Backdoor Files https://thehackernews.com/2024/04/popular-rust-crate-liblzma-sys.html "Test files" associated with the XZ Utils backdoor have made their way to a Rust crate known as liblzma-sys, new findings from Phylum reveal. liblzma-sys, which has been downloaded over 21,000 times to date, provides Rust developers with bindings to the liblzma implementation, an underlying library that is part of the XZ Utils data compression software. The

Code Keepers: Mastering Non-Human Identity Management https://thehackernews.com/2024/04/code-keepers-mastering-non-human.html Identities now transcend human boundaries. Within each line of code and every API call lies a non-human identity. These entities act as programmatic access keys, enabling authentication and facilitating interactions among systems and services, which are essential for every API call, database query, or storage account access. As we depend on multi-factor authentication and passwords to safeguard

Iranian MuddyWater Hackers Adopt New C2 Tool 'DarkBeatC2' in Latest Campaign https://thehackernews.com/2024/04/iranian-muddywater-hackers-adopt-new-c2.html The Iranian threat actor known as MuddyWater has been attributed to a new command-and-control (C2) infrastructure called DarkBeatC2, becoming the latest such tool in its arsenal after SimpleHarm, MuddyC3, PhonyC2, and MuddyC2Go. "While occasionally switching to a new remote administration tool or changing their C2 framework, MuddyWater’s methods remain constant," Deep

Zero-Day Alert: Critical Palo Alto Networks PAN-OS Flaw Under Active Attack https://thehackernews.com/2024/04/zero-day-alert-critical-palo-alto.html Palo Alto Networks is warning that a critical flaw impacting its PAN-OS software used in its GlobalProtect gateways is being exploited in the wild. Tracked as CVE-2024-3400, the issue has a CVSS score of 10.0, indicating maximum severity. "A command injection vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature

Sneaky Credit Card Skimmer Disguised as Harmless Facebook Tracker https://thehackernews.com/2024/04/sneaky-credit-card-skimmer-disguised-as.html Cybersecurity researchers have discovered a credit card skimmer that's concealed within a fake Meta Pixel tracker script in an attempt to evade detection. Sucuri said that the malware is injected into websites through tools that allow for custom code, such as WordPress plugins like Simple Custom CSS and JS or the "Miscellaneous Scripts" section of the Magento admin panel. "

U.S. Federal Agencies Ordered to Hunt for Signs of Microsoft Breach and Mitigate Risks https://thehackernews.com/2024/04/us-federal-agencies-ordered-to-hunt-for.html The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday issued an emergency directive (ED 24-02) urging federal agencies to hunt for signs of compromise and enact preventive measures following the recent compromise of Microsoft's systems that led to the theft of email correspondence with the company. The attack, which came to light earlier this year, has been

TA547 Phishing Attack Hits German Firms with Rhadamanthys Stealer https://thehackernews.com/2024/04/ta547-phishing-attack-hits-german-firms.html A threat actor tracked as TA547 has targeted dozens of German organizations with an information stealer called Rhadamanthys as part of an invoice-themed phishing campaign. "This is the first time researchers observed TA547 use Rhadamanthys, an information stealer that is used by multiple cybercriminal threat actors," Proofpoint said. "Additionally, the actor appeared to

Python's PyPI Reveals Its Secrets https://thehackernews.com/2024/04/blog-post.html GitGuardian is famous for its annual State of Secrets Sprawl report. In their 2023 report, they found over 10 million exposed passwords, API keys, and other credentials exposed in public GitHub commits. The takeaways in their 2024 report did not just highlight 12.8 million new exposed secrets in GitHub, but a number in the popular Python package repository PyPI. PyPI,