TECHZONE™

SANS Institute Warns of Novel Cloud-Native Ransomware Attacks https://thehackernews.com/2025/03/sans-institute-warns-of-novel-cloud.html The latest Palo Alto Networks Unit 42 Cloud Threat Report found that sensitive data is found in 66% of cloud storage buckets. This data is vulnerable to ransomware attacks. The SANS Institute recently reported that these attacks can be performed by abusing the cloud provider’s storage security controls and default settings. “In just the past few months, I have witnessed two different methods for

GitHub Action Compromise Puts CI/CD Secrets at Risk in Over 23,000 Repositories https://thehackernews.com/2025/03/github-action-compromise-puts-cicd.html Cybersecurity researchers are calling attention to an incident in which the popular GitHub Action tj-actions/changed-files was compromised to leak secrets from repositories using the continuous integration and continuous delivery (CI/CD) workflow. The incident involved the tj-actions/changed-files GitHub Action, which is used in over 23,000 repositories. It's used to track and retrieve all

Malicious PyPI Packages Stole Cloud Tokens—Over 14,100 Downloads Before Removal https://thehackernews.com/2025/03/malicious-pypi-packages-stole-cloud.html Cybersecurity researchers have warned of a malicious campaign targeting users of the Python Package Index (PyPI) repository with bogus libraries masquerading as "time" related utilities, but harboring hidden functionality to steal sensitive data such as cloud access tokens. Software supply chain security firm ReversingLabs said it discovered two sets of packages totaling 20 of them. The packages

Alleged Israeli LockBit Developer Rostislav Panev Extradited to U.S. for Cybercrime Charges https://thehackernews.com/2025/03/alleged-israeli-lockbit-developer.html A 51-year-old dual Russian and Israeli national who is alleged to be a developer of the LockBit ransomware group has been extradited to the United States, nearly three months after he was formally charged in connection with the e-crime scheme. Rostislav Panev was previously arrested in Israel in August 2024. He is said to have been working as a developer for the ransomware gang from 2019

GSMA Confirms End-to-End Encryption for RCS, Enabling Secure Cross-Platform Messaging https://thehackernews.com/2025/03/gsma-confirms-end-to-end-encryption-for.html The GSM Association (GSMA) has formally announced support for end-to-end encryption (E2EE) for securing messages sent via the Rich Communications Services (RCS) protocol, bringing much-needed security protections to cross-platform messages shared between Android and iOS platforms. To that end, the new GSMA specifications for RCS include E2EE based on the Messaging Layer Security (MLS) protocol

Live Ransomware Demo: See How Hackers Breach Networks and Demand a Ransom https://thehackernews.com/2025/03/live-ransomware-demo-see-how-hackers.html Cyber threats evolve daily. In this live webinar, learn exactly how ransomware attacks unfold—from the initial breach to the moment hackers demand payment. Join Joseph Carson, Delinea’s Chief Security Scientist and Advisory CISO, who brings 25 years of enterprise security expertise. Through a live demonstration, he will break down every technical step of a ransomware attack, showing you how

Why Most Microsegmentation Projects Fail—And How Andelyn Biosciences Got It Right https://thehackernews.com/2025/03/why-most-microsegmentation-projects.html Most microsegmentation projects fail before they even get off the ground—too complex, too slow, too disruptive. But Andelyn Biosciences proved it doesn’t have to be that way.  Microsegmentation: The Missing Piece in Zero Trust Security  Security teams today are under constant pressure to defend against increasingly sophisticated cyber threats. Perimeter-based defenses alone can no

New MassJacker Malware Targets Piracy Users, Hijacking Cryptocurrency Transactions https://thehackernews.com/2025/03/new-massjacker-malware-targets-piracy.html Users searching for pirated software are the target of a new malware campaign that delivers a previously undocumented clipper malware called MassJacker, according to findings from CyberArk. Clipper malware is a type of cryware (as coined by Microsoft) that's designed to monitor a victim's clipboard content and facilitate cryptocurrency theft by substituting copied cryptocurrency wallet addresses

OBSCURE#BAT Malware Uses Fake CAPTCHA Pages to Deploy Rootkit r77 and Evade Detection https://thehackernews.com/2025/03/obscurebat-malware-uses-fake-captcha.html A new malware campaign has been observed leveraging social engineering tactics to deliver an open-source rootkit called r77. The activity, condemned OBSCURE#BAT by Securonix, enables threat actors to establish persistence and evade detection on compromised systems. It's currently not known who is behind the campaign. The rootkit "has the ability to cloak or mask any file, registry key or task

Microsoft Warns of ClickFix Phishing Campaign Targeting Hospitality Sector via Fake Booking[.]com Emails https://thehackernews.com/2025/03/microsoft-warns-of-clickfix-phishing.html Microsoft has shed light on an ongoing phishing campaign that targeted the hospitality sector by impersonating online travel agency Booking.com using an increasingly popular social engineering technique called ClickFix to deliver credential-stealing malware. The activity, the tech giant said, started in December 2024 and operates with the end goal of conducting financial fraud and theft. It's

Future-Proofing Business Continuity: BCDR Trends and Challenges for 2025 https://thehackernews.com/2025/03/bcdr-2025-trends-and-challenges-for-msps-and-it-teams.html As IT environments grow more complex, IT professionals are facing unprecedented pressure to secure business-critical data. With hybrid work the new standard and cloud adoption on the rise, data is increasingly distributed across different environments, providers and locations, expanding the attack surface for emerging cyberthreats. While the need for a strong data protection strategy has become

North Korea’s ScarCruft Deploys KoSpy Malware, Spying on Android Users via Fake Utility Apps https://thehackernews.com/2025/03/north-koreas-scarcruft-deploys-kospy.html The North Korea-linked threat actor known as ScarCruft is said to have been behind a never-before-seen Android surveillance tool named KoSpy targeting Korean and English-speaking users. Lookout, which shared details of the malware campaign, said the earliest versions date back to March 2022. The most recent samples were flagged in March 2024. It's not clear how successful these efforts were. "

GitHub Uncovers New ruby-saml Vulnerabilities Allowing Account Takeover Attacks https://thehackernews.com/2025/03/github-uncovers-new-ruby-saml.html Two high-severity security flaws have been disclosed in the open-source ruby-saml library that could allow malicious actors to bypass Security Assertion Markup Language (SAML) authentication protections. SAML is an XML-based markup language and open-standard used for exchanging authentication and authorization data between parties, enabling features like single sign-on (SSO), which allows

Meta Warns of FreeType Vulnerability (CVE-2025-27363) With Active Exploitation Risk https://thehackernews.com/2025/03/meta-warns-of-freetype-vulnerability.html Meta has warned that a security vulnerability impacting the FreeType open-source font rendering library may have been exploited in the wild. The vulnerability has been assigned the CVE identifier CVE-2025-27363, and carries a CVSS score of 8.1, indicating high severity. Described as an out-of-bounds write flaw, it could be exploited to achieve remote code execution when parsing certain font

WARNING: Expiring Root Certificate May Disable Firefox Add-Ons, Security Features, and DRM Playback https://thehackernews.com/2025/03/warning-expiring-root-certificate-may.html Browser maker Mozilla is urging users to update their Firefox instances to the latest version to avoid facing issues with using add-ons due to the impending expiration of a root certificate. "On March 14, 2025, a root certificate used to verify signed content and add-ons for various Mozilla projects, including Firefox, will expire," Mozilla said. "Without updating to Firefox

Chinese Hackers Breach Juniper Networks Routers With Custom Backdoors and Rootkits https://thehackernews.com/2025/03/chinese-hackers-breach-juniper-networks.html The China-nexus cyber espionage group tracked as UNC3886 has been observed targeting end-of-life MX routers from Juniper Networks as part of a campaign designed to deploy custom backdoors, highlighting their ability to focus on internal networking infrastructure. "The backdoors had varying custom capabilities, including active and passive backdoor functions, as well as an embedded script that

Over 400 IPs Exploiting Multiple SSRF Vulnerabilities in Coordinated Cyber Attack https://thehackernews.com/2025/03/over-400-ips-exploiting-multiple-ssrf.html Threat intelligence firm GreyNoise is warning of a "coordinated surge" in the exploitation of Server-Side Request Forgery (SSRF) vulnerabilities spanning multiple platforms. "At least 400 IPs have been seen actively exploiting multiple SSRF CVEs simultaneously, with notable overlap between attack attempts," the company said, adding it observed the activity on March 9, 2025. The countries which

Pentesters: Is AI Coming for Your Role? https://thehackernews.com/2025/03/pentesters-is-ai-coming-for-your-role.html We’ve been hearing the same story for years: AI is coming for your job. In fact, in 2017, McKinsey printed a report, Jobs Lost, Jobs Gained: Workforce Transitions in a Time of Automation, predicting that by 2030, 375 million workers would need to find new jobs or risk being displaced by AI and automation. Queue the anxiety.  There have been ongoing whispers about what roles would be

URGENT: Microsoft Patches 57 Security Flaws, Including 6 Actively Exploited Zero-Days https://thehackernews.com/2025/03/urgent-microsoft-patches-57-security.html Microsoft on Tuesday released security updates to address 57 security vulnerabilities in its software, including a whopping six zero-days that it said have been actively exploited in the wild. Of the 56 flaws, six are rated Critical, 50 are rated Important, and one is rated Low in severity. Twenty-three of the addressed vulnerabilities are remote code execution bugs and 22 relate to privilege

Apple Releases Patch for WebKit Zero-Day Vulnerability Exploited in Targeted Attacks https://thehackernews.com/2025/03/apple-releases-patch-for-webkit-zero.html Apple on Tuesday released a security update to address a zero-day flaw that it said has been exploited in "extremely sophisticated" attacks. The vulnerability has been assigned the CVE identifier CVE-2025-24201 and is rooted in the WebKit web browser engine component. It has been described as an out-of-bounds write issue that could allow an attacker to craft malicious web content such that it