TECHZONE™

Android 14 Adds New Security Features to Block 2G Exploits and Baseband Attacks https://thehackernews.com/2024/10/android-14-adds-new-security-features.html Google has revealed the various security guardrails that have been incorporated into its latest Pixel devices to counter the rising threat posed by baseband security attacks. The cellular baseband (i.e., modem) refers to a processor on the device that's responsible for handling all connectivity, such as LTE, 4G, and 5G, with a mobile phone cell tower or base station over a radio interface. "This

The Secret Weakness Execs Are Overlooking: Non-Human Identities https://thehackernews.com/2024/10/the-secret-weakness-execs-are.html For years, securing a company’s systems was synonymous with securing its “perimeter.” There was what was safe “inside” and the unsafe outside world. We built sturdy firewalls and deployed sophisticated detection systems, confident that keeping the barbarians outside the walls kept our data and systems safe. The problem is that we no longer operate within the confines of physical on-prem

New Perfctl Malware Targets Linux Servers for Cryptocurrency Mining and Proxyjacking https://thehackernews.com/2024/10/new-perfctl-malware-targets-linux.html Linux servers are the target of an ongoing campaign that delivers a stealthy malware dubbed perfctl with the primary aim of running a cryptocurrency miner and proxyjacking software. "Perfctl is particularly elusive and persistent, employing several sophisticated techniques," Aqua security researchers Assaf Morag and Idan Revivo said in a report shared with The Hacker News. "When a new user logs

North Korean Hackers Using New VeilShell Backdoor in Stealthy Cyber Attacks https://thehackernews.com/2024/10/north-korean-hackers-using-new.html Threat actors with ties to North Korea have been observed delivering a previously undocumented backdoor and remote access trojan (RAT) called VeilShell as part of a campaign targeting Cambodia and likely other Southeast Asian countries. The activity, dubbed SHROUDED#SLEEP by Securonix, is believed to be the handiwork of APT37, which is also known as InkySquid, Reaper, RedEyes, Ricochet Chollima,

Separating the bee from the panda: CeranaKeeper making a beeline for Thailand https://www.welivesecurity.com/en/eset-research/separating-bee-panda-ceranakeeper-making-beeline-thailand/ ESET Research details the tools and activities of a new China-aligned threat actor, CeranaKeeper, focusing on massive data exfiltration in Southeast Asia

INTERPOL Arrests 8 in Major Phishing and Romance Fraud Crackdown in West Africa https://thehackernews.com/2024/10/interpol-arrests-8-in-major-phishing.html INTERPOL has announced the arrest of eight individuals in Côte d'Ivoire and Nigeria as part of a crackdown on phishing scams and romance cyber fraud. Dubbed Operation Contender 2.0, the initiative is designed to tackle cyber-enabled crimes in West Africa, the agency said. One such threat involved a large-scale phishing scam targeting Swiss citizens that resulted in financial losses to the tune

LockBit Ransomware and Evil Corp Members Arrested and Sanctioned in Joint Global Effort https://thehackernews.com/2024/10/lockbit-ransomware-and-evil-corp.html A new wave of international law enforcement actions has led to four arrests and the takedown of nine servers linked to the LockBit (aka Bitwise Spider) ransomware operation, marking the latest salvo against what was once a prolific financially motivated group. This includes the arrest of a suspected LockBit developer in France while on holiday outside of Russia, two individuals in the U.K. who

Ivanti Endpoint Manager Flaw Actively Targeted, CISA Warns Agencies to Patch https://thehackernews.com/2024/10/ivanti-endpoint-manager-flaw-actively.html The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a security flaw impacting Endpoint Manager (EPM) that the company patched in May to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation. The vulnerability, tracked as CVE-2024-29824, carries a CVSS score of 9.6 out of a maximum of 10.0, indicating critical severity. "An

Why system resilience should mainly be the job of the OS, not just third-party applications https://www.welivesecurity.com/en/cybersecurity/system-resilience-job-os-not-just-third-party-applications/ Building efficient recovery options will drive ecosystem resilience

Cybersecurity Awareness Month needs a radical overhaul – it needs legislation https://www.welivesecurity.com/en/cybersecurity/cybersecurity-awareness-month-radical-overhaul-legislation/ Despite their benefits, awareness campaigns alone are not enough to encourage widespread adoption of cybersecurity best practices

Fake Trading Apps Target Victims Globally via Apple App Store and Google Play https://thehackernews.com/2024/10/fake-trading-apps-target-victims.html A large-scale fraud campaign leveraged fake trading apps published on the Apple App Store and Google Play Store, as well as phishing sites, to defraud victims, per findings from Group-IB. The campaign is part of a consumer investment fraud scheme that's also widely known as pig butchering, in which prospective victims are lured into making investments in cryptocurrency or other financial

China-Linked CeranaKeeper Targeting Southeast Asia with Data Exfiltration https://thehackernews.com/2024/10/china-linked-ceranakeeper-targeting.html A previously undocumented threat actor called CeranaKeeper has been linked to a string of data exfiltration attacks targeting Southeast Asia. Slovak cybersecurity firm ESET, which observed campaigns targeting governmental institutions in Thailand starting in 2023, attributed the activity cluster as aligned to China, leveraging tools previously identified as used by the Mustang Panda actor. "The

Fake Job Applications Deliver Dangerous More_eggs Malware to HR Professionals https://thehackernews.com/2024/10/fake-job-applications-deliver-dangerous.html A spear-phishing email campaign has been observed targeting recruiters with a JavaScript backdoor called More_eggs, indicating persistent efforts to single out the sector under the guise of fake job applicant lures. "A sophisticated spear-phishing lure tricked a recruitment officer into downloading and executing a malicious file disguised as a resume, leading to a more_eggs backdoor infection,"

Alert: Over 700,000 DrayTek Routers Exposed to Hacking via 14 New Vulnerabilities https://thehackernews.com/2024/10/alert-over-700000-draytek-routers.html A little over a dozen new security vulnerabilities have been discovered in residential and enterprise routers manufactured by DrayTek that could be exploited to take over susceptible devices. "These vulnerabilities could enable attackers to take control of a router by injecting malicious code, allowing them to persist on the device and use it as a gateway into enterprise networks," Forescout

Alert: Adobe Commerce and Magento Stores Under Attack from CosmicSting Exploit https://thehackernews.com/2024/10/alert-adobe-commerce-and-magento-stores.html Cybersecurity researchers have disclosed that 5% of all Adobe Commerce and Magento stores have been hacked by malicious actors by exploiting a security vulnerability dubbed CosmicSting. Tracked as CVE-2024-34102 (CVSS score: 9.8), the critical flaw relates to an improper restriction of XML external entity reference (XXE) vulnerability that could result in remote code execution. The shortcoming,

5 Must-Have Tools for Effective Dynamic Malware Analysis https://thehackernews.com/2024/10/5-must-have-tools-for-effective-dynamic.html Dynamic malware analysis is a key part of any threat investigation. It involves executing a sample of a malicious program in the isolated environment of a malware sandbox to monitor its behavior and gather actionable indicators. Effective analysis must be fast, in-depth, and precise. These five tools will help you achieve it with ease. 1. Interactivity Having the ability to interact with the

Andariel Hacking Group Shifts Focus to Financial Attacks on U.S. Organizations https://thehackernews.com/2024/10/andariel-hacker-group-shifts-focus-to.html Three different organizations in the U.S. were targeted in August 2024 by a North Korean state-sponsored threat actor called Andariel as part of a likely financially motivated attack. "While the attackers didn't succeed in deploying ransomware on the networks of any of the organizations affected, it is likely that the attacks were financially motivated," Symantec, part of Broadcom, said in a

Researchers Sound Alarm on Active Attacks Exploiting Critical Zimbra Postjournal Flaw https://thehackernews.com/2024/10/researchers-sound-alarm-on-active.html Cybersecurity researchers are warning about active exploitation attempts targeting a newly disclosed security flaw in Synacor's Zimbra Collaboration. Enterprise security firm Proofpoint said it began observing the activity starting September 28, 2024. The attacks seek to exploit CVE-2024-45519, a severe security flaw in Zimbra's postjournal service that could enable unauthenticated attackers to

PyPI Repository Found Hosting Fake Crypto Wallet Recovery Tools That Steal User Data https://thehackernews.com/2024/10/pypi-repository-found-hosting-fake.html A new set of malicious packages has been unearthed in the Python Package Index (PyPI) repository that masqueraded as cryptocurrency wallet recovery and management services, only to siphon sensitive data and facilitate the theft of valuable digital assets. "The attack targeted users of Atomic, Trust Wallet, Metamask, Ronin, TronLink, Exodus, and other prominent wallets in the crypto ecosystem,"

AI-Powered Rhadamanthys Stealer Targets Crypto Wallets with Image Recognition https://thehackernews.com/2024/10/ai-powered-rhadamanthys-stealer-targets.html The threat actors behind the Rhadamanthys information stealer have added new advanced features to the malware, including using artificial intelligence (AI) for optical character recognition (OCR) as part of what's called "Seed Phrase Image Recognition." "This allows Rhadamanthys to extract cryptocurrency wallet seed phrases from images, making it a highly potent threat for anyone dealing in