TECHZONE™

Enhancing Incident Response Readiness with Wazuh https://thehackernews.com/2024/08/enhancing-incident-response-readiness.html Incident response is a structured approach to managing and addressing security breaches or cyber-attacks. Security teams must overcome challenges such as timely detection, comprehensive data collection, and coordinated actions to enhance readiness. Improving these areas ensures a swift and effective response, minimizing damage and restoring normal operations quickly. Challenges in incident

Critical Flaw in Rockwell Automation Devices Allows Unauthorized Access https://thehackernews.com/2024/08/critical-flaw-in-rockwell-automation.html A high-severity security bypass vulnerability has been disclosed in Rockwell Automation ControlLogix 1756 devices that could be exploited to execute common industrial protocol (CIP) programming and configuration commands. The flaw, which is assigned the CVE identifier CVE-2024-6242, carries a CVSS v3.1 score of 8.4. "A vulnerability exists in the affected products that allows a threat actor to

New Android Trojan "BlankBot" Targets Turkish Users' Financial Data https://thehackernews.com/2024/08/new-android-trojan-blankbot-targets.html Cybersecurity researchers have discovered a new Android banking trojan called BlankBot targeting Turkish users with an aim to steal financial information. "BlankBot features a range of malicious capabilities, which include customer injections, keylogging, screen recording and it communicates with a control server over a WebSocket connection," Intel 471 said in an analysis published last week.

China-Linked Hackers Compromise ISP to Deploy Malicious Software Updates https://thehackernews.com/2024/08/china-linked-hackers-compromise-isp-to.html The China-linked threat actor known as Evasive Panda compromised an unnamed internet service provider (ISP) to push malicious software updates to target companies in mid-2023, highlighting a new level of sophistication associated with the group. Evasive Panda, also known by the names Bronze Highland, Daggerfly, and StormBamboo, is a cyber espionage group that's been active since at least 2012,

AI and automation reducing breach costs – Week in security with Tony Anscombe https://www.welivesecurity.com/en/videos/ai-automation-reducing-breach-costs-week-security-tony-anscombe/ Organizations that leveraged AI and automation in security prevention cut the cost of a data breach by US$2.22 million compared to those that didn't deploy these technologies, according to IBM

DOJ and FTC Sue TikTok for Violating Children's Privacy Laws https://thehackernews.com/2024/08/doj-and-ftc-sue-tiktok-for-violating.html The U.S. Department of Justice (DoJ), along with the Federal Trade Commission (FTC), filed a lawsuit against popular video-sharing platform TikTok for "flagrantly violating" children's privacy laws in the country. The agencies claimed the company knowingly permitted children to create TikTok accounts and to view and share short-form videos and messages with adults and others on the service. They

Hackers Exploit Misconfigured Jupyter Notebooks with Repurposed Minecraft DDoS Tool https://thehackernews.com/2024/08/hackers-exploit-misconfigured-jupyter.html Cybersecurity researchers have disclosed details of a new distributed denial-of-service (DDoS) attack campaign targeting misconfigured Jupyter Notebooks. The activity, codenamed Panamorfi by cloud security firm Aqua, utilizes a Java-based tool called mineping to launch a TCP flood DDoS attack. Mineping is a DDoS package designed for Minecraft game servers. Attack chains entail the exploitation

APT41 Hackers Use ShadowPad, Cobalt Strike in Taiwanese Institute Cyber Attack https://thehackernews.com/2024/08/apt41-hackers-use-shadowpad-cobalt.html A Taiwanese government-affiliated research institute that specializes in computing and associated technologies was breached by nation-state threat actors with ties to China, according to new findings from Cisco Talos. The unnamed organization was targeted as early as mid-July 2023 to deliver a variety of backdoors and post-compromise tools like ShadowPad and Cobalt Strike. It has been attributed

APT28 Targets Diplomats with HeadLace Malware via Car Sale Phishing Lure https://thehackernews.com/2024/08/apt28-targets-diplomats-with-headlace.html A Russia-linked threat actor has been linked to a new campaign that employed a car for sale as a phishing lure to deliver a modular Windows backdoor called HeadLace. "The campaign likely targeted diplomats and began as early as March 2024," Palo Alto Networks Unit 42 said in a report published today, attributing it with medium to high level of confidence to APT28, which is also referred to as

Webinar: Discover the All-in-One Cybersecurity Solution for SMBs https://thehackernews.com/2024/08/webinar-discover-all-in-one.html In today's digital battlefield, small and medium businesses (SMBs) face the same cyber threats as large corporations, but with fewer resources. Managed service providers (MSPs) are struggling to keep up with the demand for protection. If your current cybersecurity strategy feels like a house of cards – a complex, costly mess of different vendors and tools – it's time for a change. Introducing

Mirai Botnet targeting OFBiz Servers Vulnerable to Directory Traversal https://thehackernews.com/2024/08/mirai-botnet-targeting-ofbiz-servers.html Enterprise Resource Planning (ERP) Software is at the heart of many enterprising supporting human resources, accounting, shipping, and manufacturing. These systems can become very complex and difficult to maintain. They are often highly customized, which can make patching difficult. However, critical vulnerabilities keep affecting these systems and put critical business data at risk.  The

New Windows Backdoor BITSLOTH Exploits BITS for Stealthy Communication https://thehackernews.com/2024/08/new-windows-backdoor-bitsloth-exploits.html Cybersecurity researchers have discovered a previously undocumented Windows backdoor that leverages a built-in feature called Background Intelligent Transfer Service (BITS) as a command-and-control (C2) mechanism. The newly identified malware strain has been codenamed BITSLOTH by Elastic Security Labs, which made the discovery on June 25, 2024, in connection with a cyber attack targeting an

U.S. Releases High-Profile Russian Hackers in Diplomatic Prisoner Exchange https://thehackernews.com/2024/08/us-releases-high-profile-russian.html In a historic prisoner exchange between Belarus, Germany, Norway, Russia, Slovenia, and the U.S., two Russian nationals serving time for cybercrime activities have been freed and repatriated to their country. This includes Roman Valerevich Seleznev and Vladislav Klyushin, who are part of a group of eight people who have been swapped back to Russia in exchange for the release of 16 people who

Cybercriminals Abusing Cloudflare Tunnels to Evade Detection and Spread Malware https://thehackernews.com/2024/08/cybercriminals-abusing-cloudflare.html Cybersecurity companies are warning about an uptick in the abuse of Clouflare's TryCloudflare free service for malware delivery. The activity, documented by both eSentire and Proofpoint, entails the use of TryCloudflare to create a one-time tunnel that acts as a conduit to relay traffic from an attacker-controlled server to a local machine through Cloudflare's infrastructure. Attack chains

The cyberthreat that drives businesses towards cyber risk insurance https://www.welivesecurity.com/en/business-security/cyberthreat-drives-businesses-cyber-risk-insurance/ Many smaller organizations are turning to cyber risk insurance, both to protect against the cost of a cyber incident and to use the extensive post-incident services that insurers provide

Over 1 Million Domains at Risk of 'Sitting Ducks' Domain Hijacking Technique https://thehackernews.com/2024/08/over-1-million-domains-at-risk-of.html Over a million domains are susceptible to takeover by malicious actors by means of what has been called a Sitting Ducks attack. The powerful attack vector, which exploits weaknesses in the domain name system (DNS), is being exploited by over a dozen Russian-nexus cybercriminal actors to stealthily hijack domains, a joint analysis published by Infoblox and Eclypsium has revealed. "In a Sitting

Hackers Distributing Malicious Python Packages via Popular Developer Q&A Platform https://thehackernews.com/2024/08/hackers-distributing-malicious-python.html In yet another sign that threat actors are always looking out for new ways to trick users into downloading malware, it has come to light that the question-and-answer (Q&A) platform known as Stack Exchange has been abused to direct unsuspecting developers to bogus Python packages capable of draining their cryptocurrency wallets. "Upon installation, this code would execute automatically,

New Android Banking Trojan BingoMod Steals Money, Wipes Devices https://thehackernews.com/2024/08/new-android-banking-trojan-bingomod.html Cybersecurity researchers have uncovered a new Android remote access trojan (RAT) called BingoMod that not only performs fraudulent money transfers from the compromised devices but also wipes them in an attempt to erase traces of the malware. Italian cybersecurity firm Cleafy, which discovered the RAT towards the end of May 2024, said the malware is under active development. It attributed the

Obfuscation: There Are Two Sides To Everything https://thehackernews.com/2024/08/obfuscation-there-are-two-sides-to.html How to detect and prevent attackers from using these various techniques Obfuscation is an important technique for protecting software that also carries risks, especially when used by malware authors. In this article, we examine obfuscation, its effects, and responses to it. What Is Obfuscation? Obfuscation is the technique of intentionally making information difficult to read, especially in

Google Chrome Adds App-Bound Encryption to Protect Cookies from Malware https://thehackernews.com/2024/08/google-chrome-adds-app-bound-encryption.html Google has announced that it's adding a new layer of protection to its Chrome browser through what's called app-bound encryption to prevent information-stealing malware from grabbing cookies on Windows systems. "On Windows, Chrome uses the Data Protection API (DPAPI) which protects the data at rest from other users on the system or cold boot attacks," Will Harris from the Chrome security team