TECHZONE™

THN Cybersecurity Recap: Top Threats, Tools and News (Oct 21 - Oct 27) https://thehackernews.com/2024/10/thn-cybersecurity-recap-top-threats_28.html Cybersecurity news can sometimes feel like a never-ending horror movie, can't it? Just when you think the villains are locked up, a new threat emerges from the shadows. This week is no exception, with tales of exploited flaws, international espionage, and AI shenanigans that could make your head spin. But don't worry, we're here to break it all down in plain English and arm you with the

Russian Espionage Group Targets Ukrainian Military with Malware via Telegram https://thehackernews.com/2024/10/russian-espionage-group-targets.html A suspected Russian hybrid espionage and influence operation has been observed delivering a mix of Windows and Android malware to target the Ukrainian military under the Telegram persona Civil Defense. Google's Threat Analysis Group (TAG) and Mandiant are tracking the activity under the name UNC5812. The threat group, which operates a Telegram channel named civildefense_com_ua, was created on

BeaverTail Malware Resurfaces in Malicious npm Packages Targeting Developers https://thehackernews.com/2024/10/beavertail-malware-resurfaces-in.html Three malicious packages published to the npm registry in September 2024 have been found to contain a known malware called BeaverTail, a JavaScript downloader and information stealer linked to an ongoing North Korean campaign tracked as Contagious Interview. The Datadog Security Research team is monitoring the activity under the name Tenacious Pungsan, which is also known by the monikers

Cybercriminals Use Webflow to Deceive Users into Sharing Sensitive Login Credentials https://thehackernews.com/2024/10/cybercriminals-use-webflow-to-deceive.html Cybersecurity researchers have warned of a spike in phishing pages created using a website builder tool called Webflow, as threat actors continue to abuse legitimate services like Cloudflare and Microsoft Sway to their advantage. "The campaigns target sensitive information from different crypto wallets, including Coinbase, MetaMask, Phantom, Trezor, and Bitbuy, as well as login credentials for

Sailing the Seven Seas Securely from Port to Port – OT Access Security for Ships and Cranes https://thehackernews.com/2024/10/sailing-seven-seas-securely-from-port.html Operational Technology (OT) security has affected marine vessel and port operators, since both ships and industrial cranes are being digitalized and automated at a rapid pace, ushering in new types of security challenges. Ships come to shore every six months on average. Container cranes are mostly automated. Diagnostics, maintenance, upgrade and adjustments to these critical systems are done

Researchers Uncover OS Downgrade Vulnerability Targeting Microsoft Windows Kernel https://thehackernews.com/2024/10/researchers-uncover-os-downgrade.html A new attack technique could be used to bypass Microsoft's Driver Signature Enforcement (DSE) on fully patched Windows systems, leading to operating system (OS) downgrade attacks. "This bypass allows loading unsigned kernel drivers, enabling attackers to deploy custom rootkits that can neutralize security controls, hide processes and network activity, maintain stealth, and much more," SafeBreach

Notorious Hacker Group TeamTNT Launches New Cloud Attacks for Crypto Mining https://thehackernews.com/2024/10/notorious-hacker-group-teamtnt-launches.html The infamous cryptojacking group known as TeamTNT appears to be readying for a new large-scale campaign targeting cloud-native environments for mining cryptocurrencies and renting out breached servers to third-parties. "The group is currently targeting exposed Docker daemons to deploy Sliver malware, a cyber worm, and cryptominers, using compromised servers and Docker Hub as the infrastructure

Four REvil Ransomware Members Sentenced in Rare Russian Cybercrime Convictions https://thehackernews.com/2024/10/four-revil-ransomware-members-sentenced.html Four members of the now-defunct REvil ransomware operation have been sentenced to several years in prison in Russia, marking one of the rare instances where cybercriminals from the country have been convicted of hacking and money laundering charges. Russian news publication Kommersant reported that a court in St. Petersburg found Artem Zaets, Alexei Malozemov, Daniil Puzyrevsky, and Ruslan

CERT-UA Identifies Malicious RDP Files in Latest Attack on Ukrainian Entities https://thehackernews.com/2024/10/cert-ua-identifies-malicious-rdp-files.html The Computer Emergency Response Team of Ukraine (CERT-UA) has detailed a new malicious email campaign targeting government agencies, enterprises, and military entities. "The messages exploit the appeal of integrating popular services like Amazon or Microsoft and implementing a zero-trust architecture," CERT-UA said. "These emails contain attachments in the form of Remote Desktop Protocol ('.rdp'

Researchers Discover Command Injection Flaw in Wi-Fi Alliance's Test Suite https://thehackernews.com/2024/10/researchers-discover-command-injection.html A security flaw impacting the Wi-Fi Test Suite could enable unauthenticated local attackers to execute arbitrary code with elevated privileges. The CERT Coordination Center (CERT/CC) said the vulnerability, tracked as CVE-2024-41992, said the susceptible code from the Wi-Fi Alliance has been found deployed on Arcadyan FMIMG51AX000J routers. "This flaw allows an unauthenticated local attacker to

Apple Opens PCC Source Code for Researchers to Identify Bugs in Cloud AI Security https://thehackernews.com/2024/10/apple-opens-pcc-source-code-for.html Apple has publicly made available its Private Cloud Compute (PCC) Virtual Research Environment (VRE), allowing the research community to inspect and verify the privacy and security guarantees of its offering. PCC, which Apple unveiled earlier this June, has been marketed as the "most advanced security architecture ever deployed for cloud AI compute at scale." With the new technology, the idea is

Eliminating AI Deepfake Threats: Is Your Identity Security AI-Proof? https://thehackernews.com/2024/10/eliminating-ai-deepfake-threats-is-your.html Artificial Intelligence (AI) has rapidly evolved from a futuristic concept to a potent weapon in the hands of bad actors. Today, AI-based attacks are not just theoretical threats—they're happening across industries and outpacing traditional defense mechanisms.  The solution, however, is not futuristic. It turns out a properly designed identity security platform is able to deliver defenses

SEC Charges 4 Companies Over Misleading SolarWinds Cyberattack Disclosures https://thehackernews.com/2024/10/sec-charges-4-companies-over-misleading.html The U.S. Securities and Exchange Commission (SEC) has charged four current and former public companies for making "materially misleading disclosures" related to the large-scale cyber attack that stemmed from the hack of SolarWinds in 2020. The SEC said the companies – Avaya, Check Point, Mimecast, and Unisys – are being penalized for how they handled the disclosure process in the aftermath of

Irish Watchdog Imposes Record €310 Million Fine on LinkedIn for GDPR Violations https://thehackernews.com/2024/10/irish-watchdog-imposes-record-310.html The Irish data protection watchdog on Thursday fined LinkedIn €310 million ($335 million) for violating the privacy of its users by conducting behavioral analyses of personal data for targeted advertising. "The inquiry examined LinkedIn's processing of personal data for the purposes of behavioral analysis and targeted advertising of users who have created LinkedIn profiles (members)," the Data

ESET Research Podcast: CosmicBeetle https://www.welivesecurity.com/en/podcasts/eset-research-podcast-cosmicbeetle/ Learn how a rather clumsy cybercrime group wielding buggy malicious tools managed to compromise a number of SMBs in various parts of the world

New Qilin.B Ransomware Variant Emerges with Improved Encryption and Evasion Tactics https://thehackernews.com/2024/10/new-qilinb-ransomware-variant-emerges.html Cybersecurity researchers have discovered an advanced version of the Qilin ransomware sporting increased sophistication and tactics to evade detection. The new variant is being tracked by cybersecurity firm Halcyon under the moniker Qilin.B. "Notably, Qilin.B now supports AES-256-CTR encryption for systems with AESNI capabilities, while still retaining Chacha20 for systems that lack this support

AWS Cloud Development Kit Vulnerability Exposes Users to Potential Account Takeover Risks https://thehackernews.com/2024/10/aws-cloud-development-kit-vulnerability.html Cybersecurity researchers have disclosed a security flaw impacting Amazon Web Services (AWS) Cloud Development Kit (CDK) that could have resulted in an account takeover under specific circumstances. "The impact of this issue could, in certain scenarios, allow an attacker to gain administrative access to a target AWS account, resulting in a full account takeover," Aqua said in a report shared

Cisco Issues Urgent Fix for ASA and FTD Software Vulnerability Under Active Attack https://thehackernews.com/2024/10/cisco-issues-urgent-fix-for-asa-and-ftd.html Cisco on Wednesday said it has released updates to address an actively exploited security flaw in its Adaptive Security Appliance (ASA) that could lead to a denial-of-service (DoS) condition. The vulnerability, tracked as CVE-2024-20481 (CVSS score: 5.8), affects the Remote Access VPN (RAVPN) service of Cisco ASA and Cisco Firepower Threat Defense (FTD) Software. Arising due to resource

Why Phishing-Resistant MFA Is No Longer Optional: The Hidden Risks of Legacy MFA https://thehackernews.com/2024/10/why-phishing-resistant-mfa-is-no-longer.html Sometimes, it turns out that the answers we struggled so hard to find were sitting right in front of us for so long that we somehow overlooked them. When the Department of Homeland Security, through the Cybersecurity and Infrastructure Security Agency (CISA), in coordination with the FBI, issues a cybersecurity warning and prescribes specific action, it’s a pretty good idea to at least read the

Lazarus Group Exploits Google Chrome Vulnerability to Control Infected Devices https://thehackernews.com/2024/10/lazarus-group-exploits-google-chrome.html The North Korean threat actor known as Lazarus Group has been attributed to the zero-day exploitation of a now-patched security flaw in Google Chrome to seize control of infected devices. Cybersecurity vendor Kaspersky said it discovered a novel attack chain in May 2024 that targeted the personal computer of an unnamed Russian national with the Manuscrypt backdoor. This entails triggering the