Latest Cybersecurity News and Articles

---

Mobile Malware Landscape 2022 - Kaspersky Report

A new report by Kaspersky states that almost 200,000 new mobile banking trojans surfaced in 2022, marking a 100% increase from 2021, with China being the most affected, followed by Syria and Iran. RiskTool-type potentially unwanted software accounted for the most distributions at 27.39%, followed by adware at 24.05% and trojan-type malware at 15.56%.

---

Gitpod flaw shows cloud-based development environments need security assessments

The vulnerability found by Snyk, which the Gitpod team addressed within a day, is tracked as CVE-2023-0957 and falls into a category of issues known as cross-site WebSocket hijacking.

---

EU Data Protection Board Casts Doubt on Privacy Framework

The European Data Protection Board on Tuesday published an analysis of the framework, lauding "substantial improvements" but simultaneously expressing "concerns" and requesting "clarifications on several points."

---

Multi-Year Spearphishing Campaign Targets the Maritime Industry Likely for Financial Gain

Some of the emails likely used spoofed email addresses to appear as though they were sent from people within the same organization or from other maritime-related organizations.

---

HPE Buys SSE Firm Axis Security to Obtain Single-Vendor SASE

Hewlett Packard Enterprise will soon offer its customers single-vendor SASE after agreeing to purchase a security service edge startup founded by a Symantec security researcher.

---

Critical Vulnerabilities Allowed Booking.com Account Takeover

Security researchers discovered recently that the online travel agency Booking.com was impacted by serious vulnerabilities that could have been exploited to take complete control of a user’s account.

---

U.S. Cybersecurity Agency Raises Alarm Over Royal Ransomware's Deadly Capabilities

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has released a new advisory about Royal ransomware, which emerged in the threat landscape last year. "After gaining access to victims' networks, Royal actors disable antivirus software and exfiltrate large amounts of data before ultimately deploying the ransomware and encrypting the systems," CISA said. The custom ransomware

---

Blind Eagle Re-appears in a Phishing Campaign to Target Colombian Entities

BlackBerry researchers spotted the APT-C-36 threat group, aka Blind Eagle, masquerading as a Colombian government tax agency to target financial, health, immigration, and law enforcement sectors. Based on the infection vector and other tactics, researchers believed that the campaign targeted some organizations in Chile, Spain, and Ecuador.

---

Phishing is what type of attack? Definition, trends and best practices

By George Mack, Content Marketing Manager, Check Point. Phishing threats have been making waves in the threat landscape, as they are responsible for more than 80% of security incidents. However, with all the cyber terminology thrown around, such as malware, hacks, and data loss – how do we classify phishing threats? Phishing attacks are social […] The post Phishing is what type of attack? Definition, trends and best practices appeared first on CyberTalk.

---

Highlights from the New U.S. Cybersecurity Strategy

The Biden administration today issued its vision for beefing up the nation's collective cybersecurity posture, including calls for legislation establishing liability for software products and services that are sold with little regard for security. The White House's new national cybersecurity strategy also envisions a more active role by cloud providers and the U.S. military in disrupting cybercriminal infrastructure, and names China as the single biggest cyber threat to U.S. interests.

---

7 likely scenarios: How cyber security will change in 2023

 By Isla Sibanda, an ethical hacker and cyber security specialist based out of Pretoria. For over twelve years, she’s worked as a cyber security analyst and penetration testing specialist for several major companies – including Standard Bank Group, CipherWave, and Axxess. Social engineering scams target roughly one hundred million people annually, resulting in astronomical amounts […] The post 7 likely scenarios: How cyber security will change in 2023 appeared first on CyberTalk.

---

Major Phishing Campaign Targets Trezor Crypto Wallets

“The attackers contact the victims via phone call, SMS and/or email to say that there’s been a security breach or suspicious activity on their Trezor account,” the firm warned in a Twitter post.

---

BidenCash Market Leaks Two Million Credit Cards in Birthday Blitz

The one-year-old leaked dataset contains card information from all over the world, with a significant number of them issued in the United States, China, Mexico, India, Canada, and the UK.

---

Aruba Networks fixes six critical vulnerabilities in ArubaOS

The critical flaws addressed by Aruba this time can be separated into two categories: command injection flaws and stack-based buffer overflow problems in the PAPI protocol (Aruba Networks access point management protocol).

---

Record Number of Mobile Phishing Attacks in 2022

Lookout also investigated the evolution of mobile phishing on professional devices, and since 2021 mobile phishing encounter rates have increased by roughly 10% for enterprise phones.

---

Canadian book giant says employee data was stolen during ransomware attack

In an undated followup FAQ, Indigo now says employee data was involved in the attack. The Toronto-based company did not respond to requests for comment about how many people were affected.

---

Pierce Transit and City of Lakewood Investigating Potential Ransomware Attacks

A Pierce Transit spokesperson told KOMO News in a statement that on Feb. 14, the agency "experienced a ransomware incident that temporarily disrupted some agency systems.

---

Research finds UEFI bootkit capable of bypassing security measures

New research shows that a unified extensive firmware interface (UEFI) bootkit is capable of bypassing security features despite system updates. 

---

Blackfly: Espionage Group Targets Materials Technology

The Blackfly espionage group (aka APT41, Winnti Group, Bronze Atlas) has continued to mount attacks against targets in Asia and recently targeted two subsidiaries of an Asian conglomerate, likely attempting to steal intellectual property

---

Cambodia-Based "Sour Grapes" Pig Butchering Scam Targets Southeast Asia

The teams running these scams include a young man or woman acting as the face of the scam, keyboarders who keep the victim engaged, and a team generating and repurposing media content with fabricated proof of their backstory.