Latest Cybersecurity News and Articles

---

HHS, AHA Warn of Surge in Russian DDoS Attacks on US Healthcare Sector Entities

U.S. government and industry authorities are warning the healthcare sector of a surge in distributed denial-of-service attacks in recent days against hospitals and other medical entities instigated by Russian nuisance hacking group KillNet.

---

Why CISOs need to adopt a prevention-first strategy for IoT

Antoinette Hodes is a Check Point Solutions Architect for the EMEA region and an Evangelist with the Check Point Office of the CTO. She has worked as an engineer in IT for over 25 years. She is a strong customer advocate, who connects people & processes with technology by matching the clients’ business needs with […] The post Why CISOs need to adopt a prevention-first strategy for IoT appeared first on CyberTalk.

---

Guardz Emerges From Stealth Mode With $10 Million in Funding

Guardz today emerged from stealth mode with $10 million raised in a seed funding round led by Hanaco Ventures, with additional investment from iAngels, Cyverse Capital, and GKFF Ventures.

---

New GOOTLOADER Variant Evolves Further with New Obfuscation Tricks

The UNC2565 hacker group appears to have restructured its GOOTLOADER (or Gootkit) malware by adding new components and implementing new obfuscation techniques. Gootkit is used by adversaries to drop additional malicious payloads, such as SunCrypt, REvil (Sodinokibi) ransomware, Kronos trojan, and Cobalt Strike, on compromised systems.

---

KeePass disputes vulnerability allowing stealthy password theft

The development team behind the open-source password management software KeePass is disputing what is described as a newly found vulnerability that allows attackers to stealthily export the entire database in plain text.

---

Choosing Check Point as an application security vendor

Contributed by Diana Polansky, Cloud Security Product Marketing Manager, and Sergio Silva, Product Incubation Manager. When we started to plan our goals for the new year, we took the time to think about your goals as well – and we don’t mean your personal New Year’s goals, like going to the gym more often. We […] The post Choosing Check Point as an application security vendor appeared first on CyberTalk.

---

Additional Supply Chain Vulnerabilities Uncovered in AMI MegaRAC BMC Software

Two more supply chain security flaws have been disclosed in AMI MegaRAC Baseboard Management Controller (BMC) software, nearly two months after three security vulnerabilities were brought to light in the same product. Firmware security firm Eclypsium said the two shortcomings were held back until now to provide AMI additional time to engineer appropriate mitigations. The issues, collectively

---

Hackers Abused Microsoft's "Verified Publisher" OAuth Apps to Hack Corporate Email Accounts

Microsoft on Tuesday said it took steps to disable fake Microsoft Partner Network (MPN) accounts that were used for creating malicious OAuth applications as part of a malicious campaign designed to breach organizations' cloud environments and steal email. "The applications created by these fraudulent actors were then used in a consent phishing campaign, which tricked users into granting

---

Google Ads Now Hijacked to Target Password Manager Users

A new malvertising campaign has surfaced that abuses Google Ads to target users searching for password managers and, in fact, directed them to fake sponsored websites. Previously, the FBI had warned about the explosion of such attacks that impersonated websites involved in finances and duped users into sharing their login credentials and financial data.

---

Analyzing Malware Code that Cryptojacks System to Mine for Monero Crypto

Given that the content is written in Spanish, this campaign targets Spanish-speaking people. It shows a blurred picture of a statement that tricks the user into clicking the "Enable Content" button for a clearer view which actually enables macros.

---

Maryland hospital facing outages after ‘significant’ ransomware attack

Atlantic General Hospital in Maryland is experiencing network disruptions and outages after a significant ransomware attack deployed this weekend, according to local news outlet WMDT47.

---

Auditing Kubernetes with Open Source SIEM and XDR

Container technology has gained traction among businesses due to the increased efficiency it provides. In this regard, organizations widely use Kubernetes for deploying, scaling, and managing containerized applications. Organizations should audit Kubernetes to ensure compliance with regulations, find anomalies, and identify security risks. The Wazuh open source platform plays a critical role in

---

Financial Firms in the European Union are Facing Strict Rules Around Cloud-Based Services

While it's true that DORA will primarily impact entities operating in the financial sector, DORA's regulations focus on establishing greater cyber-resilience, and will, therefore, also impact information technology roles and companies.

---

DocuSign Brand Impersonation Attack Bypasses Security Measures, Targets Over 10,000

“At first glance, the email seems to be a legitimate communication from DocuSign, with the sender name being manipulated by the attacker, reading Docusign,” reads the technical write-up by Armorblox.

---

Phishing Page Changes as per User's Email Address

ASEC stumbled across phishing emails warning users that their accounts would be shut down unless they perform a particular action. Hackers used Google's favicon feature to trick users into revealing their credentials. The account credentials entered on the phishing page were sent to a C2 whose address was the same domain as a previous campaign observed by the researchers.

---

Financial Services Targeted in 28% of UK Cyber-Attacks Last Year

Security researchers at Imperva have suggested that over a quarter of all cyber-attacks (28%) in the UK have hit the financial services and insurance (FSI) industry in the last 12 months.

---

Prilex PoS Malware Evolves to Block Contactless Payments to Steal from NFC Cards

The Brazilian threat actors behind an advanced and modular point-of-sale (PoS) malware known as Prilex have reared their head once again with new updates that allow it to block contactless payment transactions. Russian cybersecurity firm Kaspersky said it detected three versions of Prilex (06.03.8080, 06.03.8072, and 06.03.8070) that are capable of targeting NFC-enabled credit cards, taking its

---

Update: TSA issues security directive to airports, carriers after ‘no-fly’ list leak

The security directive, issued Friday, “reinforces existing requirements on handling sensitive security information and personally identifiable information,” a TSA spokesperson said.

---

Sentra raises $30M to provide a security layer for data in the cloud

The Series A round was led by Standard Investments, with participation from Munich Re Ventures, Moore Strategic Ventures, Xerox Ventures, INT3, Bessemer Venture Partners, and Zeev Ventures — bringing its total raised to $53 million.

---

Godfather Banking Trojan Expands to Infect More European Countries

Recently EclecticIQ Threat Research Team spotted samples of Godfather imitating Google Protect apps and fooling users into believing they are protected by an Android service. After successful infection, Godfather obtains the permissions for Accessibility Service and collects the default user agent, country code of the network operator, Bot ID, list of installed apps, Android version, device model, and others.