Latest Cybersecurity News and Articles

---

Chinese APT Group Abuses Visual Studio Code to Target Government in Asia

Chinese APT group Stately Taurus exploited Visual Studio Code to target government entities in Southeast Asia for cyberespionage. They utilized the software's reverse shell feature to infiltrate networks, a technique first detected in 2023.

---

Experts Identify 3 Chinese-Linked Clusters Behind Cyberattacks in Southeast Asia

A trio of threat activity clusters linked to China has been observed compromising more government organizations in Southeast Asia as part of a renewed state-sponsored operation codenamed Crimson Palace, indicating an expansion in the scope of the espionage effort. Cybersecurity firm Sophos, which has been monitoring the cyber offensive, said it comprises three intrusion sets tracked as Cluster

---

Shining a Light on Shadow Apps: The Invisible Gateway to SaaS Data Breaches

Shadow apps, a segment of Shadow IT, are SaaS applications purchased without the knowledge of the security team. While these applications may be legitimate, they operate within the blind spots of the corporate security team and expose the company to attackers.  Shadow apps may include instances of software that the company is already using. For example, a dev team may onboard their own

---

'TIDrone' Cyberattackers Target Taiwan's Drone Manufacturers

TIDrone, linked to Chinese-speaking groups, deploys advanced malware through ERP software or remote desktop tools. Trend Micro identified the threat actor as actively pursuing military and satellite industrial supply chains in Taiwan.

---

Underground Demand for Malicious LLMs is Robust

The underground market for malicious large language models (LLMs) is thriving, according to researchers from Indiana University Bloomington. They found 212 malicious LLMs for sale from April through September 2024.

---

Key Cyber Insurance Stakeholders Urge Government To Help Close $900B in Uncovered Risk

Marsh McLennan and Zurich Insurance Group have issued a white paper highlighting the need for a public-private partnership to help close this significant coverage gap, which poses a threat to both businesses and the economy.

---

New PIXHELL Attack Exploits Screen Noise to Exfiltrates Data from Air-Gapped Computers

A new side-channel attack dubbed PIXHELL could be abused to target air-gapped computers by breaching the "audio gap" and exfiltrating sensitive information by taking advantage of the noise generated by the pixels on the screen. "Malware in the air-gap and audio-gap computers generates crafted pixel patterns that produce noise in the frequency range of 0 - 22 kHz," Dr. Mordechai Guri, the head of

---

Cybercriminals Target Latin American Banks with Mekotio, BBTok, and Grandoreiro Trojans

These campaigns aim to steal sensitive banking credentials using innovative tactics, expanding beyond traditional regions like Brazil and Argentina to industries such as manufacturing, retail, and financial services.

---

Mustang Panda Deploys Advanced Malware to Spy on Asia-Pacific Governments

The threat actor tracked as Mustang Panda has refined its malware arsenal to include new tools in order to facilitate data exfiltration and the deployment of next-stage payloads, according to new findings from Trend Micro. The cybersecurity firm, which is monitoring the activity cluster under the name Earth Preta, said it observed "the propagation of PUBLOAD via a variant of the worm HIUPAN."

---

Spyware Vendors' Nebulous Ecosystem Helps Them Evade Sanctions

Spyware vendors have developed a complex ecosystem that enables them to evade sanctions effectively by utilizing a network of interconnected entities across various jurisdictions.

---

Moody's Ratings: Cyber Insurance Competition Up, Prices Down

Moody's Ratings reported that competition in the cyber insurance market is increasing, leading to a decrease in prices, with new players entering the market despite concerns about systemic risk.

---

Homeland Security Hopes to Scuttle Maritime Cyber-Threats

The U.S. Department of Homeland Security (DHS) has issued a request for information to assess the security of technology at ports in order to develop a Maritime Port Resiliency and Security Research Testbed.

---

PoC Exploit Releases for Windows Elevation of Privilege Vulnerability (CVE-2024-26230)

A PoC exploit for an Elevation of Privilege vulnerability in Windows has been released by a security researcher. This exploit targets a flaw in the Windows Telephony service, allowing attackers to gain SYSTEM privileges on affected systems.

---

Musician Charged With $10M Streaming Royalties Fraud Using AI and Bots

North Carolina musician Michael Smith has been indicted for allegedly scamming over $10 million in royalty payments from Spotify, Amazon Music, Apple Music, and YouTube Music through a massive streaming fraud scheme.

---

CAMO Unveiled: How Cybercriminals Exploit Legitimate Software for Stealthy Attacks

CAMO, short for Commercial Applications, Malicious Operations, showcases how cybercriminals are increasingly utilizing legitimate IT tools to evade security measures and conduct stealthy attacks.

---

Lazarus Group Targets Blockchain Pros with Fake Video Conferencing, Job Scam

The Lazarus Group, known for financially motivated cyber campaigns, is targeting blockchain professionals through fake job offers and fraudulent video conferencing applications.

---

North Korean Threat Actors Deploy COVERTCATCH Malware via LinkedIn Job Scams

Once installed, COVERTCATCH downloads a second-stage payload to compromise macOS systems. This tactic is part of various activity clusters, including Operation Dream Job and Contagious Interview.

---

MindsDB Fixes Critical CVE-2024-24759: DNS Rebinding Attack Bypasses Security Protections

MindsDB has fixed a critical security vulnerability, CVE-2024-24759, which could enable attackers to bypass security measures using DNS rebinding. This technique manipulates domain name resolution to bypass SSRF protection.

---

New RAMBO Attack Uses RAM Radio Signals to Steal Data from Air-Gapped Networks

A novel side-channel attack has been found to leverage radio signals emanated by a device's random access memory (RAM) as a data exfiltration mechanism, posing a threat to air-gapped networks. The technique has been codenamed RAMBO by Dr. Mordechai Guri, the head of the Offensive Cyber Research Lab in the Department of Software and Information Systems Engineering at the Ben Gurion University of

---

Confidant Health database exposed 5.3 terabytes of patient information

A cybersecurity researcher discovered an exposed Confidant Health database containing thousands of records.