Latest Cybersecurity News and Articles

---

Hackers abused API to verify millions of Authy MFA phone numbers

Twilio has confirmed that an unsecured API endpoint allowed threat actors to access phone numbers of millions of Authy multi-factor authentication users, potentially making them vulnerable to SMS phishing and SIM swapping attacks.

---

Brazil Halts Meta's AI Data Processing Amid Privacy Concerns

Brazil's data protection authority, Autoridade Nacional de Proteção de Dados (ANPD), has temporarily banned Meta from processing users' personal data to train the company's artificial intelligence (AI) algorithms. The ANPD said it found "evidence of processing of personal data based on inadequate legal hypothesis, lack of transparency, limitation of the rights of data subjects, and risks to

---

Report suggests organizations sacrifice client privacy to save money

1 in 3 security leaders believe that half of organizations are willing to trade their customer’s privacy in order to save money.

---

Global Police Operation Shuts Down 600 Cybercrime Servers Linked to Cobalt Strike

A coordinated law enforcement operation codenamed MORPHEUS has felled close to 600 servers that were used by cybercriminal groups and were part of an attack infrastructure associated with the Cobalt Strike.  The crackdown targeted older, unlicensed versions of the Cobalt Strike red teaming framework between June 24 and 28, according to Europol. Of the 690 IP addresses that were flagged to

---

Twilio's Authy App Breach Exposes Millions of Phone Numbers

Cloud communications provider Twilio has revealed that unidentified threat actors took advantage of an unauthenticated endpoint in Authy to identify data associated with Authy accounts, including users' cell phone numbers. The company said it took steps to secure the endpoint to no longer accept unauthenticated requests. The development comes days after an online persona named ShinyHunters

---

The Not-So-Secret Network Access Broker x999xx

Most accomplished cybercriminals go out of their way to separate their real names from their hacker handles. But among certain old-school Russian hackers it is not uncommon to find major players who have done little to prevent people from figuring out who they are in real life. A case study in this phenomenon is "x999xx," the nickname chosen by a venerated Russian hacker who specializes in providing the initial network access to various ransomware groups.

---

New RUSI Report Exposes Psychological Toll of Ransomware, Urges Action

A recent report by the Royal United Services Institute (RUSI) emphasized the need for all incident response stakeholders to address the psychological and physiological impact of ransomware attacks on individuals.

---

RCE, DoS Exploits Found in Rockwell PanelView Plus: Patch Now

Microsoft has exposed two significant vulnerabilities in Rockwell Automation's PanelView Plus devices that could be exploited by attackers to execute remote code and launch denial-of-service attacks.

---

Secator: Open-Source Pentesting Swiss Army Knife

Secator is an open-source task and workflow runner designed for security assessments to streamline the use of various security tools for pen testers and security researchers.

---

Vulnerabilities in CocoaPods: The Achilles' Heel of the Apple App Ecosystem

Recent discoveries have unveiled severe vulnerabilities within CocoaPods, a dependency manager essential for iOS and macOS application development. These security flaws could lead to significant supply chain attacks, jeopardizing numerous applications. The exploit allows attackers to alter the software update process, inserting harmful payloads into applications. Developers must remain vigilant and adopt robust security practices to safeguard their applications and users.

---

New Ransomware Group Uses Phone Calls to Pressure Victims, Researchers Say

Researchers have identified a new ransomware group called Volcano Demon responsible for two recent successful attacks on companies in the manufacturing and logistics sectors.

---

Understanding the FakeBat Loader: Distribution Tactics and Cybercriminal Infrastructure

In the early part of 2024, the FakeBat loader, also known as EugenLoader or PaykLoader, emerged as a significant threat utilizing the drive-by download technique to spread malware.

---

Feds Hit Health Entity With $950K Fine in Ransomware Attack

The US Department of Health and Human Services has levied a fine of $950,000 from the Heritage Valley Health System in Pennsylvania. It must address potential HIPAA violations after a ransomware attack in 2017.

---

Industry Groups Ask HHS for Guidance on Massive Change Breach Reports

Industry groups are seeking further clarification on delegation processes and want a clear statement that covered entities without a business associate relationship with Change Healthcare are not obliged to notify patients.

---

Dozens of Arrests Disrupt $2.7m Vishing Gang

The criminal gang targeted elderly Spanish citizens by posing as bank employees through voice phishing and then showing up unannounced at their homes to collect cards, bank details, and PINs.

---

Supposed Grasshopper Operators Impersonate Israeli Government and Private Companies to Deploy Open-Source Malware

The group uses a mix of publicly available malware and custom development to carry out their attacks. They have been using custom WordPress websites as a payload delivery mechanism.

---

The Emerging Role of AI in Open-Source Intelligence

Recently the Office of the Director of National Intelligence (ODNI) unveiled a new strategy for open-source intelligence (OSINT) and referred to OSINT as the “INT of first resort”. Public and private sector organizations are realizing the value that the discipline can provide but are also finding that the exponential growth of digital data in recent years has overwhelmed many traditional OSINT

---

PTC Releases Patch for Critical Flaw in Creo Elements/Direct License Server

The vulnerability, tracked as CVE-2024-6071, affects version 20.7.0.0 and earlier, and allows unauthenticated remote attackers to execute arbitrary OS commands on the server through a web interface.

---

APP Fraud Singled Out as Biggest Financial Crime Threat

Nearly two-thirds of payments professionals in the UK believe that fraud is the most urgent financial crime threat, with authorized push payment (APP) scams being the top concern, according to a survey by The Payments Association.

---

Chrome Update Will Block Entrust Certificates by November 2024

Google has announced that starting November 1, 2024, Chrome version 127 and higher will no longer trust new TLS server authentication certificates from Entrust and AffirmTrust.