Latest Cybersecurity News and Articles

---

Microsoft MSHTML Flaw Exploited to Deliver MerkSpy Spyware Tool

Unknown threat actors have been observed exploiting a now-patched security flaw in Microsoft MSHTML to deliver a surveillance tool called MerkSpy as part of a campaign primarily targeting users in Canada, India, Poland, and the U.S. "MerkSpy is designed to clandestinely monitor user activities, capture sensitive information, and establish persistence on compromised systems," Fortinet FortiGuard

---

Google Patches 25 Android Flaws, Including Critical Privilege Escalation Bug

Google has issued patches for 25 security vulnerabilities in the Android operating system. One critical bug, known as CVE-2024-31320, affects Android versions 12 and 12L, enabling privilege escalation.

---

The Impossibility of “Getting Ahead” in Cyber Defense

The nature of defense is inherently stacked against defenders, as cybercriminals aim to disrupt systems while defenders manage complex tech stacks. Additionally, the rapid evolution of technology means defenders are always playing catch-up.

---

FCC Drafts Rules to Strengthen Cyber of Emergency Systems

The Federal Communications Commission (FCC) has proposed draft final rules to enhance the security of public alert and warning systems in the face of emerging cybersecurity threats.

---

Cybersecurity is Now a Top Concern for Auto Industry, Report Finds

According to a survey by Rockwell Automation, vehicle and automotive supply manufacturers ranked cybersecurity as their biggest external concern. Cyberattacks resulted in $11.8 billion in damages during the first half of 2023 alone.

---

Polyglot Files Enable Cyber Attack Chains and Methods for Detection & Disarmament

Hackers are using polyglot files, which can fit into multiple file formats and evade detection by endpoint detection and response systems. Research indicates that some commercial EDR tools have a 0% detection rate for malicious polyglots.

---

US Supreme Court Ruling on Chevron Doctrine May Upend Future Cybersecurity Regulation

The ruling may lead to legal challenges against recent cybersecurity regulations, including the 2023 cyber incident reporting requirements by the Securities and Exchange Commission (SEC).

---

FakeBat Loader Malware Spreads Widely Through Drive-by Download Attacks

The loader-as-a-service (LaaS) known as FakeBat has become one of the most widespread loader malware families distributed using the drive-by download technique this year, findings from Sekoia reveal. "FakeBat primarily aims to download and execute the next-stage payload, such as IcedID, Lumma, RedLine, SmokeLoader, SectopRAT, and Ursnif," the company said in a Tuesday analysis. Drive-by attacks

---

Israeli Entities Targeted by Cyberattack Using Donut and Sliver Frameworks

Cybersecurity researchers have discovered an attack campaign that targets various Israeli entities with publicly-available frameworks like Donut and Sliver. The campaign, believed to be highly targeted in nature, "leverage target-specific infrastructure and custom WordPress websites as a payload delivery mechanism, but affect a variety of entities across unrelated verticals, and rely on

---

South Korean ERP Vendor's Server Hacked to Spread Xctdoor Malware

An unnamed South Korean enterprise resource planning (ERP) vendor's product update server has been found to be compromised to deliver a Go-based backdoor dubbed Xctdoor. The AhnLab Security Intelligence Center (ASEC), which identified the attack in May 2024, did not attribute it to a known threat actor or group, but noted that the tactics overlap with that of Andariel, a sub-cluster within the

---

Rapid7 To Acquire Attack Surface Management Startup Noetic Cyber

Cybersecurity firm Rapid7 has announced to acquired Noetic Cyber, a startup specializing in cyber asset attack surface management (CAASM). The terms of the deal were not disclosed.

---

Ransomware Attack Demands Reach a Staggering $5.2m in 2024

According to a new analysis by Comparitech, the average ransom demand per ransomware attack in the first half of 2024 was over $5.2m (£4.1m). This was calculated from 56 known ransom demands issued by threat actors during that period.

---

Cyber-Insurance Premiums Decline as Firms Build Resilience

Cyber insurance premiums have seen significant reductions in price due to improved cybersecurity measures implemented by organizations. Despite an 18% increase in ransomware incidents, premiums have decreased in 2023/24.

---

Preparing for Q-Day as NIST Nears Approval of PQC Standards

Q-Day, the day when a quantum computer can break modern encryption, is approaching rapidly, leaving our society vulnerable to cyberattacks. Recent advancements in quantum technology suggest that Q-Day is coming sooner than expected.

---

New Orcinius Trojan Uses VBA Stomping to Mask Infection

This multi-stage trojan utilizes Dropbox and Google Docs to update and deliver payloads. It uses the VBA stomping technique, removing the VBA source code in a Microsoft Office document, leaving only compiled p-code.

---

How Hacked YouTube Channels Spread Scams and Malware

The most common attack methods against YouTube channels involve phishing attacks to steal login credentials, exploiting weak or reused passwords, and even bypassing two-factor authentication by stealing session cookies.

---

CapraRAT Spyware Variant Disguised as Popular Apps to Target Android Users

The recent campaign shows updates to the group's techniques and social engineering tactics, as well as efforts to maximize the spyware's compatibility with older and modern versions of the Android operating system.

---

78% of organizations are tracking AI risks

A recent report found that 78 percent of organizations are tracking AI as an emerging risk while simultaneously adopting the technology themselves.

---

Dev Rejects CVE Severity, Makes his GitHub Repository Read-Only

The open source project 'ip' has been archived on GitHub due to a dubious CVE report filed against it. This is not an isolated incident, as open-source developers have seen an increase in unsubstantiated CVE reports for their projects.

---

Security leaders weigh in on Life360 data breach

Life360 was impacted by a data breach. Security leaders are sharing their insights.