Latest Cybersecurity News and Articles

---

KnowBe4 to Acquire Egress

KnowBe4, a Tampa Bay, FL-based provider of security awareness training and simulated phishing platform, is to acquire Egress Software Technologies, a London, UK-based company that specializes in adaptive and integrated cloud email security.

---

Researchers Discover Coordinated Attacks on Docker Hub to Plant Millions of Malicious Repositories

Of the 4.79 million imageless Docker Hub repositories uncovered, 3.2 million of them are said to have been used as landing pages to redirect unsuspecting users to fraudulent sites as part of three broad campaigns.

---

Millions of Malicious 'Imageless' Containers Planted on Docker Hub Over 5 Years

Cybersecurity researchers have discovered multiple campaigns targeting Docker Hub by planting millions of malicious "imageless" containers over the past five years, once again underscoring how open-source registries could pave the way for supply chain attacks. "Over four million of the repositories in Docker Hub are imageless and have no content except for the repository

---

Man Who Mass-Extorted Psychotherapy Patients Gets Six Years

A 26-year-old Finnish man was sentenced to more than six years in prison today after being convicted of hacking into an online psychotherapy clinic, leaking tens of thousands of patient therapy records, and attempting to extort the clinic and patients.

---

Prompt Fuzzer: Open-Source Tool for Strengthening GenAI Apps

Prompt Fuzzer is interactive and user-friendly, allowing users to repeat the process as many times as needed to harden their system prompts and see their security score increase as the prompt becomes more resilient.

---

Poor cyber hygiene and budgets leave organizations ill-prepared

Many organizations are vulnerable to risk, yet a majority of cyber leaders express confidence that their organization can manage risk. 

---

Researchers Unveil Novel Attack Methods Targeting Intel’s Conditional Branch Predictor

Researchers have found two novel types of attacks that target the conditional branch predictor found in high-end Intel processors, which could be exploited to compromise billions of processors currently in use.

---

UK Enacts IoT Cybersecurity Law

The Product Security and Telecommunications Infrastructure (PSTI) Act has come into effect, requiring manufacturers of consumer-grade IoT products sold in the UK to stop using guessable default passwords and have a vulnerability disclosure policy.

---

Muddling Meerkat Hackers Manipulate DNS Using China’s Great Firewall

Discovered by Infoblox, the threat activity does not have a clear goal or motivation but demonstrates sophistication and advanced capabilities to manipulate global DNS systems.

---

U.S. Government Releases New AI Security Guidelines for Critical Infrastructure

The U.S. government has unveiled new security guidelines aimed at bolstering critical infrastructure against artificial intelligence (AI)-related threats. "These guidelines are informed by the whole-of-government effort to assess AI risks across all sixteen critical infrastructure sectors, and address threats both to and from, and involving AI systems," the Department of Homeland Security (DHS)&

---

FCC Imposes $200 Million in Fines on Four US Carriers

The FCC has fined four major U.S. wireless carriers - AT&T, Sprint, T-Mobile, and Verizon - a total of nearly $200 million for unlawfully selling access to their customers' real-time location data without consent.

---

Google Rejected 2.28 Million Risky Android Apps From Play Store in 2023

Additionally, the tech giant reports that it identified and blocked 333,000 Google Play accounts that uploaded malware, fraudulent apps, or engaged in repeated grave policy violations.

---

The Darkgate Menace: Leveraging Autohotkey & Attempt to Evade SmartScreen

Researchers found a novel infection chain associated with the DarkGate malware, which is a Remote Access Trojan (RAT) developed using Borland Delphi and marketed as a Malware-as-a-Service (MaaS) offering on a Russian-language cybercrime forum.

---

Security Flaws in IRS Systems Pose Risk to Financial Statements, GAO Says

In its report, the GAO highlighted “new and continuing” shortcomings with information systems and the safeguarding of assets, issues that increase the likelihood of unauthorized access to sensitive IRS data.

---

Thoma Bravo to take UK cybersecurity company Darktrace private in $5B deal

Thoma Bravo, a private equity firm, is set to acquire the U.K.-based cybersecurity company Darktrace in a deal valued at around $5 billion. The deal is pending shareholder approval and is expected to be finalized by the end of 2024.

---

Zloader Learns Old Tricks

Zloader, a modular trojan based on the leaked ZeuS source code, has recently introduced a new anti-analysis feature in versions 2.4.1.0 and 2.5.1.0 to prevent execution on machines that differ from the original infection.

---

New U.K. Law Bans Default Passwords on Smart Devices Starting April 2024

The U.K. National Cyber Security Centre (NCSC) is calling on manufacturers of smart devices to comply with new legislation that prohibits them from using default passwords, effective April 29, 2024. "The law, known as the Product Security and Telecommunications Infrastructure act (or PSTI act), will help consumers to choose smart devices that have been designed to

---

FCC Fines Major U.S. Wireless Carriers for Selling Customer Location Data

The U.S. Federal Communications Commission (FCC) today levied fines totaling nearly $200 million against the four major carriers -- including AT&T, Sprint, T-Mobile and Verizon -- for illegally sharing access to customers' location information without consent.

---

Google Prevented 2.28 Million Malicious Apps from Reaching Play Store in 2023

Google on Monday revealed that almost 200,000 app submissions to its Play Store for Android were either rejected or remediated to address issues with access to sensitive data such as location or SMS messages over the past year. The tech giant also said it blocked 333,000 bad accounts from the app storefront in 2023 for attempting to distribute malware or for repeated policy violations. "In 2023,

---

Experts weigh in on the MITRE nation-state cyberattack

MITRE Corporation announced that it was the target of a nation-state cyberattack, and security leaders are sharing their insights.