Latest Cybersecurity News and Articles

---

PetSmart Warns of Credential Stuffing Attacks Trying to Hack Accounts

PetSmart, a major pet retail company, has issued a warning to customers about credential stuffing attacks aimed at breaching their accounts. As a precaution, passwords for accounts logged in during the attack have been reset.

---

Capita Says Cyberattack Contributed to Annual Loss of More Than $135 Million

The incident led to a drop in Capita's share price and a decline in its customer experience score. Data breaches and potential regulatory penalties could further impact the company, which is also facing criticism for its handling of personal data.

---

Hackers Switch From Crypto Drainer to Distributed WordPress Brute Force Attacks

Hackers are using compromised WordPress sites to force visitors' browsers to conduct brute-force attacks on other websites, potentially leading to data theft and site manipulation.

---

Five Ways to Keep API Integrations Secure

Regularly updating software, enforcing rate limits, and funneling logs to an SIEM solution are essential steps to maintain the security of API integrations and uncover security issues on time.

---

Linux Malware Targets Misconfigured Apache Hadoop, Confluence, Docker, and Redis Servers

An emerging malware campaign is targeting misconfigured servers hosting web-facing services like Apache Hadoop YARN, Docker, Confluence, and Redis, using novel Golang payloads for automated identification and exploitation of vulnerable hosts.

---

South Korean Police Develops Deepfake Detection Tool

The tool will be able to determine whether video content has been artificially generated using AI technology in about five to 10 minutes. Police said the software has an 80% probability of detecting whether a video is authentic.

---

Human vs. Non-Human Identity in SaaS

In today's rapidly evolving SaaS environment, the focus is on human users. This is one of the most compromised areas in SaaS security management and requires strict governance of user roles and permissions, monitoring of privileged users, their level of activity (dormant, active, hyperactive), their type (internal/ external), whether they are joiners, movers, or leavers, and more.  Not

---

NSA Shares Zero-Trust Guidance to Limit Adversaries on the Network

Organizations need to gradually advance through specific maturity levels in various components of the zero-trust architecture to effectively build a resilient security environment.

---

Why Cyber Maturity Assessment Should Become Standard Practice

Despite obstacles like time constraints and lack of expertise, regular and thorough cyber maturity assessments based on established frameworks are crucial for businesses of all sizes to enhance their security posture and resilience.

---

Kimsuky Exploits ScreenConnect Bugs, Drops ToddlerShark

The North Korea-based Kimsuky APT is abusing ScreenConnect bugs, CVE-2024-1708 and CVE-2024-1709, to propagate a new malware called ToddleShark. ToddlerShark uses polymorphic traits, legitimate Microsoft binaries, and registry modifications to establish persistence and gather sensitive information from infected devices.  With a concerted effort to prioritize security updates, organizations can safeguard their systems and data against cyberattacks.

---

Ex-Google Engineer Arrested for Stealing AI Technology Secrets for China

The U.S. Department of Justice (DoJ) announced the indictment of a 38-year-old Chinese national and a California resident of allegedly stealing proprietary information from Google while covertly working for two China-based tech companies. Linwei Ding (aka Leon Ding), a former Google engineer who was arrested on March 6, 2024, "transferred sensitive Google trade secrets and other confidential

---

Update: Europol, DOJ, NCA Deny Involvement in Recent ALPHV/BlackCat ‘Shutdown’

The incident highlights the common occurrence of theft and exit scams within criminal ransomware organizations, and experts anticipate the group's return under a new identity after their hiatus.

---

Update: CMS Rolls Out Provider Flexibilities Amid Fallout From Change Healthcare Cyberattack

Provider groups, such as the American Hospital Association and the American Medical Association, are urging the government to provide further financial assistance, particularly for smaller practices, in response to the cyberattack's impact.

---

US Government Sanctions Intellexa Consortium Individuals and Entities Behind Predator Spyware Attacks

The U.S. government sanctioned individuals and entities linked to the development and distribution of the Predator spyware, which was used to target Americans and U.S. government officials.

---

Hackers Abuse QEMU to Covertly Tunnel Network Traffic in Cyberattacks

Threat actors used the open-source hypervisor QEMU as a network tunneling tool to create a covert communication channel, demonstrating the diverse methods attackers use to remain stealthy.

---

CISA Adds Android Pixel and Sunhillo SureLine Bugs to its Known Exploited Vulnerabilities Catalog

The CISA added Android Pixel and Sunhillo SureLine vulnerabilities to its Known Exploited Vulnerabilities catalog, with the potential for local information disclosure and OS command injection.

---

TA4903 Threat Actor Spoofs U.S. Government, Small Businesses in Phishing, BEC Bids

The actor uses tactics such as spoofing government agencies, incorporating QR codes in phishing campaigns, and adopting new themes to lure victims into credential phishing and BEC activities.

---

New Python-Based Snake Info Stealer Spreading Through Facebook Messages

Facebook messages are being used by threat actors to a Python-based information stealer dubbed Snake that’s designed to capture credentials and other sensitive data. “The credentials harvested from unsuspecting users are transmitted to different platforms such as Discord, GitHub, and Telegram,” Cybereason researcher Kotaro Ogino said in a technical report. Details about the campaign&

---

Watch Out for Spoofed Zoom, Skype, Google Meet Sites Delivering Malware

Threat actors have been leveraging fake websites advertising popular video conferencing software such as Google Meet, Skype, and Zoom to deliver a variety of malware targeting both Android and Windows users since December 2023. “The threat actor is distributing Remote Access Trojans (RATs) including SpyNote RAT for Android platforms, and NjRAT and DCRat for Windows

---

Insider-driven data loss incidents cost an average of $15 million

Data loss caused by insider events costs an average of $15 million, highlighting the importance of information protection.