Latest Cybersecurity News and Articles

---

Report: 69% of Organizations Infected by Ransomware in 2023

Per a Proofpoint report, over two-thirds of organizations experienced a successful ransomware incident in the past year, with close to 60% reporting four or more separate ransomware incidents.

---

Ukraine Expects Billion-Dollar Russian Disinformation Campaign to Peak This Spring

Ukraine's military intelligence has reported that Russia has invested over $1 billion in a disinformation campaign called "Maidan-3" aimed at diminishing Western support for Kyiv and sowing distrust among Ukrainian citizens.

---

FTC’s Khan Warns Tech Industry That Agency Will Strictly Enforce AI Data Privacy

The FTC's aggressive approach to enforcing privacy regulations reflects a commitment to ensuring that AI model refinement does not compromise people's privacy or security.

---

New Backdoor Targeting European Officials Linked to Indian Diplomatic Events

A previously undocumented threat actor dubbed SPIKEDWINE has been observed targeting officials in European countries with Indian diplomatic missions using a new backdoor called WINELOADER. The adversary, according to a report from Zscaler ThreatLabz, used a PDF file in emails that purported to come from the Ambassador of India, inviting diplomatic staff to a wine-tasting

---

Lazarus Exploits Typos to Sneak PyPI Malware into Dev Systems

The notorious North Korean state-backed hacking group Lazarus uploaded four packages to the Python Package Index (PyPI) repository with the goal of infecting developer systems with malware. The packages, now taken down, are pycryptoenv, pycryptoconf, quasarlib, and swapmempool. They have been collectively downloaded 3,269 times, with pycryptoconf accounting for the most

---

Biden Executive Order Seeks to Cut China off From Americans’ Sensitive Data

The new executive order targets the unregulated data broker industry and prohibits the sale of genomic, biometric, health, geolocation, and financial data to the identified countries.

---

Report: Business Logic Abuse Dominates as API Attacks Surge

According to Imperva's State of API Security Report, attacks on the business logic of APIs, including credential stuffing and data scraping, account for the largest share (27%) of API attacks.

---

Researchers Say Iranian Hackers Targeting Israeli Defense Sector

The cybersecurity firm Mandiant has identified a suspected Iranian hacking group, UNC1549, targeting aerospace and defense industries across the Middle East, including in Israel and the United Arab Emirates.

---

Chinese Hackers Exploiting Ivanti VPN Flaws to Deploy New Malware

At least two different suspected China-linked cyber espionage clusters, tracked as UNC5325 and UNC3886, have been attributed to the exploitation of security flaws in Ivanti Connect Secure VPN appliances. UNC5325 abused CVE-2024-21893 to deliver a wide range of new malware called LITTLELAMB.WOOLTEA, PITSTOP, PITDOG, PITJET, and PITHOOK, as well as attempted to maintain

---

President Biden Blocks Mass Transfer of Personal Data to High-Risk Nations

U.S. President Joe Biden has issued an Executive Order that prohibits the mass transfer of citizens' personal data to countries of concern. The Executive Order also "provides safeguards around other activities that can give those countries access to Americans' sensitive data," the White House said in a statement. This includes sensitive information such as genomic data, biometric data,

---

CISA warns that malicious actors are targeting cloud infrastructure

Security experts weigh in on the CISA's advisory, which reveals that cyberattackers are adapting to the increased use of cloud infrastructure.

---

Update: Black Basta, Bl00dy Ransomware Gangs Join ScreenConnect Attacks

The Black Basta and Bl00dy ransomware gangs are exploiting a critical authentication bypass vulnerability (CVE-2024-1709) in unpatched ScreenConnect servers to gain admin access and deploy ransomware.

---

Calendar Meeting Links Used to Spread Mac Malware

Malicious hackers are targeting people in the cryptocurrency space in attacks that start with a link added to the target’s account at Calendly, a popular free calendar application for scheduling appointments and meetings. The attackers impersonate established cryptocurrency investors and ask to schedule a video conference call. But clicking the meeting link provided by the scammers prompts the user to run a script that quietly installs malware on macOS systems.

---

Update: Ransomware Gang Seeks $3.4 Million After Attacking Children’s Hospital

The hospital, which serves a large number of pediatric patients, is still providing care despite disruptions caused by the cyberattack. The ransomware group is attempting to sell stolen data from the hospital for 60 bitcoins.

---

Broken China? Separating fact from fiction

In episode 20 of The Cybersecurity and Geopolitical Discussion, our trio of hosts discuss how, from the outside, China appears very different. However, is this really the case?

---

47% of cloud storage billing is allocated to data and usage fees

Cloud storage was analyzed in a recent report finding that 93% of organizations plan to grow their public cloud storage capacity in 2024.

---

HSCC Issues Cyber 'Call to Action' Plan for Health Sector

The plan includes 12 measurable objectives, such as increasing cybersecurity practices, developing cross-sector risk management strategies, and implementing automation and emerging technologies.

---

Iran-Linked UNC1549 Hackers Target Middle East Aerospace & Defense Sectors

An Iran-nexus threat actor known as UNC1549 has been attributed with medium confidence to a new set of attacks targeting aerospace, aviation, and defense industries in the Middle East, including Israel and the U.A.E. Other targets of the cyber espionage activity likely include Turkey, India, and Albania, Google-owned Mandiant said in a new analysis. UNC1549 is said to overlap with 

---

Third-party attack vectors are responsible for 29% of breaches

A recent report reveals that third-party attack vectors are involved in at least 29% of breaches, emphasizing the importance of third-party risk management. 

---

LabHost Cybercrime Service Lets Anyone Phish Canadian Bank Users

LabHost offers three membership tiers targeting banks and online services, along with a real-time phishing management tool called LabRat that enables cybercriminals to steal 2FA protection.