Latest Cybersecurity News and Articles

---

UAC-0184 Targets Ukrainian Entity in Finland with Remcos RAT

Morphisec found that the UAC-0184 threat actor used steganography to deliver the Remcos RAT via the IDAT Loader, targeting a Ukrainian entity in Finland. The incident comes a few weeks after ASEC discovered that Remcos RAT is being distributed disguised as adult games through webhards. Researchers highlight that organizations must deploy behavioral-based endpoint protection solutions as an additional layer of security to thwart such attacks.

---

Cybersecurity Agencies Warn Ubiquiti EdgeRouter Users of APT28's MooBot Threat

In a new joint advisory, cybersecurity and intelligence agencies from the U.S. and other countries are urging users of Ubiquiti EdgeRouter to take protective measures, weeks after a botnet comprising infected routers was felled by law enforcement as part of an operation codenamed Dying Ember. The botnet, named MooBot, is said to have been used by a Russia-linked threat actor known as

---

The rising threat of zero-day attacks

How can security leaders prepare themselves for the unexpected? Answer this question and more on this episode of The Security Podcasts.

---

Open-Source Xeno RAT Trojan Emerges as a Potent Threat on GitHub

The multi-stage dissemination of Xeno RAT via Discord CDN demonstrates the use of deceptive tactics such as disguised shortcut files to deliver and execute the open-source malware.

---

Around 50% of IT leaders believe IoT security is their weakest point

A recent survey has revealed that less than half of IT leaders are assured in their IoT security plans. 

---

Update: LoanDepot Says About 17M Customers Had Personal Data and SSNs Stolen During Cyberattack

The cyberattack left LoanDepot's customers unable to make payments or access their online accounts, and the company expects the incident to impact its fiscal first quarter earnings by $12 to $17 million.

---

FTC bans Avast from selling browser data

The Federal Trade Commission (FTC) has banned software company Avast from selling or licensing web browsing data for advertising purposes. 

---

New Hugging Face Vulnerability Exposes AI Models to Supply Chain Attacks

Cybersecurity researchers discovered a vulnerability in the Hugging Face Safetensors conversion service that could be exploited by attackers to compromise machine learning models submitted by users, leading to supply chain attacks.

---

Zyxel Issues Security Advisory for Multiple Vulnerabilities in Firewalls and APs

Zyxel has identified and patched four critical vulnerabilities in its firewall and access point products, including flaws that could lead to remote code execution and denial-of-service attacks.

---

The average open source vulnerability is 2.5 years old

According to a report, nearly 75% of commercial codebases assessed for risk contain open source components impacted by high-risk vulnerabilities.

---

Pikabot Returns With New Tricks up Its Sleeve

The new version of Pikabot features simpler encryption algorithms, anti-debugging methods, and plaintext bot configuration, indicating a new codebase with potential future improvements.

---

WordPress LiteSpeed Plugin Vulnerability Puts 5 Million Sites at Risk

A security vulnerability has been disclosed in the LiteSpeed Cache plugin for WordPress that could enable unauthenticated users to escalate their privileges. Tracked as CVE-2023-40000, the vulnerability was addressed in October 2023 in version 5.7.0.1. "This plugin suffers from unauthenticated site-wide stored [cross-site scripting] vulnerability and could allow any unauthenticated user

---

Russian Hacker Set to Face Trial for the Hack of a Local Power Grid

A 49-year-old Russian national has been charged with carrying out a cyberattack on a local power plant, resulting in a widespread blackout in 38 villages in the Vologda region.

---

Russian SVR-Linked APT29 Threat Actors Adapt Their Tactics for Initial Cloud Access

The Russian Foreign Intelligence Service (SVR) cyber actors, also known as APT29 or Cozy Bear, have shifted their tactics to target cloud environments as organizations increasingly move to cloud-based infrastructure.

---

VEC and BEC attacks rise in the energy and infrastructure industry

New information shows that the energy and infrastructure industry is experiencing more cyberattacks utilizing social engineering tactics. 

---

UK: Privacy Watchdog Cracks Down on Biometric Employee Tracking

The British privacy watchdog has ordered a leisure center contractor, Serco Leisure, to stop using facial recognition and fingerprint scanning to track employees at 38 leisure facilities.

---

Steel Production Giant ThyssenKrupp Confirms Cyberattack on Automotive Division

ThyssenKrupp, a major steel producer and industrial engineering firm, experienced a cyberattack on its Automotive division, leading to a forced shutdown of IT systems as part of the response and containment measures.

---

Open-Source Xeno RAT Trojan Emerges as a Potent Threat on GitHub

An "intricately designed" remote access trojan (RAT) called Xeno RAT has been made available on GitHub, making it available to other actors at no extra cost. Written in C# and compatible with Windows 10 and Windows 11 operating systems, the open-source RAT comes with a "comprehensive set of features for remote system management," according to its developer, who goes by the name moom825

---

Cybersecurity Crisis in Schools

The education sector faces significant cybersecurity risks due to factors such as BYOD culture, vast student data troves, and resource scarcity, making strong cybersecurity measures crucial.

---

NIST Releases Version 2.0 of Landmark Cybersecurity Framework

NIST has updated the Cybersecurity Framework (CSF) to include quick-start guides, success stories, and a searchable catalog of references, making it more accessible and actionable for a wider range of organizations and sectors.