Latest Cybersecurity News and Articles

---

Cactus Ransomware Gang Claims the Theft of 1.5TB of Data From Schneider Electric

The attack, which hit the Sustainability Business division on January 17th, caused outages in Schneider Electric’s Resource Advisor cloud platform. The gang published 25MB of stolen data as proof of the hack.

---

New Report Reveals North Korean Hackers Targeting Defense Firms Worldwide

The North Korean state-sponsored threat actors have been attributed to a cyber espionage campaign targeting the defense sector across the world. In a joint advisory published by Germany's Federal Office for the Protection of the Constitution (BfV) and South Korea's National Intelligence Service (NIS), the agencies said the goal of the attacks is to plunder advanced defense technologies in a "

---

Learn How to Build an Incident Response Playbook Against Scattered Spider in Real-Time

In the tumultuous landscape of cybersecurity, the year 2023 left an indelible mark with the brazen exploits of the Scattered Spider threat group. Their attacks targeted the nerve centers of major financial and insurance institutions, culminating in what stands as one of the most impactful ransomware assaults in recent memory.  When organizations have no response plan in place for such an

---

SaaS Compliance through the NIST Cybersecurity Framework

The US National Institute of Standards and Technology (NIST) cybersecurity framework is one of the world's most important guidelines for securing networks. It can be applied to any number of applications, including SaaS.  One of the challenges facing those tasked with securing SaaS applications is the different settings found in each application. It makes it difficult to develop a

---

Critical Flaws Found in ConnectWise ScreenConnect Software - Patch Now

ConnectWise has released software updates to address two security flaws in its ScreenConnect remote desktop and access software, including a critical bug that could enable remote code execution on affected systems. The vulnerabilities, which currently lack CVE identifiers, are listed below - Authentication bypass using an alternate path or channel (CVSS score: 10.0) Improper limitation of

---

Google Open Sources Magika: AI-Powered File Identification Tool

Magika outperforms conventional methods and is used to enhance user safety in Gmail, Drive, and Safe Browsing. Google emphasizes the use of AI to strengthen digital security and shift the balance in favor of defenders in cybersecurity.

---

Meta Warns of 8 Spyware Firms Targeting iOS, Android, and Windows Devices

The surveillance industry continues to evolve, with recent discoveries of new surveillance tools like Patternz and a previously unknown mobile network attack called MMS Fingerprint, raising concerns about privacy and security.

---

Newly Discovered RustDoor Malware Impersonates Visual Studio Update

A new macOS malware dubbed RustDoor, written in Rust, is being distributed disguised as a Visual Studio update. The malware provides backdoor access to compromised systems and is linked to infrastructure associated with the BlackCat ransomware gang. Researchers have shared a list of known IOCs associated with RustDoor, which includes binaries, download domains, and URLs.

---

WordPress Bricks Theme Under Active Attack: Critical Flaw Impacts 25,000+ Sites

A critical security flaw in the Bricks theme for WordPress is being actively exploited by threat actors to run arbitrary PHP code on susceptible installations. The flaw, tracked as CVE-2024-25600 (CVSS score: 9.8), enables unauthenticated attackers to achieve remote code execution. It impacts all versions of the Bricks up to and including 1.9.6. It has been addressed by the theme developers in&

---

New 'MMS Fingerprinting' Zero-Click Attack Used to Deploy Spyware

The "MMS Fingerprint" technique leverages the MMS flow to retrieve user device information, which could be used to tailor malicious payloads like Pegasus spyware or craft more effective phishing campaigns.

---

‘M.O.R.E’ Ransomware Emerges on the Dark Web; Threatens Windows, Mac, Linux Users

Multi-OS Ransomware Executable (M.O.R.E) represents a new breed of ransomware that can target multiple operating systems simultaneously, posing a significant threat to cybersecurity.

---

Iran and Hezbollah Hackers Launch Attacks to Influence Israel-Hamas Narrative

Hackers backed by Iran and Hezbollah staged cyber attacks designed to undercut public support for the Israel-Hamas war after October 2023. This includes destructive attacks against key Israeli organizations, hack-and-leak operations targeting entities in Israel and the U.S., phishing campaigns designed to steal intelligence, and information operations to turn public opinion against Israel. Iran

---

LockBit Ransomware's Darknet Domains Seized in Global Law Enforcement Raid

An international law enforcement operation has led to the seizure of multiple darknet domains operated by LockBit, one of the most prolific ransomware groups, marking the latest in a long list of digital takedowns. While the full extent of the effort, codenamed Operation Cronos, is presently unknown, visiting the group's .onion website displays a seizure banner containing the message "

---

Prolific cybercrime gang disrupted by joint UK, US and EU operation

LockBit’s website under control of security agencies from both sides of Atlantic, according to postLockBit, a notorious cybercrime gang that holds its victims’ data to ransom, has been disrupted in a rare international law enforcement operation by Britain’s National Crime Agency, the FBI, Europol and a coalition of international police agencies, according to a post on the gang’s extortion website.“This site is now under the control of the National Crime Agency of the UK, working in close cooperation with the FBI and the international law enforcement taskforce ‘Operation Cronos’,” the post said on Monday. Continue reading...

---

New Google Chrome Feature Blocks Attacks Against Home Networks

Google is testing a new feature called "Private Network Access protections" in Chrome 123 to prevent malicious websites from attacking devices and services on a user's private network.

---

Gmail & Yahoo DMARC Rollout: When Cyber Compliance Gives a Competitive Edge

DMARC compliance offers businesses a competitive advantage through improved email deliverability and enhanced security posture, leading to better engagement rates and revenue growth.

---

Anatsa Android Trojan Bypasses Google Play Security, Expands Reach to New Countries

The Android banking trojan Anatsa has expanded its reach to include Slovakia, Slovenia, and Czechia, demonstrating the capability to bypass restricted settings for accessibility service in Android 13.

---

PDF Malware on the Rise, Used to Spread WikiLoader, Ursnif, and DarkGate

Cybercriminals are using ad tools to track and optimize their malware campaigns, making their lures more convincing and increasing the likelihood of users falling victim to the attacks.

---

The Department of State offers $10M for information on ALPHV/Blackcat

Anyone who can provide information regarding key members or conspirators of ALPHV/Blackcat may be offered a monetary reward. 

---

Japan Sees Increased Cyberthreats to Critical Infrastructure, Particularly From China

Recent cyberattacks on Japanese entities, such as the Ministry of Foreign Affairs and aerospace agency JAXA, underscore the persistent threat posed by Chinese hackers to Japan's security and economy.