Latest Cybersecurity News and Articles

---

Turla APT Spies on Polish NGOs Using TinyTurla Next Generation Backdoor

The TinyTurla-NG backdoor uses compromised WordPress websites as command and control endpoints and deploys PowerShell scripts to exfiltrate key material used to secure password databases, indicating a concerted effort to steal login credentials.

---

Middle East & Africa CISOs Plan to Increase 2024 Budgets by 10%

Cybersecurity spending in the Middle East, Turkey, and Africa is projected to exceed $6.5 billion in 2024 according to IDC, driven by increased cybercrime, regulatory enforcement, and government initiatives for improved cybersecurity.

---

Unprotected Cloud Database Exposed Over 384 Million Records Including Sensitive Logs and Customer Data

A massive database leak from Zenlayer, a global network service provider, exposed 384,658,212 records, including sensitive customer data and internal operations logs, without basic password protection.

---

Bumblebee Resurfaces in a New Campaign

Bumblebee returned after a four-month hiatus, employing social engineering tactics, sending emails with OneDrive URLs posing as voicemail notifications. The campaign stands out due to its utilization of VBA macro-enabled documents as most threat actors have nearly stopped using them after Microsoft began blocking macros by default. Protect your system by taking the right measures.

---

Why We Must Democratize Cybersecurity

With breaches making the headlines on an almost weekly basis, the cybersecurity challenges we face are becoming visible not only to large enterprises, who have built security capabilities over the years, but also to small to medium businesses and the broader public. While this is creating greater awareness among smaller businesses of the need to improve their security posture, SMBs are often

---

Malicious 'SNS Sender' Script Abuses AWS for Bulk Smishing Attacks

A malicious Python script known as SNS Sender is being advertised as a way for threat actors to send bulk smishing messages by abusing Amazon Web Services (AWS) Simple Notification Service (SNS). The SMS phishing messages are designed to propagate malicious links that are designed to capture victims' personally identifiable information (PII) and payment card details, SentinelOne 

---

We Can’t Risk Losing Staff to Alert Fatigue

When important cybersecurity information is buried in inconsequential noise, the results can be dire. Cybersecurity teams need to prioritize their resources and focus on the areas where they are at the most risk.

---

AWS SNS Hijackings Fuel Cloud Smishing Campaign

Threat actors are using AWS SNS and a custom bulk-messaging script called SNS Sender to carry out a smishing campaign impersonating the US Postal Service, posing significant risks to businesses' cloud instances.

---

Critical Software Vulnerabilities Impacting Credit Unions Discovered

Organizations using versions prior to v7.75 of the web application are urged to upgrade, and all organizations using this CMS should enable multi-factor authentication immediately to prevent potential breaches.

---

White House’s Neuberger: Pace of Ransomware Takedown Operations Isn’t Enough

The White House deputy national security advisor for cyber and emerging technologies, Anne Neuberger, spoke at the Munich Cyber Security Conference about the global efforts to combat ransomware attacks.

---

“TicTacToe Dropper” Malware Distribution Tactics Revealed

The dropper is typically distributed through phishing emails containing .iso file attachments, aiming to evade antivirus detection, and utilize intricate obfuscation techniques to cloak the malicious intent of the payloads.

---

The Hidden Dangers Within Ubuntu's Package Suggestion System

The interaction between Ubuntu’s command-not-found package and the snap package repository poses a significant security risk, potentially leading to the recommendation of malicious packages to users.

---

US Disrupts Russian Military Intelligence Botnet

U.S. law enforcement disrupted a criminal botnet, "Moobot," which Russian military hackers had repurposed for global cyberespionage, leading to the FBI obtaining a warrant to modify infected routers and shut down the botnet.

---

U.S. State Government Network Breached via Former Employee's Account

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has revealed that an unnamed state government organization's network environment was compromised via an administrator account belonging to a former employee. "This allowed the threat actor to successfully authenticate to an internal virtual private network (VPN) access point," the agency said in a joint advisory published

---

Newly Emerged JKwerlo Ransomware Targets Victims in France and Spain

JKwerlo's utilization of lateral movement techniques and exploitation of legitimate services like Dropbox and GitHub highlight its capability to spread across networks and evade traditional security measures.

---

Cyware and GreyNoise's Webinar Shows How Threat Intelligence Enables Efficient Detection and Prioritization to Save Time

This joint webinar by Cyware and GreyNoise aims to demonstrate how organizations can save time and money in cybersecurity by understanding the nature of threats in their security environments by effectively utilizing threat intelligence.

---

U.S. Government Disrupts Russian-Linked Botnet Engaged in Cyber Espionage

The U.S. government on Thursday said it disrupted a botnet comprising hundreds of small office and home office (SOHO) routers in the country that was put to use by the Russia-linked APT28 actor to conceal its malicious activities. "These crimes included vast spear-phishing and similar credential harvesting campaigns against targets of intelligence interest to the Russian government, such as U.S.

---

Research shows that 15% of emails were malicious in 2023

The malicious email trends seen in 2023 are expected to influence the threats security leaders will see in 2024. 

---

U.S. Internet Corp. Leaked Years of Internal, Customer Emails

U.S. Internet Corp.'s subsidiary, Securence, inadvertently exposed over a decade's worth of internal and client emails, including those of government institutions, due to a misconfigured server, raising serious security concerns.

---

North Korean Hackers Target South Korean President's Office

South Korea has accused North Korean hackers of breaching an administrator's email account in the Office of the President to access information about the president's communications and overseas trips.