Latest Cybersecurity News and Articles

---

Critical Vulnerability in Mastodon Sparks Patching Frenzy

Mastodon users and administrators need to upgrade to the latest version to patch a critical vulnerability (CVE-2024-23832) that allows attackers to take over accounts remotely.

---

macOS Malware Campaign Showcases Novel Delivery Technique

The backdoor, called Activator, employs a unique delivery method that backdoors the victim during the installation process, making it challenging to remove the infection even if the cracked software is removed.

---

Mastodon Vulnerability Allows Hackers to Hijack Any Decentralized Account

The decentralized social network Mastodon has disclosed a critical security flaw that enables malicious actors to impersonate and take over any account. "Due to insufficient origin validation in all Mastodon, attackers can impersonate and take over any remote account," the maintainers said in a terse advisory. The vulnerability, tracked as CVE-2024-23832, has a severity rating of 9.4 out of

---

AnyDesk Says Hackers Breached its Production Servers, Reset Passwords

The attackers stole source code and code signing certificates. AnyDesk responded by revoking security certificates, replacing systems, and reassuring customers that it is safe to use the software.

---

Fake Voicemail as Credential Harvesting Lure

The attackers disguise the email to appear as if it's from a legitimate brand, using social engineering techniques to lure recipients into clicking on what seems to be an embedded voicemail but is actually a credential harvesting page.

---

AnyDesk Hacked: Popular Remote Desktop Software Mandates Password Reset

Remote desktop software maker AnyDesk disclosed on Friday that it suffered a cyber attack that led to a compromise of its production systems. The German company said the incident, which it discovered following a security audit, is not a ransomware attack and that it has notified relevant authorities. "We have revoked all security-related certificates and systems have been remediated or replaced

---

Uber Fined Nearly $11 Million by Dutch Data Regulator

The regulatory fine resulted from complaints by French Uber drivers and a Paris-based civil society organization, highlighting the significance of user rights and privacy concerns.

---

Payment Fraud is Hitting Organizations Harder Than Ever Before

According to Trustpair, 96% of US companies experienced at least one fraud attempt in the past year, with 83% seeing an increase in cyber fraud. Fraudsters used various tactics such as text messages, fake websites, and CEO/CFO impersonations.

---

Man Sentenced to Six Years in Prison for Stealing Millions in Cryptocurrency via SIM Swapping

A 22-year-old man from the US, Daniel James Junk, has been sentenced to 72 months in federal prison for his involvement in a fraudulent scheme that led to the theft of millions of dollars through SIM swapping.

---

US Senate Panel Hears Plea for Action on Bank Spoofing Scams

A top U.S. banking lobbyist told a Senate panel Thursday there are limits to what financial institutions can do to stop scammers from draining individual banking accounts and called on regulators like the FCC to do more to combat caller ID spoofing.

---

State Privacy Laws Have Been Crippled by Big Tech, New Report Says

The report, conducted by the Electronic Privacy Information Center and U.S. PIRG Education Fund, highlights the lack of strong enforcement provisions, transparency, and individual data rights in these laws.

---

CVEMap: Open-Source Tool to Query, Browse and Search CVEs

The tool leverages various valuable sources, such as the CISA's Known Exploited Vulnerabilities Catalog, Exploit Prediction Scoring System (EPSS), HackerOne CVE Discovery, and others, to provide comprehensive insights into vulnerabilities.

---

Interpol Arrests More Than 30 Cybercriminals in Global ‘Synergia’ Operation

International law enforcement, with the help of 60 agencies and private companies, detained 31 suspected cybercriminals and identified 1,300 malicious servers used for phishing and malware distribution.

---

Florida Teen Faces Federal Charges in $800,000 Crypto Theft

A 19-year-old Florida teenager, Noah Michael Urban, has been charged with 14 criminal counts, including wire fraud and aggravated identity theft, for his involvement in a cryptocurrency theft scam using SIM swapping.

---

Russian APT28 Hackers Targeting High-Value Orgs with NTLM Relay Attacks

Russian state-sponsored actors have staged NT LAN Manager (NTLM) v2 hash relay attacks through various methods from April 2022 to November 2023, targeting high-value targets worldwide. The attacks, attributed to an "aggressive" hacking crew called APT28, have set their eyes on organizations dealing with foreign affairs, energy, defense, and transportation, as well as those involved with

---

White House Rejects Efforts to Undo SEC Cyber Disclosure Rule

The Biden administration opposes a congressional effort to undo the SEC's cybersecurity incident disclosure rule, citing the need for transparency to combat increasing cyberattacks.

---

Zero Trust Implementation: Plan, Then Execute, One Step at a Time

To overcome roadblocks, organizations should prioritize sensitive data, enforce strict authentication and authorization, implement micro-segmentation, and ensure employee awareness of security best practices.

---

DirtyMoe Malware Infects 2,000+ Ukrainian Computers for DDoS and Cryptojacking

The Computer Emergency Response Team of Ukraine (CERT-UA) has warned that more than 2,000 computers in the country have been infected by a strain of malware called DirtyMoe. The agency attributed the campaign to a threat actor it calls UAC-0027. DirtyMoe, active since at least 2016, is capable of carrying out cryptojacking and distributed denial-of-service (DDoS) attacks. In March

---

How 2023 Broke Long-Running Records for Health Data Breaches

The healthcare sector experienced a record-breaking number of major data breaches in 2023, affecting over 135 million individuals, highlighting the urgent need for enhanced cybersecurity measures.

---

FritzFrog Botnet is Exploiting Log4Shell Bug Now, Experts Say

The botnet's shift to targeting vulnerable Java applications in a campaign called "Frog4Shell" poses a significant risk to internal machines that may have been neglected and remained unpatched.