Latest Cybersecurity News and Articles

---

AI-Generated Code Leads to Security Issues for Most Businesses: Report

According to a survey by Snyk, over three-quarters of developers are bypassing established protocols to use AI-powered code completion tools, raising concerns about security implications.

---

‘Tis the Season for Tax Hax

TA576, a cybercriminal threat actor, has returned with tax-themed lures targeting accounting and finance organizations during the U.S. tax season, using unique attack chains and delivering Parallax RAT.

---

Phobos Ransomware Expands with New FAUST Variant

FortiGuard Labs exposed a fresh attack vector involving the FAUST ransomware, a Phobos variant. The attackers employed a Visual Basic script in an Office document to propagate FAUST. They utilized the Gitea service to store encoded files. The ransomware employs advanced evasion tactics, adds persistence, and carries an exclusion list. 

---

CISA Warns of Active Exploitation of Critical Vulnerability in iOS, iPadOS, and macOS

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a high-severity flaw impacting iOS, iPadOS, macOS, tvOS, and watchOS to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation. The vulnerability, tracked as CVE-2022-48618 (CVSS score: 7.8), concerns a bug in the kernel component. "An attacker with

---

Football Australia data leak exposes players’ contracts, fans’ personal details

Australian players, every fan and FA customer potentially affectedCybersecurity breach has been traced back to early 2022Passports, player contracts and more have been available online for almost two years due to a Football Australia (FA) data breach which cyber security researchers say includes information on every Australian fan and customer of the governing body.Lithuanian group Cybernews detected the leak and informed the FA, allowing football officials to plug the hole before the issue was made public on Thursday morning. Continue reading...

---

79% of organizations faced a ransomware attack in H2 2023

According to a recent report, 79% of respondents said their company had been the ‘victim of a ransomware attack’ between June and December 2023.

---

RunC Flaws Enable Container Escapes, Granting Attackers Host Access

Multiple security vulnerabilities have been disclosed in the runC command line tool that could be exploited by threat actors to escape the bounds of the container and stage follow-on attacks. The vulnerabilities, tracked as CVE-2024-21626, CVE-2024-23651, CVE-2024-23652, and CVE-2024-23653, have been collectively dubbed Leaky Vessels by cybersecurity vendor Snyk. "These container

---

Pawn Storm Uses Brute Force and Stealth Against High-Value Targets

Pawn Storm, aka APT28 and Forest Blizzard, has been employing anonymization layers, such as VPN services and compromised EdgeOS routers, to hide its tracks and carry out sophisticated attacks.

---

Italian Businesses Hit by Weaponized USB Devices Spreading Cryptojacking Malware

The threat actor deploys the EMPTYSPACE downloader and the QUIETBOARD backdoor to execute commands, alter crypto wallet addresses, take screenshots, and propagate the malware.

---

New Evasive Large-Scale Scareware and PUP Delivery Campaign Spotted

Unit 42 researchers discovered a large-scale campaign dubbed ApateWeb, which uses over 130,000 domains to distribute scareware, potentially unwanted programs (PUPs), and other scam pages.

---

Data Leak at Fintech Giant Direct Trading Technologies

The leaked information included names, email addresses, trading activity, passwords, and other personal details. Additionally, the company's outreach team's internal comments were exposed.

---

Security leaders share thoughts on Schneider Electric ransomware attack

Security leaders share their thoughts on the recent Schneider Electric ransomware attack and how other organizations can protect themselves.

---

Avoiding offboarding red flags

Yoav Kalati, VP Product at Wing Security, discusses the security challenges and red flags organizations face when it comes to offboarding employees.

---

Alert: Ivanti Discloses 2 New Zero-Day Flaws, One Under Active Exploitation

Ivanti is alerting of two new high-severity flaws in its Connect Secure and Policy Secure products, one of which is said to have come under targeted exploitation in the wild. The list of vulnerabilities is as follows - CVE-2024-21888 (CVSS score: 8.8) - A privilege escalation vulnerability in the web component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows

---

Microsoft Teams Phishing Attack Pushes DarkGate Malware via Group Chats

The attackers exploit default settings in Teams to send over 1,000 malicious chat invites. Once the attachment is downloaded, the malware connects to a command-and-control server.

---

Telegram Marketplaces Fuel Phishing Attacks with Easy-to-Use Kits and Malware

Cybersecurity researchers are calling attention to the "democratization" of the phishing ecosystem owing to the emergence of Telegram as an epicenter for cybercrime, enabling threat actors to mount a mass attack for as little as $230. "This messaging app has transformed into a bustling hub where seasoned cybercriminals and newcomers alike exchange illicit tools and insights creating a dark and

---

Vulnerabilities in Lamassu Bitcoin ATMs

The attack, IOActive explains, was possible due to a vulnerability in the ATM’s software update mechanism that could allow an attacker to supply their own malicious file and trigger legitimate processes for code execution.

---

Rust Payloads Exploiting Ivanti Zero-Days Linked to Sliver Toolkit

The KrustyLoader malware, identified in the analysis, is designed to download and execute a Sliver backdoor written in GoLang, indicating APT-level sophistication in these attacks.

---

Great Security or Great UX? Both, Please

Security step-ups should only be used for higher-risk scenarios and should be implemented in a user-friendly manner to maintain a balance between security and user experience.

---

Italian Businesses Hit by Weaponized USBs Spreading Cryptojacking Malware

A financially motivated threat actor known as UNC4990 is leveraging weaponized USB devices as an initial infection vector to target organizations in Italy. Google-owned Mandiant said the attacks single out multiple industries, including health, transportation, construction, and logistics. "UNC4990 operations generally involve widespread USB infection followed by the deployment of the