Latest Cybersecurity News and Articles

---

Ukrainian Energy Giant, Postal Service, Transportation Agencies Hit by Cyberattacks

The attacks on transportation, postal services, and energy companies in Ukraine may be part of a larger cyber war between Ukraine and Russia, with previous attacks on telecom and banking sectors.

---

LODEINFO Fileless Malware Evolves with Anti-Analysis and Remote Code Tricks

The malware has evolved with new features and anti-analysis techniques. It is linked to a Chinese nation-state actor known as Stone Panda and has been used in attacks targeting Japanese political establishments.

---

Perfecting the Defense-in-Depth Strategy with Automation

Medieval castles stood as impregnable fortresses for centuries, thanks to their meticulous design. Fast forward to the digital age, and this medieval wisdom still echoes in cybersecurity. Like castles with strategic layouts to withstand attacks, the Defense-in-Depth strategy is the modern counterpart — a multi-layered approach with strategic redundancy and a blend of passive and active security

---

Local Governments in Colorado, Pennsylvania, and Missouri Dealing with Ransomware Incidents

The cyber incidents have affected emergency communication systems, court services, public transit agencies, and library operations, prompting responses from state and federal agencies as well as cybersecurity professionals.

---

US Regulators Have Done Little to Address Firmware Vulnerabilities, Think Tank Argues

Firmware connects the hardware and software of a device, but efforts to protect it have been absent in many of the government’s recent cybersecurity initiatives, according to a new report by the Foundation for Defense of Democracies.

---

Malicious Ads on Google Target Chinese Users with Fake Messaging Apps

Chinese-speaking users have been targeted by malicious Google ads for restricted messaging apps like Telegram as part of an ongoing malvertising campaign. "The threat actor is abusing Google advertiser accounts to create malicious ads and pointing them to pages where unsuspecting users will download Remote Administration Trojan (RATs) instead," Malwarebytes' Jérôme Segura said in a

---

Watching the Watchdog: Learning from HHS' Grant Payment Mess

The U.S. Department of Health and Human Services (HHS) lost $7.5 million in a cyberattack last year, leading to speculation about the hacking methods used. The incident was not publicly disclosed by HHS.

---

UK Mulls Rollout of New Software Vulnerability Rules

The U.K. government is considering implementing voluntary rules for software vendors to disclose vulnerabilities in their systems. This initiative follows successful hacks targeting the country's infrastructure.

---

Tesla Hacked, 24 Zero-Days Demoed at Pwn2Own Automotive 2024

The Synacktiv Team earned $100,000 for chaining three zero-day bugs to gain root permissions on a Tesla Modem and an additional $120,000 for hacking other EV charging stations.

---

SystemBC Malware's C2 Server Analysis Exposes Payload Delivery Tricks

SystemBC malware allows threat actors to control compromised hosts, deliver additional payloads, and use SOCKS5 proxies to mask network traffic to and from the command-and-control (C2) infrastructure.

---

Stolen Crypto Falls in 2023, but Hacking Remains a Threat

The total value stolen from DeFi protocols decreased significantly in 2023, marking a 63.7% drop compared to the previous year, despite an increase in the number of individual hacking incidents.

---

Microsoft Warns of Widening APT29 Espionage Attacks Targeting Global Orgs

Microsoft on Thursday said the Russian state-sponsored threat actors responsible for a cyber attack on its systems in late November 2023 have been targeting other organizations and that it's currently beginning to notify them. The development comes a day after Hewlett Packard Enterprise (HPE) revealed that it had been the victim of an attack perpetrated by a hacking crew

---

Russian TrickBot Mastermind Gets 5-Year Prison Sentence for Cybercrime Spree

40-year-old Russian national Vladimir Dunaev has been sentenced to five years and four months in prison for his role in creating and distributing the TrickBot malware, the U.S. Department of Justice (DoJ) said. The development comes nearly two months after Dunaev pleaded guilty to committing computer fraud and identity theft and conspiracy to commit wire fraud and bank fraud. "

---

Critical Cisco Flaw Lets Hackers Remotely Take Over Unified Comms Systems

Cisco has released patches to address a critical security flaw impacting Unified Communications and Contact Center Solutions products that could permit an unauthenticated, remote attacker to execute arbitrary code on an affected device. Tracked as CVE-2024-20253 (CVSS score: 9.9), the issue stems from improper processing of user-provided data that a threat actor could abuse to send a

---

Top cybersecurity conferences in 2024

Cybersecurity conferences provide security leaders around the world with an opportunity to connect with one another, from students to executives.

---

Using Google Search to Find Software Can Be Risky

Google continues to struggle with cybercriminals running malicious ads on its search platform to trick people into downloading booby-trapped copies of popular free software applications. The malicious ads, which appear above organic search results and often precede links to legitimate sources of the same software, can make searching for software on Google a dicey affair.

---

US suffered cyberattacks from 168 threat actors in 2023

Critical infrastructure attacks were analyzed in a recent report. The report found more than 420 million attacks between January and December 2023.

---

Cybercrime Researcher Examines the Ransomware Victim’s Mindset

The study by a cybercrime researcher at the University of Twente analyzed ransomware attacks in the Netherlands from 2019-2022, finding that companies working with incident response firms were most likely to pay ransoms.

---

Major IT Outage Denies Happy Campers Their Caravan Holidays

Members have expressed concern over potential data compromise and lack of communication from CAMC about the nature of the problem, leading to speculation about a ransomware-related security breach.

---

Apple Debuts New Feature to Frustrate iPhone Thieves

A new iOS 17 update brings Stolen Device Protection feature to prevent unauthorized access and actions on stolen iPhones. Thieves will have limited access to sensitive information and actions, requiring additional authentication for critical changes.