Latest Cybersecurity News and Articles

---

Report: AI, Fake CFOs Drive Soaring Corporate Payment-Fraud Attacks

According to Trustpair, 96% of U.S. companies experienced at least one payment fraud attempt in the past year, with a 71% increase from the prior year, indicating a significant rise in fraudulent activities.

---

HHS Details New Cyber Performance Goals for Health Sector

The performance goals consist of essential and enhanced practices based on industry cybersecurity frameworks and aim to address common vulnerabilities and mature cybersecurity capabilities in the healthcare sector.

---

Netherlands-based Medical Lab Database Exposed 1.3 Million Records, COVID Test Information

A Netherlands-based medical laboratory's unsecured database exposed 1.3 million records, including COVID test results and personal identifiable information, due to a configuration issue and lack of response to responsible disclosure notices.

---

Report: Software Supply Chain Attacks Are Getting Easier

In 2023, ReversingLabs identified a significant increase in malicious packages across open-source software platforms like npm, PyPI, and RubyGems. The number of malicious packages detected increased by 1,300% from 2020 and 28% from 2022.

---

SystemBC Malware's C2 Server Analysis Exposes Payload Delivery Tricks

Cybersecurity researchers have shed light on the command-and-control (C2) server of a known malware family called SystemBC. "SystemBC can be purchased on underground marketplaces and is supplied in an archive containing the implant, a command-and-control (C2) server, and a web administration portal written in PHP," Kroll said in an analysis published last week. The risk and

---

Critical Jenkins Vulnerability Exposes Servers to RCE Attacks

The vulnerability, CVE-2024-23897, allows attackers to read arbitrary files on the Jenkins controller file system. This could potentially lead to various attacks, including remote code execution and decryption of stored secrets.

---

Federal Judge Rejects NSO’s Effort to Dismiss Apple’s Pegasus Lawsuit

Apple's lawsuit alleges that NSO Group facilitated hacking into Apple's servers, leading to significant time and expense for Apple in detecting and eradicating Pegasus from users' devices.

---

China-backed Hackers Hijack Software Updates to Implant NSPX30 Spyware

A new China-aligned threat actor named Blackwood has been identified, deploying a sophisticated implant named NSPX30 via the update mechanisms of legitimate software to target Chinese and Japanese companies and individuals.

---

Why Cyberattacks Mustn’t Be Kept Secret

Embracing a culture of cybersecurity transparency is beneficial for businesses and the broader security of the internet, as it strengthens external perception and leads to quicker and more resilient reactions to breaches.

---

Global Fintech Firm EquiLend Offline After Recent Cyberattack

The company is working to restore affected services and has hired third-party experts to investigate the security breach. It has not been disclosed if any data was exposed or stolen during the incident.

---

UK: NCSC Warns AI Will Cause Surge in Ransomware Volume and Impact

Ransomware attacks are expected to increase in volume and impact over the next two years due to advancements in artificial intelligence (AI) technologies, according to British intelligence.

---

Critical Jenkins Vulnerability Exposes Servers to RCE Attacks - Patch ASAP!

The maintainers of the open-source continuous integration/continuous delivery and deployment (CI/CD) automation software Jenkins have resolved nine security flaws, including a critical bug that, if successfully exploited, could result in remote code execution (RCE). The issue, assigned the CVE identifier CVE-2024-23897, has been described as an arbitrary file read vulnerability through the

---

Tech Giant HP Enterprise Hacked by Russian Hackers Linked to DNC Breach

Hackers linked to the Kremlin, specifically the Russian state-sponsored group APT29, infiltrated Hewlett Packard Enterprise's cloud email environment to steal mailbox data from select individuals within the company.

---

Organizations need to switch gears in their approach to email security

According to Egress, email security incidents continue to have severe impacts on organizations, with 94% experiencing security incidents in the past year, including data loss, exfiltration, and phishing attacks.

---

LODEINFO Fileless Malware Evolves with Anti-Analysis and Remote Code Tricks

Cybersecurity researchers have uncovered an updated version of a backdoor called LODEINFO that's distributed via spear-phishing attacks. The findings come from Japanese company ITOCHU Cyber & Intelligence, which said the malware "has been updated with new features, as well as changes to the anti-analysis (analysis avoidance) techniques." LODEINFO (versions 0.6.6 and 0.6.7

---

Cyber Threat Landscape: 7 Key Findings and Upcoming Trends for 2024

The 2023/2024 Axur Threat Landscape Report provides a comprehensive analysis of the latest cyber threats. The information combines data from the platform's surveillance of the Surface, Deep, and Dark Web with insights derived from the in-depth research and investigations conducted by the Threat Intelligence team. Discover the full scope of digital threats in the Axur Report 2023/2024. Overview

---

Ukrainian Hackers Claim Attack on Russian Scientific Research Center

The Ukrainian hacker group "BO Team" reportedly breached a Russian scientific research center, destroying its database and equipment. The target, the State Research Center on Space Hydrometeorology, is a key enterprise for processing satellite data.

---

French Regulators Levy $34.7 Million Fine Against Amazon for Surveilling Employees

France's data protection authority, CNIL, has fined Amazon €32 million ($34.7 million) for excessive monitoring of employees in its warehouses and for not promptly deleting the data.

---

The Effect of Omission Bias on Vulnerability Management

Omission bias in vulnerability management leads to the reluctance to patch vulnerabilities, despite evidence showing the importance of timely patching to prevent cyberattacks.

---

UK Tells Business Leaders to ‘Toughen Up’ Against Cyberattacks

The increase in ransomware attacks in the UK is attributed to the success of the ransomware-as-a-service ecosystem, making it easier for criminals to engage in disruptive attacks.