Latest Cybersecurity News and Articles

---

China-backed Hackers Hijack Software Updates to Implant "NSPX30" Spyware

A previously undocumented China-aligned threat actor has been linked to a set of adversary-in-the-middle (AitM) attacks that hijack update requests from legitimate software to deliver a sophisticated implant named NSPX30. Slovak cybersecurity firm ESET is tracking the advanced persistent threat (APT) group under the name Blackwood. It's said to be active since at least 2018. The NSPX30

---

New CherryLoader Malware Mimics CherryTree to Deploy Privilege Escalation Exploits

The loader drops two publicly available privilege escalation tools, PrintSpoofer and JuicyPotatoNG, and uses encryption methods like XOR and AES to facilitate the attack chain.

---

Security Vendors are Accused of Bending CVE Assignment Rules

Both Juniper Networks and Ivanti have attracted criticism from members of the infosec industry for the way they've handled the disclosure of vulnerabilities over the past week.

---

Data from Indian Online Gaming Platforms Teenpatti.com and Mpl.live on Sale

The alleged data breach at Teenpatti.com and Mpl.live underscores the urgent need for improved security measures in online gaming platforms, especially in handling large volumes of personal user data.

---

Unmasking MacOS Malware in Pirated Apps

Pirate applications targeting macOS users distribute a backdoor, allowing attackers to download and execute multiple payloads. Each application includes a malicious dylib, a backdoor, and a persistent downloader, posing a significant threat to users. The researchers from Jamf Threat Labs identified similarities with the ZuRu malware.

---

Over 5,300 GitLab Servers Exposed to Zero-Click Account Takeover Attacks

The flaw affects several versions of GitLab and patches have already been released. The servers at risk are mainly located in the United States, Germany, Russia, China, France, the U.K., India, and Canada.

---

New CherryLoader Malware Mimics CherryTree to Deploy PrivEsc Exploits

A new Go-based malware loader called CherryLoader has been discovered by threat hunters in the wild to deliver additional payloads onto compromised hosts for follow-on exploitation. Arctic Wolf Labs, which discovered the new attack tool in two recent intrusions, said the loader's icon and name masquerades as the legitimate CherryTree note-taking application to dupe potential victims

---

CISA Adds Atlassian Confluence Data Center Bug to Its Known Exploited Vulnerabilities Catalog

The vulnerability, tracked as CVE-2023-22527, allows remote attackers to execute arbitrary code on vulnerable Confluence installs. Atlassian has released patches to address the issue and recommends immediate action to update to the latest versions.

---

Tech Giant HP Enterprise Hacked by Russian Hackers Linked to DNC Breach

Hackers with links to the Kremlin are suspected to have infiltrated information technology company Hewlett Packard Enterprise's (HPE) cloud email environment to exfiltrate mailbox data. "The threat actor accessed and exfiltrated data beginning in May 2023 from a small percentage of HPE mailboxes belonging to individuals in our cybersecurity, go-to-market, business segments, and other functions,"

---

Global Retailer BuyGoods.com Leaks User PII, KYC data

What’s worse, the exposed server also laid bare the personal records of customers and affiliates, containing highly sensitive Personally Identifiable Information (PII) and Know Your Customer (KYC) data.

---

Browser-based phishing attacks increased 198% in H2 2023

Browser security was analyzed in a recent report. The report uncovered a 198% increase in browser-based phishing attacks in the second half of 2023.

---

There was a 198% increase in browser-based phishing attacks

Browser security was analyzed in a recent report. The report uncovered a 198% increase in browser-based phishing attacks in the second half of 2023.

---

How the Sys:All Loophole Allowed Us To Penetrate GKE Clusters in Production

An external threat actor in possession of a Google account could misuse this misconfiguration by using their own Google OAuth 2.0 bearer token to seize control of the cluster for follow-on exploitation.

---

Water Services Giant Veolia North America Hit by Ransomware Attack

The company has discovered a limited number of individuals whose personal information may have been impacted during the breach and is working with a third-party forensics firm to assess the extent of the attack's impact on its operations and systems.

---

Windows 11 KB5034204 Update Fixes Bluetooth Audio Issues, 24 bugs

KB5034204 also fixes an issue caused by a deadlock that prevents search from working on the Start menu for some users and addresses a bug affecting the OpenType font driver, affecting how text renders for third-party applications.

---

GitGot: GitHub Leveraged by Cybercriminals to Store Stolen Data

It appears that the package author was in the process of building out the malware and adding layers of deception. Fortunately, the package was detected and removed from npm before that could happen.

---

Google Kubernetes Misconfig Lets Any Gmail Account Control Your Clusters

Cybersecurity researchers have discovered a loophole impacting Google Kubernetes Engine (GKE) that could be potentially exploited by threat actors with a Google account to take control of a Kubernetes cluster. The critical shortcoming has been codenamed Sys:All by cloud security firm Orca. As many as 250,000 active GKE clusters in the wild are estimated to be susceptible to the attack vector. In

---

VexTrio: The Uber of Cybercrime - Brokering Malware for 60+ Affiliates

VexTrio has been attributed to malicious campaigns that use domains generated by a dictionary domain generation algorithm (DDGA) to propagate scams, riskware, spyware, adware, potentially unwanted programs (PUPs), and pornographic content.

---

Organizations Invest More in Data Protection But Recover Less

While most organizations consider cyber resiliency a foundational aspect of their broader business continuity or disaster recovery (BC/DR) strategy, BC/DR preparedness is not yet “passing” most service-level agreement (SLA) expectations.

---

Splunk fixed high-severity flaw impacting Windows versions

Deserialization of untrusted data can allow malicious code to be executed on the system. This is because the serialized data can contain instructions that the application will execute when it deserializes the data.