Latest Cybersecurity News and Articles

---

French CNIL Imposes Fine of $11 Million on Yahoo

The French regulator found that Yahoo had deposited at least 20 advertising cookies without obtaining proper consent, affecting more than 5 million consumers over 21 months.

---

Admin of the BreachForums Hacking Forum Sentenced to 20 Years Supervised Release

The hacking forum facilitated the exchange of illicit data and access devices, leading to the arrest of Pompompurin and the closure of RaidForums in a law enforcement operation.

---

Researchers Link 3AM Ransomware to Conti, Royal Cybercrime Gangs

Researchers have found strong links between the 3AM ransomware and the Conti syndicate through analysis of their infrastructure, communication channels, and attack tactics.

---

Groups Urge FTC to Scrutinize Google Location Data Practices

Two tech advocacy groups are urging the FTC to investigate Google for allegedly failing to delete sensitive location data as promised, potentially violating privacy and putting individuals at risk.

---

Apache ActiveMQ Flaw Exploited in New Godzilla Web Shell Attacks

A critical vulnerability in Apache ActiveMQ (CVE-2023-46604) is being actively exploited by threat actors to deploy various malicious payloads, including ransomware and DDoS botnets.

---

FTC Settles Second Case With Geolocation Data Broker in Two Weeks

The FTC has settled with a data broker, InMarket Media, for improperly collecting and selling consumers' location data without informed consent, signaling increased scrutiny of data brokers.

---

Experts Call for US Cyber Safety Review Board Rethink

There are differing opinions on whether the CSRB should be granted subpoena powers, with concerns about potential conflicts of interest and adversarial relationships with the private sector.

---

Update: Ransomware Gang Claims Responsibility for Christmas Attack on Massachusetts Hospital

The Money Message ransomware gang claimed responsibility for stealing 600GB of data from Anna Jaques Hospital, highlighting the ongoing threat to healthcare institutions.

---

IT Consultant in Germany Fined for Exposing Shoddy Security

A security researcher in Germany was fined €3,000 ($3,300) for uncovering and reporting a serious e-commerce database vulnerability. The vulnerability exposed almost 700,000 customer records due to a plaintext password stored in the software.

---

FTC Bans InMarket for Selling Precise User Location Without Consent

The U.S. Federal Trade Commission (FTC) is continuing to clamp down on data brokers by prohibiting InMarket Media from selling or licensing precise location data. The settlement is part of allegations that the Texas-based company did not inform or seek consent from consumers before using their location information for advertising and marketing purposes. "InMarket will also be prohibited from

---

Apache ActiveMQ Flaw Exploited in New Godzilla Web Shell Attacks

Cybersecurity researchers are warning of a "notable increase" in threat actor activity actively exploiting a now-patched flaw in Apache ActiveMQ to deliver the Godzilla web shell on compromised hosts. "The web shells are concealed within an unknown binary format and are designed to evade security and signature-based scanners," Trustwave said. "Notably, despite the binary's unknown file

---

Digital afterlife – how to deal with social media accounts when someone dies

Deciding what to do with a dead friend or relative’s online presence is complicated and time-consuming but there are shortcutsFind more essential summer readingGet our morning and afternoon news emails,free app or daily news podcastGavin Blomeley was lucky his mother was incredibly organised before she died. She left a note that included the passcode to her phone and access to all her online passwords.“I can’t even begin to imagine how difficult this could have gotten not having these passwords or knowing this note with all of her passwords existed,” Blomeley says.Sign up for Guardian Australia’s free morning and afternoon email newsletters for your daily news roundup Continue reading...

---

Chinese Hackers Silently Weaponized VMware Zero-Day Flaw for 2 Years

An advanced China-nexus cyber espionage group previously linked to the exploitation of security flaws in VMware and Fortinet appliances has been linked to the abuse of a critical vulnerability in VMware vCenter Server as a zero-day since late 2021. "UNC3886 has a track record of utilizing zero-day vulnerabilities to complete their mission without being detected, and this latest example further

---

Russian Hackers Stole Microsoft Corporate Emails in Month-Long Breach

The breach was facilitated by a password spray attack on a non-production test tenant account lacking two-factor authentication, highlighting the importance of robust account security measures.

---

Payoneer Accounts in Argentina Hacked in 2FA Bypass Attacks

Suspicions have been raised about a potential data leak from mobile service providers or a breach in the SMS provider used for OTP code delivery as the possible cause of the hacks.

---

CISA Issues Emergency Directive to Federal Agencies on Ivanti Zero-Day Exploits

The vulnerabilities allow threat actors to execute arbitrary commands, move laterally, perform data exfiltration, and establish persistent system access, potentially compromising target information systems.

---

China-linked APT UNC3886 Exploits VMware Zero-Day Since 2021

Mandiant researchers observed UNC3886 exploiting a VMware ESXi zero-day vulnerability in June 2023, using novel malware persistence techniques to achieve administrative access within VMware ESXi Hypervisors.

---

CISA Issues Emergency Directive to Federal Agencies on Ivanti Zero-Day Exploits

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday issued an emergency directive urging Federal Civilian Executive Branch (FCEB) agencies to implement mitigations against two actively exploited zero-day flaws in Ivanti Connect Secure (ICS) and Ivanti Policy Secure (IPS) products. The development came after the vulnerabilities – an authentication bypass

---

Microsoft's Top Execs' Emails Breached in Sophisticated Russia-Linked APT Attack

Microsoft on Friday revealed that it was the target of a nation-state attack on its corporate systems that resulted in the theft of emails and attachments from senior executives and other individuals in the company's cybersecurity and legal departments. The Windows maker attributed the attack to a Russian advanced persistent threat (APT) group it tracks as Midnight Blizzard (formerly

---

Invoice Phishing Alert: TA866 Deploys WasabiSeed & Screenshotter Malware

The threat actor tracked as TA866 has resurfaced after a nine-month hiatus with a new large-volume phishing campaign to deliver known malware families such as WasabiSeed and Screenshotter. The campaign, observed earlier this month and blocked by Proofpoint on January 11, 2024, involved sending thousands of invoice-themed emails targeting North America bearing decoy PDF files. "The PDFs