Latest Cybersecurity News and Articles

---

Oleria Raises $33M Series A to Usher in New Era of Adaptive and Autonomous Identity Security

Oleria, a company specializing in adaptive and autonomous identity security solutions, has secured $33.1 million in Series A funding, led by Evolution Equity Partners with participation from Salesforce Ventures, Tapestry VC, and Zscaler.

---

Russian State Hackers Deploying Malware in Espionage Attacks Around Europe

Russian state hackers from Center 18, a unit within Russia’s Federal Security Service (FSB), have been using sophisticated tactics to deploy backdoors on the devices of targets in NATO countries and Ukraine.

---

Wealthy Countries Boast Superior Cyber Defenses

A report by SecurityScorecard revealed that wealthier regions have better cybersecurity defenses and lower cyber risk compared to poorer regions. The study found that organizations in regions with lower GDP are more likely to suffer data breaches.

---

Update: Cyberattack on Ukraine’s Largest Telecom Provider Will Cost It About $100 Million

The attack on Kyivstar, believed to have been carried out by Sandworm APT, aimed to cause a destructive impact, deliver a psychological blow, and gather intelligence, marking a significant incident in the ongoing cyberwar between Ukraine and Russia.

---

Npm Trojan Bypasses UAC, Installs AnyDesk with "Oscompatible" Package

A malicious package uploaded to the npm registry has been found deploying a sophisticated remote access trojan on compromised Windows machines. The package, named "oscompatible," was published on January 9, 2024, attracting a total of 380 downloads before it was taken down. oscompatible included a "few strange binaries," according to software supply chain security firm Phylum, including a single

---

An Analysis of the DarkGate AutoIt Loader

The malware employs tactics such as lateral movement via PSEXEC, malicious download and execution, proxy setup, and RDP configuration to exfiltrate data and establish command and control communications.

---

U.S. Cybersecurity Agency Warns of Actively Exploited Ivanti EPMM Vulnerability

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added a now-patched critical flaw impacting Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core to its Known Exploited Vulnerabilities (KEV) catalog, stating it's being actively exploited in the wild. The vulnerability in question is CVE-2023-35082 (CVSS score: 9.8), an authentication bypass

---

Malicious Extortion Bot Targets Publicly Exposed PostgreSQL and MySQL Databases

The bot gains access to the databases, deletes all tables and databases, and leaves a ransom note demanding payment for data recovery. However, the bot only saves a small portion of the data, even if the ransom is paid.

---

TA866 Returns with a Large Email Campaign

The new campaign by TA866 involved a large volume of emails with attached PDFs containing OneDrive URLs that initiated a multi-step infection chain leading to malware payload.

---

New Docker Malware Steals CPU for Crypto & Drives Fake Website Traffic

Vulnerable Docker services are being targeted by a novel campaign in which the threat actors are deploying XMRig cryptocurrency miner as well as the 9Hits Viewer software as part of a multi-pronged monetization strategy. "This is the first documented case of malware deploying the 9Hits application as a payload," cloud security firm Cado said, adding the development is a sign that adversaries are

---

Malware Exploiting 9Hits, Turns Docker Servers into Crypto Miners

Attackers are using off-the-shelf images from Dockerhub to spread malware, with the 9Hits app visiting various websites and the XMRig miner disabled from visiting crypto-related sites to prevent analysis.

---

TensorFlow CI/CD Flaw Exposed Supply Chain to Poisoning Attacks

Continuous integration and delivery misconfigurations in TensorFlow could have been exploited for supply chain attacks, allowing malicious code injection and compromise of GitHub and PyPi releases.

---

49% of organizations cite poor training as cause for privacy concerns

According to a recent data privacy report, 43% say their privacy budget is underfunded and 51% of respondents expect a decrease in budget.

---

Report: 75% of Organizations Hit by Ransomware in 2023

Cyberattacks are the leading cause of technology outages for 40% of organizations, emphasizing the need for comprehensive disaster preparation beyond just cybersecurity measures, according to Veeam.

---

Russian COLDRIVER Hackers Expand Beyond Phishing with Custom Malware

The Russia-linked threat actor known as COLDRIVER has been observed evolving its tradecraft to go beyond credential harvesting to deliver its first-ever custom malware written in the Rust programming language. Google's Threat Analysis Group (TAG), which shared details of the latest activity, said the attack chains leverage PDFs as decoy documents to trigger the infection sequence. The lures are

---

Apple, AMD, Qualcomm, Imagination GPUs Open to Data Theft Using New LeftoverLocals Vulnerability

The vulnerability affects various GPU products, with AMD and Apple planning mitigations, and Imagination and Qualcomm issuing fixes. Nvidia and Arm are reportedly unaffected.

---

OpenAI Combats Election Misinformation Amid Growing Concerns

OpenAI is taking steps to prevent the use of ChatGPT in spreading election misinformation, including restricting its use for political campaigning and lobbying, and creating tools to empower voters to assess the authenticity of images.

---

Pro-Russia Group Hit Swiss Government Sites After Zelensky Visit in Davos

Switzerland's National Cyber Security Centre promptly detected and responded to the DDoS attacks, restoring access to the targeted websites, including the Davos-Klosters ski resort and Swiss Ministry of the Interior.

---

As Hacks Worsen, SEC Turns up the Heat on CISOs

The cybersecurity industry is facing increasing legal oversight and consequences, making it riskier to work in this field. Companies are now required to disclose "material" security incidents within four working days to the SEC.

---

Taiwanese Semiconductor Company Foxsemicon Suffers Ransomware Attack

Foxsemicon, a major semiconductor manufacturer in Taiwan, was targeted by the LockBit ransomware gang, who threatened to leak customers' personal data if a ransom was not paid.