Latest Cybersecurity News and Articles

---

Update: Okta Says Data Leaked on Hacking Forum Not From its Systems

The leaked data claimed to be from Okta includes user IDs, full names, company names, office addresses, phone numbers, email addresses, positions/roles, and other information.

---

Malware Campaign Exploits Popup Builder WordPress Plugin to Infect 3,900+ Sites

A new malware campaign is leveraging a high-severity security flaw in the Popup Builder plugin for WordPress to inject malicious JavaScript code. According to Sucuri, the campaign has infected more than 3,900 sites over the past three weeks. "These attacks are orchestrated from domains less than a month old, with registrations dating back to February 12th, 2024," security researcher

---

British Authorities Have Never Detected a Breach of Ransomware Sanctions — But is That Good or Bad News?

Aside from frustrating ransomware payments, the sanctions regime is used by law enforcement agencies to hamper the ability of cyber threat actors to monetize their criminal activities and sow discord within certain groups.

---

Roku Cancels Unauthorized Subscriptions and Provides Refunds for 15K Breached Accounts

Roku canceled unauthorized subscriptions, refunded affected user accounts, and reset passwords after discovering a breach involving hacked username and password combinations.

---

Ransomware Attacks are Hitting Critical Infrastructure More Often, FBI Says

According to the FBI's annual Internet Crime Report for 2023, more than 2 in 5 ransomware attacks in 2023 targeted organizations in critical infrastructure sectors, indicating a growing threat to essential services.

---

Update: Third-Party Breach and Missing MFA Led to British Library Attack

The attackers successfully copied a significant amount of data, including personal details of Library users and staff, leading to a deep and extensive impact on the institution.

---

South Korean Citizen Detained in Russia on Cyber Espionage Charges

Russia has detained a South Korean national for the first time on cyber espionage charges and transferred from Vladivostok to Moscow for further investigation. The development was first reported by Russian news agency TASS. “During the investigation of an espionage case, a South Korean citizen Baek Won-soon was identified and detained in Vladivostok, and put into custody under a court

---

Belgian Village Whose Brewery was Hit by Cyberattack Faces Another on its Coffee Roastery

The Belgian village of Breendonk has experienced cyberattacks targeting both Duvel Moortgat Brewery and local coffee roasters Koffie Beyers, with the incidents occurring at the same time and in close geographic proximity.

---

CISA shares resources to bolster election security for 2024 primaries

A statement released by the CISA discusses the importance of election security as well as the organization’s measures to support election officials. 

---

BianLian Group Exploits JetBrains TeamCity Bugs in Ransomware Attacks

The BianLian ransomware group exploited vulnerabilities in JetBrains TeamCity software to gain initial access to target environments. The group attempted to execute a custom GO backdoor but switched to LotL and utilized a PowerShell backdoor instead.

---

Incognito Darknet Market Mass-Extorts Buyers, Sellers

Borrowing from the playbook of ransomware purveyors, the darknet narcotics bazaar Incognito Market has begun extorting all of its vendors and buyers, threatening to publish cryptocurrency transaction and chat records of users who refuse to pay a fee ranging from $100 to $20,000. The bold mass extortion attempt comes just days after Incognito Market administrators reportedly pulled an "exit scam" that left users unable to withdraw millions of dollars worth of funds from the platform.

---

Fake Leather Wallet App on Apple App Store is a Crypto Drainer

The developers of the Leather cryptocurrency wallet have issued a warning about a counterfeit app on the Apple App Store. This fake app has led to users reporting that it drains their wallets and steals their digital assets.

---

Funding Round Secures $20M for Reach Security

The Series A funding was led by new investors Ballistic Ventures and Artisanal Ventures, as well as existing backers Webb Investment Network, Ridge Ventures, and TechOperators.

---

UK: Cyberattack Cripples Leicester City Council Systems Until ‘At Least Midweek'

While the nature of the cyberattack has not been disclosed, it is noted that this incident is part of a series of attacks on local authorities this year, with the latest affecting the council's ability to provide essential services.

---

Dozens of Data Brokers Disclose Selling Reproductive Healthcare Info, Precise Geolocation and Data Belonging to Minors

New information from the state of California reveals that many data brokers collect and sell sensitive information, including data related to reproductive health, geolocation, and minors.

---

New Banking Trojan CHAVECLOAK Targets Brazilian Users via Phishing Tactics

Users in Brazil are the target of a new banking trojan known as CHAVECLOAK that's propagated via phishing emails bearing PDF attachments. "This intricate attack involves the PDF downloading a ZIP file and subsequently utilizing DLL side-loading techniques to execute the final malware," Fortinet FortiGuard Labs researcher Cara Lin said. The attack chain involves the use of

---

Embracing the Cloud: Revolutionizing Privileged Access Management with One Identity PAM Essentials

As cyber threats loom around every corner and privileged accounts become prime targets, the significance of implementing a robust Privileged Access Management (PAM) solution can't be overstated. With organizations increasingly migrating to cloud environments, the PAM Solution Market is experiencing a transformative shift toward cloud-based offerings. One Identity PAM Essentials stands

---

Iran-Linked ‘Lord Nemesis’ Group Appears Intent on Intimidating Israeli Organizations, Report Says

An Iranian state-backed hacking group, known as Lord Nemesis, targeted an Israeli academic administration software company called Rashim Software. The attackers used their access to infiltrate several of the company's clients.

---

How New and Old Security Threats Keep Persisting

New research by Cymulate highlights the correlation between threat exposures, vulnerabilities, misconfigurations, and security controls. It emphasizes the importance of proactive security measures to prevent cyberattacks.

---

CISA Forced to Take Two Systems Offline Last Month After Ivanti Compromise

The breach was limited to two systems, the Infrastructure Protection (IP) Gateway and the Chemical Security Assessment Tool (CSAT), which house critical information about U.S. infrastructure interdependency and private sector chemical security plans.