Latest Cybersecurity News and Articles

---

European parking app announced data breach

Cyberattacks, data breaches and newly exploited vulnerabilities across the globe were analyzed in a recent report by Check Point Research. 

---

Fake and Stolen X Gold Accounts Flood Dark Web

A surge of fake or stolen Twitter Gold (now X Gold) accounts has been flooding both the surface web and the dark web over the past year, according to cybersecurity firm CloudSEK.

---

Qualcomm Chip Vulnerability Enables Remote Attack by Voice Call

Qualcomm has announced a critical vulnerability that could lead to remote attacks on devices using their chipsets. The flaw, tracked as CVE-2023-33025, involves a buffer overflow during VoLTE calls, allowing attackers to execute code remotely.

---

SonicWall Acquires Banyan to Boost Zero-Trust, SSE Offerings

With its second acquisition in two months, SonicWall aims to help enterprises with growing remote workforces through zero-trust network and security service edge offerings.

---

CISA Warns of Actively Exploited Bugs in Chrome and Excel Parsing Library

The CISA has identified two recently patched vulnerabilities, one in Google Chrome and another in the open-source Perl library Spreadsheet::ParseExcel, that have been actively exploited and require immediate mitigation.

---

Threat Actor Leaks 3.6 Million Records Allegedly Stolen From Cross Switch

The data breach, carried out by a threat actor named IntelBroker, has allegedly exposed sensitive details such as full names, emails, phone numbers, banking information, and more.

---

5 New Year's resolutions for CISOs

In an ever-evolving digital age, how can CISOs prepare themselves and their employees? What should they take into consideration for the new year?

---

Malware Using Google MultiLogin Exploit to Maintain Access Despite Password Reset

Information stealing malware are actively taking advantage of an undocumented Google OAuth endpoint named MultiLogin to hijack user sessions and allow continuous access to Google services even after a password reset. According to CloudSEK, the critical exploit facilitates session persistence and cookie generation, enabling threat actors to maintain access to a valid session in an

---

Hacktivists Shut Down Top State-Owned Belarusian News Agency

Belarusian hacktivist group, the Cyber-Partisans, launched a cyberattack on the country's leading state-owned media outlet, wiping the main website servers and backups, as a retaliatory measure against President Lukashenko's propaganda campaign.

---

Online Museum Collections Down After Ransomware Attack on Service Provider

Gallery Systems, a museum software provider, has revealed that it experienced a ransomware attack last week, leading to ongoing IT outages. The attack caused the company to take systems offline to prevent further encryption.

---

Ban on Ransomware Payments? The Alternative Isn’t Working

Ransomware attacks in the US reached record levels in 2023, targeting hospitals, schools, government organizations, and private-sector businesses, costing victims an average of $1.5 million to rectify.

---

Defunct Ambulance Service Data Breach Impacts Nearly One Million People

Fallon Ambulance Services, a subsidiary of Transformative Healthcare, was targeted in a ransomware attack that exposed the personal information of nearly a million people. The attack occurred in February 2023 and was discovered in April 2023.

---

European Central Bank to Put Banks Through Cyber Stress Test

The European Central Bank will conduct cyber stress tests on 109 banks in Europe to assess their resilience against cyberattacks. The tests will simulate disruptive cyberattacks and evaluate how the banks respond and recover.

---

Orbit Chain Loses $86 Million in the Last Fintech Hack of 2023

The stolen funds are believed to be linked to North Korean hacking groups, such as Lazarus, who use cryptocurrency cyberattacks to bypass international sanctions and finance their weapons development program.

---

5 Ways to Reduce SaaS Security Risks

As technology adoption has shifted to be employee-led, just in time, and from any location or device, IT and security teams have found themselves contending with an ever-sprawling SaaS attack surface, much of which is often unknown or unmanaged. This greatly increases the risk of identity-based threats, and according to a recent report from CrowdStrike, 80% of breaches today use compromised

---

SMTP Smuggling: New Flaw Lets Attackers Bypass Security and Spoof Emails

A new exploitation technique called Simple Mail Transfer Protocol (SMTP) smuggling can be weaponized by threat actors to send spoofed emails with fake sender addresses while bypassing security measures. "Threat actors could abuse vulnerable SMTP servers worldwide to send malicious emails from arbitrary email addresses, allowing targeted phishing attacks," Timo Longin, a senior security

---

DOJ Slams XCast with $10 Million Fine Over Massive Illegal Robocall Operation

XCast transmitted billions of illegal robocalls to American consumers, using false affiliations with government agencies and misleading information to deceive victims into making purchases.

---

New York State AG Hits Hospital With $300K Fine for Web Tracker Use

NewYork-Presbyterian Hospital has been fined $300,000 by state regulators for privacy violations related to its use of tracking tools on its websites and patient portal. It violated HIPAA rules by sharing patient information with third parties.

---

Hacker Group Claims to Steal 3TB Data From Iranian Food Delivery Giant Snappfood

The hacker group, known as "irleaks," publicly disclosed the breach and claimed to have acquired a vast amount of data, including customer details, vendor records, payment information, device data, product orders, and more.

---

BT Misses Deadline for Removing Huawei From Network Core

BT has failed to meet the extended deadline to remove Huawei equipment from its core networks, with only 2G and 3G services still being served by non-compliant infrastructure.