Latest Cybersecurity News and Articles

---

With Car Privacy Concerns Rising, Automakers May Be on Road to Regulation

Regulators, particularly the California Privacy Protection Agency and the Federal Trade Commission, are starting to investigate and potentially take action against connected vehicle manufacturers for privacy violations.

---

Russian Military Hackers Target Ukraine With New MASEPIE Malware

The CERT-UA has issued a warning about a new phishing campaign orchestrated by Russian hackers known as APT28. The campaign targeted Ukraine between December 15 and 25, 2023, using phishing emails that tricked recipients into clicking on a link.

---

Google to Settle Class Action Lawsuit Alleging Incognito Mode Does Not Protect User Privacy

Google has reached a preliminary settlement in a class-action lawsuit accusing the company of deceiving users about their privacy while using the Incognito mode. The settlement comes after a nearly four-year legal battle.

---

Game Mod on Steam Breached to Push Password-Stealing Malware

The Downfall fan expansion for the game Slay the Spire was breached on Christmas Day, distributing the Epsilon information stealer malware through the Steam update system.

---

Eagers Automotive Halts Stock Trading in Response to Cyberattack

The extent of the cyber incident is still being determined, but external experts have been engaged to investigate, raising concerns about a potential data breach and exposure of sensitive financial information.

---

CERT-UA Uncovers New Malware Wave Distributing OCEANMAP, MASEPIE, STEELHOOK

The Computer Emergency Response Team of Ukraine (CERT-UA) has warned of a new phishing campaign orchestrated by the Russia-linked APT28 group to deploy previously undocumented malware such as OCEANMAP, MASEPIE, and STEELHOOK to harvest sensitive information. The activity, which was detected by the agency between December 15 and 25, 2023, targets government entities

---

Update: Operational Halt at First American Financial Corporation, Subsidiary After Cyberattack

The company is working to restore its operations and has notified regulatory authorities. Despite the disruption, the company is still able to close loans and accept payments.

---

Kimsuky Hackers Deploying AppleSeed, Meterpreter, and TinyNuke in Latest Attacks

Nation-state actors affiliated to North Korea have been observed using spear-phishing attacks to deliver an assortment of backdoors and tools such as AppleSeed, Meterpreter, and TinyNuke to seize control of compromised machines. South Korea-based cybersecurity company AhnLab attributed the activity to an advanced persistent threat group known as Kimsuky. “A notable point about attacks that

---

Microsoft Disables MSIX App Installer Protocol Widely Used in Malware Attacks

Multiple financially motivated hacking groups have been observed using the App Installer service as an entry point for ransomware attacks, leveraging signed malicious MSIX app packages distributed via Microsoft Teams and malicious search engine ads.

---

Do the Casino Ransomware Attacks Make the Case to Pay?

Experts caution that the decision to pay or not pay depends on various factors, including the type of data compromised, the availability of backups, the financial impact on the organization, and the sector in which the company operates.

---

Update: Kroll Reveals FTX Customer Info Exposed in August Data Breach

The August data breach at Kroll exposed personal information of FTX bankruptcy claimants, including coin holdings and balances, making them potential targets for threat actors in the cryptocurrency market.

---

Microsoft Disables MSIX App Installer Protocol Widely Used in Malware Attacks

Microsoft on Thursday said it’s once again disabling the ms-appinstaller protocol handler by default following its abuse by multiple threat actors to distribute malware. “The observed threat actor activity abuses the current implementation of the ms-appinstaller protocol handler as an access vector for malware that may lead to ransomware distribution,” the Microsoft Threat Intelligence

---

Blockchain Developer’s Wallet Emptied in “Job Interview” Using Npm Package

The scam involved the developer downloading npm packages from a GitHub repository, which potentially allowed the attackers to gain access to his machine and drain his wallet.

---

New Rugmi Malware Loader Surges with Hundreds of Daily Detections

The malware is sold as a service and can be obtained through malvertising, fake browser updates, and cracked software installations. It has also been found that the malware is being spread through Discord's content delivery network.

---

Google Cloud Resolves Privilege Escalation Flaw Impacting Kubernetes Service

Google Cloud has addressed a medium-severity security flaw in its platform that could be abused by an attacker who already has access to a Kubernetes cluster to escalate their privileges. "An attacker who has compromised the Fluent Bit logging container could combine that access with high privileges required by Anthos Service Mesh (on clusters that have enabled it) to

---

Trinidad and Tobago Social Security Agency Discloses Post-Christmas Ransomware Attack

The National Insurance Board in Trinidad and Tobago has been hit by a ransomware attack, leading to the closure of its offices and limiting its operations for an extended period.

---

LockBit Ransomware Disrupts Emergency Care at German Hospitals

The attack occurred on December 24, 2023, and caused severe disruptions to the hospitals' IT systems. Investigations are underway to determine the extent of the damage and whether any data was stolen.

---

Albanian Parliament, Telecom Company Hit by Cyberattacks

The Albanian parliament and a telecom company were targeted by cyberattacks originating from outside Albania. The attacks, which attempted to interfere with infrastructure and delete data, have not been attributed to a specific threat actor.

---

Most Sophisticated iPhone Hack Ever Exploited Apple's Hidden Hardware Feature

The Operation Triangulation spyware attacks targeting Apple iOS devices leveraged never-before-seen exploits that made it possible to even bypass pivotal hardware-based security protections erected by the company. Russian cybersecurity firm Kaspersky, which discovered the campaign at the beginning of 2023 after becoming one of the targets, described it as

---

Ohio Lottery Suffers Cyberattack Claimed by DragonForce Ransomware Group

The newly surfaced DragonForce ransomware gang has claimed responsibility for the attack, stating that they have encrypted devices and stolen data, including personal information of Ohio Lottery customers and employees.