Latest Cybersecurity News and Articles

---

DarkGate Malware Delivered via Microsoft Teams

Threat actors have been spotted exploiting Microsoft Teams’ external access feature—enabled by default—allowing users to add external members to Teams chats. An AT&T customer identified an unsolicited Teams chat from an external user, suspected to be a phishing lure. It is recommended to disable External Access in Microsoft Teams unless it is necessary for daily business use.

---

Cloudflare Breach: Nation-State Hackers Access Source Code and Internal Docs

Cloudflare has revealed that it was the target of a likely nation-state attack in which the threat actor leveraged stolen credentials to gain unauthorized access to its Atlassian server and ultimately access some documentation and a limited amount of source code. The intrusion, which took place between November 14 and 24, 2023, and detected on November 23, was carried out "with the goal of

---

UK: City Cyber Task Force Launches to Secure Corporate Finance

The Institute of Chartered Accountants in England and Wales (ICAEW) and the National Cyber Security Centre (NCSC) are leading a task force with other organizations to improve the security of corporate finance deals.

---

Protect AI Acquires Laiyer AI to Better Secure AI Models

The acquisition will enable organizations to benefit from Laiyer AI's LLM Guard software, which detects, redacts, and sanitizes inputs and outputs from LLMs with lower latency, while also supporting open source contributions.

---

Does CVSS 4.0 Solve the Exploitability Problem?

The new system introduces changes such as splitting attack complexity into two parameters and categorizing user interaction into three levels, offering a more nuanced and comprehensive assessment of vulnerabilities.

---

Arrests in $400M SIM-Swap Tied to Heist at FTX?

Three Americans were charged this week with stealing more than $400 million in a November 2022 SIM-swapping attack. The U.S. government did not name the victim organization, but there is every indication that the money was stolen from the now-defunct cryptocurrency exchange FTX, which had just filed for bankruptcy on that same day.

---

Europcar Denies Data Breach of 50 Million Users, Says Data is Fake

Security researchers suggest that the fake data may not have been generated using artificial intelligence, as claimed, but rather through existing projects that can create realistic-looking data.

---

Incognia Raises $31M in Series B Funding

Incognia, a San Jose-based company specializing in location identity solutions, has raised $31M in Series B funding led by Bessemer Venture Partners, with participation from FJ Labs and existing investors.

---

Zero-Day Vulnerability can Blind Defenses Relying on Windows Event Logs

The vulnerability can be leveraged by an attacker with local network access, and until Microsoft issues a patch, users can implement micropatches provided by Acros to mitigate the risk.

---

Aim Security Raises $10M for its GenAI Security Platform

Tel Aviv-based Aim Security has raised $10 million in seed funding for its new GenAI security platform, led by YL Ventures and including participation from Cyber Club London and angel investors.

---

Exploit Released for Android Local Elevation Flaw Impacting Seven OEMs

A local privilege elevation flaw (CVE-2023-45779) affecting several Android OEMs was discovered and addressed in the December 2023 security update, highlighting weaknesses in APEX module signing using test keys.

---

US Charges Two More Suspects With DraftKings Account Hacks

The defendants used credential stuffing techniques to compromise accounts, sell access to them, and devised a method for buyers to withdraw funds, resulting in millions of dollars in illicit gains.

---

Global Affairs Canada Hit by Cyberattack, Shuts Down Computer Systems to Fix

The Foreign Ministry of Canada has been hit by a cyberattack, leading to the closure of remote access to its network. Hackers gained access to personal data, and experts suspect a foreign country, possibly Russia or China, to be behind the attack.

---

Hackers Obtain Confidential Information on Romanian Officials After Cyberattack at Parliament

Hackers breached the Romanian Chamber of Deputies' database and obtained confidential information, including the prime minister's identity documents and medical analyses. They threatened to release the data unless they received a ransom of $34,000.

---

FritzFrog Returns with Log4Shell and PwnKit, Spreading Malware Inside Your Network

The threat actor behind a peer-to-peer (P2P) botnet known as FritzFrog has made a return with a new variant that leverages the Log4Shell vulnerability to propagate internally within an already compromised network. "The vulnerability is exploited in a brute-force manner that attempts to target as many vulnerable Java applications as possible," web infrastructure and security

---

Pentagon Investigating Theft of Sensitive Files by Ransomware Group

The Department of Defense is investigating claims by the ransomware group ALPHV that they have stolen sensitive data related to the U.S. military, including information from the Defense Counterintelligence and Security Agency.

---

Italian Data Protection Watchdog Accuses ChatGPT of Privacy Violations

The Italian data protection authority has notified OpenAI, the maker of ChatGPT, of potential violations of the EU's GDPR privacy laws. The issues include collecting personal data, age protections, and potential exposure of sensitive information.

---

The Rise of Python-Scripted Ransomware

The ransomware, named "grinchv3," self-copies itself to the startup folder for persistence, encrypts user data using the Fernet symmetric key encryption algorithm, and adds a pop-up message after encryption.

---

Update: Johnson Controls Reports $27M Hit From Ransomware Attack

The company's ongoing investigation and remediation efforts are focused on containing the unauthorized activity and assessing the impact on data, with no observed evidence of impact on its digital products and solutions.

---

HeadCrab 2.0 Goes Fileless, Targeting Redis Servers for Crypto Mining

The new version, HeadCrab 2.0, employs advanced evasion techniques and uses the Redis MGET command for command-and-control communications, making it more difficult to detect.