Latest Cybersecurity News and Articles

---

CherryBlos Malware Steals Cryptocurrency via Your Photos

CherryBlos is a family of Android malware that can steal cryptocurrency by extracting sensitive information from photos on a user's phone. This includes details related to cryptocurrency wallets, such as recovery phrases.

---

Signature Techniques of Asian APT Groups Revealed

The industries most frequently targeted by Asian APT groups include government, industrial, healthcare, IT, agriculture, and energy sectors, emphasizing the importance of tailored security measures for these industries.

---

Yellen Says Ransomware Attack on China’s Biggest Bank Minimally Disrupted Treasury Market Trades

A ransomware attack that forced China’s biggest bank to take some systems offline only minimally disrupted the U.S. Treasury market. The post Yellen Says Ransomware Attack on China’s Biggest Bank Minimally Disrupted Treasury Market Trades appeared first on SecurityWeek.

---

Personal Information Impacted in Breach of Computer Network, Butler County Says

The county is conducting a review to determine the extent of the breach, identify those affected, and will provide written notice and credit monitoring services to impacted individuals.

---

Personal Information Impacted in Breach of Computer Network, Butler County Says

The county is conducting a review to determine the extent of the breach, identify those affected, and will provide written notice and credit monitoring services to impacted individuals.

---

Chinese Hackers Launch Covert Espionage Attacks on 24 Cambodian Organizations

Cybersecurity researchers have discovered what they say is malicious cyber activity orchestrated by two prominent Chinese nation-state hacking groups targeting 24 Cambodian government organizations. "This activity is believed to be part of a long-term espionage campaign," Palo Alto Networks Unit 42 researchers said in a report last week. "The observed activity aligns with geopolitical goals of

---

Major Phishing-as-a-Service Syndicate 'BulletProofLink' Dismantled by Malaysian Authorities

Malaysian law enforcement authorities have announced the takedown of a phishing-as-a-service (PhaaS) operation called BulletProofLink. The Royal Malaysian Police said the effort, which was carried out with assistance from the Australian Federal Police (AFP) and the U.S. Federal Bureau of Investigation (FBI) on November 6, 2023, was based on information that the threat actors behind the platform

---

New BiBi-Windows Wiper Targets Windows Systems in Pro-Hamas Attacks

Cybersecurity researchers have warned about a Windows version of a wiper malware that was previously observed targeting Linux systems in cyber attacks aimed at Israel. Dubbed BiBi-Windows Wiper by BlackBerry, the wiper is the Windows counterpart of BiBi-Linux Wiper, which has been put to use by a pro-Hamas hacktivist group in the wake of the Israel-Hamas war last month. "The Windows variant [...

---

Private UK health data donated for medical research shared with insurance companies

Observer investigation reveals UK Biobank opened its biomedical database to insurance firms despite pledge it would not do soSensitive health information donated for medical research by half a million UK citizens has been shared with insurance companies despite a pledge that it would not be.An Observer investigation has found that UK Biobank opened up its vast biomedical database to insurance sector firms several times between 2020 and 2023. The data was provided to insurance consultancy and tech firms for projects to create digital tools that help insurers predict a person’s risk of getting a chronic disease. The findings have raised concerns among geneticists, data privacy experts and campaigners over vetting and ethical checks at Biobank. Continue reading...

---

It’s Still Easy for Anyone to Become You at Experian

In the summer of 2022, KrebsOnSecurity documented the plight of several readers who had their accounts at big-three consumer credit reporting bureau Experian hijacked after identity thieves simply re-registered the accounts using a different email address. Sixteen months later, Experian clearly has not addressed this gaping lack of security. I know that because my account at Experian was recently hijacked, and the only way I could recover access was by recreating the account.

---

Microsoft Warns of Fake Skills Assessment Portals Targeting IT Job Seekers

A sub-cluster within the infamous Lazarus Group has established new infrastructure that impersonates skills assessment portals as part of its social engineering campaigns. Microsoft attributed the activity to a threat actor it calls Sapphire Sleet, describing it as a "shift in the persistent actor's tactics." Sapphire Sleet, also called APT38, BlueNoroff, CageyChameleon, and CryptoCore, has a

---

Spammers Abuse Google Forms Quizzes to Perform Scams

Cisco's Talos Intelligence blog reveals a sophisticated spam exploit using Google Forms' quiz results feature, collecting email addresses subtly via a quiz template. The spammer leverages Google's infrastructure to send phishing emails, bypassing spam blockers until Google addresses this method, ultimately leading victims to a complex cryptocurrency scam. As these types of scams continue to emerge now and then, organizations must stay updated on IoCs and block malicious indicators.

---

Hackers Breach Healthcare Organizations via ScreenConnect Remote Access

The attackers are targeting healthcare organizations in the U.S. using local ScreenConnect instances used by Transaction Data Systems (TDS), a pharmacy supply chain and management systems solution provider.

---

'Effluence' Backdoor Persists Despite Patching Atlassian Confluence Servers

Attackers exploited the CVE-2023-22515 vulnerability to gain initial access and embed a web shell, allowing them to execute malicious actions without needing a valid user account.

---

Cyberattack Continues to Affect Operations at Tri-City Medical Center in San Diego

The hospital has taken its information systems offline and is working with cybersecurity specialists and law enforcement to restore functionality, but it is unclear if a ransom has been demanded or if patient data has been compromised.

---

After ChatGPT, Anonymous Sudan Took Down Cloudflare Website

The attack caused intermittent connectivity issues for a few minutes but did not impact any services or products provided by Cloudflare. The group claims to have used the Skynet and Godzilla botnets for the recent attacks.

---

Stealthy Kamran Spyware Targeting Urdu-speaking Users in Gilgit-Baltistan

The spyware, disguised as an Android app, has been available on the website since January 2023 and has compromised at least 20 mobile devices, harvesting sensitive information and uploading it to a command-and-control server.

---

Update: McLaren Health Care Revealed That a Data Breach Impacted 2.2 Million People

The ALPHV/BlackCat ransomware group claimed responsibility for the breach and accused McLaren of attempting to cover it up, stating that they still have access to the organization's network.

---

Washington State Department of Transportation Working To Recover From Cyberattack

The cause of the cyberattack is under investigation, and while some parts of the website are back up, certain features such as the travel map and online freight permits remain out of service.

---

New APT Group DarkCasino and the Global Surge in WinRAR 0-Day Exploits

DarkCasino exploited a WinRAR 0-day vulnerability (CVE-2023-38831) to launch phishing attacks against forum users, posing a significant threat due to the large installed base and difficulty in identifying and defending against these attacks.