Latest Cybersecurity News and Articles

---

Ransomware-as-a-Service: The Growing Threat You Can't Ignore

Ransomware attacks have become a significant and pervasive threat in the ever-evolving realm of cybersecurity. Among the various iterations of ransomware, one trend that has gained prominence is Ransomware-as-a-Service (RaaS). This alarming development has transformed the cybercrime landscape, enabling individuals with limited technical expertise to carry out devastating attacks.

---

Russian FSB Cyber Actor Star Blizzard Continues Worldwide Spear-phishing Campaigns

Star Blizzard uses extensive research and preparation, including creating fake email accounts and social media profiles, to build trust with their targets before delivering malicious links.

---

Progress Software Discloses Two New CVEs in MOVEit

Progress Software has disclosed two new high-severity vulnerabilities in its MOVEit file-transfer service, bringing the total number of vulnerabilities to eight since a zero-day exploit in May.

---

Mac Users Beware: New Trojan-Proxy Malware Spreading via Pirated Software

Unauthorized websites distributing trojanized versions of cracked software have been found to infect Apple macOS users with a new Trojan-Proxy malware. "Attackers can use this type of malware to gain money by building a proxy server network or to perform criminal acts on behalf of the victim: to launch attacks on websites, companies and individuals, buy guns, drugs, and other illicit

---

BEC 3.0 Phishing Attack via Genial.ly

Hackers are using the free website Genial.ly to send phishing links as part of a Business Compromise 3.0 attack. Users receive legitimate-looking emails inviting them to click on a link to view content created in Genial.ly.

---

MrAnon Stealer Spreads via Email with Fake Hotel Booking PDF

This malware is a Python-based information stealer compressed with cx-Freeze to evade detection. MrAnon Stealer steals its victims' credentials, system information, browser sessions, and cryptocurrency extensions.

---

WordPress Releases Update 6.4.2 to Address Critical Remote Attack Vulnerability

WordPress has released version 6.4.2 with a patch for a critical security flaw that could be exploited by threat actors by combining it with another bug to execute arbitrary PHP code on vulnerable sites. "A remote code execution vulnerability that is not directly exploitable in core; however, the security team feels that there is a potential for high severity when combined with some plugins,

---

WordPress Fixes POP Chain Exposing Websites to RCE Attacks

This vulnerability could allow attackers to run arbitrary PHP code on a target website. The vulnerability is a Property Oriented Programming (POP) chain that requires an attacker to control all the properties of a deserialized object.

---

Founder of Bitzlato Cryptocurrency Exchange Pleads Guilty in Money-Laundering Scheme

The Russian founder of the now-defunct Bitzlato cryptocurrency exchange has pleaded guilty, nearly 11 months after he was arrested in Miami earlier this year. Anatoly Legkodymov (aka Anatolii Legkodymov, Gandalf, and Tolik), according to the U.S. Justice Department, admitted to operating an unlicensed money-transmitting business that enabled other criminal actors to launder their

---

John Denning joins FS-ISAC as Chief Information Security Officer

FS-ISAC has announced the appointment of John Denning as Chief Information Security Officer (CISO) effective as of January 1, 2024.

---

Google Pushes Yet Another Security Update to Its Chrome Browser

Chrome version 120 includes 10 bug fixes, with two of them being highly critical security patches. The high-ranked security vulnerabilities include "Use after free" exploits in Media Stream and Side Panel Search.

---

UK: Cambridge Hospitals Admit Two Excel-Based Data Breaches

A Cambridge NHS trust has admitted to two historic data breaches, involving the accidental disclosure of patient data while responding to Freedom of Information requests.

---

Dangerous Vulnerability in Fleet Management Software Seemingly Ignored by Vendor

The vulnerability, which impacts the Syrus4 IoT gateway made by Digital Communications Technologies (DCT), gives hackers access to the software and commands used to manage thousands of vehicles.

---

Groveport Madison School District Servers Hacked by Ransomware Group

The BlackSuit ransomware group was able to hack into two servers belonging to the school district, impacting Windows devices, file services, printers, and copiers. Phones were not impacted.

---

New SLAM Attack Steals Sensitive Data From AMD, Future Intel CPUs

The SLAM attack exploits hardware features in upcoming CPUs from Intel, AMD, and Arm to obtain the root password hash from kernel memory, highlighting potential security vulnerabilities.

---

47% of organizations monitored supply chain risks monthly or more

According to a report, there was a 26% increase in supply chain breaches in 2022 and 9% of organizations are working with suppliers to fix them.

---

Millions of Patient Scans and Health Records Spilling Online Thanks to Decades-Old DICOM Bug

Over 3,800 PACS servers across 110 countries are unintentionally exposing the private data of 16 million patients, including names, addresses, and even Social Security numbers.

---

Apple and Some Linux Distros are Open to Bluetooth Attack

A Bluetooth authentication bypass vulnerability, tracked as CVE-2023-45866, allows attackers to connect to Apple, Android, and Linux devices and inject keystrokes to run arbitrary commands.

---

Microsoft Warns of COLDRIVER's Evolving Evading and Credential-Stealing Tactics

The threat actor known as COLDRIVER has continued to engage in credential theft activities against entities that are of strategic interests to Russia while simultaneously improving its detection evasion capabilities. The Microsoft Threat Intelligence team is tracking under the cluster as Star Blizzard (formerly SEABORGIUM). It's also called Blue Callisto, BlueCharlie (or TAG-53),

---

TA422’s Dedicated Exploitation Loop—the Same Week After Week

Russian APT group TA422 has been actively exploiting patched vulnerabilities to target government, aerospace, education, finance, manufacturing, and technology sectors in Europe and North America.