Latest Cybersecurity News and Articles

---

Report: UK's Sellafield Nuclear Site Hacked by Groups Linked to Russia and China

The breach was first detected in 2015, but it is still unclear if the malware has been fully eliminated. The compromised systems may have affected sensitive activities such as handling radioactive waste and monitoring for leaks or fires.

---

UK FCA Warns of Christmas Loan Fee Fraud Surge

Scammers are exploiting the need for loans for Christmas spending, leading to a surge in loan fee fraud – a type of scam where victims are promised loans they never receive, whilst being tricked into paying an upfront charge as a ‘deposit’ or ‘fee.’

---

ENISA Publishes Threat Landscape Report on DoS Attacks

The ENISA Threat Landscape for DoS Attacks report provides insights into the motivations, goals, and impacts of DoS attacks, highlighting the need for organizations to enhance their defenses and prepare prevention and remediation strategies.

---

Disney+ Cyber Scheme Exposes New Impersonation Attack Tactics

In one recent case, attackers sent auto-generated emails with attached PDFs personalized with the recipient's name, detailing an inflated charge for a Disney+ subscription.

---

US Federal Agencies Miss Deadline for Incident Response Requirements

A report by the US Government Accountability Office (GAO) has found that 20 US federal agencies have failed to meet the deadline for implementing incident response capabilities required by law.

---

East River Medical Notifies Over 605,000 Patients of Data Breach Affecting Their SSNs

The breach occurred between August 31, 2023, and September 20, 2023, prompting ERMI to secure its systems, involve law enforcement, and conduct an investigation with a cybersecurity firm.

---

Meta Launches Default End-to-End Encryption for Chats and Calls on Messenger

Meta has announced the rollout of end-to-end encryption (E2EE) in its Messenger app for personal calls and one-to-one messages. This update is considered a significant milestone and comes after years of redesigning the platform.

---

Google Fixes Three Chromecast Device Vulnerabilities

The bugs, discovered by external security researchers and labeled as CVE-2023-48424, CVE-2023-48425, and CVE-2023-6181, pose a risk of supply chain interception, where hackers replace legitimate software updates with malicious versions.

---

New Stealthy 'Krasue' Linux Trojan Targeting Telecom Firms in Thailand

A previously unknown Linux remote access trojan called Krasue has been observed targeting telecom companies in Thailand by threat actors to main covert access to victim networks at lease since 2021. Named after a nocturnal female spirit of Southeast Asian folklore, the malware is "able to conceal its own presence during the initialization phase," Group-IB said in a report

---

Meta Launches Default End-to-End Encryption for Chats and Calls on Messenger

Meta has officially begun to roll out support for end-to-end encryption (E2EE) in Messenger for personal calls and one-to-one personal messages by default in what it called the "most significant milestone yet." "This isn't a routine security update: we rebuilt the app from the ground up, in close consultation with privacy and safety experts," Loredana Crisan, vice president of

---

90% of global energy companies experienced a third-party data breach

Third-party data breaches against energy organizations were analyzed in a recent report, finding that 90% of global organizations have had a breach.

---

69% of organizations facing ransomware attacks paid the ransom

According to a recent Claroty report, 75% of respondents reported being targeted by ransomware in the past year and 69% paid the ransom.

---

Jennifer Williams named Vice President, Information Security at HOOPP

Healthcare of Ontario Pension Plan (HOOPP) has announced Jennifer Williams will be the new Vice President, Information Security.

---

ICANN Launches Service to Help With WHOIS Lookups

More than five years after domain name registrars started redacting personal data from all public domain registration records, the non-profit organization overseeing the domain industry has introduced a centralized online service designed to make it easier for researchers, law enforcement and others to request the information directly from registrars.

---

Cryptocurrency: The geopolitical and economic impacts

In Episode 18 of The Cybersecurity & Geopolitical Discussion, Lisa Forte, Phil Ingram and Ian Thornton-Trump discuss the impact of cryptocurrency on geopolitical and economic conflict.

---

40% of Google Drive files contain sensitive information

According to a new report, documents that had been shared externally often contained confidential information, with 18,000 files flagged as having “highly sensitive” data, like PII.

---

42% of flagged messages are impersonation warnings

According to a report, 42% of organizations say employees with BYOD policies that use tools like WhatsApp have led to new security incidents.

---

North Korean Andariel Hackers Steal South Korean Anti-Aircraft Data

Seoul police have seized the servers and virtual asset exchanges used by Andariel, arrested the person involved in transferring ransomware funds, and advised organizations to strengthen their cybersecurity measures to prevent future attacks.

---

Mine Digs up $30M for Its No-Code Approach to Vetting Data Privacy

Battery Ventures and PayPal Ventures are co-leading this round, with participation also from Nationwide Ventures and all its previous backers, including Saban Ventures, Gradient Ventures, MassMutual Ventures, and Headline Ventures.

---

Alert: Threat Actors Can Leverage AWS STS to Infiltrate Cloud Accounts

Threat actors can take advantage of Amazon Web Services Security Token Service (AWS STS) as a way to infiltrate cloud accounts and conduct follow-on attacks. The service enables threat actors to impersonate user identities and roles in cloud environments, Red Canary researchers Thomas Gardner and Cody Betsworth said in a Tuesday analysis. AWS STS is a web service that enables