Latest Cybersecurity News and Articles

---

UK schoolgirls secure victory as champions of NCSC cyber skills contest

Teams of schoolgirls from across the UK have been crowned cyber security champions.

---

NCSC launches Cyber Incident Exercising scheme

New CIE assured providers give organisations support to create structured table-top or live-play cyber incident exercises.

---

The European Space Agency Explores Cybersecurity for Space Industry

The European Space Agency is developing a Space Cybersecurity Operations Centre (C-SOC) to detect and respond to emerging cyberattacks on space system infrastructures and the space industry.

---

Linux Version of Qilin Ransomware Focuses on VMware ESXi

The Linux encryptor includes extensive command-line options for customization, allowing threat actors to specify exclusion and encryption criteria, as well as configure virtual machines that should not be encrypted.

---

Account Takeover Attacks Use ScrubCrypt to Deploy RedLine Stealer Malware

The initial stage of the infection involves a .bat file delivered through social engineering, containing a base64-encoded payload??. This leads to an obfuscated .NET executable file as the next infection stage??.

---

The Current State of Open RAN Security

The Open Radio Access Network (ORAN) architecture, while providing standardized interfaces and protocols, is vulnerable to attacks through malicious xApps that can compromise the entire RAN Intelligent Controller (RIC) subsystem.

---

US Health Department Urges Hospitals to Patch Critical Citrix Bleed Bug

The U.S. Department of Health and Human Services (HHS) has warned hospitals about the actively exploited Citrix Bleed vulnerability used by ransomware gangs to breach networks, emphasizing the urgent need for patching.

---

US Man Jailed Eight Years for SIM Swapping and Apple Support Impersonation

The scams involved SIM swapping, social media account takeovers, Zelle payment fraud, and impersonating Apple Support personnel to steal money, NFTs, cryptocurrency, and other valuable digital property.

---

TrickBot Developer Pleads Guilty in US Court

A Russian national, Vladimir Dunaev, has pleaded guilty for his involvement in developing TrickBot malware, which targeted hospitals and healthcare centers with ransomware attacks during the COVID-19 pandemic.

---

Over 20,000 Vulnerable Microsoft Exchange Servers Exposed to Attacks

Over 30,000 servers have reached the end-of-life stage, with many still vulnerable to critical security issues. Some of these vulnerabilities can lead to remote code execution.

---

LogoFAIL: UEFI Vulnerabilities Expose Devices to Stealth Malware Attacks

The Unified Extensible Firmware Interface (UEFI) code from various independent firmware/BIOS vendors (IBVs) has been found vulnerable to potential attacks through high-impact flaws in image parsing libraries embedded into the firmware. The shortcomings, collectively labeled LogoFAIL by Binarly, "can be used by threat actors to deliver a malicious payload and bypass Secure Boot, Intel

---

DJvu ransomware Latest Variant Xaro Emerges in the Threat Landscape

A variant of the DJvu ransomware, named Xaro, has been identified in a campaign that leverages cracked software for distribution. Xaro is spread through an archive file masquerading as legitimate freeware. Organizations are advised to whitelist apps or sites to stay safe.

---

Microsoft Warns of Malvertising Scheme Spreading CACTUS Ransomware

Microsoft has warned of a new wave of CACTUS ransomware attacks that leverage malvertising lures to deploy DanaBot as an initial access vector. The DanaBot infections led to "hands-on-keyboard activity by ransomware operator Storm-0216 (Twisted Spider, UNC2198), culminating in the deployment of CACTUS ransomware," the Microsoft Threat Intelligence team said in a series of posts on X (

---

NCSC statement following exploitation of Unitronics programmable logic controllers

NCSC supports mitigation advice in advisory regarding exploitation of Unitronics programmable logic controllers used in the water sector and across a range of other industries.

---

Agent Racoon Backdoor Targets Organizations in Middle East, Africa, and U.S.

Organizations in the Middle East, Africa, and the U.S. have been targeted by an unknown threat actor to distribute a new backdoor called Agent Racoon. "This malware family is written using the .NET framework and leverages the domain name service (DNS) protocol to create a covert channel and provide different backdoor functionalities," Palo Alto Networks Unit 42 researcher Chema Garcia 

---

North Korea's Lazarus Group Rakes in $3 Billion from Cryptocurrency Hacks

The Lazarus Group, linked to North Korea, has exploited decentralized finance (DeFi) protocols to steal cryptocurrency and launder funds, contributing to the rise of DeFi hacking in 2022.

---

Russian Hacker Vladimir Dunaev Convicted for Creating TrickBot Malware

A Russian national has been found guilty in connection with his role in developing and deploying a malware known as TrickBot, the U.S. Department of Justice (DoJ) announced. Vladimir Dunaev, 40, was arrested in South Korea in September 2021 and extradited to the U.S. a month later. "Dunaev developed browser modifications and malicious tools that aided in credential harvesting and data

---

60 US Credit Unions Offline After Cloud Ransomware Infection

The affected IT provider, Ongoing Operations, was infiltrated through the Citrix Bleed vulnerability, emphasizing the importance of robust cybersecurity measures and patching vulnerabilities promptly.

---

Expert Warns of Turtle macOS Ransomware

While the Turtle ransomware may not pose a significant risk to macOS users currently, its existence highlights the ongoing efforts by ransomware authors to target Apple devices.

---

Surgical Practice Notifying 437,400 Patients of Data Theft

Proliance Surgeons, a large Seattle-based surgical group, suffered a ransomware attack and data theft, potentially compromising the personal information of nearly 437,400 individuals.