Latest Cybersecurity News and Articles

---

Crypto Investor Losses Near $1M in Rug Pull Scheme

The recently identified scam involved the creation of counterfeit tokens and manipulated trading activities to attract investors before swiftly withdrawing liquidity and causing substantial losses.

---

App Used by Hundreds of Schools Leaking Children’s Data

The leaked data poses a significant threat to children, as it can be exploited by malicious actors for extortion, impersonation, identity theft, fraud, and even potential child abuse.

---

Vanderbilt University Medical Center Investigating Cybersecurity Incident

The hospital system was added to the leak site of the Meow ransomware gang. VUMC has confirmed the incident but has not provided details on when it occurred or the effects of the attack.

---

New 'HrServ.dll' Web Shell Detected in APT Attack Targeting Afghan Government

An unspecified government entity in Afghanistan was targeted by a previously undocumented web shell called HrServ in what’s suspected to be an advanced persistent threat (APT) attack. The web shell, a dynamic-link library (DLL) named “hrserv.dll,” exhibits “sophisticated features such as custom encoding methods for client communication and in-memory execution,” Kaspersky security researcher Mert

---

Warning: 3 Critical Vulnerabilities Expose ownCloud Users to Data Breaches

The maintainers of the open-source file-sharing software ownCloud have warned of three critical security flaws that could be exploited to disclose sensitive information and modify files. A brief description of the vulnerabilities is as follows - Disclosure of sensitive credentials and configuration in containerized deployments impacting graphapi versions from 0.2.0 to 0.3.0. (CVSS score: 10.0)

---

North Korean Supply Chain Attacks Prompt Joint Warning From South Korea and the UK

The United Kingdom and South Korea have issued a joint advisory warning about software supply chain attacks carried out by North Korean state-linked hackers, highlighting the increasing volume and sophistication of such attacks.

---

Bahrain Government Websites Briefly Inaccessible After Cyberattack Over Israel-Hamas War

The Al-Toufan hacker group targeted the Foreign Ministry and the Information Affairs Ministry's websites and also released scans of passports allegedly obtained from the hack.

---

Hackers Demand $60M From TransUnion and Experian in South Africa, Claiming Data Theft

The hacker group, known as N4ughtySecTU, demanded a ransom of $30 million from both the credit reporting agencies and claims to have direct access to their data and infrastructure.

---

Taj Hotel Data Breach Potentially Impacts 1.5 Million Customers

The breach occurred in November and a threat actor named "Dnacookies" is demanding $5,000 for the full dataset, which includes customers' addresses, mobile numbers, and membership IDs.

---

Rhysida, the new ransomware gang behind British Library cyber-attack

Gang thought to be from Russia or CIS has attacked companies and institutions in several countriesA new name was added to the cyber-rogues’ gallery of ransomware gangs this week after a criminal group called Rhysida claimed responsibility for an attack on the British Library.The library confirmed that personal data stolen in a cyber-attack last month has appeared for sale online. Continue reading...

---

Cyberattack at Legal Sector Service Provider CTS Disrupts UK Property Deals

CTS, a legal sector specialist infrastructure service provider, confirmed in a statement that it has experienced a service outage caused by a cyber-incident. The outage is believed to have affected up to 200 law firms that use CTS’ services.

---

Australia’s Cybersecurity Strategy Focuses on Protecting Small Businesses and Critical Infrastructure

The strategy includes financial investments to support small and medium businesses, strengthen critical infrastructure, and enhance cyber capabilities, but critics argue that the allocated funds are insufficient.

---

Cybercriminals Using Telekopye Telegram Bot to Craft Phishing Scams on a Grand Scale

More details have emerged about a malicious Telegram bot called Telekopye that's used by threat actors to pull off large-scale phishing scams. "Telekopye can craft phishing websites, emails, SMS messages, and more," ESET security researcher Radek Jizba said in a new analysis. The threat actors behind the operation – codenamed Neanderthals – are known to run the criminal enterprise as a

---

BlackCat Ransomware Claims Attack on Fidelity National Financial

The incident involved an intruder accessing Fidelity National Financial's systems and acquiring certain credentials, leading to the shutdown of various systems and impacting the company's operations.

---

Telekopye Toolkit Used as Telegram Bot to Scam Online Marketplace Users

The Telekopye Toolkit, implemented as a Telegram bot, is a tool used by scammers to deceive users in online marketplaces by creating phishing websites and fabricating fake screenshots, emails, and SMS messages.

---

FTC announces plans to mitigate AI voice fraud

The Federal Trade Commission (FTC) has announced plans to better protect consumers from artificial intelligence (AI) voice cloning and fraud.

---

Rust-Powered SysJoker Backdoor Used in Hamas-Linked Cyberattacks Against Israel

The use of OneDrive instead of Google Drive for storing command-and-control server URLs allows attackers to easily change the C2 address and stay ahead of reputation-based services.

---

Phishing Emails Soar 237% Ahead of Black Friday

Between November 1 and November 14 this year, security vendor Egress detected a 237% increase in phishing emails relating specifically to Black Friday and Cyber Monday, versus the period September 1-October 31.

---

William Wetherill named new DefenseStorm CISO

 After nine years, Robert Thibodeaux, DefenseStorm's Chief Information Security Officer (CISO), will retire and William Wetherill will step in as the new CISO.

---

Kubernetes Secrets of Fortune 500 Companies Exposed in Public Repositories

Publicly exposed Kubernetes configuration secrets pose a significant risk of supply chain attacks, with credentials for accessing container image registries being stored in public repositories.