Latest Cybersecurity News and Articles

---

Rogue npm Package Deploys Open-Source Rootkit in New Supply Chain Attack

A new deceptive package hidden within the npm package registry has been uncovered deploying an open-source rootkit called r77, marking the first time a rogue package has delivered rootkit functionality. The package in question is node-hide-console-windows, which mimics the legitimate npm package node-hide-console-window in what's an instance of a typosquatting campaign. It was downloaded 704

---

Wisconsin County Dealing With Ransomware Attack on Public Health Department

The Cuba ransomware gang claimed responsibility for the attack, with concerns raised about potential connections to the Russian state due to their history of targeting government systems in Ukraine and Montenegro.

---

EU Parliament Wants Journalists to Have Better Protections From Spyware

There are differing views between the European Parliament and the European Council regarding the level of protections for journalists from spyware, which will be subject to negotiations.

---

Microsoft Warns of Cyber Attacks Attempting to Breach Cloud via SQL Server Instance

Microsoft has detailed a new campaign in which attackers unsuccessfully attempted to move laterally to a cloud environment through a SQL Server instance. "The attackers initially exploited a SQL injection vulnerability in an application within the target's environment," security researchers Sunders Bruskin, Hagai Ran Kestenberg, and Fady Nasereldeen said in a Tuesday report. "This allowed the

---

Indiana Attorney General Sues Provider Over Violation of Consumer Protection, Privacy Laws

CarePointe, a medical provider in Indiana, is being sued by the state attorney general for allegedly being aware of security risks before a ransomware attack exposed the personal information of 45,000 patients.

---

C-Suite Leaders to Boost Cybersecurity Compliance Amid SEC Disclosure Rule: Deloitte

Almost two-thirds of executives at publicly traded companies plan to strengthen their cybersecurity programs in response to a new rule by the SEC that requires companies to report material cybersecurity incidents within four business days.

---

Ransomware Reinfections on the Rise From Improper Remediation

Ransomware attacks can have devastating financial and reputational consequences, with the potential to close down businesses, highlighting the importance of effective remediation and prevention strategies.

---

Don’t Let Zombie Zoom Links Drag You Down

Many organizations, including Fortune 500 firms, have exposed Zoom links that allow unauthorized individuals to initiate video conference meetings, posing a risk of phishing and social engineering attacks.

---

New ‘Looney Tunables’ Linux Bug Gives Root Privileges on Major Distros

The flaw, introduced in glibc 2.34, highlights the severity and widespread nature of the vulnerability, emphasizing the need for immediate patching by system administrators.

---

ShellTorch Vulnerabilities Put Organizations at Risk of Server Takeover

The vulnerabilities, collectively known as "ShellTorch," have been patched in the latest version of TorchServe (0.8.2), hence, developers are encouraged to update to ensure their systems are secure.

---

LightSpy Spyware Evolves to Add New Plugins for Data Exfiltration

LightSpy, associated with the Chinese APT41 group, was found to contain a Core implant and 14 plugins for data exfiltration, supporting 24 different commands. LightSpy's Core supports 24 different commands, including self and plugin updates, indicating a sophisticated and versatile threat actor behind it.

---

Looney Tunables: New Linux Flaw Enables Privilege Escalation on Major Distributions

A new Linux security vulnerability dubbed Looney Tunables has been discovered in the GNU C library's ld.so dynamic loader that, if successfully exploited, could lead to a local privilege escalation and allow a threat actor to gain root privileges. Tracked as CVE-2023-4911 (CVSS score: 7.8), the issue is a buffer overflow that resides in the dynamic loader's processing of the GLIBC_TUNABLES

---

Qualcomm Releases Patch for Three New Zero-Days Under Active Exploitation

"There are indications from Google Threat Analysis Group and Google Project Zero that CVE-2023-33106, CVE-2023-33107, CVE-2022-22071, and CVE-2023-33063 may be under limited, targeted exploitation," the semiconductor company said in an advisory.

---

Experts Discover Multiple Malicious npm Packages

Researchers at FortiGuard Labs uncovered nine sets of malicious NPM packages designed to steal sensitive data, including system information, user credentials, and source code. These malicious packages use install scripts to exfiltrate data to webhooks or file-sharing links. These npm packages highlight a significant and often overlooked threat within the open-source ecosystem.

---

Motel One Group discloses data breach

The Motel One Group announced that the company was the target of a cyberattack affecting address data and customer credit card information.

---

81% of security leaders say that API security is a higher priority

According to a recent Noname Security report, API security is more of a priority for 81% of security leaders than it was 12 months ago.

---

Qualcomm Releases Patch for 3 new Zero-Days Under Active Exploitation

Chipmaker Qualcomm has released security updates to address 17 vulnerabilities in various components, while warning that three other zero-days have come under active exploitation. Of the 17 flaws, three are rated Critical, 13 are rated High, and one is rated Medium in severity. "There are indications from Google Threat Analysis Group and Google Project Zero that CVE-2023-33106, CVE-2023-33107,

---

Microsoft Edge, Teams Get Fixes for Zero-Days in Open-Source Libraries

The vulnerabilities are caused by heap buffer overflow weaknesses in open-source libraries used by the products, and they can lead to crashes or arbitrary code execution.

---

Warning: PyTorch Models Vulnerable to Remote Code Execution via ShellTorch

Cybersecurity researchers have disclosed multiple critical security flaws in the TorchServe tool for serving and scaling PyTorch models that could be chained to achieve remote code execution on affected systems. Israel-based runtime application security company Oligo, which made the discovery, has coined the vulnerabilities ShellTorch. "These vulnerabilities [...] can lead to a full chain Remote

---

US Executives Targeted in Phishing Attacks Exploiting Flaw in Indeed Job Platform

A recent phishing campaign has exploited an open redirection vulnerability in the popular job search platform Indeed, targeting executives in senior roles to steal their Microsoft credentials.