Latest Cybersecurity News and Articles

---

Iranian APT Group OilRig Using New Menorah Malware for Covert Operations

Sophisticated cyber actors backed by Iran known as OilRig have been linked to a spear-phishing campaign that infects victims with a new strain of malware called Menorah. "The malware was designed for cyberespionage, capable of identifying the machine, reading and uploading files from the machine, and downloading another file or malware," Trend Micro researchers Mohamed Fahmy and Mahmoud Zohdy 

---

Researchers Extract Sounds From Still Images on Smartphone Cameras

A group of academic researchers has devised a technique to extract sounds from still images captured using smartphone cameras with rolling shutters and movable lens structures.

---

Large Michigan Healthcare Provider Confirms Ransomware Attack

McLaren HealthCare, one of the largest healthcare systems in Michigan, has confirmed a ransomware attack, potentially impacting patient data and causing disruptions in their computer network.

---

New Critical Security Flaws Expose Exim Mail Servers to Remote Attacks

The Exim maintainers and the Zero Day Initiative (ZDI) have experienced delays and communication issues in addressing these vulnerabilities, raising concerns about the handling of security flaws in widely used software.

---

FBI Warns Energy Sector of Likely Increase in Targeting by Chinese, Russian Hackers

The FBI warns that changes in the global energy supply, including US exports of liquefied natural gas and shifts in the crude oil supply chain, are likely to boost the targeting of critical energy infrastructure by Chinese and Russian hackers.

---

APT34 Deploys Phishing Attack With New Menorah Malware

The Menorah malware is designed for cyberespionage and possesses capabilities such as machine identification, file reading and uploading, shell command execution, and file downloading.

---

CISA Warns of Old JBoss RichFaces Vulnerability Being Exploited in Attacks

The flaw, tracked as CVE-2018-14667, was added by CISA on Thursday to its Known Exploited Vulnerabilities (KEV) Catalog, with federal agencies being instructed to apply mitigations or discontinue the use of the product by October 19.

---

New Critical Security Flaws Expose Exim Mail Servers to Remote Attacks

Multiple security vulnerabilities have been disclosed in the Exim mail transfer agent that, if successfully exploited, could result in information disclosure and remote code execution. The list of flaws, which were reported anonymously way back in June 2022, is as follows - CVE-2023-42114 (CVSS score: 3.7) - Exim NTLM Challenge Out-Of-Bounds Read Information Disclosure Vulnerability

---

Cybercriminals Using New ASMCrypt Malware Loader Flying Under the Radar

Threat actors are selling a new crypter and loader called ASMCrypt, which has been described as an "evolved version" of another loader malware known as DoubleFinger. "The idea behind this type of malware is to load the final payload without the loading process or the payload itself being detected by AV/EDR, etc.," Kaspersky said in an analysis published this week. DoubleFinger was first

---

City of Fort Lauderdale, Florida, Taken for $1.2m in Email Scam

The payment, intended for a new police headquarters building, was made to a scammer who posed as the legitimate contractor, Moss Construction. The incident underscores the need for increased cybersecurity measures against business email compromise.

---

What Happens to Government Devices During a Shutdown?

Government-issued devices face heightened security risks during a federal shutdown, as furloughed employees are typically restricted from using them, leaving networks and devices vulnerable.

---

Lazarus APT Lures Employees of Spanish Aerospace Company with Trojanized Coding Challenges

The attack involved the deployment of a sophisticated backdoor called LightlessCan, which mimics native Windows commands and implements techniques to avoid detection by security monitoring software.

---

FBI Warns Organizations of Dual Ransomware, Wiper Attacks

As part of this trend, which was observed in July 2023, the FBI notes in a new private industry notification, threat actors deploy two ransomware variants in close date proximity to one another.

---

Nexusflow Raises $10.6m to Build Conversational Interface for Security Tools

By synthesizing data from various security sources and utilizing natural language commands, Nexusflow aims to revolutionize cybersecurity operations by seamlessly interpreting human instructions and providing insights.

---

Hackers Set Sights on Apache NiFi Flaw That Exposes Many Organizations to Attacks

“The impact of this vulnerability is severe, as it grants attackers the ability to gain unauthorized access to systems, exfiltrate sensitive data, and execute malicious code remotely,” Cyfirma notes in an analysis of the bug and its exploitation.

---

Misconfigured AWS Storage Bucket of WSBC Leaks 4,600 Passports

The World Baseball Softball Confederation (WBSC) left a data repository exposed, including sensitive files such as copies of 4,600 national passports, putting individuals at risk of identity theft and other fraudulent activities.

---

CISA, NSA, FBI and Japan warn of BlackTech, PRC-linked cyber activity

CISA has recently published a Joint Cybersecurity Advisory about malicious activity by People’s Republic of China (PRC)-linked cyber actors known as BlackTech.

---

Security leaders discuss implications as Sony investigates recent cyber attack

Here, security leaders discuss their thoughts on the most recent alleged Sony attack and what lessons can be learned.

---

Tech Industry Leaders and White House Clash Over Plan for Improved Cloud Security

The industry argues that KYC could cost billions of dollars in administrative costs and raise privacy concerns, while sophisticated hackers would easily work around these requirements.

---

Budworm Strikes Again: Updated SysUpdate Targets Government and Telecom Sectors

The Budworm APT group is evolving its cyber arsenal. Budworm’s signature technique consists of executing SysUpdate on victims' networks by sideloading the DLL payload using the authentic INISafeWebSSO application - a tactic it has employed since at least 2018. Organizations should proactively update and patch their systems to counter known vulnerabilities exploited by tools like SysUpdate.