Latest Cybersecurity News and Articles

---

New Ransomware Group Emerges with Hive's Source Code and Infrastructure

The threat actors behind a new ransomware group called Hunters International have acquired the source code and infrastructure from the now-dismantled Hive operation to kick-start its own efforts in the threat landscape. "It appears that the leadership of the Hive group made the strategic decision to cease their operations and transfer their remaining assets to another group, Hunters

---

Ransomware Group Leaks Files Allegedly Stolen From Boeing

The LockBit ransomware group has leaked gigabytes of files allegedly stolen from the systems of aerospace giant Boeing.  The post Ransomware Group Leaks Files Allegedly Stolen From Boeing appeared first on SecurityWeek.

---

Top 5 Marketing Tech SaaS Security Challenges

Effective marketing operations today are driven by the use of Software-as-a-Service (SaaS) applications. Marketing apps such as Salesforce, Hubspot, Outreach, Asana, Monday, and Box empower marketing teams, agencies, freelancers, and subject matter experts to collaborate seamlessly on campaigns and marketing initiatives.  These apps serve as the digital command centers for marketing

---

Major Phishing-as-a-Service Syndicate 'BulletProofLink' Dismantled by Malaysian Authorities

BulletProofLink offered ready-to-use phishing templates to conduct credential harvesting campaigns, targeting well-known services and engaging in double theft to maximize profits.

---

North Korea-Linked APT Sapphire Sleet Targets IT Job Seekers

They have created fake skills assessment portals to trick recruiters into registering for an account. Previously, they used platforms like LinkedIn and employed lures related to skills assessment.

---

Mr. Cooper Says Customer Data Compromised in Cyberattack

US mortgage giant Mr. Cooper announced that customer data was compromised in an October 31 cyberattack. The post Mr. Cooper Says Customer Data Compromised in Cyberattack appeared first on SecurityWeek.

---

Operations at Major Australian Ports Significantly Disrupted by Cyberattack

A cyberattack on Australian shipping giant DP World, which may have been a ransomware attack, has resulted in serious disruptions at major ports. The post Operations at Major Australian Ports Significantly Disrupted by Cyberattack appeared first on SecurityWeek.

---

CherryBlos Malware Steals Cryptocurrency via Your Photos

CherryBlos is a family of Android malware that can steal cryptocurrency by extracting sensitive information from photos on a user's phone. This includes details related to cryptocurrency wallets, such as recovery phrases.

---

Signature Techniques of Asian APT Groups Revealed

The industries most frequently targeted by Asian APT groups include government, industrial, healthcare, IT, agriculture, and energy sectors, emphasizing the importance of tailored security measures for these industries.

---

Yellen Says Ransomware Attack on China’s Biggest Bank Minimally Disrupted Treasury Market Trades

A ransomware attack that forced China’s biggest bank to take some systems offline only minimally disrupted the U.S. Treasury market. The post Yellen Says Ransomware Attack on China’s Biggest Bank Minimally Disrupted Treasury Market Trades appeared first on SecurityWeek.

---

Personal Information Impacted in Breach of Computer Network, Butler County Says

The county is conducting a review to determine the extent of the breach, identify those affected, and will provide written notice and credit monitoring services to impacted individuals.

---

Personal Information Impacted in Breach of Computer Network, Butler County Says

The county is conducting a review to determine the extent of the breach, identify those affected, and will provide written notice and credit monitoring services to impacted individuals.

---

Chinese Hackers Launch Covert Espionage Attacks on 24 Cambodian Organizations

Cybersecurity researchers have discovered what they say is malicious cyber activity orchestrated by two prominent Chinese nation-state hacking groups targeting 24 Cambodian government organizations. "This activity is believed to be part of a long-term espionage campaign," Palo Alto Networks Unit 42 researchers said in a report last week. "The observed activity aligns with geopolitical goals of

---

Major Phishing-as-a-Service Syndicate 'BulletProofLink' Dismantled by Malaysian Authorities

Malaysian law enforcement authorities have announced the takedown of a phishing-as-a-service (PhaaS) operation called BulletProofLink. The Royal Malaysian Police said the effort, which was carried out with assistance from the Australian Federal Police (AFP) and the U.S. Federal Bureau of Investigation (FBI) on November 6, 2023, was based on information that the threat actors behind the platform

---

New BiBi-Windows Wiper Targets Windows Systems in Pro-Hamas Attacks

Cybersecurity researchers have warned about a Windows version of a wiper malware that was previously observed targeting Linux systems in cyber attacks aimed at Israel. Dubbed BiBi-Windows Wiper by BlackBerry, the wiper is the Windows counterpart of BiBi-Linux Wiper, which has been put to use by a pro-Hamas hacktivist group in the wake of the Israel-Hamas war last month. "The Windows variant [...

---

Private UK health data donated for medical research shared with insurance companies

Observer investigation reveals UK Biobank opened its biomedical database to insurance firms despite pledge it would not do soSensitive health information donated for medical research by half a million UK citizens has been shared with insurance companies despite a pledge that it would not be.An Observer investigation has found that UK Biobank opened up its vast biomedical database to insurance sector firms several times between 2020 and 2023. The data was provided to insurance consultancy and tech firms for projects to create digital tools that help insurers predict a person’s risk of getting a chronic disease. The findings have raised concerns among geneticists, data privacy experts and campaigners over vetting and ethical checks at Biobank. Continue reading...

---

It’s Still Easy for Anyone to Become You at Experian

In the summer of 2022, KrebsOnSecurity documented the plight of several readers who had their accounts at big-three consumer credit reporting bureau Experian hijacked after identity thieves simply re-registered the accounts using a different email address. Sixteen months later, Experian clearly has not addressed this gaping lack of security. I know that because my account at Experian was recently hijacked, and the only way I could recover access was by recreating the account.

---

Microsoft Warns of Fake Skills Assessment Portals Targeting IT Job Seekers

A sub-cluster within the infamous Lazarus Group has established new infrastructure that impersonates skills assessment portals as part of its social engineering campaigns. Microsoft attributed the activity to a threat actor it calls Sapphire Sleet, describing it as a "shift in the persistent actor's tactics." Sapphire Sleet, also called APT38, BlueNoroff, CageyChameleon, and CryptoCore, has a

---

Spammers Abuse Google Forms Quizzes to Perform Scams

Cisco's Talos Intelligence blog reveals a sophisticated spam exploit using Google Forms' quiz results feature, collecting email addresses subtly via a quiz template. The spammer leverages Google's infrastructure to send phishing emails, bypassing spam blockers until Google addresses this method, ultimately leading victims to a complex cryptocurrency scam. As these types of scams continue to emerge now and then, organizations must stay updated on IoCs and block malicious indicators.

---

Hackers Breach Healthcare Organizations via ScreenConnect Remote Access

The attackers are targeting healthcare organizations in the U.S. using local ScreenConnect instances used by Transaction Data Systems (TDS), a pharmacy supply chain and management systems solution provider.