Latest Cybersecurity News and Articles

---

Private UK health data donated for medical research shared with insurance companies

Observer investigation reveals UK Biobank opened its biomedical database to insurance firms despite pledge it would not do soSensitive health information donated for medical research by half a million UK citizens has been shared with insurance companies despite a pledge that it would not be.An Observer investigation has found that UK Biobank opened up its vast biomedical database to insurance sector firms several times between 2020 and 2023. The data was provided to insurance consultancy and tech firms for projects to create digital tools that help insurers predict a person’s risk of getting a chronic disease. The findings have raised concerns among geneticists, data privacy experts and campaigners over vetting and ethical checks at Biobank. Continue reading...

---

It’s Still Easy for Anyone to Become You at Experian

In the summer of 2022, KrebsOnSecurity documented the plight of several readers who had their accounts at big-three consumer credit reporting bureau Experian hijacked after identity thieves simply re-registered the accounts using a different email address. Sixteen months later, Experian clearly has not addressed this gaping lack of security. I know that because my account at Experian was recently hijacked, and the only way I could recover access was by recreating the account.

---

Microsoft Warns of Fake Skills Assessment Portals Targeting IT Job Seekers

A sub-cluster within the infamous Lazarus Group has established new infrastructure that impersonates skills assessment portals as part of its social engineering campaigns. Microsoft attributed the activity to a threat actor it calls Sapphire Sleet, describing it as a "shift in the persistent actor's tactics." Sapphire Sleet, also called APT38, BlueNoroff, CageyChameleon, and CryptoCore, has a

---

Spammers Abuse Google Forms Quizzes to Perform Scams

Cisco's Talos Intelligence blog reveals a sophisticated spam exploit using Google Forms' quiz results feature, collecting email addresses subtly via a quiz template. The spammer leverages Google's infrastructure to send phishing emails, bypassing spam blockers until Google addresses this method, ultimately leading victims to a complex cryptocurrency scam. As these types of scams continue to emerge now and then, organizations must stay updated on IoCs and block malicious indicators.

---

Hackers Breach Healthcare Organizations via ScreenConnect Remote Access

The attackers are targeting healthcare organizations in the U.S. using local ScreenConnect instances used by Transaction Data Systems (TDS), a pharmacy supply chain and management systems solution provider.

---

'Effluence' Backdoor Persists Despite Patching Atlassian Confluence Servers

Attackers exploited the CVE-2023-22515 vulnerability to gain initial access and embed a web shell, allowing them to execute malicious actions without needing a valid user account.

---

Cyberattack Continues to Affect Operations at Tri-City Medical Center in San Diego

The hospital has taken its information systems offline and is working with cybersecurity specialists and law enforcement to restore functionality, but it is unclear if a ransom has been demanded or if patient data has been compromised.

---

After ChatGPT, Anonymous Sudan Took Down Cloudflare Website

The attack caused intermittent connectivity issues for a few minutes but did not impact any services or products provided by Cloudflare. The group claims to have used the Skynet and Godzilla botnets for the recent attacks.

---

Stealthy Kamran Spyware Targeting Urdu-speaking Users in Gilgit-Baltistan

The spyware, disguised as an Android app, has been available on the website since January 2023 and has compromised at least 20 mobile devices, harvesting sensitive information and uploading it to a command-and-control server.

---

Update: McLaren Health Care Revealed That a Data Breach Impacted 2.2 Million People

The ALPHV/BlackCat ransomware group claimed responsibility for the breach and accused McLaren of attempting to cover it up, stating that they still have access to the organization's network.

---

Washington State Department of Transportation Working To Recover From Cyberattack

The cause of the cyberattack is under investigation, and while some parts of the website are back up, certain features such as the travel map and online freight permits remain out of service.

---

New APT Group DarkCasino and the Global Surge in WinRAR 0-Day Exploits

DarkCasino exploited a WinRAR 0-day vulnerability (CVE-2023-38831) to launch phishing attacks against forum users, posing a significant threat due to the large installed base and difficulty in identifying and defending against these attacks.

---

72% of security leaders are concerned about the adverse effects of AI

According to a report, 74% of IT and security decision makers said their organization’s IT or security budget increased compared to the year prior.

---

6% of companies have not had a digital risk cyberattack since 2020

A recent BrandShield survey of chief information security officers (CISOs) found that CISOs reported an average loss of $2.1M USD per cyberattack.

---

Industrial and Commercial Bank of China Dealing With LockBit Ransomware Attack

ICBC informed clients that a cybersecurity issue would require them to reroute trades and temporarily stop accepting orders. The attack highlights the vulnerability of critical infrastructure providers, such as the financial sector.

---

Dolly.com Pays Ransom, Attackers Release Data Anyway

The attackers gained access to sensitive company and customer data, including high-level account logins, credit card information, customer addresses, and more, posing a significant risk to Dolly.com and its users.

---

Diana Lovati hired as True Anomaly's first CISO

Diana Lovati was hired as the first CISO at True Anomaly. Lovati has experience with risk management, compliance, IT and data protection.

---

Hive Ransomware Resurfaces as Hunters International, Researchers Claim

Hunters International focuses on data exfiltration rather than encryption and primarily targets victims in the United States, the UK, Germany, and Namibia, including hospitals.

---

Cavelo Raises CA$5 Million for Attack Surface Management Platform

Cavelo has raised CA$5 million (~US$3.6 million USD) to help organizations comply with data protection regulations. The post Cavelo Raises CA$5 Million for Attack Surface Management Platform appeared first on SecurityWeek.

---

In Other News: EU Government Surveillance, Rewards for Iranian Hackers, Evolution of Chinese Spying

Noteworthy stories that might have slipped under the radar: EU regulation enables government surveillance, US offering rewards for Iranian hackers, evolution of Chinese spying.  The post In Other News: EU Government Surveillance, Rewards for Iranian Hackers, Evolution of Chinese Spying appeared first on SecurityWeek.