Latest Cybersecurity News and Articles

---

New Report Uncovers Three Distinct Clusters of China-Nexus Attacks on Southeast Asian Government

An unnamed Southeast Asian government has been targeted by multiple China-nexus threat actors as part of espionage campaigns targeting the region over extended periods of time. "While this activity occurred around the same time and in some instances even simultaneously on the same victims' machines, each cluster is characterized by distinct tools, modus operandi and infrastructure," Palo Alto

---

Outer Space and Juicy Mix: OilRig Campaigns Targeting Israeli Organizations

ESET revealed details on two cyberespionage campaigns conducted by the OilRig APT group against Israeli organizations, using spear-phishing emails. The Outer Space campaign utilized the Solar backdoor and the SC5k downloader, while the Juicy Mix campaign featured the Mango backdoor and additional browser-data dumpers and credential stealers. Organizations need to prioritize email security measures and employee training to combat spear-phishing attacks.

---

Teachers encouraged to enter schoolgirls into UK's flagship cyber security contest

Registration opens for the CyberFirst Girls competition 2023/2024.

---

Deadglyph: New Advanced Backdoor with Distinctive Malware Tactics

Cybersecurity researchers have discovered a previously undocumented advanced backdoor dubbed Deadglyph employed by a threat actor known as Stealth Falcon as part of a cyber espionage campaign. "Deadglyph's architecture is unusual as it consists of cooperating components – one a native x64 binary, the other a .NET assembly," ESET said in a new report shared with The Hacker News. "This combination

---

Update: Dallas Says Royal Ransomware Breached Its Network Using Stolen Account

Royal gained access to the City's network using a stolen domain service account in early April and maintained access to the compromised systems between April 7 and May 4.

---

Government of Bermuda Links Cyberattack to Russian Hackers

"The public is advised that the Government Is currently experiencing internet/email and phone service interruptions. All Departments are impacted," the Bermuda Government said.

---

Chinese, North Korean Nation-State Groups Target Health Data

Financially motivated groups originating in North Korea and China "have all the sophistication of many other cybercriminal gangs but also have the resources - technological, financial and diplomatic - of a state behind them," HHS HC3 warned.

---

Apple and Chrome Zero-Days Exploited to Hack Egyptian ex-MP with Predator Spyware

The three zero-day flaws addressed by Apple on September 21, 2023, were leveraged as part of an iPhone exploit chain in an attempt to deliver a spyware strain called Predator targeting former Egyptian member of parliament Ahmed Eltantawy between May and September 2023. "The targeting took place after Eltantawy publicly stated his plans to run for President in the 2024 Egyptian elections," the

---

Crypto Firm Nansen Asks Users to Reset Passwords After Vendor Breach

Nansen stopped the malicious activity shortly after the affected vendor informed them about the incident, but the ensuing investigation confirmed that user data was compromised.

---

LastPass: ‘Horse Gone Barn Bolted’ is Strong Password

The password manager service LastPass is now forcing some of its users to pick longer master passwords. LastPass says the changes are needed to ensure all customers are protected by their latest security improvements. But critics say the move is little more than a public relations stunt that will do nothing to help countless early adopters whose password vaults were exposed in a 2022 breach at LastPass.

---

Iranian Nation-State Actor OilRig Targets Israeli Organizations

The campaigns, dubbed Outer Space and Juicy Mix, entailed the use of two previously documented first-stage backdoors called Solar and Mango, which were deployed to collect sensitive information from major browsers and the Windows Credential Manager.

---

Hotel Hackers Redirect Guests to Fake booking.com to Steal Cards

Despite the sophisticated techniques used, users can still protect themselves by being cautious of unsolicited links, suspicious messages, and checking URLs for deception, as well as contacting the company directly for clarification.

---

Risk management legislation introduced to House of Representatives

The National Risk Management Act, designed to strengthen the defense of critical infrastructure, was introduced to the U.S. House of Representatives.

---

BBTok Banking Trojan Impersonates Over 40 Banks to Hijack Victim Accounts

The campaign uses advanced obfuscation techniques, phishing links, and geofencing to ensure victims are located only in Brazil and Mexico, demonstrating an evolution in the attackers' tactics.

---

New Variant of Banking Trojan BBTok Targets Over 40 Latin American Banks

An active malware campaign targeting Latin America is dispensing a new variant of a banking trojan called BBTok, particularly users in Brazil and Mexico. "The BBTok banker has a dedicated functionality that replicates the interfaces of more than 40 Mexican and Brazilian banks, and tricks the victims into entering its 2FA code to their bank accounts or into entering their payment card number,"

---

S&P 500 companies find gaps in their cybersecurity leadership

A report found that S&P 500 organizations have gaps in their cybersecurity leadership (CISOs and/or CIOs) when it comes to risk mitigation.

---

Ohio Community College Data Theft Breach Affects Nearly 300K

In a breach notification on Wednesday, Lakeland Community College didn't provide any details on the attack, which occurred between March 7 and March 31, but the Vice Society ransomware group had earlier listed the college on its data leak site.

---

57% of LockBit victims were organizations with 200 employees or fewer

A Trend Micro Incorporated report found that many ransomware actors are targeting smaller organizations that have 200 or fewer employees.

---

Attacker Unleashes Stealthy Crypto Mining via Malicious Python Package

The Python package "Culturestreak" is a malicious software that hijacks system resources for unauthorized cryptocurrency mining. The package utilizes obfuscated code and random filenames to evade detection, making it a persistent threat.

---

Sandman APT Infiltrates Telecommunications Companies Using LuaDream Backdoor

The activities of Sandman suggest espionage motivations, with a focus on telecommunications providers and a potential connection to a private contractor or mercenary group.