Latest Cybersecurity News and Articles

---

New Malvertising Campaign Uses Fake Windows News Portal to Distribute Malicious Installers

A new malvertising campaign has been found to employ fake sites that masquerade as legitimate Windows news portal to propagate a malicious installer for a popular system profiling tool called CPU-Z. "This incident is a part of a larger malvertising campaign that targets other utilities like Notepad++, Citrix, and VNC Viewer as seen in its infrastructure (domain names) and cloaking templates used

---

SysAid Zero-Day Vulnerability Exploited by Ransomware Group

The vulnerability, tracked as CVE-2023-47246, allows for arbitrary code execution and has been exploited by a threat actor known as Lace Tempest, who is associated with the deployment of Cl0p ransomware.

---

Study shows data breaches decreased 84% in US during Q3

The U.S. is still the first most breached country in Q3 2023 despite a decrease in breach count, according to a recent report.

---

CISA Alerts of High-Severity SLP Vulnerability Now Under Active Exploitation

The vulnerability allows an unauthenticated, remote attacker to register services and use spoofed UDP traffic to conduct a DoS attack with a significant amplification factor, making it a serious threat to network and server security.

---

Iranian Hackers are Using New MuddyC2Go C2 Framework Against Israel

MuddyC2Go allows the threat actors to automate the connection to their command-and-control server using an embedded PowerShell script, eliminating the need for manual execution.

---

Risk Ledger Raises £6.25 Million for Supply Chain Security Solution

UK-based Risk Ledger has raised £6.25 million (~$7.65 million) in Series A funding to prevent supply chain attacks. The post Risk Ledger Raises £6.25 Million for Supply Chain Security Solution appeared first on SecurityWeek.

---

Japan Aviation Electronics Targeted in Ransomware Attack

Japan Aviation Electronics confirms cyberattack as Alphv/BlackCat ransomware group publishes allegedly stolen data. The post Japan Aviation Electronics Targeted in Ransomware Attack appeared first on SecurityWeek.

---

When Email Security Meets SaaS Security: Uncovering Risky Auto-Forwarding Rules

While intended for convenience and efficient communication, email auto-forwarding rules can inadvertently lead to the unauthorized dissemination of sensitive information to external entities, putting confidential data at risk of exposure to unauthorized parties. Wing Security (Wing), a SaaS security company, announced yesterday that their SaaS shadow IT discovery methods now include a solution

---

MuddyC2Go: New C2 Framework Iranian Hackers Using Against Israel

Iranian nation-state actors have been observed using a previously undocumented command-and-control (C2) framework called MuddyC2Go as part of attacks targeting Israel. "The framework's web component is written in the Go programming language," Deep Instinct security researcher Simon Kenin said in a technical report published Wednesday. The tool has been attributed to MuddyWater, an Iranian 

---

Council for Scottish Islands Faces IT Outage After ‘Incident’

Organizations must urgently apply the patch for the Citrix vulnerability, CitrixBleed, and actively hunt for any malicious activity to prevent session hijacking and data breaches.

---

CISA Says SLP Vulnerability Allowing Amplified DoS Attacks Exploited in the Wild

CISA says an SLP vulnerability allowing for a DoS amplification factor of 2,000 is being exploited in attacks. The post CISA Says SLP Vulnerability Allowing Amplified DoS Attacks Exploited in the Wild appeared first on SecurityWeek.

---

SysAid Zero-Day Vulnerability Exploited by Ransomware Group

CVE-2023-47246 zero-day vulnerability in SysAid IT service management software has been exploited by Cl0p ransomware affiliates. The post SysAid Zero-Day Vulnerability Exploited by Ransomware Group appeared first on SecurityWeek.

---

US Urges Critical Infrastructure Firms to Get “Shields Ready”

The US government has launched a new campaign designed to encourage CNI stakeholders to enhance cyber-resilience in their organizations. The “Shields Ready” initiative is intended to complement the successful “Shields Up” campaign.

---

Researchers Uncover Undetectable Crypto Mining Technique on Azure Automation

SafeBreach discovered three methods to run the miner, including exploiting a bug in the Azure pricing calculator, creating a dummy test-job, and leveraging Azure Automation's custom Python package upload feature.

---

Russian Hackers Used OT Attack to Disrupt Power in Ukraine Amid Mass Missile Strikes

Mandiant says Russia's Sandworm hackers used a novel OT attack to cause power outages that coincided with mass missile strikes on critical infrastructure across Ukraine. The post Russian Hackers Used OT Attack to Disrupt Power in Ukraine Amid Mass Missile Strikes appeared first on SecurityWeek.

---

Russian Hackers Used Novel OT Attack to Disrupt Ukrainian Power Amid Mass Missile Strikes

Mandiant says Russia's Sandworm hackers used a novel OT attack to cause power outages that coincided with mass missile strikes on critical infrastructure across Ukraine. The post Russian Hackers Used Novel OT Attack to Disrupt Ukrainian Power Amid Mass Missile Strikes appeared first on SecurityWeek.

---

CISA Alerts: High-Severity SLP Vulnerability Now Under Active Exploitation

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a high-severity flaw in the Service Location Protocol (SLP) to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. Tracked as CVE-2023-29552 (CVSS score: 7.5), the issue relates to a denial-of-service (DoS) vulnerability that could be weaponized to launch massive DoS

---

New ObjCShellz Malware Spotted Targeting macOS Systems

The North Korea-based BlueNoroff APT group has been linked with a new malware strain that is being used to target macOS systems. Dubbed ObjCShellz, the malware shares similarities with the RustBucket malware campaign, which came to light earlier this year.

---

Black Friday bargain hunters warned of enhanced online scams after millions lost last year

Latest Cyber Aware campaign aims to help shoppers protect themselves online in the run up to the festive period.

---

Protecto Joins Cadre of Startups in AI Data Protection Space

Silicon Valley startup is pitching APIs to help organizations protect data and ensure compliance throughout the AI deployment lifecycle. The post Protecto Joins Cadre of Startups in AI Data Protection Space appeared first on SecurityWeek.