Latest Cybersecurity News and Articles

---

US Senator Quizzes 23andMe Over Credential-Stuffing Hack

Genetics testing firm 23andMe is facing multiple class action lawsuits and congressional scrutiny following a credential-stuffing hacking incident that exposed sensitive customer data.

---

California City Warns of Data Breach After Attack Claim by NoEscape Ransomware

The breach, which occurred from August 12 to September 26, involved the theft of personal information such as names, Social Security numbers, driver's license numbers, medical information, and health insurance policy numbers.

---

Humans Need to Rethink Trust in the Wake of Generative AI

A recent survey by ISACA revealed that the biggest risk associated with generative AI is misinformation and disinformation. This has led to concerns about privacy violations, social engineering, intellectual property loss, and job displacement.

---

Missouri school district announces data breach

Reeds Spring School District discovered in late September that threat actors had gained access to files between April 26, 2023 and May 18, 2023. 

---

N. Korean Lazarus Group Targets Software Vendor Using Known Flaws

The North Korea-aligned Lazarus Group has been attributed as behind a new campaign in which an unnamed software vendor was compromised through the exploitation of known security flaws in another high-profile software. The attack sequences, according to Kaspersky, culminated in the deployment of malware families such as SIGNBT and LPEClient, a known hacking tool used by the threat actor for

---

DuckTail Malware Spread via Fake Job Offers From Compromised LinkedIn Profiles

DuckTail is a highly elusive form of malicious software that evades detection, collects information about victims, communicates with a Command and Control server through a Telegram Bot, and exfiltrates data through ZIP archives.

---

In Other News: Ex-NSA Employee Spying for Russia, EU Threat Landscape, Cyber Education Funding

Noteworthy stories that might have slipped under the radar: Ex-NSA employee spying for Russia, EU threat landscape report, cyber education funding The post In Other News: Ex-NSA Employee Spying for Russia, EU Threat Landscape, Cyber Education Funding appeared first on SecurityWeek.

---

Report: Consumers are Taking Action to Protect Their Privacy

A recent survey conducted by Cisco reveals that younger consumers are more proactive in protecting their privacy, with 42% of those aged 18-24 exercising their Data Subject Access Rights.

---

Advanced ‘StripedFly’ Malware With 1 Million Infections Shows Similarities to NSA-Linked Tools

The StripedFly malware has APT-like capabilities, but remained unnoticed for five years, posing as a cryptocurrency miner. The post Advanced ‘StripedFly’ Malware With 1 Million Infections Shows Similarities to NSA-Linked Tools appeared first on SecurityWeek.

---

F5 Warns of Critical Remote Code Execution Vulnerability in BIG-IP

A critical-severity vulnerability in F5 BIG-IP CVE-2023-46747 allows unauthenticated attackers to execute code remotely. The post F5 Warns of Critical Remote Code Execution Vulnerability in BIG-IP appeared first on SecurityWeek.

---

Survey highlights 5 mounting pressures Chief Risk Officers face

A recent survey reveals Chief Risk Officers (CROs) are facing five pressures that require the acceleration in the transformation of the risk function to adapt to change.

---

Cybersecurity Resilience Quotient Metric for Measuring Security Effectiveness

The Cybersecurity Resilience Quotient (CRQ) metric goes beyond traditional approaches by considering factors such as asset exposure, vulnerability, criticality, architecture defensibility, and business process vulnerabilities.

---

In-Home Hospitality App Hello Alfred Exposes User Data

The in-home hospitality app exposed almost 170,000 user records, including sensitive personal data and partial payment information, due to a passwordless and publicly accessible database.

---

Report: Security Not a Priority For a Third of SMBs

A key point of contention is the shared responsibility model which is frequently misunderstood. While cloud providers like AWS secure the infrastructure, customers are responsible for safeguarding their sensitive data and other components.

---

Record-Breaking 100 Million RPS DDoS Attack Exploits HTTP/2 Rapid Reset Flaw

Cloudflare has revealed that it mitigated thousands of hyper-volumetric HTTP distributed denial-of-service (DDoS) attacks exploiting the recently disclosed HTTP/2 Rapid Reset flaw.

---

Security Leaders Have Good Reasons to Fear AI-Generated Attacks

According to Abnormal Security, the majority of security leaders are not adequately prepared to defend against AI-generated email attacks, relying on traditional solutions that lack effectiveness.

---

Android Adware Apps on Google Play Amass Two Million Installs

These apps, associated with malware families such as 'FakeApp,' 'Joker,' and 'HiddenAds,' have been downloaded over 2 million times. The HiddenAds apps push intrusive ads to users while hiding their presence on the infected devices.

---

FakeUpdateRU: New Malware Camouflaged as Fake Chrome Update

A new malware variant dubbed FakeUpdateRU was found targeting site visitors, attempting to trick them into downloading a fake Google Chrome update. The infection impacts WordPress websites as well as other CMS platforms. Google has blocked many domains associated with this malware, but attackers have adapted by linking directly to compromised websites.

---

New Project Analyzes and Catalogs Vendor Support for Secure PLC Coding

While some secure coding practices apply to all PLCs, others are specific to each vendor, making it difficult to find relevant documentation. The project aims to provide this information in an easy-to-digest format.

---

France Says Russian State Hackers Breached Numerous Critical Networks

The Russian APT28 hacking group, also known as 'Strontium' or 'Fancy Bear,' has been targeting government entities, businesses, universities, research institutes, and think tanks in France since the second half of 2021.