Latest Cybersecurity News and Articles

---

MalDoc in PDF: New Malicious Attack Discovered by JPCERT

Japan CERT has uncovered a novel attack technique named 'MalDoc in PDF' that involves embedding a malicious Word file into a PDF document to evade detection. While the file appears as a PDF, it can be opened in Word and execute malicious macros. JPCERT has shared detection details and a Yara rule in its report.

---

FBI Dismantles QakBot Malware, Frees 700,000 Computers, Seizes $8.6 Million

A coordinated law enforcement effort codenamed Operation Duck Hunt has felled QakBot, a notorious Windows malware family that's estimated to have compromised over 700,000 computers globally and facilitated financial fraud as well as ransomware. To that end, the U.S. Justice Department (DoJ) said the malware is "being deleted from victim computers, preventing it from doing any more harm," adding

---

U.S. Hacks QakBot, Quietly Removes Botnet Infections

The U.S. government today announced a coordinated crackdown against QakBot, a complex malware family used by multiple cybercrime groups to lay the groundwork for ransomware infections. The international law enforcement operation involved seizing control over the botnet's online infrastructure, and quietly removing the Qakbot malware from tens of thousands of infected Microsoft Windows computer systems.

---

University of Michigan Shuts Down Network After Cyberattack

The University of Michigan has taken all of its systems and services offline to deal with a cybersecurity incident, causing a widespread impact on online services the night before classes started.

---

DarkGate Malware Activity Spikes as Developer Rents Out Malware to Affiliates

"The current spike in DarkGate malware activity is plausible given the fact that the developer of the malware has recently started to rent out the malware to a limited number of affiliates," Telekom Security said in a report published last week.

---

Japan’s Cybersecurity Agency Breached by Suspected Chinese Hackers: Report

Suspected Chinese hackers breached Japan’s cybersecurity agency and potentially accessed sensitive data stored on its networks for nine months before being discovered, it was reported on Tuesday.

---

US Government Email Servers Hacked in Barracuda Zero-Day Attacks

The attacks' motivation was espionage, with the threat actor (tracked as UNC4841) engaging in targeted exfiltration from systems belonging to high-profile users in government and high-tech verticals.

---

Meta Fights Sprawling Chinese ‘Spamouflage’ Operation

The network typically posted praise for China and its Xinjiang province and criticisms of the United States, Western foreign policies, and critics of the Chinese government including journalists and researchers, the Meta report says.

---

80% of organizations expect ransomware spending to increase

Ransomware was analyzed in a recent report by Enterprise Strategy Group (ESG) finding that ransomware is seen as a top threat for organizations.

---

Chinese Hacking Group Exploits Barracuda Zero-Day to Target Government, Military, and Telecom

A suspected Chinese-nexus hacking group exploited a recently disclosed zero-day flaw in Barracuda Networks Email Security Gateway (ESG) appliances to breach government, military, defense and aerospace, high-tech industry, and telecom sectors as part of a global espionage campaign. Mandiant, which is tracking the activity under the name UNC4841, described the threat actor as "highly responsive to

---

DarkGate Malware Activity Spikes as Developer Rents Out Malware to Affiliates

A new malspam campaign has been observed deploying an off-the-shelf malware called DarkGate. "The current spike in DarkGate malware activity is plausible given the fact that the developer of the malware has recently started to rent out the malware to a limited number of affiliates," Telekom Security said in a report published last week. The latest findings build on recent findings from security

---

86% of organizations using AI agree on need for clear AI guidelines

Organizations' leadership and workforce were surveyed by Conversica on artificial intelligence (AI) use and opinions, including data security.

---

Compromised OpenCart Payment Module Steals Credit Card Information

Attackers are increasingly using backend PHP infections, making it more challenging to detect Magecart infections without access to the compromised website's backend code.

---

Is the Cybersecurity Community’s Obsession With Compliance Counter-Productive?

Cybersecurity professionals should focus on effectively defending their organizations against common breach types, rather than prioritizing compliance and checking boxes on audit forms.

---

Android Banking Trojan MMRat Carries Out Bank Fraud via Fake App Stores

MMRat uses customized command-and-control protocols and remains undetected on VirusTotal, highlighting its ability to evade detection and exploit large volumes of data transfer.

---

CISA publishes resource for migrating to post-quantum cryptography  

CISA urges organizations to begin early planning for migration to post-quantum cryptographic standards by developing quantum-readiness roadmaps.

---

Web Control, Crime Patrol or Real Pawns in Cybercrime

A group of young employees in Hyderabad ran a sophisticated scam using VOIP to target unsuspecting people in the U.S. and trick them into buying gift cards, which were then converted into cryptocurrency and Indian Rupees.

---

Study finds increase in cybersecurity attacks fueled by generative AI

A new report analyzes stressors caused by generative AI, with 51% of security professionals saying they are likely to leave their job over the next year.

---

Spainish Police Warns of LockBit Locker Ransomware Phishing Attacks

"A wave of sending emails to architecture companies has been detected, although it is not ruled out that they extend their action to other sectors," reads the machine-translated police announcement.

---

Survey Provides Takeaways for Security Pros to Operationalize their Remediation Life Cycle

Ask any security professional and they’ll tell you that remediating risks from various siloed security scanning tools requires a tedious and labor-intensive series of steps focused on deduplication, prioritization, and routing of issues to an appropriate “fixer” somewhere in the organization. This burden on already resource-strapped security teams is an efficiency killer.  A new study,