Latest Cybersecurity News and Articles

---

IT Leaders Alarmed by Generative Ai’s SAAS Security Implications

IT leaders are grappling with anxiety over the risks of generative AI despite continued confidence in their software-as-a-service (SaaS) security posture, according to Snow Software.

---

Global Cybercrime Treaty Could be ‘Disastrous for Human Rights,’ NGOs Warn

Human rights organizations are sounding alarm about a United Nations cybercrime treaty being negotiated this week in New York, warning that the rules could expand government surveillance powers and give dictatorships further tools of repression.

---

Phishing-as-a-Service Gets Smarter: Microsoft Sounds Alarm on AiTM Attacks

Microsoft is warning of an increase in adversary-in-the-middle (AiTM) phishing techniques, which are being propagated as part of the phishing-as-a-service (PhaaS) cybercrime model.

---

Privacy Regulators Tell Social Media Companies to Fear the Scrapers

Social media companies and other businesses have an obligation to protect users’ publicly available information from data scrapers that gather it for unintended purposes, an international group of privacy regulators said last week.

---

Japan's JPCERT Warns of New 'MalDoc in PDF' Attack Technique

Japan’s computer emergency response team (JPCERT) has recently observed a new attack technique, called ‘MalDoc in PDF’, that bypasses detection by embedding a malicious Word file into a PDF file.

---

Citrix NetScaler Alert: Ransomware Hackers Exploiting Critical Vulnerability

Unpatched Citrix NetScaler systems exposed to the internet are being targeted by unknown threat actors in what's suspected to be a ransomware attack. Cybersecurity company Sophos is tracking the activity cluster under the moniker STAC4663. Attack chains involve the exploitation of CVE-2023-3519, a critical code injection vulnerability impacting NetScaler ADC and Gateway servers that could

---

Corporate Boards Expand Cybersecurity Risk Oversight, Report Finds

With new Securities and Exchange Commission disclosure rules set to take effect in early September, a study from the EY Center for Board Matters shows director oversight of cybersecurity at Fortune 100 companies is rapidly evolving.

---

New TZW Ransomware Unlocked; Belongs to Adhubllka Family

Security researchers at Netenrich laid bare a previously misclassified strain of ransomware, TZW, as part of the Adhubllka ransomware family. Unlike other high-profile ransomware campaigns, TZW targets individuals and small businesses, demanding small ransoms ranging from $800 to $1,600. This study underscores how ransomware is intricately designed to confuse those seeking to counter cybercriminals.

---

Attackers can Discover IP Addresses by Sending Links Over the Skype Mobile App

A security researcher discovered that it's possible to discover a target’s IP address by sending a link over the Skype mobile app. The researcher pointed out that the attack only requires the target to open the message.

---

Update: Two Men Arrested Following Poland Railway Hacking

Polish police on Sunday arrested two men suspected of illegally hacking into the national railway’s communications network, which destabilized traffic in some areas of the country this weekend.

---

Cyber Info-Sharing Guide for Healthcare Sector Updated

Public-private cybersecurity councils urged the healthcare industry to be more expansive in sharing signs of hacking, warning that traditional indicators aren't enough to defend against modern cybersecurity threats.

---

Ransomware Attack Cleanup Costs: $10M So Far for Rackspace

The San Antonio, Texas, company's multi-million expenditure includes "costs to investigate and remediate, legal and other professional services, and supplemental staff resources that were deployed to provide support to customers."

---

Attacks on Citrix NetScaler Systems Linked to Ransomware Actor

A threat actor believed to be tied to the FIN8 hacking group exploits the CVE-2023-3519 remote code execution flaw to compromise unpatched Citrix NetScaler systems in domain-wide attacks.

---

Cybercriminals Used Just Three Malware Loaders to Launch 80% of Attacks, Deets Inside

ReliaQuest has identified the top malware loaders that have been causing trouble for SOC teams. These loaders are often used by threat actors to gain initial access to a network and drop payloads for further exploitation. The top seven most observed malware loaders from January 1 to July 31, 2023, include QakBot, SocGholish, Raspberry Robin, Gootloader, Guloader, Chromeloader, and Ursnif.

---

Phishing-as-a-Service Gets Smarter: Microsoft Sounds Alarm on AiTM Attacks

Microsoft is warning of an increase in adversary-in-the-middle (AiTM) phishing techniques, which are being propagated as part of the phishing-as-a-service (PhaaS) cybercrime model. In addition to an uptick in AiTM-capable PhaaS platforms, the tech giant noted that existing phishing services like PerSwaysion are incorporating AiTM capabilities. "This development in the PhaaS ecosystem enables

---

Gregory Thompson appointed as first CISO at Vantage Data Centers

Gregory Thompson has been appointed as Chief Information Security Officer at Vantage Data Centers. Thompson is the first CISO at the company. 

---

Key takeaways from BlackHat 2023

The best cyber defenses will only go so far. As Ukraine has shown, cyberattacks are not the only way to take down critical infrastructure.

---

Signs of Malware Attack Targeting Rust Developers Found on Crates.io

The Rust Foundation was notified and it quickly removed the packages and locked the uploader’s account. GitHub was also notified and took action against the associated account.

---

Uncovering a Privacy-Preserving Approach to Machine Learning

In the era of data-driven decision making, businesses are harnessing the power of machine learning (ML) to unlock valuable insights, gain operational efficiencies, and solidify competitive advantage.

---

Experts Uncover How Cybercriminals Could Exploit Microsoft Entra ID for Elevated Privilege

Cybersecurity researchers have discovered a case of privilege escalation associated with a Microsoft Entra ID (formerly Azure Active Directory) application by taking advantage of an abandoned reply URL. "An attacker could leverage this abandoned URL to redirect authorization codes to themselves, exchanging the ill-gotten authorization codes for access tokens," Secureworks Counter Threat Unit (