Latest Cybersecurity News and Articles

---

NoFilter Attack: Sneaky Privilege Escalation Method Bypasses Windows Security

A previously undetected attack method called NoFilter has been found to abuse the Windows Filtering Platform (WFP) to achieve privilege escalation in the Windows operating system. "If an attacker has the ability to execute code with admin privilege and the target is to perform LSASS Shtinkering, these privileges are not enough," Ron Ben Yizhak, a security researcher at Deep Instinct, told The

---

NYC Finance Department Sent Every Employee Their Colleagues’ Personal Info

The New York City’s tax collection agency accidentally shared the home addresses, cell phone numbers, and personal email addresses of more than 1,700 workers with all those employees.

---

White House holds roundtable on data protection

Participants at a White House roundtable shared insights and concerns about the harms and risks of companies sharing and selling consumer data.

---

China-Linked Bronze Starlight Group Targeting Gambling Sector with Cobalt Strike Beacons

An ongoing cyber attack campaign originating from China is targeting the Southeast Asian gambling sector to deploy Cobalt Strike beacons on compromised systems.  Cybersecurity firm SentinelOne said the tactics, techniques, and procedures point to the involvement of a threat actor tracked as Bronze Starlight (aka Emperor Dragonfly or Storm-0401), which has been linked to the use of short-lived 

---

Play Ransomware Found Using Security MSPs and N-Day Exploits to Attack

The Play ransomware group is targeting managed security service providers (MSSPs) to gain initial access and use up to a half-decade-old vulnerabilities in security appliances, warn security researchers with Adlumin.

---

New LABRAT Campaign Exploits GitLab Flaw for Cryptojacking and Proxyjacking Activities

A new, financially motivated operation dubbed LABRAT has been observed weaponizing a now-patched critical flaw in GitLab as part of a cryptojacking and proxyjacking campaign. "The attacker utilized undetected signature-based tools, sophisticated and stealthy cross-platform malware, command-and-control (C2) tools which bypassed firewalls, and kernel-based rootkits to hide their presence," Sysdig 

---

New Apple iOS 16 Exploit Enables Stealthy Cellular Access Under Fake Airplane Mode

Cybersecurity researchers have documented a novel post-exploit persistence technique on iOS 16 that could be abused to fly under the radar and main access to an Apple device even when the victim believes it is offline. The method "tricks the victim into thinking their device's Airplane Mode works when in reality the attacker (following successful device exploit) has planted an artificial

---

Over 74% of organizations see a rise in AI use by cybercriminals

 According to a recent report, the threat of email attacks generated by AI is growing year over year and is projected to increase exponentially.

---

Hackers are Increasingly Hiding Within Services Such as Slack and Trello to Deploy Malware

An analysis of more than 400 malware families deployed over the past two years found that at least a quarter of them abused legitimate internet services in some way as part of their infrastructure.

---

The Plan to Better Protect US Hospitals From Ransomware

The HHS' Advanced Research Projects Agency for Health (Arpa-H) launched an initiative to find and help fund the development of cybersecurity technologies that can specifically improve defenses for digital infrastructure in US health care.

---

Cybercriminals Selling SMS Bomber Attack Tools on Underground Forums

The underground market for SMS Bomber services is thriving, with various platforms offering attack services for a fee, highlighting the need for increased security measures in registration pages and APIs.

---

CISA Publishes Plan For Remote Monitoring Tools After Nation-State, Ransomware Exploitation

In an announcement Wednesday, CISA said it worked with industry partners as part of the Joint Cyber Defense Collaborative (JCDC) to create a “clear roadmap to advance security and resilience of the RMM ecosystem.”

---

CISA posts remote monitoring & management systems cyber defense plan

A new plan published by CISA through JCDC provides a roadmap to address systemic risks by advancing security and resilience of the RMM ecosystem.

---

Why You Need Continuous Network Monitoring?

Changes in the way we work have had significant implications for cybersecurity, not least in network monitoring. Workers no longer sit safely side-by-side on a corporate network, dev teams constantly spin up and tear down systems, exposing services to the internet. Keeping track of these users, changes and services is difficult – internet-facing attack surfaces rarely stay the same for long. But

---

Large-Scale Campaign Delivers Proxy Server App to Make Systems Serve as Residential Exit Nodes

The proxy application is silently installed by malware on infected systems without user knowledge or interaction, and it goes undetected by anti-virus software as it is signed.

---

Malvertisers up Their Game Against Researchers

Threat actors are using advanced cloaking techniques in malvertising campaigns to remain undetected and drop malware, making it more challenging for defenders to identify and report these incidents.

---

Ongoing Hijacking Campaign Targets LinkedIn Accounts

Several LinkedIn users have reported difficulties in recovering their hacked or locked-out accounts through LinkedIn support. Some claimed to have faced ransom demands or account deletion threats. In the past few months, according to Google Trends, there’s been a 5000% increase in searches related to LinkedIn account hacks and recovery.

---

AWS Customers’ Most Common Security Mistake

Misconfigurations play a central and persistent role in cyber intrusions. According to Google Cloud research released earlier this month, poor identity and access management is directly linked to more than 3 in 5 compromises in the cloud.

---

Russian Hackers Use Zulip Chat App for Covert C&C in Diplomatic Phishing Attacks

An ongoing campaign targeting ministries of foreign affairs of NATO-aligned countries points to the involvement of Russian threat actors. The phishing attacks feature PDF documents with diplomatic lures, some of which are disguised as coming from Germany, to deliver a variant of a malware called Duke, which has been attributed to APT29 (aka BlueBravo, Cloaked Ursa, Cozy Bear, Iron Hemlock,

---

Raccoon Stealer Returns with New Evasion Capabilities

After a 6-month hiatus, the developers behind the notorious Raccoon Stealer information-stealing malware have reintroduced version 2.3.0 to cybercriminal forums. Its enhanced features include a quick search tool, anti-suspicion measures against security-assisting bots, IP reporting to deter monitoring, and a log stats panel.