Latest Cybersecurity News and Articles

---

A Third of UK University Students Targeted By Fraud

One in three students at British universities encountered fraud attempts online last year, according to a new study from NatWest. A third of respondents said they’d encountered a scam over the previous 12 months.

---

Public Sector Hit in Sudden Surge, Reveals New Report

A BlackBerry threat intelligence report revealed a 40% rise in cyberattacks against government and public service entities versus the previous quarter. This includes public transit, utilities, schools, and other government services we rely on daily.

---

How Disjoined Threat Intelligence Limits Companies — And What to do About it

Threat intelligence is more abundant than ever. The information defenders can use to hunt, prepare for and counter potential threats isn’t hard to find, but it is fragmented.

---

Ransomware: To Pay or Not to Pay

The best strategy against ransomware attacks is a combination of robust defenses to protect assets and a focus on resilience and flexibility to minimize disruptions and respond effectively to incidents.

---

PDF Lures Aimed at NATO Countries Contain a Russian Clue

One of the PDFs delivered a variant of Duke, malware that has been linked to Russian state-sponsored cyber-espionage activities of APT29, also known as Nobelium, Cozy Bear, and The Dukes.

---

Global IoT Trust Survey Reveals Security Concerns

A report, Circles of Trust 2023: Exploring Consumer Trust in the Digital Society, published by Utimaco, suggests only 14% of consumers view smart devices as secure, despite 38% using them.

---

CISA Warns of Critical Citrix ShareFile Flaw Exploited in the Wild

CISA is warning that a critical Citrix ShareFile secure file transfer vulnerability tracked as CVE-2023-24489 is being targeted by unknown actors and has added the flaw to its catalog of known security flaws exploited in the wild.

---

Google Introduces First Quantum Resilient FIDO2 Security Key Implementation

The development comes less than a week after the tech giant said it plans to add support for quantum-resistant encryption algorithms in Chrome 116 to set up symmetric keys in TLS connections.

---

If there is a lesson from the NI police data breach it is not to forget the cruelty of the Troubles | Martin Kettle

The leak could undermine security in Northern Ireland – restoring power sharing is a political necessity at this momentHalf of the people who live in these islands have no adult memory at all of the Northern Ireland troubles. Too many of those who can remember them have allowed the bombings, shootings, riots and violence to slip from their minds in the 25 years that have passed since a peace treaty was signed in 1998. But last week’s data leak by the Police Service of Northern Ireland (PSNI) ought to be a wake-up call for the forgetful, and a lightbulb moment for the unaware.Nine days ago, in response to a freedom of information request whose provenance remains unclear, someone in the PSNI mistakenly put the names, initials, ranks, place of work and departments of all of its 10,000 officers and staff online for about three hours before they were removed. Especially in a profession where police and their families were, and sometimes still are, regular targets, it was a spectacular security breach, even in these more peaceful times.Martin Kettle is a Guardian columnist Continue reading...

---

Unveiling the Sophisticated Statc Stealer

Zscaler ThreatLabz detected and dissected Statc Stealer, a potent information-stealing malware targeting Windows systems. This C++-based malware effectively extracts sensitive data from popular web browsers, cryptocurrency wallets, and messaging apps like Telegram. To counteract the risks, the implementation of several proactive strategies such as education and awareness, robust antivirus solutions, and network monitoring, among others, is essential.

---

CISA Adds Citrix ShareFile Flaw to KEV Catalog Due to In-the-Wild Attacks

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical security flaw in Citrix ShareFile storage zones controller to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active in-the-wild exploitation. Tracked as CVE-2023-24489 (CVSS score: 9.8), the shortcoming has been described as an improper access control bug that, if successfully exploited

---

70% of web applications have severe security gaps

According to a CyCognito report, 74% of assets with personally identifiable information (PII) are vulnerable to at least one known major exploit.

---

Major U.S. Energy Organization Targeted in QR Code Phishing Attack

According to Cofense, who spotted this campaign, this is the first time that QR codes have been used at this scale, indicating that more phishing actors may be testing their effectiveness as an attack vector.

---

Chrome 116 Patches 26 Vulnerabilities

Google on Tuesday announced the release of Chrome 116 to the stable channel with patches for 26 vulnerabilities, including 21 reported by external researchers. Of the externally reported bugs, eight have a severity rating of ‘high.’

---

Report finds exposed sensitive data in more than 30% of cloud assets

A new report reveals that more than 30% of cloud data assets contain sensitive information.

---

Experts Uncover Weaknesses in PowerShell Gallery Enabling Supply Chain Attacks

The flaws have to do with the service's lax policy surrounding package names, lacking protections against typosquatting attacks, as a result enabling attackers to upload malicious PowerShell modules that appear genuine to unsuspecting users.

---

Chamber of Commerce Urges SEC to Delay Cyber Rule Implementation

The U.S. Chamber of Commerce urged the Securities and Exchange Commission to delay by a year the effective date of new cybersecurity rules, saying the regulatory move could otherwise have “severe consequences” for companies.

---

Scott Sykes joins Asurity as Chief Information Security Officer

Scott Sykes has been hired as CISO at Asurity Technologies. Sykes was previously CISO at Netcracker Technology and Tata Communications.

---

Raccoon Stealer Malware Returns With New Stealthier Version

The developers of Raccoon Stealer information-stealing malware have ended their 6-month hiatus from hacker forums to promote a new 2.3.0 version of the malware to cybercriminals.

---

Automotive data privacy under scrutiny in California

California regulators are examining how automakers and others handle data collected from internet-connected vehicles, the California Privacy Protection Agency said late last month.