Latest Cybersecurity News and Articles

---

15 New CODESYS SDK Flaws Expose OT Environments to Remote Attacks

A set of 15 high-severity security flaws have been disclosed in the CODESYS V3 software development kit (SDK) that could result in remote code execution and denial-of-service under specific conditions, posing risks to operational technology (OT) environments. The flaws, tracked from CVE-2022-47379 through CVE-2022-47393 and dubbed CoDe16, carry a CVSS score of 8.8 with the exception of

---

CISA Adds Microsoft .NET Vulnerability to KEV Catalog Due to Active Exploitation

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a recently patched security flaw in Microsoft's .NET and Visual Studio products to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. Tracked as CVE-2023-38180 (CVSS score: 7.5), the high-severity flaw relates to a case denial-of-service (DoS) impacting .NET and Visual Studio. It

---

77% of financial firms saw an increase in cyberattack frequency

Cyberattacks against financial organizations were analyzed in a recent report, finding that 77% saw an increase in cyberattack frequency.

---

President Biden signs security technology executive order

In an effort to protect sensitive technology, President Biden signed an executive order on regulating U.S. security technology investments.

---

The Guardian view on Northern Ireland’s data leak: putting lives at risk | Editorial

The police’s error is hard to forgive, but ministers must treat Northern Ireland’s wider human safety needs as a priority tooA new documentary film recounts a grim story from the Northern Ireland Troubles. Half a century ago, Thomas Niedermayer was a German businessman living in Belfast. At Christmas in 1973, he was kidnapped from his home by the IRA, possibly to be traded for imprisoned bombers, and murdered. His body was found in a shallow grave in 1980. Ten years on, his widow, Ingeborg, took her own life. A year after that, the Niedermayers’ younger daughter, Renate, killed herself. Another two years later, their elder daughter, Gabriella, did the same.The Niedermayer murder, as detailed in the Face Down documentary, was vicious. For the family, the damage lasted for generations, creating new victims and further tragedies. The lesson is frighteningly timely. This week, the Police Service of Northern Ireland mistakenly published an online spreadsheet detailing the surnames, initials, ranks or grades, locations and departments of all current PSNI officers and civilian staff members. The spreadsheet was not taken down for three hours. Approximately 10,000 people were listed. The consequences could endure for decades. Continue reading...

---

Sweet Security Raises $12M Seed Round for its Cloud Security Suite

The $12 million seed round was led by Glilot Capital Partners, with participation from CyberArk Ventures and a number of angel investors including Gerhard Eschelbeck, a former CISO at Google, and Travis McPeak, who led product security at Databricks.

---

Encryption Flaws in Popular Chinese Language App Put Users' Typed Data at Risk

The findings come from the University of Toronto's Citizen Lab, which carried out an analysis of the encryption mechanism used in Tencent's Sogou Input Method, an app that has over 455 million monthly active users across Windows, Android, and iOS.

---

Fourty Vulnerabilities Patched in Android With August 2023 Security Updates

“Exploitation for many issues on Android is made more difficult by enhancements in newer versions of the Android platform. We encourage all users to update to the latest version of Android where possible,” Google noted in its security bulletin.

---

IRS Confirms Takedown of Bulletproof Hosting Provider Lolek

A popular bulletproof hosting platform was taken down by authorities in the U.S. and Poland this week, marking the latest effort to limit the anonymous access cybercriminals have to critical tools.

---

Adobe Patches 30 Acrobat, Reader Vulnerabilities on Patch Tuesday

Adobe on Tuesday rolled out a big batch of security updates for its flagship Acrobat and Reader software, patching at least 30 vulnerabilities affecting Windows and macOS installations.

---

Q2 of 2023 saw a rise in spam calls featuring family impersonations

According to a fraud report, while the overall volume of spam calls declined from Q1, data collected showed that the rate of fraud calls increased.

---

Update: The MOVEit Spree is as Bad as — or Worse — Than You Think it is

The mass exploit of a zero-day vulnerability in MOVEit has compromised more than 600 organizations and 40 million individuals to date, but the numbers mask a more disastrous outcome that’s still unfolding.

---

New Attack Alert: Freeze[.]rs Injector Weaponized for XWorm Malware Attacks

Malicious actors are using a legitimate Rust-based injector called Freeze[.]rs to deploy a commodity malware called XWorm in victim environments. The novel attack chain, detected by Fortinet FortiGuard Labs on July 13, 2023, is initiated via a phishing email containing a booby-trapped PDF file. It has also been used to introduce Remcos RAT by means of a crypter called SYK Crypter, which was

---

New Statc Stealer Malware Emerges: Your Sensitive Data at Risk

A new information malware strain called Statc Stealer has been found infecting devices running Microsoft Windows to siphon sensitive personal and payment information. "Statc Stealer exhibits a broad range of stealing capabilities, making it a significant threat," Zscaler ThreatLabz researchers Shivam Sharma and Amandeep Kumar said in a technical report published this week. "It can steal

---

NIST Releases Draft Overhaul of Its Core Cybersecurity Framework

The National Institute of Standards and Technology released a long-anticipated draft version of the Cybersecurity Framework 2.0 Tuesday, the first major update of the agency’s risk guidance since 2014.

---

Pro-Russian Hacker Group Claims Attacks on French, Dutch Websites

The latest attacks come a week after the group, NoName057(16), hit Spanish and Italian government and private sector organizations with distributed denial-of-service (DDoS) attacks.

---

Report: 37% Of Third-Party Applications Have High-Risk Permissions

Examining data since 2013, Abnormal identified a massive increase in third-party apps integrated with email, underscoring the proliferation of an emerging threat vector that cybercriminals are exploiting as they continue to shift their tactics.

---

China-Linked Hackers Strike 17 Nations in Three-Year-Long Cyber Campaign

Hackers associated with China's Ministry of State Security (MSS) have been linked to attacks in 17 different countries in Asia, Europe, and North America from 2021 to 2023.

---

Private network adoption grows as enterprises seek greater control and security

A market survey of prospective enterprises by Spirent reveals that security and network resiliency are key drivers motivating enterprises to consider private networking, fuelling a market forecast to reach $7.7 billion by 2027.

---

C-Level Executives at Over 100 Firms Targeted in Massive Cloud Account Takeover Scheme Using EvilProxy

Most of the attacks targeted high-ranking executives. The researchers estimated that the campaign targeted over 100 organizations globally, collectively representing 1.5 million employees.