Latest Cybersecurity News and Articles

---

Microsoft Visual Studio Code Flaw Lets Extensions Steal Passwords

Microsoft's Visual Studio Code (VS Code) code editor and development environment contains a flaw that allows malicious extensions to retrieve authentication tokens stored in Windows, Linux, and macOS credential managers.

---

New Android 14 Security Feature: IT Admins Can Now Disable 2G Networks

Google has introduced a new security feature in Android 14 that allows IT administrators to disable support for 2G cellular networks in their managed device fleet. The search giant said it's introducing a second user setting to turn off support, at the model level, for null-ciphered cellular connections. "The Android Security Model assumes that all networks are hostile to keep users safe from

---

New SkidMap Malware Variant Targets Linux Distributions

A highly sophisticated malware variant called SkidMap is targeting vulnerable Redis services on a wide range of Linux distributions, including Alibaba, Anolis, CentOS, and RedHat. The attack chain begins with attackers logging into unsecured Redis instances via brute force attacks and setting up variables containing cron tasks under a base64 string. 

---

Microsoft Releases Patches for 74 New Vulnerabilities in August Update

Microsoft has patched a total of 74 flaws in its software as part of the company's Patch Tuesday updates for August 2023, down from the voluminous 132 vulnerabilities the company fixed last month. This comprises six Critical and 67 Important security vulnerabilities. Also released by the tech giant are two defense-in-depth updates for Microsoft Office (ADV230003) and the Memory Integrity System

---

New Report Exposes Vice Society's Collaboration with Rhysida Ransomware

Tactical similarities have been unearthed between the double extortion ransomware group known as Rhysida and Vice Society, including in their targeting of education and healthcare sectors. "As Vice Society was observed deploying a variety of commodity ransomware payloads, this link does not suggest that Rhysida is exclusively used by Vice Society, but shows with at least medium confidence that

---

Ensuring data privacy while working remotely

Protecting the personal information of remote executives.

---

Microsoft Patch Tuesday, August 2023 Edition

Microsoft Corp. today issued software updates to plug more than 70 security holes in its Windows operating systems and related products, including a patch that addresses multiple zero-day vulnerabilities currently being exploited in the wild.

---

Financial sector saw an 80% increase in interactive intrusions

Cyberattack trends were analyzed in a recent report by CrowdStrike. The report revealed a massive increase in identity-based intrusions.

---

Tom Gorup hired as Edigo Vice President of Security Services

Tom Gorup has been hired as the Vice President of Security Services at Edigo. Gorup has 15 years of experience in the cybersecurity industry.

---

Meet the Brains Behind the Malware-Friendly AI Chat Service ‘WormGPT’

WormGPT, a private new chatbot service advertised as a way to use Artificial Intelligence (AI) to help write malicious software without all the pesky prohibitions on such activity enforced by ChatGPT and Google Bard, has started adding restrictions on how the service can be used. Faced with customers trying to use WormGPT to create ransomware and phishing scams, the 23-year-old Portuguese programmer who created the project now says his service is slowly morphing into “a more controlled environment.” The large language models (LLMs) made by ChatGPT parent OpenAI or Google or Microsoft all have various safety measures designed to prevent people from abusing them for nefarious purposes — such as creating malware or hate speech. In contrast, WormGPT has promoted itself as a new LLM that was created specifically for cybercrime activities.

---

MPs fiddled with voter ID as electoral data security burned

Electoral Commission hack is reminder of importance of protecting democratic system where it countsIt turns out that while Conservative ministers were spending hours of parliamentary time in 2021-22 introducing requirements for voters to produce ID at polling stations – to protect elections against a threat most experts believed was negligible – the Electoral Commission was being hacked by “hostile actors”.These hackers, who have not been identified and whose motivations are unclear, were able to access the data, such as home addresses, of millions of voters, many of whom choose not to make that information publicly available. Continue reading...

---

Ukrainian State Agencies Targeted with Open-Source Malware MerlinAgent

In early August, an unidentified threat actor tracked as UAC-0154 sent malicious emails to its targets, purportedly containing security tips from Ukraine's computer emergency response team (CERT-UA).

---

Hackers Increasingly Abuse Cloudflare Tunnels for Stealthy Connections

Cloudflare Tunnels provide a range of access controls, gateway configurations, team management, and user analytics, giving users a high degree of control over the tunnel and the exposed compromised services.

---

New Malware Campaign Targets Inexperienced Cybercriminals with OpenBullet Configs

A new malware campaign has been observed making use of malicious OpenBullet configuration files to target inexperienced cybercriminals with the goal of delivering a remote access trojan (RAT) capable of stealing sensitive information.

---

New Threat Actor Targets Bulgaria, China, Vietnam, and Other Countries With Customized Yashma Ransomware

The threat actor behind this operation uses an uncommon technique of downloading the ransom note from a GitHub repository, evading detection by embedding it in an embedded batch file.

---

Report: Two-Thirds of UK Sites Vulnerable to Bad Bots

The majority (66%) of UK websites are unable to block simple bot attacks, exposing their businesses to fraud, account compromise, and much more, according to a report by DataDome.

---

QakBot Malware Operators Expand C2 Network with 15 New Servers

The operators associated with the QakBot (aka QBot) malware have set up 15 new command-and-control (C2) servers as of late June 2023. The findings are a continuation of the malware's infrastructure analysis from Team Cymru, and arrive a little over two months after Lumen Black Lotus Labs revealed that 25% of its C2 servers are only active for a single day. "QakBot has a history of taking an

---

Invisible Ad Fraud Campaign Targets South Korean Android Users

The discovery by McAfee’s Mobile Research Team shed light on a trend where certain apps distributed through Google Play discreetly load ads while the user’s device screen is turned off.

---

White House Pushes Cybersecurity Defense for K-12 Schools

Typically understaffed and underfunded when it comes to cybersecurity, American K-12 schools have experienced a ramp-up in ransomware attacks, particularly after the pandemic forced the hasty adoption of remote tools for teaching.

---

HHS Warns Healthcare Sector of Attacks by Rhysida Ransomware Group

Authorities are sounding the alarm about double-extortion attacks against healthcare and public health sector organizations by a relatively new ransomware-as-a-service group, Rhysida, which until recently had mainly focused on other industries.