Latest Cybersecurity News and Articles

---

BlackTech APT Breaks in Cisco Routers, Targets U.S. and Japanese Companies

A Chinese state-sponsored APT called BlackTech has been found breaking into network routers to remain undetected and stealthily move across a variety of organizations. BlackTech actors often focus on branch routers (typically smaller appliances used at remote branch offices) and take advantage of the trusted connections between a victim and other entities to expand their access to the targeted networks. 

---

Progress Software Patches Critical Pre-Auth Flaws in WS_FTP Server Product

The company identified eight flaws that could be exploited remotely, with two of them (CVE-2023-40044 and CVE-2023-42657) rated as critical due to the risk of pre-authenticated remote command execution attacks.

---

Progress Software Releases Urgent Hotfixes for Multiple Security Flaws in WS_FTP Server

Progress Software has released hotfixes for a critical security vulnerability, alongside seven other flaws, in the WS_FTP Server Ad hoc Transfer Module and in the WS_FTP Server manager interface. Tracked as CVE-2023-40044, the flaw has a CVSS score of 10.0, indicating maximum severity. All versions of the software are impacted by the flaw. "In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a

---

Cisco Warns of Vulnerability in IOS and IOS XE Software After Exploitation Attempts

Cisco is warning of attempted exploitation of a security flaw in its IOS Software and IOS XE Software that could permit an authenticated remote attacker to achieve remote code execution on affected systems. The medium-severity vulnerability is tracked as CVE-2023-20109, and has a CVSS score of 6.6. It impacts all versions of the software that have the GDOI or G-IKEv2 protocol enabled. The

---

UK and US host international dialogue to advance cyber support for groups that strengthen democracy

Agency heads from nine countries share insights and approaches to help improve collective cyber resilience of global democracy.

---

Unraveling the CACTUS Ransomware Group’s Recent Exploits

The CACTUS ransomware group employs unique encryption techniques, including hiding the decryption key within a file named ntuser.dat, to evade detection by anti-virus software.

---

Misconfigured TeslaMate Instances Put Tesla Car Owners at Risk

Improper configuration of third-party software like TeslaMate can result in privacy breaches, compromising the owner's daily routine and posing risks such as planned robberies.

---

GitHub Repositories Hit by Password-Stealing Commits Disguised as Dependabot Contributions

A new malicious campaign has been observed hijacking GitHub accounts and committing malicious code disguised as Dependabot contributions with an aim to steal passwords from developers. "The malicious code exfiltrates the GitHub project's defined secrets to a malicious C2 server and modify any existing javascript files in the attacked project with a web-form password-stealer malware code

---

Are Developers Giving Enough Thought to Prompt Injection Threats When Building Code?

Prompt injection attacks manipulate LLMs by introducing malicious commands into free text inputs, posing a significant threat to cybersecurity and potentially leading to unauthorized activities or data leaks.

---

Millions of Files With Potentially Sensitive Information Exposed Online, Researchers Say

A recent analysis by Censys has uncovered about 314,000 internet-connected devices and web servers that are exposing millions of files, potentially containing sensitive data.

---

CISA Rolls Dice on Public Service Campaign to Raise Cyber Awareness

The Cybersecurity and Infrastructure Security Agency (CISA) has launched a national public service campaign called "Secure our World" to raise awareness of cybersecurity in local communities.

---

SSH Keys Stolen by Stream of Malicious PyPI and npm Packages

The attackers utilized typosquatting and code modifications to trick developers into installing malicious packages and continuously refined their techniques to evade detection.

---

Caesars Entertainment Faces Class Action Lawsuits Following Rewards Database Hack

At least four separate plaintiffs allege the company was negligent for allowing their sensitive personal data to be stolen in a social engineering attack by criminal threat groups.

---

Russian Hackers Target Ukrainian Government Systems Involved in War Crimes Investigations

Ukrainian cybersecurity officials have reported that the recent espionage campaigns targeted entities involved in investigating war crimes, such as the prosecutor general's office and courts.

---

China's BlackTech Hacking Group Exploited Routers to Target U.S. and Japanese Companies

Cybersecurity agencies from Japan and the U.S. have warned of attacks mounted by a state-backed hacking group from China to stealthily tamper with branch routers and use them as jumping-off points to access the networks of various companies in the two countries. The attacks have been tied to a malicious cyber actor dubbed BlackTech by the U.S. National Security Agency (NSA), Federal Bureau of

---

Swan Retail Cyberattack Woes Continue for Independent UK Retailers

The attacks have caused significant problems for retailers, with issues such as inventory management and order fulfillment still not resolved. Retailers have reported glitches and loss of sales due to the cyberattack.

---

Campbell Soup Says Summer Cyberattack Caused Limited Business Impact

The incident did not affect systems that connect with customers or suppliers, and the company is working with its insurer to make claims under its cyber insurance coverage.

---

Amid MGM, Caesars Incidents, Attackers Focus on Luxury Hotels

The campaign targets luxury resorts and hotel chains, using reconnaissance emails and instant messages to trick employees into responding and downloading malicious files from trusted cloud domains.

---

Cybersecurity firm Lumu raises $30M to detect network intrusions

Ricardo Villadiego, Lumu’s founder and CEO, says that the new cash will be put toward growing Lumu’s sales team in the U.S., supporting its go-to-market strategy, and increasing the startup’s investments in R&D.

---

Cannot Depend on Dependabot: Found Contributing Malicious Code

Threat actors meticulously fabricated commit messages to mimic Dependabot's automated contributions to mask the malevolent activities they were indulging in. Between July 8 and July 11, an unidentified threat actor began compromising a multitude of GitHub repositories, affecting both public and private sectors, with a significant number of victims originating from Indonesia. The attackers skillfully manipulated commit messages, leading developers to believe that the real Dependabot had made these contributions.