Latest Cybersecurity News and Articles

---

Ukraine's CERT Thwarts APT28's Cyberattack on Critical Energy Infrastructure

The Computer Emergency Response Team of Ukraine (CERT-UA) on Tuesday said it thwarted a cyber attack against an unnamed critical energy infrastructure facility in the country.

---

Peiter 'Mudge' Zatko Lands Role as CISA Senior Technical Adviser

The U.S. government’s cybersecurity agency CISA on Monday confirmed the addition of Peiter ‘Mudge’ Zatko to its roster of prominent voices preaching the gospel of security-by-design and secure-by-default development principles.

---

Experts Uncover Underground Phishing “Empire” W3LL Targeting 56,000 Microsoft 365 Accounts

Security researchers have uncovered a new covert phishing operation selling sophisticated tools used to target an estimated 56,000 Microsoft 365 accounts in just a 10-month period.

---

MITRE and CISA Release Open Source Tool for OT Attack Emulation

The new Caldera for OT extension is the result of a collaboration between the Homeland Security Systems Engineering and Development Institute (HSSEDI) and CISA, to help improve the resilience of critical infrastructure.

---

Hawai’i State Department of Health Resolves Website Defacement

The incident affected healthybydefault.hawaii.gov — a website created by the Hawai?i State Department of Health (DOH) in compliance with a 2020 state law that mandates healthy beverages be the default option in children’s meals.

---

What’s in a NoName? Researchers See a Lone-Wolf DDoS Group

The Russian hacker group called NoName057(16) is carrying out regular distributed denial-of-service (DDoS) attacks on European financial institutions, government websites, and transportation services.

---

Minneapolis School District Says Data Breach Affected More Than 100,000 People

In its notification letter, the school district said it would have informed victims earlier, but it needed time for a “comprehensive review” to determine “whether sensitive information was present” in the leak.

---

Outlook Breach: Microsoft Reveals How a Crash Dump Led to a Major Security Breach

Microsoft on Wednesday revealed that a China-based threat actor known as Storm-0558 acquired the inactive consumer signing key to forging tokens to access Outlook by compromising an engineer’s corporate account. This enabled the adversary to access a debugging environment that contained a crash dump of the consumer signing system that took place in April 2021 and steal the key. “A consumer

---

94% of organizations don't have full visibility into service accounts

Identity security was analyzed in a report by Silverfort finding the identity attack surface as the most significant gap in cybersecurity resilience.

---

Nominations for Top Cybersecurity Leader 2024 are now open

The submission form for Security magazine's Top Cybersecurity Leaders 2024 is now open until November 17, 2023 with awardees named in March 2024.

---

Anti-scraping policies and data privacy

Listen to this episode of The Security Podcasts with Oded Anderman, Program Manager in Meta Platform’s Privacy organization, on data scraping.

---

Zero-Day Alert: Latest Android Patch Update Includes Fix for Newly Actively Exploited Flaw

Google has rolled out monthly security patches for Android to address a number of flaws, including a zero-day bug that it said may have been exploited in the wild. Tracked as CVE-2023-35674, the high-severity vulnerability is described as a case of privilege escalation impacting the Android Framework. “There are indications that CVE-2023-35674 may be under limited, targeted exploitation,” the

---

Crypto Gambling Platform Stake.com Back Online After $40 Million Heist

Curaçao-headquartered Stake.com offers casino and sports betting for players using cryptocurrency. However, the firm flagged on Monday that it had spotted unauthorized transactions being made from its ETH and BSC hot wallets.

---

Alert: Phishing Campaigns Deliver New SideTwist Backdoor and Agent Tesla Variant

The Iranian threat actor tracked as APT34 has been linked to a new phishing attack that leads to the deployment of a variant of a backdoor called SideTwist. “APT34 has a high level of attack technology, can design different intrusion methods for different types of targets, and has supply chain attack capability,” NSFOCUS Security Labs said in a report published last week. APT34, also known by

---

Bogus URL Shorteners Go Mobile-Only in AdSense Fraud Campaign

The attackers have implemented multiple layers of defense to protect their Google AdSense accounts, including JavaScript execution, mobile user agent checks, user interaction requirements, and server-side user agent checks.

---

Threat Actors Target NPM, PyPI, and RubyGems Developers

A new cyber campaign has emerged, with threat actors uploading malicious packages to PyPI, NPM, and RubyGems repositories, posing a significant threat to macOS user data. The malicious packages would collect system information and exfiltrate it to attacker-controlled servers. Security firm Phylum identified a connection between these packages, suggesting a coordinated campaign against software developers.

---

Researchers Discover Critical Vulnerability in PHPFusion CMS

The authenticated local file inclusion flaw, identified as CVE-2023-2453, allows for remote code execution if an attacker can upload a maliciously crafted ".php" file to a known path on a target system.

---

New Agent Tesla Variant Being Spread by Specially Crafted Excel Document

A new variant of the Agent Tesla malware is spreading through a phishing campaign, exploiting the CVE-2017-11882/CVE-2018-0802 vulnerability to gain access to victims' devices and steal sensitive information.

---

ASUS Routers are Affected by Three Critical Remote Code Execution Flaws

ASUS routers RT-AX55, RT-AX56U_V2, and RT-AC86U are affected by three critical remote code execution vulnerabilities (CVE-2023-39238, CVE-2023-39239, and CVE-2023-39240) that can potentially allow threat actors to take over the devices.

---

GhostSec Leaks Source Code of Alleged Iranian Surveillance Tool

The first messages were posted on August 27, with GhostSec saying it had discovered facial recognition "and various other privacy invading features and tools" within the FANAP group's software.