Latest Cybersecurity News and Articles

---

Expensive Proxies Underpin Anonymous Sudan DDoS Attacks

Pro-Russian hacker group Anonymous Sudan appears to use expensive online infrastructure to perpetuate distributed denial-of-service attacks, undermining its claim to be a volunteer group operating from an impoverished East African country.

---

Update: Hackers warn University of Manchester students’ of imminent data leak

The threat actors claim to have stolen 7 TB of data from the University of Manchester during a June 6th cyberattack in an email sent to students and shared with BleepingComputer.

---

ChatGPT and data protection laws: Compliance challenges for businesses

To ensure the legal and safe use of data, businesses should provide employee training, anonymize PII before processing, and regularly review and update data protection policies.

---

US federal agency using outdated Telerik software got compromised

A group of government-backed hackers used an almost six-year-old Telerik vulnerability to break into a US federal agency's Microsoft IIS web server, underscoring the importance of patching.

---

The significance of CIS Control mapping in the 2023 Verizon DBIR

The mapping of CIS Controls to Verizon’s incident classifications presents organizations with an opportunity to optimize their security resources by aligning them with real-world security incidents.

---

Hackers Exploiting Critical Vulnerability in VMware's Aria Operations Networks

The flaw, tracked as CVE-2023-20887, could allow a malicious actor with network access to the product to perform a command injection attack, resulting in remote code execution.

---

New Sophisticated Toolkit Abuses macOS Systems

Researchers stumbled across a collection of malicious artifacts, dubbed JokerSpy, which they believe to be components of an advanced toolkit specifically designed to target Apple macOS systems. Based on the above and that multiple files were missing from the victim system, the researchers suspect that the malicious artifacts are part of a more intricate attack.

---

New Condi Malware Hijacking TP-Link Wi-Fi Routers for DDoS Botnet Attacks

A new malware called Condi has been observed exploiting a security vulnerability in TP-Link Archer AX21 (AX1800) Wi-Fi routers to rope the devices into a distributed denial-of-service (DDoS) botnet. Fortinet FortiGuard Labs said the campaign has ramped up since the end of May 2023. Condi is the work of a threat actor who goes by the online alias zxcr9999 on Telegram and runs a Telegram channel

---

Alert! Hackers Exploiting Critical Vulnerability in VMware's Aria Operations Networks

VMware has flagged that a recently patched critical command injection vulnerability in Aria Operations for Networks (formerly vRealize Network Insight) has come under active exploitation in the wild. The flaw, tracked as CVE-2023-20887, could allow a malicious actor with network access to the product to perform a command injection attack, resulting in remote code execution. It impacts VMware

---

Philadelphia healthcare facility suffers ransomware attack

Philadelphia healthcare facility Vincera has issued a notice following a ransomware attack in April of 2023 that compromised patient data.

---

Researchers Expose New Severe Flaws in Wago and Schneider Electric OT Products

Three security vulnerabilities have been disclosed in operational technology (OT) products from Wago and Schneider Electric. The flaws, per Forescout, are part of a broader set of shortcomings collectively called OT:ICEFALL, which now comprises a total of 61 issues spanning 13 different vendors. "OT:ICEFALL demonstrates the need for tighter scrutiny of, and improvements to, processes related to

---

Microsoft fixes Azure AD auth flaw enabling account takeover

Microsoft has addressed an Azure Active Directory (Azure AD) authentication flaw that could allow threat actors to escalate privileges and potentially fully take over the target's account.

---

Untrained users are biggest flaw in organizations’ cyber defense layer

A recent report reveals that 33.1% of employees are likely to click on a suspicious link or comply with a fraudulent request. 

---

OT:Icefall: Vulnerabilities Identified in Wago Controllers

The flaws were identified as part of the OT:Icefall research that has led to the public disclosure of 61 vulnerabilities impacting more than 100 OT products from 13 vendors.

---

Compromised Linux SSH servers engage in DDoS attacks, cryptomining

A threat actor is mounting dictionary attacks to log into Linux servers with SSH installed and saddle the server with the Tsunami and ShellBot DDoS bots, the XMRig CoinMiner program, and Log Cleaner – a tool for deleting and modifying logs.

---

Experts Uncover Year-Long Cyberattack on IT Firm Utilizing Custom Malware RDStealer

"The operation was active for more than a year with the end goal of compromising credentials and data exfiltration," Bitdefender security researcher Victor Vrabie said in a technical report shared with The Hacker News.

---

Vulnerable information is discovered within minutes by cybercriminals

Cybercriminal habits were analyzed in a recent report by Orca Security that reveals that attackers typically find exposed secrets in two minutes.

---

Phishing scam takes $950k from DoorDash drivers

The scam involved placing bogus orders, contacting drivers claiming to be from the DoorDash support team, and convincing them to hand over banking details or log in to a fake portal.

---

55% of employees solely use mobile device for work while traveling

Bring your own device (BYOD) policies have become difficult for IT teams to monitor, especially during increased travel in summer months.

---

Inside of the WASP's nest: deep dive into PyPI-hosted malware

Virustotal experts identified a number of specific PyPI-based malware campaigns, including Discord Token Grabber V2, Hazard Token Grabber V2, Chromium Stealer, and W4SP Stealer (with Hyperion obfuscator).