Latest Cybersecurity News and Articles

---

90% of CISOs say certifications improved security confidence

According to a report focusing on Chief Information Security Officer (CISO) perspectives, 50% identified cloud security as their top concern. 

---

High-Severity Vulnerabilities Patched in Splunk Enterprise

The most severe of these is CVE-2023-32707, a privilege escalation issue that allows low-privileged users with the ‘edit_user’ capability to escalate privileges to administrator, via a specially crafted web request.

---

Iranian dissidents' claim of presidential hack likely legitimate, experts say

A trove of documents, images, and videos from the offices of Iranian President Ebrahim Raisi posted online Monday appear to be authentic, cybersecurity experts familiar with the matter told CyberScoop on Wednesday.

---

California-based Workforce Platform Prosperix Leaks Drivers Licenses and Medical Records of Job Seekers

The misconfiguration led to the exposure of approximately 250,000 files. 42,000 of them contained the sensitive data of job seekers, namely: Full names, Dates of birth, Occupation history, Home addresses, Phone numbers, and Email addresses.

---

Federal vision to streamline cyber incident reporting expected this summer

The Cyber Incident Reporting Council will issue a report to Congress "in the next month or two" with recommendations on ways to achieve harmony across a complex network of federal cyber mandates.

---

Chinese Phishing Gang "PostalFurious" Expands Campaign

A recently discovered Chinese phishing gang has expanded its campaigns to the Middle East with new scams designed to harvest personal and payment data from victims, according to Group-IB.

---

Report: Advanced phishing attacks grew 356% in 2022

A new report analyzed the most prevalent cyberattack trends and identified an 87% increase in the total number of attacks over the course of last year.

---

Camaro Dragon Strikes with New TinyNote Backdoor for Intelligence Gathering

Israeli cybersecurity firm Check Point, which dubbed the Go-based malware TinyNote, said it functions as a first-stage payload capable of "basic machine enumeration and command execution via PowerShell or Goroutines."

---

New Horabot Campaign Targets Spanish-Speaking Users in the Americas

Horabot enables the threat actor to control the victim’s Outlook mailbox, exfiltrate contacts’ email addresses, and send phishing emails with malicious HTML attachments to all addresses in the victim’s mailbox.

---

Discord Admins Hacked by Malicious Bookmarks – Krebs on Security

A number of Discord communities focused on cryptocurrency have been hacked this past month after their administrators were tricked into running malicious Javascript code disguised as a Web browser bookmark.

---

Harvard Pilgrim Health Care Ransomware Attack Hits 2.5 Million People

Last week, the organization published a notice informing that ransomware actors maintained access to its systems between March 28 and April 17, 2023, when the breach was discovered.

---

New Botnet Malware 'Horabot' Targets Spanish-Speaking Users in Latin America

Spanish-speaking users in Latin America have been at the receiving end of a new botnet malware dubbed Horabot since at least November 2020. "Horabot enables the threat actor to control the victim's Outlook mailbox, exfiltrate contacts' email addresses, and send phishing emails with malicious HTML attachments to all addresses in the victim's mailbox," Cisco Talos researcher Chetan Raghuprasad 

---

Insurers Predict $33bn Bill for Catastrophic "Cyber Event"

A catastrophic “once-in-200-years” cyber event could cause $33bn in losses for the cyber-insurance sector, according to the new Through the Looking Glass report from Guy Carpenter.

---

New MOVEit Transfer Zero-Day Mass-Exploited in Data Theft Attacks

"Progress has discovered a vulnerability in MOVEit Transfer that could lead to escalated privileges and potential unauthorized access to the environment," reads a security advisory from Progress.

---

QBot Abuses Windows WordPad for Infection

QBot operators are exploiting a DLL hijacking flaw in the Windows 10 WordPad executable known as write.exe to avoid detection. The infection may lead to the exposure of a user's email address which could be utilized in future phishing attacks. Furthermore, the impacted device can be infected by downloading other payloads, such as Cobalt Strike, for initial access. Experts revealed attackers can spread laterally throughout the network.

---

Phishing campaigns thrive as evasive tactics outsmart conventional detection

A 25% increase in the use of phishing kits has been recorded in 2022, according to Group-IB. The key phishing trends observed are the increasing use of access control and advanced detection evasion techniques.

---

The Importance of Managing Your Data Security Posture

Data security is reinventing itself. As new data security posture management solutions come to market, organizations are increasingly recognizing the opportunity to provide evidence-based security that proves how their data is being protected. But what exactly is data security posture, and how do you manage it?  Data security posture management (DSPM) became mainstream following the publication

---

Critical Vulnerabilities Found in Faronics Education Software

NCC Group identified a total of 11 vulnerabilities in Faronics Insight, including three critical-severity flaws (CVSS score of 9.6) leading to RCE. Two of these could be exploited without authentication.

---

Camaro Dragon Strikes with New TinyNote Backdoor for Intelligence Gathering

The Chinese nation-stage group known as Camaro Dragon has been linked to yet another backdoor that's designed to meet its intelligence-gathering goals. Israeli cybersecurity firm Check Point, which dubbed the Go-based malware TinyNote, said it functions as a first-stage payload capable of "basic machine enumeration and command execution via PowerShell or Goroutines." What the malware lacks in

---

Go-based GobRAT Targets Linux Routers in Japan

Actors behind a new malware named GobRAT were observed launching attacks against Linux routers in Japan. Cybercriminals abuse routers with publicly accessible web user interfaces. The malware strain is written in Go and established C2 communication via TLS. It can receive as many as 22 varieties of encrypted commands for execution.