Latest Cybersecurity News and Articles

---

Phishing Links via Linktree

In this attack, end-users get an email with a spoofed Microsoft OneDrive or Sharepoint notification that a file has been shared with them, instructing them to open the file.

---

Two Critical Flaws Found in Alibaba Cloud's PostgreSQL Databases

A chain of two critical flaws has been disclosed in Alibaba Cloud's ApsaraDB RDS for PostgreSQL and AnalyticDB for PostgreSQL that could be exploited to breach tenant isolation protections and access sensitive data belonging to other customers.

---

Cisco and VMware Release Security Updates to Patch Critical Flaws in their Products

Cisco and VMware have released security updates to address critical security flaws in their products that could be exploited by malicious actors to execute arbitrary code on affected systems. The most severe of the vulnerabilities is a command injection flaw in Cisco Industrial Network Director (CVE-2023-20036, CVSS score: 9.9), which resides in the web UI component and arises as a result of

---

3CX Breach Was a Double Supply Chain Compromise

We learned some remarkable new details this week about the recent supply-chain attack on VoIP software provider 3CX, a complex, lengthy intrusion that has the makings of a cyberpunk spy novel: North Korean hackers using legions of fake executive accounts on LinkedIn to lure people into opening malware disguised as a job offer; malware targeting Mac and Linux users working at defense and cryptocurrency firms; and software supply-chain attacks nested within earlier supply chain attacks.

---

Phishing Scams Abusing Microsoft Teams and More

Cybercriminals have become increasingly adept at designing new phishing tactics. Lately, a scam was found camouflaging as the legitimate Microsoft Teams login with the goal of tricking users into entering their login credentials.

---

APT28 Uses Vulnerability in Cisco Routers to Deploy Malware

Government agencies in the U.S. and the U.K. issued a joint advisory to warn organizations about attacks exploiting an old vulnerability in Cisco routers. The attacks are attributed to the Fancy Bear threat group and the flaw in question is CVE-2017-6742. The attackers are exploiting the vulnerability to deploy a custom malware, named Jaguar Tooth.

---

LockBit Eyes macOS; Test Version of macOS Encryptor Revealed

MalwareHunterTeam discovered a ZIP archive—belonging to the LockBit ransomware group—uploaded to VirusTotal containing previously unknown encryptors for macOS, ARM, FreeBSD, MIPS, and SPARC. Security analysts from BleepingComputer assert that the discovered builds could have been created for testing purposes.

---

Tax-Themed Phishing Attacks Proliferate During Tax Filing Season

With the tax reason around, the frequency of campaigns related to taxes and accounting has increased with threats like Remcos RAT, Emotet, and GuLoader hovering to scam users. The IRS issued an advisory, urging taxpayers to be wary and vigilant of new tax-related scams.

---

Navigating the Pandora’s Box that is ChatGPT: Insights from a Global CISO

Jonathan Fischbein is the Chief Information Security Officer for cyber security vendor Check Point Software. He has more than 25 years’ experience in high-tech security markets, shaping security strategies, and in developing ad-hoc solutions to help large corporations mitigate security threats. In this exciting and tell-all interview, Check Point’s Global CISO Jonathan Fishbein shares a […] The post Navigating the Pandora’s Box that is ChatGPT: Insights from a Global CISO appeared first on CyberTalk.

---

Why cyber security should be treated as an ESG issue

EXECUTIVE SUMMARY: The World Economic Forum describes cyber security as one of the top five global risks, highlighting the need for organizations to integrate cyber security into ESG risk management. As a result, effective oversight of security has become a priority for investors and regulators, who continue to push for robust oversight frameworks. Organizations that […] The post Why cyber security should be treated as an ESG issue appeared first on CyberTalk.

---

New Infrastructure of MuddyWater APT Group Uncovered

MuddyWater has been employing SimpleHelp, a lawful tool used for managing and controlling remote devices, to establish persistence on compromised devices, revealed researchers. The attackers send phishing emails containing links to file storage systems such as OneDrive, Dropbox, or OneHub to download SimpleHelp installers.

---

Fifty percent of CISOs confident that software is completely tested

As companies shift towards hybrid and multicloud environments, CISOs have expressed concerns over keeping their software and data secure.

---

Wargaming an effective data breach playbook

Foreseeing every possible twist and turn of a breach may be impossible, but through extensive wargaming, security teams can simulate diverse situations to give them a proactive edge.

---

Hackers Storing Malware in Google Drive as Encrypted ZIP Files To Evade Detection

Google’s Cybersecurity Action Team (GCAT) and Mandiant researched a list of techniques and methods used by threat actors over the period for penetrating the environments and other malicious activities.

---

Cyber insurance premium hikes slowed in 2022, Fitch says

Experts say insurance companies’ demand for stronger cybersecurity practices from policyholders contributed toward fewer ransomware claims and decelerating premiums in 2022.

---

‘AuKill’ EDR killer malware abuses Process Explorer driver

The AuKill tool abuses an outdated version of the driver used by version 16.32 of the Microsoft utility, Process Explorer, to disable EDR processes before deploying either a backdoor or ransomware on the target system.

---

Giving a Face to the Malware Proxy Service ‘Faceless’ – Krebs on Security

For less than a dollar per day, Faceless customers can route their malicious web traffic through tens of thousands of compromised systems advertised on the proxy service.

---

Real estate firm OrangeTee & Tie fined for data breach involving 250,000 customers and employees

Names, bank account numbers, property transaction amounts, as well as identity card numbers were extracted from outdated database servers of the real estate firm by a cybercrime group in 2021.

---

Raspberry Robin Adopts Unique Detection Evasion Techniques

Several of the new methods Raspberry Robin uses are related to its ability to avoid being run on virtual machines (VMs), which security researchers often use to analyze malware.

---

Pre-pandemic techniques are fueling record fraud rates

Within the largest financial institutions, insurers, and retailers, the rise and adoption of AI, an impending recession, and the return of pre-pandemic fraud techniques are driving record rates of fraud attacks, according to Pindrop.