Latest Cybersecurity News and Articles

---

Hackers Using Self-Extracting Archives Exploit for Stealthy Backdoor Attacks

An unknown threat actor used a malicious self-extracting archive (SFX) file in an attempt to establish persistent backdoor access to a victim's environment, new findings from CrowdStrike show. SFX files are capable of extracting the data contained within them without the need for dedicated software to display the file contents. It achieves this by including a decompressor stub, a piece of code

---

Push Security raises $15M to help SaaS users lower their online vulnerability

The Series A funding is being led by GV (Google Ventures), with participation from Decibel and several angels, including Dug Song, former CEO at Duo Security, and Tray.io CEO Rich Waldron.

---

Google TAG Warns of North Korean-linked ARCHIPELAGO Cyberattacks

A North Korean government-backed threat actor has been linked to attacks targeting government and military personnel, think tanks, policy makers, academics, and researchers in South Korea and the U.S. Google's Threat Analysis Group (TAG) is tracking the cluster under the name ARCHIPELAGO, which it said is a subset of another threat group tracked by Mandiant under the name APT43. The tech giant

---

New Proxyjacking Attack Hijacks Systems to Collect Profits via Proxyware Services

Instead of the typical cryptojacking or backdoor payload, the attacker installed an agent that turned the compromised account into a proxy server, allowing the attacker to sell the IP to a proxyware service and collect the profit.

---

International sting takes down online marketplace of stolen identities

Operation led by FBI and Dutch police with involvement of UK National Crime Agency takes Genesis Market offlineA criminal online marketplace selling millions of stolen identities for as little as 56p has been taken down in an international crackdown.The sting, led by the FBI and Dutch police with the involvement of law enforcement agencies across 18 countries, including the UK’s National Crime Agency (NCA), took Genesis Market offline on Tuesday evening. Continue reading...

---

Protect Your Company: Ransomware Prevention Made Easy

Every year hundreds of millions of malware attacks occur worldwide, and every year businesses deal with the impact of viruses, worms, keyloggers, and ransomware. Malware is a pernicious threat and the biggest driver for businesses to look for cybersecurity solutions.  Naturally, businesses want to find products that will stop malware in its tracks, and so they search for solutions to do that.

---

How Strategic Investors Can Help Cybersecurity Startups

Cybersecurity startups face rising pressures during this economic uncertainty, but strategic investors can help them succeed in providing tech that defends against cyberattacks.

---

Database Misconfiguration Leads to Leakage of 600,000 Records From Online Marketplace

Security researcher Jeremiah Fowler found 600,000 “customer support attachments” related to website Z2U, which included images of individuals holding credit cards, passports and other ID documents.

---

HTTP/S DDoS Attacks Soar 487% in Three Years

Netscout also pointed to a notable 18% increase in direct-path attacks over the past three years, corresponding to a drop in reflection or amplification attacks of about the same percentage.

---

How can organizations bridge the gap between DR and cybersecurity?

Many organizations still operate these functions separately, leading to slower response times, budgeting challenges, duplicated resource allocations, and an overall weaker security and business continuity posture.

---

3CX decided supply chain attack indicator was false positive

The CEO of VoIP software provider 3CX said his team tested its products in response to alerts notifying it of a supply chain attack, and assessed reports that its client code was infested with malware were a false positive.

---

Beware of Disney Phishing Scams in 2023

The phishing messages typically claim that there is a problem with your Disney account, such as a billing issue, and that you need to update your account information to resolve the problem.

---

Don’t Fall for Vinted Phishing Scams

Scammers are posing as buyers and sending fraudulent messages to sellers, reserving products for sale and then immediately canceling them. They then send messages to request the personal information of the sellers.

---

Turkish Hacking Group ‘TurkHackTeam’ Targets Banks and Government Agencies in Defacement Attacks

In recent news, a hacking group with alleged Turkish origins has surfaced, claiming to target banks, servers, government agencies, and facilities. Most of their attacks, which have been reported on Twitter, appear to be defacement attacks.

---

Alert! Cybercriminals Leverage Tax-Related Themes to Drop Malware

Cybercriminals associated with TACTICAL#OCTOPUS were spotted distributing tax-related email lures to spread malware. Security analysts at Securonix revealed that attackers are using authentic W-2 tax documents, I-9 forms, and real estate purchase contracts as bait.

---

Strivacity Scores $20M for CIAM Expansion Plans

The new financing round was led by San Francisco-based venture capital outfit SignalFire. The company said it also took in investments from Ten Eleven Ventures and prominent security executives Kevin Mandia and Jack Huffard.

---

Typhon Reborn Stealer Malware Resurfaces with Advanced Evasion Techniques

The threat actor behind the information-stealing malware known as Typhon Reborn has resurfaced with an updated version (V2) that packs in improved capabilities to evade detection and resist analysis. The new version is offered for sale on the criminal underground for $59 per month, $360 per year, or alternatively, for $540 for a lifetime subscription. "The stealer can harvest and exfiltrate

---

HP to patch critical bug in LaserJet printers within 90 days

The bug, tracked as CVE-2023-1707, affects about 50 HP Enterprise LaserJet and HP LaserJet Managed Printers models. It has a severity score of 9.1 out of 10 on the CVSS v3.1 standard and exploiting it could potentially lead to information disclosure.

---

Attacks Ramp Up Against Cacti and Realtek Vulnerabilities

Security issues in Realtek and Cacti are being exploited to distribute ShellBot and Moobot malware, revealed FortiGuard Labs. Realtek bug, CVE-2021-35394, is an arbitrary command injection bug that affects UDPServer. CVE-2022-46169, the Cacti bug, is a command injection flaw that enables an unauthenticated user to execute arbitrary code on the vulnerable server.

---

AlienFox Evolves to Target Variety of Cloud Services for Cryptomining

AlienFox is a new modular toolkit that enables attackers to scan for misconfigured servers to pilfer authentication keys and credentials for cloud-based email services. SentinelLabs discovered three variants of AlienFox containing scripts that automate malicious operations using the stolen credentials.