Researchers discovered the spread of a malicious exe file that targets specific individuals and is disguised as information related to a personal data leak. The malware functions as a backdoor, executing obfuscated commands in XML format after receiving them from the threat actor. Because this…
Category: GBHackers on Security | #1 Globally Trusted Cyber Security News Platform
MrAnon Stealer Attacking Windows Users Via Weaponized PDF Files
Phishing emails targeting Windows users were discovered, tricking users into opening a malicious PDF file called “MrAnon Stealer” that spreads malware by using fake booking details. To obtain the final malware, the PowerShell script is executed by the PDF after…
Hackers Spy iPhone Users Using Malicious Keyboard Apps
A new method of keylogging using malicious keyboard apps has been discovered to affect iPhones, evading all Apple’s security detection procedures. Additionally, threat actors could also use this method to steal passwords, authentication codes, notes, private messages, etc., There have…
Over 50% of the Insider Attacks Uses Privilege Escalation Vulnerability
In the labyrinth of cybersecurity, the specter of insider threats emerges as a formidable adversary, wielding both malicious intent and unintentional foibles. This expose delves into the intricacies of how insiders exploit vulnerabilities, introducing an air of risk through actions…
How Smart Cars Are Spying You? Most important Privacy Concerns 2024
Privacy concerns related to smart cars primarily revolve around the extensive data collection, sharing, and potential misuse of personal information. Automobiles that are outfitted with artificial intelligence that is driven by systems are known as smart cars. They comprise numerous…
Crypto Exchange Founder Pleads Guilty for Dark Web Transfer
Bitzlato Ltd., a cryptocurrency exchange, was founded and is primarily owned by an individual who facilitated transactions between buyers and sellers in dark markets. The exchange acted as a conduit for such transactions to take place, making it an important…
Researchers Uncovered an Active Directory DNS spoofing exploit
In the intricate web of our interconnected world, the Domain Name System (DNS) stands as a linchpin, directing users to their online destinations. Yet, even this vital system is not impervious to the dark art of malicious manipulation. In a…
WordPress POP Chain Flaw Exposes Over 800M+ Websites to Attack
A critical remote code execution vulnerability has been patched as part of the WordPress 6.4.2 version. This vulnerability exists in the POP chain introduced in version 6.4, which can be combined with a separate Object Injection, resulting in the execution…
Russian Star Blizzard New Evasion Techniques to Hijack Email Accounts
Hackers target email accounts because they contain valuable personal and financial information. Successful email breaches enable threat actors to:- Cybersecurity researchers at Microsoft Threat Intelligence team recently unveiled that the Russian state-sponsored actor, Star Blizzard (aka SEABORGIUM, COLDRIVER, Callisto Group),…
Exploitation Methods Used by PlugX Malware Revealed by Splunk Research
PlugX malware is sophisticated in evasion, as it uses the following techniques to avoid detection by antivirus programs, making it challenging for security measures to identify and mitigate its presence:- That’s why PlugX malware stands out as a challenging and…
TA422 Hackers Attack Organizations Using Outlook & WinRAR Vulnerabilities
Hackers exploit Outlook and WinRAR vulnerabilities because these widely used software programs are lucrative targets. Outlook vulnerabilities offer:- WinRAR vulnerabilities provide an entry point to manipulate compressed files, potentially executing malicious code on a victim’s system. Cybersecurity researchers at Proofpoint…
Bluetooth keystroke-injection Flaw: A Threat to Apple, Linux & Android Devices
An unauthenticated Bluetooth keystroke-injection vulnerability that affects Android, macOS, and iOS devices has been discovered. This vulnerability can be exploited by tricking the Bluetooth host state machine into pairing with a fake keyboard without authentication. This vulnerability affects Android devices…
Atlassian Patches RCE Flaw that Affected Multiple Products
Atlassian has been discovered with four new vulnerabilities associated with Remote Code Execution in multiple products. The CVEs for these vulnerabilities have been assigned as CVE-2023-22522, CVE-2023-22523, CVE-2023-22524, and CVE-2022-1471. Atlassian has patched these vulnerabilities and has released security advisories…
SLAM Attack Gets Root Password Hash in 30 Seconds
Spectre is a class of speculative execution vulnerabilities in microprocessors that can allow threat actors unauthorized access to sensitive data. Hackers exploit Spectre because it enables them to extract confidential information by manipulating the speculative execution capabilities of CPUs, bypassing…
SLAM Attack Gets Root Password Hash in 30 Seconds by Exploiting Hardware Security
Spectre is a class of speculative execution vulnerabilities in microprocessors that can allow threat actors unauthorized access to sensitive data. Hackers exploit Spectre because it enables them to extract confidential information by manipulating the speculative execution capabilities of CPUs, bypassing…
Akira Ransomware Exploiting Zero-day Flaws For Organization Network Access
The Akira ransomware group, which first appeared in March 2023, has been identified as a serious threat to data security. It encrypts data and demands a ransom for decryption, affecting both Windows and Linux devices. The group has about 140…
Hackers Deliver AsyncRAT Through Weaponized WSF Script Files
The AsyncRAT malware, which was previously distributed through files with the .chm extension, is now being disseminated via WSF script format. The WSF file was found to be disseminated in a compressed file (.zip) format through URLs included in emails. AsyncRAT spreads…
Serpent Stealer Acquire Browser Passwords and Erases Intrusion Logs
Beneath the surface of the cyber realm, a silent menace emerges—crafted with the precision of the .NET framework, the Serpent Stealer slithers undetected through security measures, leaving traces of its intrusion. Researchers at K7 Labs have analyzed the malware called…
BlueNoroff: New Malware Attacking MacOS Users
Researchers have uncovered a new Trojan-attacking macOS user that is associated with the BlueNoroff APT group and their ongoing RustBucket campaign. As a subgroup of Lazarus, BlueNoroff possesses reverse engineering expertise because they spend time analyzing and patching SWIFT Alliance software as well…
Doppelgänger: Hackers Employ AI to Launch Highly sophistication Attacks
It has been observed that threat actors are using AI technology to conduct illicit operations on social media platforms. These malicious actors employ several tactics and automated bots to achieve their nefarious goals, which can pose a serious threat to…
Kali Linux 2023.4 Released – What’s New!
Kali Linux 2023.4, the latest version of Offensive Security’s renowned operating system, has been released, and it includes the advanced Gnome 45 desktop environment and 15 new tools, with enhancements to existing ones. Kali Linux is a Linux distribution intended for…
Trickbot Malware Developer Pleads Guilty & Faces 35 Years in Prison
A 40-year-old Russian national, Vladimir Dunaev, pleaded guilty for developing and deploying Trickbot malware. Trickbot, a suite of malware tools, targeted hospitals and businesses, causing millions in losses. Trickbot is a sophisticated modular banking Trojan that primarily targets financial institutions. …
ICANN Launches RDRS to Assist Law Enforcement Agencies to Discover Private Info
ICANN is a non-profit organization that is responsible for coordinating the global internet’s- This organization manages the distribution and maintenance of domain names and ensures the stable and secure operation of the Internet. ICANN introduced RDRS (Registration Data Request Service),…
Hackers Use Weaponized Documents to Attack U.S. Aerospace Industry
An American aerospace company has been the target of a commercial cyberespionage campaign dubbed AeroBlade, which appears to be aimed at carrying out both competitive and commercial cyberespionage. The threat actor employed spear-phishing as the means of distribution mechanism. A…
Active Attacks Targeting Google Chrome & ownCloud Flaws: CISA Warns
The CISA announced two known exploited vulnerabilities active attacks targeting Google Chrome & own cloud vulnerabilities in their catalog. As the national coordinator for critical infrastructure security and resilience, CISA oversees government cybersecurity operations. Document Protect Your Storage With SafeGuard…
Cactus Ransomware Exploiting Qlik Sense code execution Vulnerability
A new Cactus Ransomware was exploited in the code execution vulnerability to Qlik Sense for initial access. Qlik Sense is a data discovery and analytics platform that allows you to visualize and analyze data from various sources. It has a…
Hackers Bypass Antivirus with ScrubCrypt Tool to Install RedLine Malware
The ScrubCrypt obfuscation tool has been discovered to be utilized in attacks to disseminate the RedLine Stealer malware, and its new variant was being marketed in underground communities. Threat actors use the ScrubCrypt obfuscation tool to help them avoid detection by antivirus software and initiate attacks that might…
Hotel’s Booking.com Hacked Logins Let Attacker Steal Guest Credit Cards
According to a recent report by Secureworks, a well-planned and advanced phishing attack was carried out, specifically targeting hotels and their guests, through the popular website Booking.com. The attackers utilized a sophisticated phishing campaign to lure unsuspecting victims into providing…
Critical Zoom Vulnerability Let Attackers Take Over Meetings
Zoom, the most widely used video conferencing platform has been discovered with a critical vulnerability that threat actors could potentially exploit for various malicious purposes. This vulnerability was reported as part of the H1-4420 Hacking event conducted in June 2023.…
Hackers Using Weaponized Invoice to Deliver LUMMA Malware
Hackers use weaponized invoices to exploit trust in financial transactions, embedding malware or malicious links within seemingly legitimate payment requests. This tactic aims to deceive recipients into opening the invoice, leading to:- Cybersecurity researchers at Perception Point recently discovered and…
US-Seized Crypto Currency Mixer Used by North Korean Lazarus Hackers
The U.S. Treasury Department sanctioned the famous cryptocurrency mixer Sinbad after it was claimed that the North Korean hacker group Lazarus was using it to launder funds that had been stolen. Millions of dollars worth of virtual currency from Lazarus Group…
CISA Warns Hackers Exploiting Wastewater Systems Logic Controllers
In a disconcerting turn of events, cyber threat actors have set their sights on Unitronics programmable logic controllers (PLCs) embedded in Water and Wastewater Systems (WWS). This perilous trend casts a looming shadow over the nation’s critical infrastructure, with the…
Zyxel Command Injection Flaws Let Attackers Run OS Commands
Three Command injection vulnerabilities have been discovered in Zyxel NAS (Network Attached Storage) products, which could allow a threat actor to execute system commands on successful exploitation of these vulnerabilities. Zyxel NAS (Network Attached Storage) devices provide fast, secure, and…
North Korean Hackers Attacking macOS Using Weaponized Documents
Hackers often use weaponized documents to exploit vulnerabilities in software, which enables the execution of malicious code. All these documents contain malicious code or macros, often disguised as familiar files, which help hackers gain unauthorized access and deliver malware to…
Most Popular Websites Still Allow Users To Have Weak Passwords
The latest analysis shows that tens of millions of people are creating weak passwords on three of the four most popular websites in the world, which do not fulfill the minimum required standards. Researchers also found that 12% of websites…
Iranian Mobile Banking Malware Steal Login Credentials & Steal OTP Codes
An Android malware campaign was previously discovered that distributed banking trojans targeting four major Iranian Banks: Bank Mellat, Bank Saderat, Resalat Bank, and Central Bank of Iran. There were 40 credential-harvesting applications circulated on Cafe Bazaar between December 2022 and…
Chrome Zero-Day Vulnerability That Exploited In The Wild
Google has fixed the sixth Chrome zero-day bug that was exploited in the wild this year. The flaw, identified as CVE-2023-6345, is classified as an integer overflow in Skia, an open-source 2D graphics library written in C++. “Google is aware that an exploit…
BLUFFS: Six New Attacks that Break Secrecy of Bluetooth Sessions
Six novel Bluetooth attack methods have been discovered, which were named BLUFFS (Bluetooth Forward and Future Secrecy) attacks. These attacks could enable threat actors to impersonate devices or machine-in-the-middle attacks. These attacks have been reported to be at the architectural…
Google Workspace’s Design Flaw Allows Attacker Unauthorized Access
Recent years saw a surge in cloud tech adoption, highlighting the efficiency through tools like Google’s Domain-Wide Delegation. It enables GCP (Google Cloud Platform) identities to perform tasks in GWS (Google Workspace) apps on behalf of Workspace users, streamlining work…
Serial ‘SIM Swapper’ Sentenced to Eight Years in Prison
In a digital age marred by deceit, 25-year-old Amir Hossein Golshan stands as a testament to the dark underbelly of cyberspace. Hailing from downtown Los Angeles, Golshan’s intricate orchestration of fraudulent schemes has earned him a federal prison sentence of…
Design Flaw in Domain-Wide Delegation Could Leave Google Workspace Vulnerable to Takeover – Hunters
BOSTON, MASS. and TEL AVIV, ISRAEL, November 28, 2023 – A severe design flaw in Google Workspace’s domain-wide delegation feature discovered by threat hunting experts from Hunters’ Team Axon, can allow attackers to misuse existing delegations, enabling privilege escalation and…
Chinese Hackers Stolen Chip Designs from Major Dutch Semiconductor Company
Hackers target chips to exploit vulnerabilities in hardware, enabling unauthorized access to systems or extracting sensitive data. The Norwegian news agency NRC reported that a Chinese-linked hacker group, a Dutch semiconductor giant, recently breached the NXP’s network. Manipulating chips could…
Hackers Behind High-Profile Ransomware Attacks on 71 Countries Arrested
Hackers launched ransomware attacks to extort money from the following two entities by encrypting their data and demanding a ransom payment for its release:- Here, cryptocurrency payments’ financial motivation and relative anonymity make them an attractive method for hackers. Recently,…
Broadcom Completes the $61 Billion Acquisition of VMware
Broadcom Inc., a multinational semiconductor manufacturing company headquartered in San Jose, CA, has announced the successful acquisition of VMware in a $61 billion deal. VMware is a top supplier of multi-cloud services for all apps, providing digital innovation with organizational control.…
Google Drive Users Files Suddenly Disappeared, Tech Gaint Investigating
In a perplexing turn of events, a notable cohort of Google Drive users is grappling with the disappearance of files from their accounts. Reports indicate that some users have experienced the loss of crucial data, with instances of up to…
A New Telekopye Bots That Tricks Users to Steal Payment Details
Phishing bots are a tool used by hackers to fool people into disclosing private information such as- With the help of these automated tools, threat actors easily create deceptive, harmful emails and websites, which makes it easier for them to…
Cybersecurity tool investments are rising in Asia-Pacific as Cyberattacks grow
Investments in cybersecurity tools have been on the rise in the Asia-Pacific region, owing to the increased prevalence of cyberattacks. It is projected that the market will grow at a CAGR of 16.4% by 2032. The market for cyber warfare…
DPRK Hackers Exploit MagicLine4NX Zero-day in Supply Chain Attacks
North Korea, DPRK threat actors, have been reportedly involved in several supply-chain attacks to gain unauthorized access to the intranet of an organization. One of the software exploited by the DPRK threat actors was the MagicLine4NX security authentication program, which…
NukeSped Malware Exploiting Apache ActiveMQ Vulnerability
The Andariel threat group has been discovered installing malware via the exploitation of the Apache ActiveMQ remote code execution vulnerability classified as CVE-2023-46604. The group is known to be either a subsidiary of Lazarus or in an active partnership with the Lazarus…
Konni Group Uses Weaponized Word Documents to Deliver RAT Malware
In the ever-evolving cybersecurity domain, the resurgence of NetSupport RAT, a Remote Access Trojan (RAT), has raised concerns among security professionals. This sophisticated malware, initially developed as a legitimate remote administration tool, has been repurposed by malicious actors to infiltrate…
MOVEit Hack : Over 185,000 AutoZone Users Personal Data Hacked
AutoZone Inc., a US retailer of automotive parts and accessories, warned customers that their data had been compromised as a result of the Clop MOVEit file transfer attacks. Personal information, such as the names and social security numbers of 185,000…
Dell Command Configure Vulnerability Let Attackers Compromise Vulnerable Systems
It has been discovered that there is a high-severity vulnerability in Dell Command Configure that could potentially be exploited by malicious users to compromise the system. The vulnerability has been given a CVSS base score of 7.3 and has been…
North Korean Hackers Exploiting Zero-day Vulnerabilities & Supply Chains
The DPRK has been a great threat to organizations in recent times. Their attack methods have been discovered with several novel techniques involving different scenarios. Their recent attack method was associated with fake candidates and employers for supply chain attacks.…
DarkGate Malware-as-a-Service Evolved as Complete Toolkit
DarkGate is a complete toolkit, first discovered in 2018, that provides attackers with extensive capabilities to access target systems completely. On underground cybercrime forums, an actor known as RastaFarEye develops and sells the software as Malware-as-a-Service (MaaS). The malware is offered through a…
The RAT King “NetSupport RAT” is Back in Action Via fake browser updates
In the perpetually evolving realm of cybersecurity, the reawakening of NetSupport RAT, a Remote Access Trojan (RAT), casts a looming shadow that beckons the attention of vigilant security professionals. This insidious malware, initially conceived as a bona fide remote administration…
‘Pig butchering’: Authorities Seized $9M in Crypto During Dollar Conversion
Authorities seized about $9 million in crypto, which was earned by taking advantage of over 70 victims nationwide through alleged “pig butchering” schemes. A pig-butchering scam is an investment fraud that tricks people into investing their money in seemingly legitimate and lucrative enterprises. These…
ZTNA vs VPN: What is the Difference? Will ZTNA Replace VPN?
In the late 1990s, VPN technology revolutionized remote work. However, the traditional VPN model has become outdated and unworkable as the world becomes increasingly mobile and cloud-based. The need for a new cybersecurity system has been growing for years. Businesses…
MySQL Security Best Practices Guide – 2024
MySQL stands out for its reliability and efficiency among the various database systems available. However, as with any technology that holds valuable data, MySQL databases are a lucrative target for cybercriminals. This makes MySQL security not just an option but…
Exposed Kubernetes Secrets Allow Hackers to Access Sensitive Environments
Kubernetes is an open-source container orchestration platform that automates the deployment, scaling, and management of containerized applications. Besides this, hackers often target Kubernetes due to its widespread adoption, making it a valuable attack vector for compromising and controlling distributed systems. …
Cisco Patched Products Vulnerable to HTTP/2 Rapid Reset Attack
A new high-severity vulnerability has been discovered in multiple Cisco products, which could potentially allow HTTP/2 Rapid Reset Attack. This vulnerability enables a novel distributed denial of service (DDoS) attack technique. This vulnerability was assigned with CVE-2023-44487 and a severity…
Windows Hello Fingerprint Authentication Exploited on Microsoft, Dell, & Lenovo Laptops
Microsoft Windows Hello Fingerprint authentication was evaluated for security over its fingerprint sensors embedded in laptops. This led to the discovery of multiple vulnerabilities that would allow a threat actor to bypass the Windows Hello Authentication completely. The research was…
117 Vulnerabilities Discovered in Microsoft 365 Apps
Microsoft 365 Apps is a suite of productivity tools that includes the following apps and services offered by Microsoft through a subscription service:- Hackers often target these applications because they are widely used in business environments, providing a large potential…
Million-Dollar Crypto Scam that Leaves Investors Empty-handed
In the fast-paced world of cryptocurrency, the ever-looming threat of Rug Pulls has once again taken center stage. Check Point’s Threat Intel Blockchain system, a vigilant guardian of the blockchain realm, recently uncovered a meticulously executed scheme that swindled nearly…
North Korean Hackers Posed as Job Recruiters and Seekers
Two ongoing efforts, Contagious Interview and Wagemole, have been identified to target job-seeking activities connected to North Korean Hackers and state-sponsored threat actors. Threat actors use the interview process in “Contagious Interview” to trick developers into installing malware by posing…
Poloniex Offered $10 Million Reward to Hacker for Return of $120 Million
Poloniex is a popular cryptocurrency exchange platform headquartered in the United States that provides a diverse range of digital assets for trading. The platform was established in January 2014 by Tristan D’Agosta, with a vision to make cryptocurrency trading easier…
DarkGate Gained Popularity for its Covert Nature and Antivirus Evasion
DarkGate, a sophisticated Malware-as-a-Service (MaaS) offered by the enigmatic RastaFarEye persona, has surged in prominence. The malware is known for abusing Microsoft Teams and MSI files to compromise target systems. This Sekoia report delves into its ominous capabilities, examining its…
New Phishing Attack Hijacks Email Thread to Inject Malicious URL
Researchers discovered a new campaign delivering DarkGate and PikaBot that employs strategies similar to those employed in QakBot phishing attempts. This operation sends out a large number of emails to a variety of industries, and because the malware transmitted has…
Former Infosec COO Pleads Guilty for Hacking Hospitals
Former COO of the Atlanta-based cybersecurity company Securolytics, Vikas Singla, launched a series of cyberattacks on the non-profit healthcare organization Gwinnett Medical Center (GMC), which has locations in Lawrenceville and Duluth, Georgia. GMC suffered a financial loss of $817,804.12 as…
Hackers Abusing WhatsApp Messages to Install Android Malware
Embarking on a journey into the realm of cyber threats, Microsoft recently uncovered a series of mobile banking trojan campaigns meticulously designed to exploit unsuspecting users in India. This expose delves into the sophisticated strategies employed by cybercriminals utilizing social…
Hackers Exploit Asset Management Program to Deploy Malware
The Andariel group has been identified in recent reports as distributing malware through asset management programs. This group has been previously discovered to be in a relationship with the Lazarus group. The Andariel group is known to launch supply chain,…
FCC Implemented New Rules to Stop SIM Swapping Attacks
In a pivotal decision on November 15, 2023, the Federal Communications Commission (FCC) orchestrated a formidable defensive strategy against insidious scams targeting consumers’ cell phone accounts. This comprehensive report delves into the intricacies of the newly adopted rules, designed to…
FCC Implemented new Rules to Stop SIM swapping Attacks
In a pivotal decision on November 15, 2023, the Federal Communications Commission (FCC) orchestrated a formidable defensive strategy against insidious scams targeting consumers’ cell phone accounts. This comprehensive report delves into the intricacies of the newly adopted rules, designed to…
Yamaha Ransomware Attack: Employees Personal Information Exposed
A ransomware attack targeted Yamaha Motor Co., Ltd., resulting in a partial disclosure of the personal information maintained by the company. Notably, a third party gained unauthorized access to one of the servers run by Yamaha Motor Philippines, Inc. (YMPH),…
Threat Intelligence with Sandbox Analysis: Security Analyst Guide – 2024
Threat intelligence (TI) is critical to organizations’ cybersecurity infrastructure, allowing them to keep track of the evolving threat landscape and ensure timely detection. However, TI Solutions’ information frequently lacks the specifics required for thorough security measures. One way to address…
AMIDES – Open-source Detection System to Uncover SIEM Blind Points
Cyberattacks pose a significant risk, and prevention alone isn’t enough, so timely detection is crucial. That’s why most organizations use SIEM (Security Information and Event Management) systems to centrally collect and analyze security events with expert-written rules for detecting intrusions.…
Critical AI Tool Vulnerabilities Let Attackers Execute Arbitrary Code
Multiple critical flaws in the infrastructure supporting AI models have been uncovered by researchers, which raise the risk of server takeover, theft of sensitive information, model poisoning, and unauthorized access. Affected are platforms that are essential for hosting and deploying large language models, including Ray,…
‘123456’ Crackable in seconds, 2023’s Most Prevalent Password
For half a decade, NordPass has delved into the realm of password habits, uncovering familiar tunes that persist. However, this year’s narrative is layered with intriguing patterns, particularly within distinct platform categories. Amidst the discourse on passkeys, a question lingers:…
Gang of 5 Employees Stole The Customer Data at Late Night in Office
The sequence of events sounds like it was taken straight from a movie script. Five software programmers were working late into the night, chatting on their phones while they worked. During the wee hours of October 9, between 1:00 am…
Dark Effects of Bot Attacks that Drive 73% of Internet Traffic
In a chilling revelation, the cybercrime economy is projected to soar to $10.5 trillion by 2025, driven by financially motivated bad actors orchestrating dark enterprises. Uncover the intricate web of these malicious activities and the alarming surge in cyber threats.…
Kubernetes Security on AWS: A Practical Guide
Kubernetes security is safeguarding your Kubernetes clusters, the applications they host, and the infrastructure they rely on from threats. As a container orchestration platform, Kubernetes is incredibly powerful but presents a broad attack surface for potential adversaries. Kubernetes security encompasses…
FortiSIEM Injection Flaw: Let Attackers Execute Malicious Commands
Fortinet notifies users of a critical OS command injection vulnerability in the FortiSIEM report server that might enable an unauthenticated, remote attacker to execute malicious commands via crafted API requests. FortiSIEM is Fortinet’s security information and event management (SIEM) solution,…
20+ Companies Hacked in Massive Cyber Attack on Critical Infrastructure
In an alarming development, Denmark faced its most extensive cyber attack in May 2023, targeting crucial components of its energy infrastructure. A total of 22 companies fell victim to a meticulously coordinated attack, breaching their industrial control systems and prompting…
Hacker Receives 18-Month Prison for Running Dark Web Forum
In a momentous development in cybersecurity, Thomas Kennedy McCormick, alias “fubar,” a resident of Cambridge, Massachusetts, has been sentenced to 18 months imprisonment for masterminding a racketeering conspiracy within the infamous Darkode hacking forum. The intricate web of cybercrime unraveled…
Ransomware Gang Files an SEC Complaint for Victim Not Disclosing Data Breach
Alphv Ransomware gang filed an SEC complaint against MeridianLink for not disclosing a data breach. BlackCat, also known as ALPHV, BlackCat operates on the ransomware as a service (RaaS) model, with developers offering the malware for use by affiliates and…
Toyota Financial Hack Claimed by Medusa Ransomware
The biggest manufacturer of automobiles, Toyota, has discovered unauthorized activity on systems in a few of its Europe & African services. The ‘Medusa ransomware gang allegedly took data from Toyota Financial Services.’ The group offered the business ten days to…
Beware! Hackers Can Now Exploit a Security Flaw in Zoom Client
The popular video messaging platform Zoom has discovered multiple vulnerabilities affecting Zoom Clients. These vulnerabilities might allow an unauthorized user to carry out denial-of-service, privilege escalation, and information disclosure attacks. To receive the most recent security updates and bug fixes, Zoom…
ManageEngine Information Disclosure Flaw Exposes Encryption Keys
ManageEngine, one of the most widely used IT infrastructure management platforms that offers more than 60 Enterprise IT management tools, has been discovered with an Information Disclosure vulnerability which is tracked as CVE-2023-6105. This vulnerability affects multiple ManageEngine products, including…
Wireshark 4.2.0 Released: What’s New!
Wireshark, a leading network packet analyzer, has released version 4.2.0, which brings bug fixes, protocol updates, major API changes, codec support, and several new features. It is still a widely used and popular tool for network protocol analysis. Network administrators and security experts use packet…
Samsung Hacked: Customers Personal Information Exposed
Samsung Electronics (U.K.) Limited has announced a cybersecurity incident, corroborating the exposure of customer data that originated in July 2019. The disclosure comes as the tech behemoth contends with the repercussions of illicit access to personal information. Sequence of the…
Reptar – A New CPU Vulnerability Affects Intel and AMD CPUs
A critical CPU vulnerability can pose a significant threat by allowing:- Exploitation of such vulnerabilities can lead to widespread cyberattacks and significant disruptions. Recently, Google noted a rise in CPU vulnerabilities this year, as August disclosures reveal the following vulnerabilities…
TA402 Group using Weaponized XLL and RAR Files to Deliver Malware
Researchers have discovered a new phishing campaign that targets Middle Eastern and North African Government Entities to deliver a new initial access downloader termed “IronWind.” This downloader is followed by additional payload stages, which downloads a shellcode. Most campaigns were…
Hackers Abuse Google Forms to Bypass Anti-spam Filters
Cybersecurity researchers at Talos have discovered that spammers are taking advantage of Google Forms quizzes to disseminate various types of online scams to unsuspecting victims. Since Google’s servers are where the emails are coming from, it could be simpler for…
Ddostf DDoS Malware Attacking MySQL Servers in Windows Environments
Researchers found that vulnerable MySQL servers are being deployed with the Ddostf DDoS bot, which is capable of launching Distributed Denial of Service (DDoS) attacks. Ddostf, which was first identified around 2016, is well-known for supporting both Windows and Linux platforms…
SystemBC, a SWISS KNIFE Proxy Malware, Used by Numerous Ransomware Groups
SystemBC (aka Coroxy or DroxiDat) is a multifunctional malware known as Proxy, Bot, Backdoor, and RAT, adapting to attackers’ needs. Since 2018, this multifunctional malware has been active, and it remains popular in underground markets, with consistent annual incidents. Cybersecurity…
LogShield: A New Framework that Detects the APT Attack Patterns
There have been several cases of GPT model-based detection for various attacks from system logs. However, there has been no dedicated framework for detecting APTs as they use a low and slow approach to compromise the systems. Security researchers have…
What Does PCI DSS 4.0 Mean for API?
Payment Card Industry Data Security Standard or PCI DSS 4.0 was released in May 2022 by the PCI Security Standards Council (PCI SSC). After using PCI DSS 3.2.1 for several years, PCI DSS 4.0 is the latest security standard version…
Hackers Exploiting Create2 to Bypass Wallet Security Alerts
Recently, hackers have used the Ethereum network’s CREATE2 opcode to bypass wallet security alarms in certain wallets. Using Create2’s pre-calculation feature, the Drainers can produce unique addresses for every malicious signature. After the victim signs the malicious signature, these addresses are deployed.…
Hackers Selling Exploits for Critical Vulnerabilities on the Dark Web
Dark forums and Telegram channels have become great places for threat actors to sell critical vulnerabilities and exploits. These vulnerabilities and exploits were associated with the Elevation of Privilege, Authentication Bypass, SQL Injection, and Remote Code Execution in products like…
Intel is Being Sued Over the ‘Downfall’ CPU Vulnerability for $10K per Plaintiff
A class-action lawsuit had been filed against Intel due to a critical “Downfall” vulnerability in Intel CPUs, a defect that Intel was aware of since 2018 but neglected to report. According to Intel, the only way to “fix” it is to apply…
Authorities Took Down Massive Phishing-as-a-service Provider
A notorious phishing service that supplied cybercriminals with phishing kits, scam pages, and stolen credentials has been disrupted by a joint operation involving Malaysian, Australian, and U.S. authorities. BulletProftLink, also known as a phishing-as-a-service (PhaaS) platform, had been operating for…