Latest Cybersecurity News and Articles

---

Emotet malware attacks return after three-month break

The Emotet malware operation is again sending malicious spam emails as of Tuesday morning after a three-month break, rebuilding its network and infecting devices worldwide.

---

R3NIN Sniffer-as-a-Service Targets E-commerce Consumers

Cybersecurity analysts at Cybel reported on R3NIN, an online skimmer, that pilfers payment card data and PII from unsuspecting individuals while they checkout from online shops. This toolkit has capabilities for creating unique JavaScript injection codes, managing exfiltrated data, managing compromised payment card info (across different browsers), checking BINs, parsing data, and generating statistics.

---

PayPal Ventures Invests in Threat Prevention Leader Deep Instinct

Deep Instinct, the first company to apply deep learning to cybersecurity, today announced an investment from PayPal Ventures. The funding will help further accelerate Deep Instinct's growth, driven by its disruptive threat prevention technology.

---

CISA's KEV Catalog Updated with Three New Flaws Threatening IT Management Systems

The most critical of the three is CVE-2022-35914, which concerns a remote code execution vulnerability in the third-party library htmlawed present in Teclib GLPI, an open-source asset and IT management software package.

---

BlackLotus UEFI Bootkit Bypasses Fully Patched Windows 11

BlackLotus bootkit has been discovered interfering with UEFI Secure Boot, a crucial platform security feature, that can run even on fully up-to-date Windows 11 systems. The robust, persistent 80 KB toolkit was created in Assembly and C language. To prevent infecting computers in Armenia, Belarus, Kazakhstan, Moldova, Romania, Russia, and Ukraine, it also has geofencing capabilities.

---

Private Malware for Sale: A Closer Look at AresLoader

In December 2022, a private loader named “AresLoader” was advertised for sale on the top-tier Russian-language hacking forum XSS by a threat actor going by the name “DarkBLUP”.

---

Sharp Panda Using New Soul Framework Version to Target Southeast Asian Governments

High-profile government entities in Southeast Asia are the target of a cyber espionage campaign undertaken by a Chinese threat actor known as Sharp Panda since late last year. The intrusions are characterized by the use of a new version of the Soul modular framework, marking a departure from the group's attack chains observed in 2021. Israeli cybersecurity company Check Point said the "

---

APT27 Modified its Custom RAT to Target Linux Systems

Iron Tiger, an APT organization, has updated its SysUpdate RAT by incorporating additional functionality and support for malware infection to target the Linux OS. Experts suspect APT27 used the chat app Youdu to send malicious links to the employees, luring them into downloading the initial infection payloads. Organizations are suggested to tighten up the vigilance of all entry points, including emails and IM with ant-malware and anti-phishing solutions. 

---

CISA's KEV Catalog Updated with 3 New Flaws Threatening IT Management Systems

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added three security flaws to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The list of vulnerabilities is below - CVE-2022-35914 (CVSS score: 9.8) - Teclib GLPI Remote Code Execution Vulnerability CVE-2022-33891 (CVSS score: 8.8) - Apache Spark Command Injection Vulnerability

---

Parallax RAT Targets Crypto Companies via Process Hollowing

Uptycs researchers spotted a new malware campaign targeting cryptocurrency companies with Parallax RAT. It can collect system metadata and data stored in the clipboard. Once the malware has been successfully injected, attackers interact with the victims by asking questions and sharing their Telegram ID via Notepad for further communication.

---

Ghosts of Vulnerabilities Past Still Haunt the Present

According to VulnCheck, the KEV Catalog comprises 868 bugs, including 557 added in the past year. Among these, 241 have been abused by APT actors, 122 by ransomware gangs, and 69 by botnets. Another report by Tenable categorized significant vulnerability data to identify the most significant risks and disrupt attack paths, thereby reducing the overall exposure to cyberattacks.

---

New HiatusRAT Emerges to Infect Business-Grade Routers

Experts at Lumen Black Lotus Labs stumbled across a campaign dubbed Hiatus dropping a pair of payloads to infect business routers. The payloads include HiatusRAT and a variant of tcpdump (which enables packet capture on the target device). With HiatusRAT, criminals can turn a compromised machine into a secret proxy system. Researchers identified at least 100 infected systems, with most of the infections in Europe and Latin America.

---

New Cyber Reports & Initiatives Target Key Vulnerabilities

Two recently released reports highlight the increasing challenges faced by security practitioners, particularly those who have larger and more integrated systems between their IT and OT environments.

---

New Vulnerabilities in TPM 2.0 May Affect IoT and Enterprise Devices

Researchers at Quarkslab unveiled two bugs in the Trusted Platform Module (TPM) 2.0 reference library specification. The attacks could potentially lead to information disclosure or privilege escalation. The first bug, CVE-2023-1017, concerns an out-of-bounds write while the other bug, CVE-2023-1018, is an out-of-bounds read issue. Billions of internet-connected devices across different organizations are vulnerable to the threat.

---

Breaking barriers: Insight’s investment in women’s leadership and board readiness

Megan Amdahl is Senior Vice President of Partner Alliances & North America Transformation at Insight, a solutions integrator company that provides technical expertise and advisory services to help organizations accelerate their digital journeys and modernize their businesses. Megan is a finance leader with more than 10 years of diverse experience in financial planning and analysis, […] The post Breaking barriers: Insight’s investment in women’s leadership and board readiness appeared first on CyberTalk.

---

Sued by Meta, Freenom Halts Domain Registrations

The domain name registrar Freenom, whose free domain names have long been a draw for spammers and phishers, has stopped allowing new domain name registrations. The move comes just days after the Dutch registrar was sued by Meta, which alleges the company ignores abuse complaints about phishing websites while monetizing traffic to those abusive domains.

---

Fighting back against cyber attacks on water systems

EXECUTIVE SUMMARY: In the U.S., the government is requiring states to research and report on the cyber capabilities of drinking water utilities. This is part of the White House’s larger effort to protect the country’s critical infrastructure from nation-state cyber attacks and similarly dangerous threats. The new requirements were implemented by the Environmental Protection Agency […] The post Fighting back against cyber attacks on water systems appeared first on CyberTalk.

---

New SYS01stealer Threat Uses Facebook Ads to Target Critical Infrastructure Firms

Morphisec has tracked an advanced info-stealer called SYS01stealer since November 2022. It uses similar lures and loading techniques to another information stealer recently named S1deload by Bitdefender, but the actual payload is different.

---

Vice Society Ransomware Group Claims Hamburg University of Applied Sciences as Latest Victim

The university warned that “significant amounts of data from various areas” were copied, including usernames and “cryptographically secured” passwords, email addresses, and mobile phone numbers.

---

Transparent Tribe Lures Indian and Pakistani Officials With Romance Scam to Spread Malware

ESET researchers have identified an active Transparent Tribe campaign, targeting mostly Indian and Pakistani Android users – presumably with a military or political orientation.