Latest Cybersecurity News and Articles

---

Cybercriminals Shift Tactics to Pressure More Victims Into Paying Ransoms

Cybercriminals' new tactics led to a 64% increase in ransomware claims in 2023, driven by a 415% rise in "indirect" incidents and remote access vulnerabilities, pressuring more victims to pay ransoms, according to At-Bay.

---

Fortinet FortiSIEM Command Injection Flaw (CVE-2023-34992) Deep-Dive

Researchers at Horizon3.ai discovered a critical remote code execution vulnerability (CVE-2023-34992) in Fortinet FortiSIEM, allowing unauthenticated attackers to execute commands as root users and gain access to sensitive information.

---

CyberArk Snaps up Venafi for $1.54B to Ramp up in Machine-to-Machine Security

The acquisition will allow CyberArk to expand its capabilities in securing machine-to-machine communications and address the growing attack surface in the cloud-first, AI-driven, and post-quantum world.

---

GitCaught Campaign Leverages GitHub Repositories and Fake Profiles for Malicious Infrastructure

Insikt Group uncovered a sophisticated campaign led by Russian-speaking actors who used GitHub profiles to spoof legitimate software apps and distribute various malware, including Atomic macOS Stealer (AMOS) and Vidar.

---

NextGen Healthcare Mirth Connect Under Attack - CISA Issues Urgent Warning

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a security flaw impacting NextGen Healthcare Mirth Connect to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The flaw, tracked as CVE-2023-43208 (CVSS score: N/A), concerns a case of unauthenticated remote code execution arising from an incomplete

---

"Linguistic Lumberjack" Vulnerability Discovered in Popular Logging Utility Fluent Bit

Cybersecurity researchers have discovered a critical security flaw in a popular logging and metrics utility called Fluent Bit that could be exploited to achieve denial-of-service (DoS), information disclosure, or remote code execution. The vulnerability, tracked as CVE-2024-4323, has been codenamed Linguistic Lumberjack by Tenable Research. It impacts versions from 2.0.7 through

---

Data protection top motivator for cloud-based backup

A recent report found that the top drivers for cloud-based backup are the desire to integrate cyber technologies with data protection and backup.

---

Chinese Duo Indicted for Laundering $73m in Pig Butchering Case

Two Chinese nationals have been indicted for their alleged involvement in a multimillion-dollar "pig butchering" investment fraud scheme, where they laundered over $73 million through US financial institutions and cryptocurrency wallets.

---

Too Many ICS Assets are Exposed to the Public Internet

The enterprise attack surface is rapidly expanding due to the convergence of IT and OT systems, leading to a large number of ICS assets being exposed to the public internet and creating new vulnerabilities that security teams struggle to manage.

---

Iranian MOIS-Linked Hackers Behind Destructive Attacks on Albania and Israel

An Iranian threat actor affiliated with the Ministry of Intelligence and Security (MOIS) has been attributed as behind destructive wiping attacks targeting Albania and Israel under the personas Homeland Justice and Karma, respectively. Cybersecurity firm Check Point is tracking the activity under the moniker Void Manticore, which is also known as Storm-0842 (formerly DEV-0842) by

---

US SEC Approves Wall Street Data Breach Reporting Regs

The SEC has approved new regulations that require broker-dealers and investment firms to notify their clients within 30 days of detecting a data breach, in an effort to modernize and enhance the protection of consumers' financial data.

---

AI Python Package Flaw ‘Llama Drama’ Threatens Software Supply Chain

A critical vulnerability in the Jinja2 template rendering Python tool used by the llama_cpp_python package for integrating AI models can allow hackers to execute arbitrary code, putting systems and data at risk.

---

Judge Denies Class Certification in Blackbaud Hack Lawsuit

The judge said the plaintiffs did not show an "administratively feasible" way for the court to determine whether a particular individual is a class member without extensive and individualized fact-finding.

---

Latrodectus Malware Loader Emerges as Potential Replacement for IcedID

Researchers have observed a surge in email phishing campaigns delivering Latrodectus, a new malware loader believed to be the successor to the IcedID malware, which is capable of deploying additional payloads such as QakBot, DarkGate, and PikaBot.

---

The Importance of Access Controls in Incident Response

Adequate IAM policies are essential for incident management tooling to ensure the right people can quickly address issues without being blocked. Authentication verifies a person's identity, while authorization manages permissions and access levels.

---

Grandoreiro Banking Trojan is Back With Major Updates

The Grandoreiro banking Trojan has resurfaced with major updates, including enhanced functionality and the ability to target over 1500 global banking applications and websites in more than 60 countries, making it a more potent threat.

---

Addressing the Cybersecurity Vendor Ecosystem Disconnect

Experts highlight the need for better collaboration within the cybersecurity vendor ecosystem to help security teams defend against increasing automated, machine-generated cyberattacks.

---

Kinsing Hacker Group Expands its Cryptoming Botnet Network with More Vulnerability Exploits

The Kinsing hacker group has demonstrated its ability to continuously evolve and adapt, quickly integrating newly disclosed vulnerabilities into its exploit arsenal to expand its cryptojacking botnet across various operating systems and platforms.

---

White House Unveils AI Safety Framework for US Workers

The White House unveiled a framework to protect U.S. workers from AI risks, emphasizing health and safety rights, governance, human oversight, and transparency as organizations adopt new technologies.

---

CISA Senior Official Goldstein to Leave Agency in June

Eric Goldstein, the executive assistant director for cybersecurity at the CISA, is leaving the agency in June after playing a crucial role in driving the agency's secure-by-design initiatives and strengthening partnerships with the private sector.