Latest Cybersecurity News and Articles

---

GCHQ director and U.S. cyber chief among speakers confirmed for CYBERUK 2024

NCSC announces colleagues and experts from across the globe to speak at this year’s conference in Birmingham.

---

Dubious NuGet Package May Portend Chinese Industrial Espionage

"SqzrFramework480" is a .NET dynamic link library (DLL) that seems to pertain to Bozhon Precision Industry Technology Co., a Chinese manufacturer of consumer electronics and various industrial technologies.

---

Two Chinese APT Groups Ramp Up Cyber Espionage Against ASEAN Countries

Two China-linked advanced persistent threat (APT) groups have been observed targeting entities and member countries affiliated with the Association of Southeast Asian Nations (ASEAN) as part of a cyber espionage campaign over the past three months. This includes the threat actor known as Mustang Panda, which has been recently linked to cyber attacks against Myanmar as well as

---

Everything you need to know about the Microsoft Exchange Server hack

Updated: A new critical vulnerability impacting Exchange Server is being exploited in the wild.

---

Women working in tech are less likely to be employed full time

A recent report found that fewer women technology professionals reported receiving an increase in pay over the last year compared to men.

---

Agent Tesla's New Ride: The Rise of a Novel Loader

Recently, SpiderLabs identified a phishing email with an attached archive that included a Windows executable disguised as a fraudulent bank payment. This action initiated an infection chain culminating in the deployment of Agent Tesla.

---

Malicious NuGet Package Linked to Industrial Espionage Targets Developers

Threat hunters have identified a suspicious package in the NuGet package manager that's likely designed to target developers working with tools made by a Chinese firm that specializes in industrial- and digital equipment manufacturing. The package in question is SqzrFramework480, which ReversingLabs said was first published on January 24, 2024. It has been downloaded 

---

Agenda Ransomware Propagates to vCenters and ESXi via Custom PowerShell Script

Agenda ransomware group uses RMM tools, as well as Cobalt Strike for deployment of the ransomware binary. It can also propagate via PsExec and SecureShell, while also making use of different vulnerable SYS drivers for defense evasion.

---

67% of businesses sync on-premises passwords to cloud environments

New research provides key insights and classifications regarding the threats that identity security teams face. 

---

Recent ‘MFA Bombing’ Attacks Targeting Apple Users

Several Apple customers recently reported being targeted in elaborate phishing attacks that involve what appears to be a bug in Apple's password reset feature. In this scenario, a target's Apple devices are forced to display dozens of system-level prompts that prevent the devices from being used until the recipient responds "Allow" or "Don't Allow" to each prompt. Assuming the user manages not to fat-finger the wrong button on the umpteenth password reset request, the scammers will then call the victim while spoofing Apple support in the caller ID, saying the user's account is under attack and that Apple support needs to "verify" a one-time code.

---

Canadian Discount Retailer Giant Tiger Says Customer Data Was Compromised in Third-Party Breach

The retailer first learned of the security incident on March 4, and concluded that customer information was involved by March 15, the company wrote in an email to customers.

---

US Indicts Accused APT31 Chinese Hackers for Hire

U.S. federal prosecutors indicted seven Chinese nationals they accuse of hacking for a Beijing economic and intelligence espionage group whose operations reacted to geopolitical trends.

---

New Zealand Government Discloses Cyberattacks by China-Linked APT40 on Two Parliamentary Agencies

New Zealand's admission it's been on the receiving end came a day after the UK and United States detailed Chinese-supported attacks on government institutions – including the UK's Electoral Register.

---

New Tycoon 2FA Phishing Kit Raises Cybersecurity Concerns

An analysis by Sekoia revealed that the kit has emerged as one of the most prevalent AiTM phishing kits, with over 1,100 domain names detected between October 2023 and February 2024.

---

New ZenHammer Memory Attack Impacts AMD CPUs Based on Zen Architecture

Academic researchers developed ZenHammer, the first variant of the Rowhammer DRAM attack that works on CPUs based on a recent AMD Zen microarchitecture that maps physical addresses on DDR4 and DDR5 memory chips.

---

Hospitals Lobby Feds to Clarify Breach Duties in UHG Attack

The AHA is asking the Department of Health and Human Services' Office for Civil Rights for a "unified notification process" if a breach occurred in the February 21 cyberattack on UnitedHealth Group's Change Healthcare unit.

---

UK Privacy Watchdog Updates Guidance on Data Protection Fines

After suffering a data breach, organizations in the United Kingdom that work closely and transparently with regulators and cybersecurity officials will be treated with greater leniency if their case results in penalties and a fine.

---

U.S. Charges 7 Chinese Nationals in Major 14-Year Cyber Espionage Operation

The U.S. Department of Justice (DoJ) on Monday unsealed indictments against seven Chinese nationals for their involvement in a hacking group that targeted U.S. and foreign critics, journalists, businesses, and political officials for about 14 years. The defendants include Ni Gaobin (倪高彬), Weng Ming (翁明), Cheng Feng (程锋), Peng Yaowen (彭耀文), Sun Xiaohui (孙小辉), Xiong Wang (熊旺), and Zhao Guangzong (

---

Senator Demands Answers From HHS About $7.5 Million Cyber Theft in 2023

HHS has not issued a public statement about the incident, and its Office of the Inspector General declined to confirm or deny an investigation was underway when pressed about it in January.

---

Cybercriminals can leverage March Madness as bait for attacks

March Madness, like any other major public event, may provide a platform for malicious actors to work.