Latest Cybersecurity News and Articles

---

Two New Ivanti Bugs Discovered as CISA Warns of Hackers Bypassing Mitigations

Ivanti has discovered two new vulnerabilities in its Policy Secure and Connect Secure VPN products, impacting U.S. government and other industries. One is an unauthorized access issue, while the other allows privilege escalation.

---

Ransomware Incidents Hit Record High, But Law Enforcement Takedowns Slow Growth

According to Corvus, the number of active ransomware groups grew by 34% between Q1 and Q4 2023, linked to the fracturing of well-known ransomware groups that leaked their proprietary encryptors.

---

'Leaky Vessels' Cloud Bugs Allow Container Escapes Globally

Vulnerabilities in container engine components, dubbed "Leaky Vessels," pose a serious threat by allowing attackers to break out of containers and execute malicious actions on the underlying host system.

---

Cybercriminals Embrace Smarter Strategies, Less Effort

The expanding supply chain vulnerabilities and digital transformation are increasing the risk of data breaches in 2024. Threat actors may target rare earth material supply chains and leverage small-scale data manipulation for major impact.

---

Dozens in Jordan targeted by authorities using NSO spyware, report finds

Findings suggest Jordan is relying on cyberweapon to quash dissent and its use is ‘staggeringly widespread’About three dozen journalists, lawyers and human rights workers in Jordan have been targeted by authorities using powerful spyware made by Israel’s NSO Group amid a broad crackdown on press freedoms and political participation, according to a report by the lobbying group Access Now.The information suggests the Jordanian government has used the Israeli cyberweapon against members of civil society, including at least one American citizen living in Jordan, between 2019 and September 2023. Continue reading...

---

CISA Warns of Active Exploitation of Critical Flaws in Apple iOS and macOS

The flaw allows attackers with arbitrary read and write capability to bypass Pointer Authentication, and it's recommended that Federal Civilian Executive Branch (FCEB) agencies apply the fixes by February 21, 2024.

---

New York AG Sues Citibank for Poor Phishing Protections

The lawsuit from the New York Attorney General claims that the bank lacks sufficient security measures to prevent unauthorized transfers and fails to respond effectively when red flags are raised.

---

Nitrogen Shelling Malware From Hacked Sites

The threat actors behind the Nitrogen campaign prefer hosting their payloads on compromised WordPress sites and have a known connection to ransomware, making it a serious threat to businesses.

---

Brazilian Police Make Arrests in Grandoreiro Banking Malware Case

The Grandoreiro malware can track keyboard inputs, simulate mouse activity, and initiate communication with criminals’ servers, making it a potent threat to banking activities.

---

Warning: New Malware Emerges in Attacks Exploiting Ivanti VPN Vulnerabilities

Google-owned Mandiant said it identified new malware employed by a China-nexus espionage threat actor known as UNC5221 and other threat groups during post-exploitation activity targeting Ivanti Connect Secure VPN and Policy Secure devices. This includes custom web shells such as BUSHWALK, CHAINLINE, FRAMESTING, and a variant of LIGHTWIRE. "CHAINLINE is a Python web shell backdoor that is

---

Nigerian 'Yahoo Boys' Behind Social Media Sextortion Surge in the US

The Network Contagion Research Institute (NCRI) has found that teenagers from Western English-speaking countries are increasingly targeted by financial sextortion attacks conducted by Nigeria-based cybercriminals, known as 'Yahoo Boys.'

---

AI-Generated Code Leads to Security Issues for Most Businesses: Report

According to a survey by Snyk, over three-quarters of developers are bypassing established protocols to use AI-powered code completion tools, raising concerns about security implications.

---

‘Tis the Season for Tax Hax

TA576, a cybercriminal threat actor, has returned with tax-themed lures targeting accounting and finance organizations during the U.S. tax season, using unique attack chains and delivering Parallax RAT.

---

Phobos Ransomware Expands with New FAUST Variant

FortiGuard Labs exposed a fresh attack vector involving the FAUST ransomware, a Phobos variant. The attackers employed a Visual Basic script in an Office document to propagate FAUST. They utilized the Gitea service to store encoded files. The ransomware employs advanced evasion tactics, adds persistence, and carries an exclusion list. 

---

CISA Warns of Active Exploitation of Critical Vulnerability in iOS, iPadOS, and macOS

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a high-severity flaw impacting iOS, iPadOS, macOS, tvOS, and watchOS to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation. The vulnerability, tracked as CVE-2022-48618 (CVSS score: 7.8), concerns a bug in the kernel component. "An attacker with

---

Football Australia data leak exposes players’ contracts, fans’ personal details

Australian players, every fan and FA customer potentially affectedCybersecurity breach has been traced back to early 2022Passports, player contracts and more have been available online for almost two years due to a Football Australia (FA) data breach which cyber security researchers say includes information on every Australian fan and customer of the governing body.Lithuanian group Cybernews detected the leak and informed the FA, allowing football officials to plug the hole before the issue was made public on Thursday morning. Continue reading...

---

79% of organizations faced a ransomware attack in H2 2023

According to a recent report, 79% of respondents said their company had been the ‘victim of a ransomware attack’ between June and December 2023.

---

RunC Flaws Enable Container Escapes, Granting Attackers Host Access

Multiple security vulnerabilities have been disclosed in the runC command line tool that could be exploited by threat actors to escape the bounds of the container and stage follow-on attacks. The vulnerabilities, tracked as CVE-2024-21626, CVE-2024-23651, CVE-2024-23652, and CVE-2024-23653, have been collectively dubbed Leaky Vessels by cybersecurity vendor Snyk. "These container

---

Pawn Storm Uses Brute Force and Stealth Against High-Value Targets

Pawn Storm, aka APT28 and Forest Blizzard, has been employing anonymization layers, such as VPN services and compromised EdgeOS routers, to hide its tracks and carry out sophisticated attacks.

---

Italian Businesses Hit by Weaponized USB Devices Spreading Cryptojacking Malware

The threat actor deploys the EMPTYSPACE downloader and the QUIETBOARD backdoor to execute commands, alter crypto wallet addresses, take screenshots, and propagate the malware.