Latest Cybersecurity News and Articles

---

Why Cyberattacks Mustn’t Be Kept Secret

Embracing a culture of cybersecurity transparency is beneficial for businesses and the broader security of the internet, as it strengthens external perception and leads to quicker and more resilient reactions to breaches.

---

Global Fintech Firm EquiLend Offline After Recent Cyberattack

The company is working to restore affected services and has hired third-party experts to investigate the security breach. It has not been disclosed if any data was exposed or stolen during the incident.

---

UK: NCSC Warns AI Will Cause Surge in Ransomware Volume and Impact

Ransomware attacks are expected to increase in volume and impact over the next two years due to advancements in artificial intelligence (AI) technologies, according to British intelligence.

---

Critical Jenkins Vulnerability Exposes Servers to RCE Attacks - Patch ASAP!

The maintainers of the open-source continuous integration/continuous delivery and deployment (CI/CD) automation software Jenkins have resolved nine security flaws, including a critical bug that, if successfully exploited, could result in remote code execution (RCE). The issue, assigned the CVE identifier CVE-2024-23897, has been described as an arbitrary file read vulnerability through the

---

Tech Giant HP Enterprise Hacked by Russian Hackers Linked to DNC Breach

Hackers linked to the Kremlin, specifically the Russian state-sponsored group APT29, infiltrated Hewlett Packard Enterprise's cloud email environment to steal mailbox data from select individuals within the company.

---

Organizations need to switch gears in their approach to email security

According to Egress, email security incidents continue to have severe impacts on organizations, with 94% experiencing security incidents in the past year, including data loss, exfiltration, and phishing attacks.

---

LODEINFO Fileless Malware Evolves with Anti-Analysis and Remote Code Tricks

Cybersecurity researchers have uncovered an updated version of a backdoor called LODEINFO that's distributed via spear-phishing attacks. The findings come from Japanese company ITOCHU Cyber & Intelligence, which said the malware "has been updated with new features, as well as changes to the anti-analysis (analysis avoidance) techniques." LODEINFO (versions 0.6.6 and 0.6.7

---

Cyber Threat Landscape: 7 Key Findings and Upcoming Trends for 2024

The 2023/2024 Axur Threat Landscape Report provides a comprehensive analysis of the latest cyber threats. The information combines data from the platform's surveillance of the Surface, Deep, and Dark Web with insights derived from the in-depth research and investigations conducted by the Threat Intelligence team. Discover the full scope of digital threats in the Axur Report 2023/2024. Overview

---

Ukrainian Hackers Claim Attack on Russian Scientific Research Center

The Ukrainian hacker group "BO Team" reportedly breached a Russian scientific research center, destroying its database and equipment. The target, the State Research Center on Space Hydrometeorology, is a key enterprise for processing satellite data.

---

French Regulators Levy $34.7 Million Fine Against Amazon for Surveilling Employees

France's data protection authority, CNIL, has fined Amazon €32 million ($34.7 million) for excessive monitoring of employees in its warehouses and for not promptly deleting the data.

---

The Effect of Omission Bias on Vulnerability Management

Omission bias in vulnerability management leads to the reluctance to patch vulnerabilities, despite evidence showing the importance of timely patching to prevent cyberattacks.

---

UK Tells Business Leaders to ‘Toughen Up’ Against Cyberattacks

The increase in ransomware attacks in the UK is attributed to the success of the ransomware-as-a-service ecosystem, making it easier for criminals to engage in disruptive attacks.

---

China-backed Hackers Hijack Software Updates to Implant "NSPX30" Spyware

A previously undocumented China-aligned threat actor has been linked to a set of adversary-in-the-middle (AitM) attacks that hijack update requests from legitimate software to deliver a sophisticated implant named NSPX30. Slovak cybersecurity firm ESET is tracking the advanced persistent threat (APT) group under the name Blackwood. It's said to be active since at least 2018. The NSPX30

---

New CherryLoader Malware Mimics CherryTree to Deploy Privilege Escalation Exploits

The loader drops two publicly available privilege escalation tools, PrintSpoofer and JuicyPotatoNG, and uses encryption methods like XOR and AES to facilitate the attack chain.

---

Security Vendors are Accused of Bending CVE Assignment Rules

Both Juniper Networks and Ivanti have attracted criticism from members of the infosec industry for the way they've handled the disclosure of vulnerabilities over the past week.

---

Data from Indian Online Gaming Platforms Teenpatti.com and Mpl.live on Sale

The alleged data breach at Teenpatti.com and Mpl.live underscores the urgent need for improved security measures in online gaming platforms, especially in handling large volumes of personal user data.

---

Unmasking MacOS Malware in Pirated Apps

Pirate applications targeting macOS users distribute a backdoor, allowing attackers to download and execute multiple payloads. Each application includes a malicious dylib, a backdoor, and a persistent downloader, posing a significant threat to users. The researchers from Jamf Threat Labs identified similarities with the ZuRu malware.

---

Over 5,300 GitLab Servers Exposed to Zero-Click Account Takeover Attacks

The flaw affects several versions of GitLab and patches have already been released. The servers at risk are mainly located in the United States, Germany, Russia, China, France, the U.K., India, and Canada.

---

New CherryLoader Malware Mimics CherryTree to Deploy PrivEsc Exploits

A new Go-based malware loader called CherryLoader has been discovered by threat hunters in the wild to deliver additional payloads onto compromised hosts for follow-on exploitation. Arctic Wolf Labs, which discovered the new attack tool in two recent intrusions, said the loader's icon and name masquerades as the legitimate CherryTree note-taking application to dupe potential victims

---

CISA Adds Atlassian Confluence Data Center Bug to Its Known Exploited Vulnerabilities Catalog

The vulnerability, tracked as CVE-2023-22527, allows remote attackers to execute arbitrary code on vulnerable Confluence installs. Atlassian has released patches to address the issue and recommends immediate action to update to the latest versions.