Latest Cybersecurity News and Articles

---

Operation RusticWeb: Rust-Based Malware Targets Indian Government Entities

Indian government entities and the defense sector have been targeted by a phishing campaign that's engineered to drop Rust-based malware for intelligence gathering. The activity, first detected in October 2023, has been codenamed Operation RusticWeb by enterprise security firm SEQRITE. "New Rust-based payloads and encrypted PowerShell commands have been utilized to exfiltrate

---

BidenCash Dark Web Marketplace Leaks 1.6 Million Credit Card Details

Unlike a previous leak, this one does not include names or emails of cardholders. While the absence of names reduces the risk of identity theft, the leaked financial details still pose a significant risk for unauthorized transactions.

---

Decoy Microsoft Word Documents Used to Deliver Nim-Based Malware

A new phishing campaign is leveraging decoy Microsoft Word documents as bait to deliver a backdoor written in the Nim programming language. "Malware written in uncommon programming languages puts the security community at a disadvantage as researchers and reverse engineers' unfamiliarity can hamper their investigation," Netskope researchers Ghanashyam Satpathy and Jan Michael Alcantara 

---

Iran’s Peach Sandstorm Group Deploys FalseFont Backdoor Against Defense Sector

FalseFont is a custom backdoor with various capabilities that allow operators to remotely access compromised systems, execute files, and transmit information to Command and Control servers.

---

New Rules in UK Could Reimburse Fraud Victims up to £415,000 ($525,000)

The UK's Payment Systems Regulator (PSR) announced that victims could be repaid up to £415,000 ($525,000) unless the bank can prove "gross negligence" on the part of the individual.

---

BattleRoyal Threat Cluster Spread DarkGate RAT via Email and Fake Browser Updates

The BattleRoyal cluster, using DarkGate and NetSupport malware, demonstrates the use of multiple attack chains and social engineering techniques to deliver payloads via email and fake update lures.

---

Analysis: The Various Ways Malicious JavaScript can Steal Your Secrets

Researchers from Unit 42 have discovered that threat actors are using malicious JavaScript to steal sensitive information by exploiting popular survey sites, low-quality hosting, and web chat APIs.

---

First American Takes IT Systems Offline After Cyberattack

First American Financial Corporation, the second-largest title insurance company in the US, has experienced a cyberattack and has taken some systems offline to contain the impact.

---

CISA Seeks Comment on Secure by Design Principles to Boost Global Software Security

The Biden administration is pushing for secure-by-design principles to be embraced by the tech industry, aiming to make security a core feature of software development to prevent attacks exploiting vulnerabilities.

---

MageCart WordPress Plugin Injects Malicious User & Credit Card Skimmer

A recent analysis discovered a malicious plugin injected into a WordPress/WooCommerce website that creates a fake administrator user and injects credit card skimming JavaScript into the checkout page.

---

Cisco to Acquire Cloud-Native Networking and Security Startup Isovalent

Isovalent has developed eBPF, an open-source technology that provides insight into the operating system layer, and Cilium, which offers visibility into cloud-native applications.

---

St Vincent’s Health Australia Says Data Stolen in Cyberattack

St Vincent's, Australia's largest not-for-profit health and aged care provider, has confirmed that it has experienced a cyberattack and that hackers have stolen some of its data.

---

FTC Proposes Tougher Children’s Data Privacy Rules for First Time in a Decade

The proposed changes to the Children's Online Privacy Protection Rule (COPPA) would hold service providers responsible for ensuring the safety of digital experiences for children, rather than relying solely on parents.

---

Kansas City-Area Hospital Transfers Patients, Reschedules Appointments After Cyberattack

A hospital near Kansas City, Missouri, is facing disruptions in patient care due to a cyberattack on its IT systems. Some patients had to be transferred to other hospitals, and the hospital is actively investigating the source of the disruption.

---

These aren’t the Android phones you should be looking for

Users should exercise caution when using third-party app stores or purchasing cheap devices from unknown brands, as they may be at a higher risk of malware and other security threats.

---

NIST Report Identifies Significant Privacy Gaps in Genomic Data Handling

Breaches of genomic data not only pose risks to individuals but also have implications for their families, while sharing such data is crucial for research and development in the biotechnology field.

---

UAC-0099 Using WinRAR Exploit to Target Ukrainian Firms with LONEPAGE Malware

The threat actor known as UAC-0099 has been linked to continued attacks aimed at Ukraine, some of which leverage a high-severity flaw in the WinRAR software to deliver a malware strain called LONEPAGE. "The threat actor targets Ukrainian employees working for companies outside of Ukraine," cybersecurity firm Deep Instinct said in a Thursday analysis. UAC-0099 was first

---

Yahoo Survivor Football Bug Let Players Pick Winners After NFL Games Were Over

A bug on Yahoo's sports betting platform allowed users to cheat by placing bets after the games had already been decided, potentially impacting the outcome of survivor pools with real money involved.

---

Update: Notorious Ransomware Group Tussles With Law Enforcement, Regenerates After Takedown

The ransomware group AlphV has re-emerged just hours after law enforcement agencies took down its infrastructure. The group claimed to have "unseized" its data leak site and updated information about new victims.

---

Microsoft Warns of New 'FalseFont' Backdoor Targeting the Defense Sector

Organizations in the Defense Industrial Base (DIB) sector are in the crosshairs of an Iranian threat actor as part of a campaign designed to deliver a never-before-seen backdoor called FalseFont. The findings come from Microsoft, which is tracking the activity under its weather-themed moniker Peach Sandstorm (formerly Holmium), which is also known as APT33, Elfin, and Refined Kitten. "