Latest Cybersecurity News and Articles

---

Lyca Mobile Suffers Disruptive Cyberattack; Investigates Ransomware Possibility

The cyberattack caused disruptions to national and international calling, as well as customers' and retailers' access to top-ups, indicating a potential ransomware attack.

---

Sony Confirms Data Breach Impacting Thousands of US Employees

The breach, caused by the Clop ransomware gang, occurred in late June but was only publicly acknowledged by Sony recently, with the company taking immediate action to remediate the vulnerability and launch an investigation.

---

Researchers Link DragonEgg Android Spyware to LightSpy iOS Surveillanceware

New findings have identified connections between an Android spyware called DragonEgg and another sophisticated modular iOS surveillanceware tool named LightSpy. DragonEgg, alongside WyrmSpy (aka AndroidControl), was first disclosed by Lookout in July 2023 as a strain of malware capable of gathering sensitive data from Android devices. It was attributed to the Chinese nation-state group APT41. On

---

Ransomware double-extortion attacks increased 72%

Malware, ransomware attacks and network security trends were analyzed in a recent report by WatchGuard, finding a rise in double-extortion attacks.

---

Typosquatting Campaign Delivers R77 Rootkit Through Malicious JavaScript Package

The typosquatting attack involved a malicious package called node-hide-console-windows that downloaded a Discord bot, which then planted an open-source rootkit called r77.

---

Dead Grandma Locket Request Tricks Bing Chat’s AI Into Solving Security Puzzle

This incident highlights a new type of vulnerability, similar to prompt injection, where users can bypass the constraints of the AI model. Microsoft is likely to address this issue in future versions of Bing Chat.

---

Dark Web Sale of FBI LEEP Classified Data Sparks Concerns Over National Security

The sale of these credentials puts sensitive information at risk of being misused by cybercriminals. It is unclear how many credentials are being sold or if they are genuine.

---

NATO Investigates Alleged Cyberattack Affecting Some Unclassified Websites

NATO is currently investigating claims that data was stolen from its unclassified websites by the hacking group SiegedSec. The group allegedly stole 9 GB of data, including documents from various NATO portals.

---

San Francisco Metropolitan Transportation Commission Leaves 26,000 Files Publicly Accessible

A misconfiguration in the Metropolitan Transportation Commission (MTC) systems resulted in the exposure of over 26,000 files, including clients' home addresses and vehicle plate numbers.

---

Wing Disrupts the Market by Introducing Affordable SaaS Security

Today, mid-sized companies and their CISOs are struggling to handle the growing threat of SaaS security with limited manpower and tight budgets. Now, this may be changing. By focusing on the critical SaaS security needs of these companies, a new approach has emerged that can be launched for $1,500 a year. If the name Wing Security (Wing) rings a bell, it is probably because earlier this year,

---

Chinese APT41 Actors Target WeChat Users via Trojanized App Version

APT41, previously associated with web application attacks, has shifted its tactics to develop mobile-specific malware, including the DragonEgg and LightSpy surveillance malware, which share similar configuration patterns and runtime structures.

---

Predator Spyware Linked to Madagascar Government Ahead of Election

The Madagascar government likely used the Cytrox-developed Predator spyware to conduct political domestic surveillance ahead of the country’s presidential election, according to research by Sekoia.

---

EvilProxy Phishing Attack Targets Indeed

Menlo Labs discovered a July to August phishing campaign targeting executives in banking, insurance, real estate, and manufacturing, using the complex EvilProxy phishing kit. The campaign highlights the escalating threats that organizations face from threat actors due to the use of sophisticated tools and trusted platforms to hoodwink their targets.

---

Rogue npm Package Deploys Open-Source Rootkit in New Supply Chain Attack

A new deceptive package hidden within the npm package registry has been uncovered deploying an open-source rootkit called r77, marking the first time a rogue package has delivered rootkit functionality. The package in question is node-hide-console-windows, which mimics the legitimate npm package node-hide-console-window in what's an instance of a typosquatting campaign. It was downloaded 704

---

Wisconsin County Dealing With Ransomware Attack on Public Health Department

The Cuba ransomware gang claimed responsibility for the attack, with concerns raised about potential connections to the Russian state due to their history of targeting government systems in Ukraine and Montenegro.

---

EU Parliament Wants Journalists to Have Better Protections From Spyware

There are differing views between the European Parliament and the European Council regarding the level of protections for journalists from spyware, which will be subject to negotiations.

---

Microsoft Warns of Cyber Attacks Attempting to Breach Cloud via SQL Server Instance

Microsoft has detailed a new campaign in which attackers unsuccessfully attempted to move laterally to a cloud environment through a SQL Server instance. "The attackers initially exploited a SQL injection vulnerability in an application within the target's environment," security researchers Sunders Bruskin, Hagai Ran Kestenberg, and Fady Nasereldeen said in a Tuesday report. "This allowed the

---

Indiana Attorney General Sues Provider Over Violation of Consumer Protection, Privacy Laws

CarePointe, a medical provider in Indiana, is being sued by the state attorney general for allegedly being aware of security risks before a ransomware attack exposed the personal information of 45,000 patients.

---

C-Suite Leaders to Boost Cybersecurity Compliance Amid SEC Disclosure Rule: Deloitte

Almost two-thirds of executives at publicly traded companies plan to strengthen their cybersecurity programs in response to a new rule by the SEC that requires companies to report material cybersecurity incidents within four business days.

---

Ransomware Reinfections on the Rise From Improper Remediation

Ransomware attacks can have devastating financial and reputational consequences, with the potential to close down businesses, highlighting the importance of effective remediation and prevention strategies.