Latest Cybersecurity News and Articles

---

Stealthy npm Malware Exposes Developer Data

Upon analyzing the attack code, Phylum uncovered that it utilized a combination of post-install hooks and pre-install scripts to trigger the execution of malicious code once the packages were installed.

---

Budget Constraints Threaten Cybersecurity in Government Bodies

Government organizations and public services are increasingly targeted by cyberattacks from both nation-states and cybercriminals, necessitating the need for stronger cybersecurity measures.

---

Understanding Active Directory Attack Paths to Improve Security

Introduced in 1999, Microsoft Active Directory is the default identity and access management service in Windows networks, responsible for assigning and enforcing security policies for all network endpoints. With it, users can access various resources across networks. As things tend to do, times, they are a'changin' – and a few years back, Microsoft introduced Azure Active Directory, the

---

Update: All Versions of Ivanti Product Affected by Vulnerability Used in Norway Government Attack

“Since originally reporting CVE-2023-35082… Ivanti has continued its investigation and has found that this vulnerability impacts all versions of Ivanti Endpoint Manager Mobile 11.10, 11.9, and 11.8 and MobileIron Core 11.7 and below,” Ivanti said.

---

Spanish Police Arrest Three Behind Payment Card Fraud

The group mainly targeted ATMs of Spanish national banks using cloned payment cards. Spanish police estimated the group had fraudulently pocketed nearly 196,000 euros (~$215,000).

---

Report: Manufacturing Sector Lost $46 Billion to Ransomware Attacks

Ransomware attacks on manufacturing organizations have surged annually, resulting in substantial financial losses, with a recent report by Comparitech revealing that the sector suffered $46 billion in downtime since 2018. So far 56 manufacturing organizations have been targeted in ransomware attacks, this year. 

---

TargetCompany Ransomware Abuses FUD Obfuscator Packers

The TargetCompany ransomware is using fully undetectable (FUD) packers and Metasploit to infect vulnerable systems, making it difficult for current security solutions to detect and prevent.

---

New Yashma Ransomware Variant Targets Multiple English-Speaking Countries

An unknown threat actor is using a variant of the Yashma ransomware to target various entities in English-speaking countries, Bulgaria, China, and Vietnam at least since June 4, 2023. Cisco Talos, in a new write-up, attributed the operation with moderate confidence to an adversary of likely Vietnamese origin. "The threat actor uses an uncommon technique to deliver the ransom note," security

---

Nigerian Man Admits to $1.3M Business Email Compromise Scam

A Nigerian national pleaded guilty to participating in a BEC scheme to steal $1.25m from a Boston investment firm. The scam involved using malware and a spoofed domain name to trick the firm into transferring money to attacker-controlled accounts.

---

Teach a Man to Phish and He’s Set for Life – Krebs on Security

A recent phishing scam has been using an old trick to fool Microsoft Windows users. The scam involves sending an email with an attachment that appears to be a PDF file, but is actually an .eml file disguised as a .pdf.

---

Cyberinsurance Firm Resilience Raises $100 Million to Expand Its Cyber Risk Platform

The Series D round was led by Intact Ventures, an affiliate of Resilience’s primary capacity provider, Intact Insurance’s underwriting companies, with participation by Lightspeed Venture Partners, as well as General Catalyst and Founders Fund.

---

Latest Batloader Campaigns Use Pyarmor Pro for Evasion

The Batloader initial access malware, used by the group Water Minyades, has upgraded its evasion techniques by utilizing Pyarmor Pro to obfuscate its malicious Python scripts.

---

LOLBAS in the Wild: 11 Living-Off-The-Land Binaries Used for Malicious Purposes

Cybersecurity researchers have discovered a set of 11 living-off-the-land binaries-and-scripts (LOLBAS) that could be maliciously abused by threat actors to conduct post-exploitation activities.  "LOLBAS is an attack method that uses binaries and scripts that are already part of the system for malicious purposes," Pentera security researcher Nir Chako said. "This makes it hard for security teams

---

Extended warranty robocallers fined $300 million after 5 billion scam calls

The Federal Communications Commission (FCC) has announced a record-breaking $299,997,000 fine imposed on an international network of companies for placing five billion robocalls to more than 500 million phone numbers over three months in 2021.

---

New Microsoft Azure AD CTS Feature can be Abused for Lateral Movement

Microsoft's new Azure Active Directory Cross-Tenant Synchronization (CTS) feature, introduced in June 2023, has created a new potential attack surface that might allow threat actors to more easily spread laterally to other Azure tenants.

---

Rise of AI leads to free training sources

The rise of technology such as artificial intelligence (AI) has led to security leaders looking for ways to educate themselves on its uses and risks. 

---

Cl0p Ransomware Gang Revises its Extortion Strategy

MOVEit-hijacker Cl0p ransomware gang has changed its extortion tactics and is now using torrents to distribute data stolen in the MOVEit Transfer breaches. Previously, the group utilized Tor data leak sites, but this method was slow and easier to shut down. Through torrents, criminals are expecting faster transfer speeds making the leak more impactful. As torrents are decentralized, it becomes challenging for law enforcement to shut them down.

---

New Malware Campaign Targets Inexperienced Cyber Criminals with OpenBullet Configs

A new malware campaign has been observed making use of malicious OpenBullet configuration files to target inexperienced cyber criminals with the goal of delivering a remote access trojan (RAT) capable of stealing sensitive information. Bot mitigation company Kasada said the activity is designed to "exploit trusted criminal networks," describing it as an instance of advanced threat actors "

---

White House announces K-12 cybersecurity plans

 The White House has announced steps for providing various resources for K-12 schools to update their cybersecurity practices and report incidents.

---

Spyware Maker Letmespy Shuts Down After Hacker Deletes Server Data

In a notice on its website in both English and Polish, LetMeSpy confirmed the “permanent shutdown” of the spyware service and that it would cease operations by the end of August.