Latest Cybersecurity News and Articles

---

Shutterfly Says Cl0p Ransomware Attack Did Not Impact Customer Data

This week, the Cl0p ransomware gang published Shutterfly's name on its data leak site, among other companies it has targeted, largely via the MOVEit SQL Injection vulnerability, tracked as CVE-2023-34362.

---

Cisco Shopping Spree Adds Oort ID Threat Detection Tech

Cisco’s cybersecurity shopping spree hit another gear Thursday with the planned acquisition of Oort, an early-stage startup selling software in the Identity Threat Detection and Response (ITDR) category.

---

Malicious Campaigns Target Government, Military and Civilian Entities in Ukraine, Poland

Ukraine’s Computer Emergency Response Team (CERT-UA) has attributed the July campaign to the threat actor group UNC1151, as a part of the GhostWriter operational activities allegedly linked to the Belarusian government.

---

Defend Against Insider Threats: Join this Webinar on SaaS Security Posture Management

As security practices continue to evolve, one primary concern persists in the minds of security professionals—the risk of employees unintentionally or deliberately exposing vital information. Insider threats, whether originating from deliberate actions or accidental incidents, pose a significant challenge to safeguarding sensitive data. To effectively address insider risks, organizations must

---

AIOS WordPress Plugin Faces Backlash for Storing User Passwords in Plain Text

All-In-One Security (AIOS), a WordPress plugin installed on over one million sites, has issued a security update after a bug introduced in version 5.1.9 of the software caused users' passwords being added to the database in plaintext format. "A malicious site administrator (i.e. a user already logged into the site as an admin) could then have read them," UpdraftPlus, the maintainers of AIOS, 

---

Zimbra Urges Customers to Manually Fix Actively Exploited Zero-Day Reported by Google TAG

“A security vulnerability in Zimbra Collaboration Suite Version 8.8.15 that could potentially impact the confidentiality and integrity of your data has surfaced,” reads the advisory published by the company.

---

USB Drive Malware Attacks Spiking Again in First Half of 2023

Mandiant outlined how two USB malware campaigns have been observed this year; one named 'Sogu,' attributed to a Chinese espionage threat group 'TEMP.HEX,' and another named 'Snowydrive,' attributed to UNC4698, which targets Asian oil and gas firms.

---

TeamTNT's Cloud Credential Stealing Campaign Now Targets Azure and Google Cloud

A malicious actor has been linked to a cloud credential stealing campaign in June 2023 that's focused on Azure and Google Cloud Platform (GCP) services, marking the adversary's expansion in targeting beyond Amazon Web Services (AWS). The findings come from SentinelOne and Permiso, which said the "campaigns share similarity with tools attributed to the notorious TeamTNT cryptojacking crew,"

---

Crit.IX: Flaws in Honeywell Experion DCS, Posing Risk to Critical Industries

Reportedly, Armis detected these flaws in May 2022 and informed Honeywell about 13 code issues found in the Experion C300 controllers and server, which were later rolled into nine new vulnerabilities.

---

Fewer Than 100 Scammers Responsible For Global Email Extortion

Barracuda Networks teamed up with Columbia University to analyze over 300,000 extortion emails tracked by the firm over a one-year period. They looked specifically at the Bitcoin addresses used by the scammers in order to discern specific trends.

---

Citrix Fixes Critical Flaw in Secure Access Client for Ubuntu

Citrix addressed a critical vulnerability, tracked as CVE-2023-24492 (CVSS score of 9.6), affecting the Secure Access client for Ubuntu that could be exploited to achieve remote code execution.

---

NATO Allies’ New Cyber Pledges To Remain Classified — But Here’s What We Know

During this week’s NATO summit in Vilnius, Lithuania, allies agreed to a number of new cybersecurity pledges. The substance of these commitments has not been detailed — the documents themselves are classified — but here’s what we do know.

---

Lokibot Exploits Word Document Vulnerabilities to Propagate

FortiGuard Labs claimed to have found several Office maldocs purposed to exploit known vulnerabilities, specifically CVE-2021-40444 and CVE-2022-30190 (Follina). Researchers noted that the version of Lokibot used in the campaign includes MD5 hash. This version of Lokibot info-stealer seems to have appeared first in March.

---

Fake PoC for Linux Kernel Vulnerability on GitHub Exposes Researchers to Malware

In a sign that cybersecurity researchers continue to be under the radar of malicious actors, a proof-of-concept (PoC) has been discovered on GitHub, concealing a backdoor with a "crafty" persistence method.

---

New SOHO Router Botnet AVrecon Spreads to 70,000 Devices Across 20 Countries

A new malware strain has been found covertly targeting small office/home office (SOHO) routers for more than two years, infiltrating over 70,000 devices and creating a botnet with 40,000 nodes spanning 20 countries. Lumen Black Lotus Labs has dubbed the malware AVrecon, making it the third such strain to focus on SOHO routers after ZuoRAT and HiatusRAT over the past year. "This makes AVrecon one

---

Zimbra Warns of Critical Zero-Day Flaw in Email Software Amid Active Exploitation

Zimbra has warned of a critical zero-day security flaw in its email software that has come under active exploitation in the wild. "A security vulnerability in Zimbra Collaboration Suite Version 8.8.15 that could potentially impact the confidentiality and integrity of your data has surfaced," the company said in an advisory. It also said that the issue has been addressed and that it's expected to

---

Scam Page Volumes Witness a 304% Annual Surge, Finds Group-IB

Security researchers published its Digital Risk Trends 2023 report and noted a significant rise in phishing websites, with a 62% year-on-year growth, and a surge of 304% in scam pages. Scammers exhibited a particular interest in brands from the APAC and MEA regions. Organizations must implement robust security measures and foster a proactive cybersecurity culture among employees.

---

Protecting the Cloud

One of the technologies that has been instrumental in facilitating smart buildings has been the emergence of “the cloud.”

---

HWL Ebsworth hack: sensitive Victorian government documents released by criminals

State’s chief information security officer says information from Victorian departments and agencies was accessedFollow our Australia news live blog for the latest updatesGet our morning and afternoon news emails, free app or daily news podcastHighly sensitive legal documents from the Victorian government’s departments and agencies have been published on the dark web by cybercriminals.The breach is connected to data that was stolen from the law firm HWL Ebsworth in April by a Russian-linked ransomware gang and posted online.Sign up for Guardian Australia’s free morning and afternoon email newsletters for your daily news roundup Continue reading...

---

SEO Expert Hired and Fired By Ashley Madison Turned on Company, Promising Revenge

[This is Part II of a story published here last week on reporting that went into a new Hulu documentary series on the 2015 Ashley Madison hack.] It was around 9 p.m. on Sunday, July 19, when I received a message through the contact form on KrebsOnSecurity.com that the marital infidelity website AshleyMadison.com had been hacked. The message contained links to confidential Ashley Madison documents, and included a manifesto that said a hacker group calling itself the Impact Team was prepared to leak data on all 37 million users unless Ashley Madison and a sister property voluntarily closed down within 30 days.