Latest Cybersecurity News and Articles

---

Organizations urged to incorporate FCC covered list into risk management plans

CISA has issued an alert to remind critical infrastructure owners to take steps in securing the nation’s critical supply chains.

---

ScarCruft Deploys RokRAT via LNK File

ScarCruft, a North Korean threat group, has been attempting to deliver the RokRAT malware since July 2022 using oversized LNK files. The malware is capable of targeting macOS (CloudMensis) and Android (RambleOn). The malware variants are equipped to carry out a range of activities such as credential theft, data exfiltration, command and shellcode execution, file and directory management, and more.

---

Earth Longzhi Returns, Targets New Regions Using New Tactics

After more than six months of no activity, Chinese state-sponsored threat group Earth Longzhi is back with new tricks up its sleeves in a new series of attacks. The attackers aim at IIS and Microsoft Exchange servers exposed to the internet to get access to the networks to install the Behinder web shell. Protection against such threats demands a proactive defense strategy.

---

Kimsuky Evolves Reconnaissance Capabilities in New Global Campaign

SentinelLabs has observed ongoing attacks from Kimsuky, a North Korean state-sponsored APT that has a long history of targeting organizations across Asia, North America, and Europe.

---

Critical RCE vulnerability in Cisco phone adapters, no update available

“This vulnerability is due to a missing authentication process within the firmware upgrade function. An attacker could exploit this vulnerability by upgrading an affected device to a crafted version of firmware,” Cisco’s security advisory explains.

---

Hackers Targeting Italian Corporate Banking Clients with New Web-Inject Toolkit DrIBAN

Italian corporate banking clients are the target of an ongoing financial fraud campaign that has been leveraging a new web-inject toolkit called drIBAN since at least 2019. "The main goal of drIBAN fraud operations is to infect Windows workstations inside corporate environments trying to alter legitimate banking transfers performed by the victims by changing the beneficiary and transferring

---

New Fleckpe Android Malware Installed 600,000 Times on Google Play Store

Kaspersky reveals that Fleckpe is the newest addition to the realm of malware that generates unauthorized charges by subscribing users to premium services, joining the ranks of other malicious Android malware, such as Jocker and Harly.

---

Sourcepass Raises Additional $65M in Funding

The company intends to use the funds to support its strategic objectives, including acquiring Proxios, which expands its physical presence in the mid-Atlantic states, while broadening its client base in the healthcare, legal, and non-profit sectors.

---

Discord leaks ‘demoralizing’ for US intelligence agencies, DNI Haines says

The leaks of classified documents online by a Massachusetts Air National Guard member have had an emotional impact on the government agencies that produce those products, the director of national intelligence told Congress on Thursday.

---

N. Korean Kimsuky Hackers Using New Recon Tool ReconShark in Latest Cyberattacks

The North Korean state-sponsored threat actor known as Kimsuky has been discovered using a new reconnaissance tool called ReconShark as part of an ongoing global campaign. "[ReconShark] is actively delivered to specifically targeted individuals through spear-phishing emails, OneDrive links leading to document downloads, and the execution of malicious macros," SentinelOne researchers Tom Hegel

---

Lack of Visibility: The Challenge of Protecting Websites from Third-Party Scripts

Third-party apps such as Google Analytics, Meta Pixel, HotJar, and JQuery have become critical tools for businesses to optimize their website performance and services for a global audience. However, as their importance has grown, so has the threat of cyber incidents involving unmanaged third-party apps and open-source tools. Online businesses increasingly struggle to maintain complete visibility

---

Three-Quarters of Firms Predict Breach in Coming Year

Most global organizations anticipate suffering a data breach or cyber-attack in the next 12 months, despite cyber-risk levels falling overall, according to a new report from Trend Micro.

---

Packagist Repository Hacked: Over a Dozen PHP Packages with 500 Million Compromised

PHP software package repository Packagist revealed that an "attacker" gained access to four inactive accounts on the platform to hijack over a dozen packages with over 500 million installs to date. "The attacker forked each of the packages and replaced the package description in composer.json with their own message but did not otherwise make any malicious changes," Packagist's Nils Adermann said

---

Incident response at organizations can run from cool to chaotic

According to a CyberRisk Alliance Business Intelligence survey, nearly three-quarters (73%) of respondents say their organization has an incident response playbook to guide decision-making during a cybersecurity incident.

---

Companies need a wakeup call to fix chronic security shortcomings, cyber experts say

Digital risks confronting organizations remain the same year after year, and the threat and potential damage awaiting unsuspecting victims are abundantly clear. Yet, many organizations still struggle to address the fundamentals of cybersecurity.

---

IcedID: Exploring Four Recent Malware Infection Techniques

In the multi-stage attack chain for IcedID, phishing emails, fake Zoom installers, malicious .one files, and malvertising campaigns are all plausible infection methods that can ultimately direct victims toward websites hosting malicious payloads.

---

Hackers start using double DLL sideloading to evade detection

An APT hacking group known as "Dragon Breath," "Golden Eye Dog," or "APT-Q-27" is demonstrating a new trend of using several complex variations of the classic DLL sideloading technique to evade detection.

---

Fleckpe Android Malware Sneaks onto Google Play Store with Over 620,000 Downloads

A new Android subscription malware named Fleckpe has been unearthed on the Google Play Store, amassing more than 620,000 downloads in total since 2022. Kaspersky, which identified 11 apps on the official app storefront, said the malware masqueraded as legitimate photo editing apps, camera, and smartphone wallpaper packs. The apps have since been taken down. The operation primarily targeted users

---

Cisco Warns of Vulnerability in Popular Phone Adapter, Urges Migration to Newer Model

Cisco has warned of a critical security flaw in SPA112 2-Port Phone Adapters that it said could be exploited by a remote attacker to execute arbitrary code on affected devices. The issue, tracked as CVE-2023-20126, is rated 9.8 out of a maximum of 10 on the CVSS scoring system. The company credited Catalpa of DBappSecurity for reporting the shortcoming. The product in question makes it possible

---

$10M Is Yours If You Can Get This Guy to Leave Russia

The U.S. government this week put a $10 million bounty on the head of a Russian man who for the past 18 years operated Try2Check, one of the cybercrime underground's most trusted services for checking the validity of stolen credit card data. U.S. authorities say 43-year-old Denis Kulkov's card-checking service made him at least $18 million, which he used to buy a Ferrari, Land Rover, and other luxury items.