Latest Cybersecurity News and Articles

---

Magecart Attacks Conducted via Sleek, Modern Looking Fake Payment Screens

The latest iteration, as observed by Malwarebytes on a Parisian travel accessory store running on the PrestaShop CMS, involved the injection of a skimmer called Kritec to intercept the checkout process and display a fake payment dialog to victims.

---

Ukrainian man arrested for selling data on 300 million people to Russians

A 36-year-old Ukrainian citizen was arrested this week for allegedly selling the personal data of over 300 million people to Russia, the Ukrainian cyber police said in a statement.

---

Alloy Taurus APT Spotted Using PingPull and a New Backdoor to Target Linux Users

Unit 42 discovered a new version of the PingPull malware, designed by Alloy Taurus (aka Gallium), to cripple Linux systems. It is essentially an ELF file that only 3 out of 62 antivirus vendors flagged as malicious. During the investigation, the threat actor's infrastructure also blurted out the evidence of another backdoor used in the attack known as Sword2033.

---

Report: Ransomware attacks see resurgence in 2023

A report released this week reveals manufacturing as the top targeted industry for ransomware attacks.

---

New Atomic macOS Malware Steals Keychain Passwords and Crypto Wallets

Threat actors are advertising a new information stealer for the Apple macOS operating system called Atomic macOS Stealer (or AMOS) on Telegram for $1,000 per month, joining the likes of MacStealer. "The Atomic macOS Stealer can steal various types of information from the victim's machine, including Keychain passwords, complete system information, files from the desktop and documents folder, and

---

NSA cyber director warns of ransomware attacks on Ukraine, Western supply chains

Russian hackers are attempting to inject ransomware into Ukraine's logistics supply chain and those of the Western countries that back Kyiv in its fight against Moscow, a senior National Security Agency official said on Wednesday.

---

Why Your Detection-First Security Approach Isn't Working

Stopping new and evasive threats is one of the greatest challenges in cybersecurity. This is among the biggest reasons why attacks increased dramatically in the past year yet again, despite the estimated $172 billion spent on global cybersecurity in 2022. Armed with cloud-based tools and backed by sophisticated affiliate networks, threat actors can develop new and evasive malware more quickly

---

Zyxel Firewall Devices Vulnerable to Remote Code Execution Attacks — Patch Now

Networking equipment maker Zyxel has released patches for a critical security flaw in its firewall devices that could be exploited to achieve remote code execution on affected systems. The issue, tracked as CVE-2023-28771, is rated 9.8 on the CVSS scoring system. Researchers from TRAPA Security have been credited with reporting the flaw. "Improper error message handling in some firewall versions

---

Hackers Steal Emails, Private Messages From Two Hookup Websites

Hackers have stolen email addresses, direct messages, and other personal data from users of two dating websites, according to Troy Hunt, the founder and maintainer of Have I Been Pwned.

---

ViperSoftX InfoStealer Adopts Sophisticated Techniques to Avoid Detection

A significant number of victims in the consumer and enterprise sectors located across Australia, Japan, the U.S., and India have been affected by an evasive information-stealing malware called ViperSoftX. ViperSoftX was first documented in 2020, with cybersecurity company Avast detailing a campaign in November 2022 that leveraged the malware to distribute a malicious Google Chrome extension

---

The double-edged sword of generative AI

While there have been many laudable applications of these technologies in healthcare, education, and even art, it’s essential to understand the broader way in which these technologies could be used and the potential risks they pose.

---

Google banned 173K developer accounts to block malware, fraud rings

The company revealed in its "bad apps" yearly report that it also prevented almost 1.5 million apps linked to various policy violations from reaching the Google Play Store.

---

FIN7 Exploits Vulnerabilities in Veeam Backup Software

A Veeam Backup process was seen carrying out a shell command to download and implement a PowerShell script abusing the Veeam Backup & Replication vulnerability, CVE-2023-27532. Further analysis revealed that the script was in fact the Powertrash in-memory dropper, a tool that has been previously used by FIN7. Consequently, the group deployed Diceloader, a backdoor also referred to as Lizar.

---

Password reset woes could cost FTSE 100 companies $156 million each month

According to a study by MyCena Security Solutions, there is an opportunity for businesses to learn how to eradicate password resets from their processes to improve both their security and bottom line.

---

Tonto Team Uses Anti-Malware File to Launch Attacks on South Korean Institutions

South Korean education, construction, diplomatic, and political institutions are at the receiving end of new attacks perpetrated by a China-aligned threat actor known as the Tonto Team.

---

Attention Online Shoppers: Don't Be Fooled by Their Sleek, Modern Looks — It's Magecart!

An ongoing Magecart campaign has attracted the attention of cybersecurity researchers for leveraging realistic-looking fake payment screens to capture sensitive data entered by unsuspecting users. "The threat actor used original logos from the compromised store and customized a web element known as a modal to perfectly hijack the checkout page," Jérôme Segura, director of threat intelligence at

---

"Ashamed" LockBit ransomware gang apologizes to hacked school, offers free decryption tool

Olympia Community Unit School District 16 - the largest school district in Illinois - realized on February 26, 2023, that it had suffered a ransomware attack, after being targeted by an affiliate of the notorious LockBit ransomware group.

---

Tonto Team Uses Anti-Malware File to Launch Attacks on South Korean Institutions

South Korean education, construction, diplomatic, and political institutions are at the receiving end of new attacks perpetrated by a China-aligned threat actor known as the Tonto Team. "Recent cases have revealed that the group is using a file related to anti-malware products to ultimately execute their malicious attacks," the AhnLab Security Emergency Response Center (ASEC) said in a report

---

Many Public Salesforce Sites are Leaking Private Data

A shocking number of organizations -- including banks and healthcare providers -- are leaking private and sensitive information from their public Salesforce Community websites, KrebsOnSecurity has learned. The data exposures all stem from a misconfiguration in Salesforce Community that allows an unauthenticated user to access records that should only be available after logging in.

---

The age of giant AI models, already over?

EXECUTIVE SUMMARY: If you expected OpenAI to further develop ChatGPT’s ‘neural network’ in order to enhance the bot’s performance, allowing it to perform an even wider range of tasks with unprecedented accuracy and efficiency, you might find yourself disappointed. OpenAI’s CEO, Sam Altman, warns that the research strategy used to create the bot has already […] The post The age of giant AI models, already over? appeared first on CyberTalk.