Latest Cybersecurity News and Articles

---

GuLoader returns with a rotten shipment

In this instance, a fake shipping notification in Italian was observed, humorously reflecting GuLoader's Italian origins. Unlike previous cases, GuLoader was not concealed within a Zip file but rather an ISO file.

---

Prison Time for 11 Involved in India's Cosmos Bank Heist

A judicial magistrate first class court in Pune on April 15 passed an order convicting eleven accused of stealing in August 2018 up to $1.76 million from Cosmos Cooperative Bank.

---

VMware Releases Critical Patches for Workstation and Fusion Software

VMware has released updates to resolve multiple security flaws impacting its Workstation and Fusion software, the most critical of which could allow a local attacker to achieve code execution.

---

VMware Releases Critical Patches for Workstation and Fusion Software

VMware has released updates to resolve multiple security flaws impacting its Workstation and Fusion software, the most critical of which could allow a local attacker to achieve code execution. The vulnerability, tracked as CVE-2023-20869 (CVSS score: 9.3), is described as a stack-based buffer-overflow vulnerability that resides in the functionality for sharing host Bluetooth devices with the

---

PaperCut Vulnerability Exploited in Active Attacks

While cybercriminals are exploiting the pair of bugs in PaperCut MF/NG print management software, researchers at cybersecurity firm Horizon3 revealed information about one of the bugs, identified as CVE-2023-27350, and also shared a PoC exploit code. The bug can be effectively exploited by criminals to dodge detection and run arbitrary code on susceptible PaperCut servers. Trend Micro is poised to release further details on the bugs on May 10th.

---

Beware of Infected (Fake) Installers: BumbleBee Malware Alert

A recent discovery by cybersecurity experts has revealed a new BumbleBee loader infection campaign that utilizes Google advertisements to promote trojanized versions of widely-used applications. It attempted to spread via fake installers of well-known software such as Zoom, Cisco AnyConnect, ChatGPT, and Citrix Workspace. 

---

Ongoing OCX#HARVESTER Campaign Targeting Financial Organizations

Security analysts uncovered a new attack campaign, tracked as OCX#HARVESTER, wherein malicious payloads used as part of the campaign were found related to the More_eggs backdoor. Based on the targeted victims and the modus operandi of the More_eggs malware, researchers associated the campaign with FIN6 APT. 

---

Inaugural Attacks Exploit Kubernetes RBAC to Deploy Backdoor

Cloud security firm Aqua uncovered a massive crypto-mining campaign that creates backdoors and runs miners using Kubernetes (K8s) Role-Based Access Control (RBAC). In this attack, threat actors also check for the presence of other miner malware on the server and then establish persistence using the RBAC. Additionally, they deploy DaemonSets to access resources of the K8s clusters.

---

Decoy Dog: An Enterprise-targeting Malware Toolkit

Decoy Dog, a new enterprise-targeting malware toolkit, is using DNS query dribbling and strategic domain aging techniques to bypass security checks and target enterprises. Researchers have shared IOCs on its public GitHub repository which can be helpful for security teams.

---

Fakecalls Gets Sneakier, Abuses Stolen App Keys

Fakecalls banking trojan has been targeting South Korean organizations via fake apps; this time it is abusing legitimate app signing keys to bypass signature-based detection techniques. To avoid detection, the malware uses a packer to encrypt its source code. Stay safe by downloading apps from the official stores and reliable sources only.

---

10 new and dangerous malware threats to watch out for (2023 edition)

EXECUTIVE SUMMARY: Discover 10 of the most dangerous malware threats and learn how to identify, prevent and defend against attacks. Malware-based attacks pose a significant risk to 80% of small-to-medium sized businesses, while larger organizations are becoming increasingly vulnerable to dangerous and damaging incidents. Stay informed in order to safeguard your organization. Types of malware […] The post 10 new and dangerous malware threats to watch out for (2023 edition) appeared first on CyberTalk.

---

Insecure Default Configuration in Apache Superset Leads to Remote Code Execution

Researchers found that a majority of internet-exposed instances of Apache Superset – at least 2000 (two-thirds of all servers) – are running with a dangerous default configuration. This means many of these servers are effectively open to the public.

---

New SLP Vulnerability Could Let Attackers Launch 2200x Powerful DDoS Attacks

The top 10 countries with the most organizations having vulnerable SLP instances are the U.S., the U.K., Japan, Germany, Canada, France, Italy, Brazil, the Netherlands, and Spain.

---

Security leaders weigh in on CommScope breach

Last week hackers published data stolen from CommScope through a ransomware attack. Among the stolen data was employee’s Social Security numbers and bank account details.

---

Iranian Hackers Launch Sophisticated Attacks Targeting Israel with PowerLess Backdoor

The attack chain documented by Check Point begins with an ISO disk image file that makes use of Iraq-themed lures to drop a custom in-memory downloader that ultimately launches the PowerLess implant.

---

Organizations are stepping up their game against cyber threats

Global median dwell time drops to just over two weeks, reflecting the essential role partnerships and the exchange of information play in building a more resilient cybersecurity ecosystem, according to Mandiant.

---

TP-Link Archer WiFi router flaw exploited by Mirai malware

The Mirai malware botnet is actively exploiting a TP-Link Archer A21 (AX1800) WiFi router vulnerability tracked as CVE-2023-1389 to incorporate devices into DDoS (distributed denial of service) swarms.

---

The U.S., U.K. and Germany rank top in ransomware attacks

Cyberattacks have increased over the past few years. Ransomware attacks from April 2022 to March 2023 were analyzed in a recent report by Black Kite.

---

Adult content malvertising scheme leads to clickjacking

Visitors are lured to several fake blogs about topics they might find interesting. The original blog, however, is hidden by an overlay showing blurred explicit content and a button asking the visitor to confirm they are 18+ to enter the website.

---

VirusTotal now has an AI-powered malware analysis feature

VirusTotal Code Insight analyzes potentially harmful files to explain their (malicious) behavior, and it will improve the ability to identify which of them pose actual threats.