Latest Cybersecurity News and Articles

---

National Cybersecurity Alliance launches HBCU Scholarship Program

Established in partnership with One In Tech, an ISACA Foundation, the initiative will support individuals who are currently underrepresented in the industry by ensuring equitable access and advancements within cybersecurity and tech careers.

---

Experts released PoC Exploit code for actively exploited PaperCut flaw

The cybersecurity firm Horizon3 disclosed details of the flaw along with a PoC exploit code for CVE-2023-27350. The PoC code allows attackers to bypass authentication and execute code on vulnerable PaperCut servers.

---

Google Authenticator App Gets Cloud Backup Feature for TOTP Codes

Search giant Google on Monday unveiled a major update to its 12-year-old Authenticator app for Android and iOS with an account synchronization option that allows users to back up their time-based one-time passwords (TOTPs) codes to the cloud. "This change means users are better protected from lockout and that services can rely on users retaining access, increasing both convenience and security,"

---

Cyber security technology integration, intrapreneurship & beyond

In this edited interview excerpt from The Women in Technology Podcast, Check Point Global Cyber Security Warrior and Evangelist Micki Boland speaks with Becky Schneider about cyber security, technology integration, the intrapreneureal spirit and so much more. Don’t miss this! And if you like what you read, please check out the full podcast.  Tell us […] The post Cyber security technology integration, intrapreneurship & beyond appeared first on CyberTalk.

---

8220 Gang of Cryptojackers Exploit Log4Shell to Mint Coins

Researchers found 8220 Gang exploiting the Log4Shell vulnerability to install CoinMiner in VMware Horizon servers of Korean energy-related companies. The gang uses a PowerShell script to download ScrubCrypt and establish persistence by making edits to the registry entries. System administrators are advised to verify whether their existing VMware servers are susceptible and apply the latest patches.

---

Play Ransomware Group Adds Two New Tools to Harvest More Data

The Play ransomware group has added two custom tools written in .NET to expand the effectiveness of its attacks. Named Grixba and Volume Shadow Copy Service (VSS), these tools enable attackers to keep track of users in compromised networks and gather information about security, backup, and remote administration software.

---

New Blind Eagle Attack Chain Discovered

The Blind Eagle cyberespionage group was identified as the source of a new multi-stage attack chain that ultimately results in the deployment of NjRAT on compromised systems. In this attack campaign, Blind Eagle leverages social engineering, custom malware, and spear-phishing attacks. Therefore, upgrade your security posture to stay safe. Moreover, training employees on how to detect phishing emails is much recommended. 

---

AuKill Exploits Process Explorer Utility via BYOVD, Deploys Ransomware

Sophos X-Ops uncovered a defense evasion tool called AuKill. The tool exploits an outdated version of the driver used by version 16.32 of the Microsoft utility Process Explorer to disable EDR processes to deploy either a backdoor or ransomware on the targeted system. Since the beginning of 2023, the tool has been used to drop Medusa Locker and LockBit ransomware strains.

---

Spain to implement biometric debit and credit cards

Because of the risk of mag stripes being read and copied, Spain will begin replacing existing credit cards with fingerprint biometrics cards in 2024.

---

Mint Sandstorm Targets U.S. Critical Infrastructure

Microsoft connected the Iranian Mint Sandstorm APT group (aka PHOSPHORUS) to a wave of attacks, between late-2021 and mid-2022, targeting the U.S. critical infrastructure. The group targets private/public organizations, including activists, journalists, the Defense Industrial Base (DIB), political dissidents, and employees from various government agencies.

---

Enterprise devices have an average of 67 applications installed

The security of workplace devices and applications remains a growing concern within hybrid and remote environments, according to new research.

---

These two countries are teaming up to develop AI for cybersecurity

Singapore and France have announced plans to set up a research facility to jointly develop artificial intelligence (AI) capabilities that can be applied in cyber defense.

---

Package names repurposed to push malware on PyPI

At the beginning of March, ReversingLabs researchers encountered a malicious package on the Python Package Index (PyPI) named termcolour, a three-stage downloader published in multiple versions.

---

North Korean Hackers Target Mac Users With New ‘RustBucket’ Malware

Dubbed RustBucket and able to fetch additional payloads from its command-and-control (C&C) server, the malware has been attributed to the APT actor BlueNoroff, which is believed to be a subgroup of the infamous Lazarus hacking group.

---

Threat actors can use ChatGPT to sharpen cyberthreats, but no need to panic yet

Since the generative artificial intelligence chatbot was released in November, Palo Alto Networks’ Unit 42 has detected up to 118 malicious URLs related to ChatGPT daily and domain squatting related to the tool has surged 17,818%.

---

Hackers Exploit Generative AI to Spread RedLine Stealer MaaS

As generative AI tools like OpenAI ChatGPT and Google Bard continue to dominate the headlines—and pundits debate whether the technology has taken off too quickly without necessary guardrails—cybercriminals are showing no hesitance in exploiting them.

---

Tomiris called, they want their Turla malware back

The threat actor targets government and diplomatic entities in the CIS. The few victims discovered in other regions (Middle East or Southeast Asia) turn out to be foreign representations of CIS countries, illustrating Tomiris’s narrow focus.

---

Top shopping periods see an increase in bot attacks

Attack trends such as brute forcing, carding, credential stuffing, inventory hoarding, scalping and web scraping were analyzed in a recent report.

---

SolarWinds Platform Update Patches High-Severity Vulnerabilities

The most severe of the two issues is CVE-2022-36963 (CVSS score of 8.8), which is described as a command injection bug in SolarWinds’ infrastructure monitoring and management solution.

---

ViperSoftX Updates Encryption and Anti-Analysis Techniques to Stay Stealthy

ViperSoftX, a type of information-stealing software, has been primarily reported as focusing on cryptocurrencies, making headlines in 2022 for its execution technique of hiding malicious code inside log files.