Latest Cybersecurity News and Articles

---

Iranian Hackers Using SimpleHelp Remote Support Software for Persistent Access

The Iranian threat actor known as MuddyWater is continuing its time-tested tradition of relying on legitimate remote administration tools to commandeer targeted systems. While the nation-state group has previously employed ScreenConnect, RemoteUtilities, and Syncro, a new analysis from Group-IB has revealed the adversary's use of the SimpleHelp remote support software in June 2022. MuddyWater,

---

Israeli Spyware Vendor QuaDream to Shut Down Following Citizen Lab and Microsoft Expose

Israeli spyware vendor QuaDream is allegedly shutting down its operations in the coming days, less than a week after its hacking toolset was exposed by Citizen Lab and Microsoft.

---

HHS updates cybersecurity best practices, shares free workforce training

The Health Industry Cybersecurity Practices (HICP), one of the most critical cybersecurity resources for healthcare provider organizations, has been updated with two additional volumes and supporting mitigation resources.

---

LockBit Ransomware Now Targeting Apple macOS Devices

Threat actors behind the LockBit ransomware operation have developed new artifacts that can encrypt files on devices running Apple's macOS operating system. The development, which was reported by the MalwareHunterTeam over the weekend, appears to be the first time a big-game ransomware crew has created a macOS-based payload. Additional samples identified by vx-underground show that the macOS

---

APT28 exploits known vulnerability to carry out reconnaissance and deploy malware on Cisco routers

APT28 accesses poorly maintained Cisco routers and deploys malware on unpatched devices using CVE-2017-6742.

---

UK and US issue warning about APT28 actors exploiting poorly maintained Cisco routers

Joint advisory calls on organisations to secure devices to prevent network attacks.

---

Collaboration only way to respond to cyber threats says renowned tech entrepreneur

The interview with Hermann Hauser will be aired later this week at the NCSC's cyber security conference CYBERUK, held in Belfast.

---

7 tips for tackling cyber security technical debt

EXECUTIVE SUMMARY: The cyber risk landscape is evolving. Novel attack types are appearing at an unprecedented rate. Cyber criminals are constantly seeking new ways to infiltrate networks, paralyze systems, steal data and drive their own financial gains. As organizations race to keep up with emerging threats, it’s all-too-common for security leaders to ignore the growing […] The post 7 tips for tackling cyber security technical debt appeared first on CyberTalk.

---

Understanding the Threat of Titan Stealer Malware

The malware spreads through methods like phishing, malicious ads, and cracked software. It also uses a technique called process hollowing to inject the malicious code into a legitimate process called AppLaunch.exe.

---

China-linked APT41 group spotted using open-source red teaming tool GC2

In October 2022, threat actors sent phishing emails that contained links to a password-protected file hosted in Drive. The final payload was the Go-written GC2 tool that gets commands from Google Sheets and exfiltrates data to Google Drive.

---

ZeroFox to Acquire Threat Intelligence Firm LookingGlass for $26 Million

ZeroFox (ZFOX), which advertises itself as an external cybersecurity solutions provider, on Monday, announced that it’s in the process of acquiring threat intelligence and attack surface management company LookingGlass.

---

New Captcha Protected Phishing Attack Targets Access to Payroll Files

The phishing attack is hosted on a landing page at payroll-microsoft365-access-panel-2023[.]softr[.]app/ which redirects to azaleastays[.]com/devr365web2023/ once a button is clicked.

---

Twitter no longer exists, it’s just X Corp. now

EXECUTIVE SUMMARY: In a move sparking intense speculation, Twitter technically “no longer exists” after a merge with X Corp., according to a document submitted to a California court earlier this month. What the change means for Twitter is unclear. In the past, Twitter’s owner, Elon Musk, suggested that purchasing the company would accelerate plans to […] The post Twitter no longer exists, it’s just X Corp. now appeared first on CyberTalk.

---

Cybersecurity leaders reflect on Samsung, ChatGPT incidents

After it was discovered that three Samsung employees shared company information with ChatGPT, cybersecurity leaders are sharing their thoughts. 

---

FIN7 and Ex-Conti Cybercrime Gangs Join Forces in Domino Malware Attacks

The latest intrusion wave, spotted by IBM Security X-Force two months ago, involves the use of Dave Loader, a crypter previously attributed to the Conti group (aka Gold Blackburn, ITG23, or Wizard Spider), to deploy the Domino backdoor.

---

Israeli Spyware Vendor QuaDream to Shut Down Following Citizen Lab and Microsoft Expose

Israeli spyware vendor QuaDream is allegedly shutting down its operations in the coming days, less than a week after its hacking toolset was exposed by Citizen Lab and Microsoft. The development was reported by the Israeli business newspaper Calcalist, citing unnamed sources, adding the company "hasn't been fully active for a while" and that it "has been in a difficult situation for several

---

Qbot Banking Trojan Increasingly Delivered Via Business Emails

Discovered by security researchers at Kaspersky, the malicious campaign relied on messages written in different languages, including English, German, Italian, and French.

---

Cenlar appoints Theodore Mugnier Director of Information Security

Theodore Mugnier was hired as Director of Information Security for Cenlar FSB. Mugnier is a former Marine with two decades of intelligence experience.

---

New QBot Banking Trojan Campaign Hijacks Business Emails to Spread Malware

A new QBot malware campaign is leveraging hijacked business correspondence to trick unsuspecting victims into installing the malware, new findings from Kaspersky reveal. The latest activity, which commenced on April 4, 2023, has primarily targeted users in Germany, Argentina, Italy, Algeria, Spain, the U.S., Russia, France, the U.K., and Morocco. QBot (aka Qakbot or Pinkslipbot) is a banking

---

Vixen Panda APT Group suspected of targeting foreign ministry in cyberattack

A Chinese hacker group, Vixen Panda, is suspected of targeting the Foreign Ministry in a recent cyberattack. As per a new report by Euractiv, the hackers showed a keen interest in policy documents.