Latest Cybersecurity News and Articles

---

Microsoft shares guidance to detect BlackLotus UEFI bootkit attacks

Analyzing devices compromised with BlackLotus, the Microsoft Incident Response team identified several points in the malware installation and execution process that allow its detection.

---

Vice Society Ransomware Using Stealthy PowerShell Tool for Data Exfiltration

Threat actors associated with the Vice Society ransomware gang have been observed using a bespoke PowerShell-based tool to fly under the radar and automate the process of exfiltrating data from compromised networks. "Threat actors (TAs) using built-in data exfiltration methods like [living off the land binaries and scripts] negate the need to bring in external tools that might be flagged by

---

New Zaraza Bot Credential-Stealer Sold on Telegram Targeting 38 Web Browsers

A novel credential-stealing malware called Zaraza bot is being offered for sale on Telegram while also using the popular messaging service as a command-and-control (C2). "Zaraza bot targets a large number of web browsers and is being actively distributed on a Russian Telegram hacker channel popular with threat actors," cybersecurity company Uptycs said in a report published last week. "Once the

---

Australians report record $3.1bn losses to scams, with real amount even higher, ACCC says

Investment fraud amounts for biggest share at $1.5bn, followed by remote access and payment redirection rortsFollow our Australia news live blog for the latest updatesGet our morning and afternoon news emails, free app or daily news podcastAustralians lost a record amount of more than $3.1bn to scams in 2022, up from the $2bn lost in 2021, a new report from the Australian Competition and Consumer Commission has revealed.The Targeting Scams report, which compiles data from Scamwatch, ReportCyber, major banks and money remitters, was based on an analysis of more than 500,000 reports.Sign up for Guardian Australia’s free morning and afternoon email newsletters for your daily news roundup Continue reading...

---

Labour glitch put voting intentions data of millions at risk

Exclusive: Experts say sensitive information could potentially have been harvested and used for targeted election interferenceThe voting intentions of millions of Britons in local authority wards across the country could have been at risk of misuse as a result of a glitch in the Labour party’s main phone-banking system, the Guardian understands.Experts had warned that the sensitive data could potentially have been harvested via an automated programme and used for targeted election interference by campaign groups or even hostile states. Continue reading...

---

RTM Locker Enforces Strict Rules on Affiliates to Avoid Public Attention

Trellix detected a new private RaaS group, named Read The Manual (RTM) Locker, that has been leveraging affiliates for ransom. Also, it flies under the radar by avoiding high-profile targets. Moreover, the self-destructive nature of RTM Locker and the wipeout of logs make it a tough game to crack for security professionals.

---

Transparent Tribe Eyes Indian Education Sector

SentinelLabs identified a campaign by the Transparent Tribe that targets the Indian education sector via education-themed malicious Office documents propagating Crimson RAT. The group has long been targeting different sectors in India. Hence, vigilance and robust cyber defense strategies are necessary.

---

Forensic Analysis Confirms Involvement of North Korean Attackers in 3CX Supply Chain Attack

3CX confirmed that the software supply chain attack was the work of a North Korean hacker group, UNC4736. The group used the Taxhaul and Simplesea malware for infecting Windows and macOS, respectively. Attackers used Taxhaul (or TxRLoader) to target Windows machines, which was further used to deploy a second-stage payload called Coldcat.

---

APT28 Leader’s Email Breached by Ukrainian Hackers

Ukrainian hacker group Cyber Resistance claimed to have hacked the personal accounts, emails, and social media of a Russian GRU officer, who is also the leader of APT28. The email hack allowed the hackers to extract sensitive documents along with personal information and photos, and then leak them into the public domain.

---

Legion: A Python-Based Hacking Tool Targets Websites and Web Services

The cybercriminal group, which goes by the moniker “Forza Tools,” was seen offering Legion - a Python-based credential harvester and SMTP hijacking tool. The malware targets online email services for phishing and spam attacks. Experts suggest it is likely based on the AndroxGhOst malware and has several feature modules. 

---

iPhones Hacked to Drop QuaDream’s KingsPawn Spyware

QuaDream, an Israeli company best known for its malware Reign, has launched the new commercial spyware KingsPawn (a Pegasus-like threat). To begin the attack, iCloud calendar invitations with backdated timestamps are sent to targeted iOS devices. Experts recommend following best practices, such as enabling automatic software updates and using reliable anti-malware software to stay protected.

---

Darktrace: Investigation found no evidence of LockBit breach

It is now apparent that LockBit messed up, confusing Darktrace with threat intelligence company DarkTracer which tweeted about the gang's leak site being flooded with fake victims.

---

Massive malvertising campaign targets seniors via fake Weebly sites

The malvertising campaign is run via Google ads aimed at seniors. The threat actor is creating hundreds of fake websites via Weebly to host decoy content to fool search engines and crawlers while redirecting victims to a fake computer alert.

---

Vice Society ransomware uses new PowerShell data theft tool in attacks

The new, rather sophisticated PowerShell script automates data theft from compromised networks. The script uses PowerShell to automate data exfiltration and consists of multiple functions, including Work(), Show(), CreateJobLocal(), and fill().

---

Google Releases Urgent Chrome Update to Fix Actively Exploited Zero-Day Vulnerability

Tracked as CVE-2023-2033, the high-severity vulnerability has been described as a type confusion issue in the V8 JavaScript engine. Clement Lecigne of Google's Threat Analysis Group (TAG) has been credited with reporting the issue on April 11, 2023.

---

Google Releases Urgent Chrome Update to Fix Actively Exploited Zero-Day Vulnerability

Google on Friday released out-of-band updates to resolve an actively exploited zero-day flaw in its Chrome web browser, making it the first such bug to be addressed since the start of the year. Tracked as CVE-2023-2033, the high-severity vulnerability has been described as a type confusion issue in the V8 JavaScript engine. Clement Lecigne of Google's Threat Analysis Group (TAG) has been

---

Why is ‘Juice Jacking’ Suddenly Back in the News?

KrebsOnSecurity received a nice bump in traffic this week thanks to tweets from the Federal Bureau of Investigation (FBI) and the Federal Communications Commission (FCC) about "juice jacking," a term first coined here in 2011 to describe a potential threat of data theft when one plugs their mobile device into a public charging kiosk. It remains unclear what may have prompted the alerts, but the good news is that there are some fairly basic things you can do to avoid having to worry about juice jacking.

---

Researchers Disclosure Cisco ISE Broken Access Control Issue

A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to bypass authorization and access system files.

---

Juniper Networks Patches Critical Third-Party Component Vulnerabilities

Networking, cloud, and cybersecurity solutions provider Juniper Networks this week published advisories detailing tens of vulnerabilities found across its product portfolio, including critical bugs in third-party components of Junos OS and STRM.

---

New landscapes in cloud security (2023)

Richard Flanders has 35 years’ experience in advising clients on all aspects of enterprise IT. He has held senior roles at VMware, Fujitsu and Computacenter and others and is currently leading Check Points’ cloud security business in Eastern EMEA and Africa. He has been in this role at Check Point for seven years. In this […] The post New landscapes in cloud security (2023) appeared first on CyberTalk.