GAO recommends new agency to streamline how US government protects citizens’ data

Heather ‘Razzlekhan’ Morgan sentenced to 18 months in prison, ending Bitfinex saga 

AI company tells SEC that $250,000 stolen in cyberattack

British software company Microlise confirms hackers compromised corporate data

Ohio man behind Helix cryptocurrency mixer gets 3-year sentence

Bigoted text messages after Trump victory also targeted Latinos, LGBTQ+ communities, FBI says

Indian police arrest suspect in $230 million WazirX crypto exchange hack

Malware being delivered by mail, warns Swiss cyber agency

Hungary confirms hack of defense procurement agency

Click Here Podcasts

The Record-Centered.svg

Home

Subscribe to Cyber Daily®

Alexander Martin

getty-images-xQHXLEfMJg0-unsplash.jpg

UK says a new law banning social media for under-16s is 'on the table'

Suzanne Smalley

GAO-headquarters.jpg

Jonathan Greig

railway.jpg

TSA not monitoring transportation sector efforts to stop ransomware, watchdog says

47451116722_68b13f827b_o.jpg

Landmark ruling by Australian regulator sets guardrails for commercial use of facial recognition tech

Daryna Antoniuk

facebook (1).jpg

German court says victims of massive Facebook data breach can be compensated

nso_group_1.jpg

Testimony from NSO Group raises questions about its culpability for spyware abuses

crowd.jpg

Data privacy experts predict some wins under Trump 2.0

Faucet.jpg

Many US water systems exposed to ‘high-risk’ vulnerabilities, watchdog finds

Joe Warminsky

pexels-kevin-ku-577585.jpg

Russian national in US custody in Phobos ransomware investigation

CVE-2024-40348

CVE-2024-40348 is a vulnerability that allows unauthorized access to the /etc/passwd file on targeted systems, with multiple proof-of-concept (POC) exploits and tools like Bazaar v1.4.3 being developed and shared on platforms such as GitHub for potential exploitation.

CVE-2024-36991

CVE-2024-36991 is a serious path traversal vulnerability affecting Splunk Enterprise versions earlier than 9.2.2, 9.1.5, and 9.0.10, which attackers can exploit to list directories and potentially access sensitive files like /etc/passwd on Windows systems, with proof-of-concept (PoC) exploits available on GitHub.

CVE-2024-38112

CVE-2024-38112, a Windows MSHTML Platform spoofing vulnerability disclosed in July 2024 and exploited by the APT group Void Banshee to deploy infostealer malware, has been actively exploited in the wild and is linked to subsequent attacks involving another vulnerability, CVE-2024-43461.

REMCOS RAT

Recent reports indicate that cybercriminals are leveraging a phishing campaign to distribute a fileless variant of Remcos RAT malware, exploiting the CVE-2017-0199 vulnerability in Microsoft Office and WordPad through malicious Excel documents, which allows attackers to gain remote control over victims' devices and facilitate data exfiltration.

CVE-2024-20419

CVE-2024-20419 is a critical vulnerability in Cisco's Smart Software Manager On-Prem that allows unauthenticated remote attackers to change user passwords without knowledge of the existing passwords, and scripts exploiting this vulnerability are being sold on underground forums for significant sums.

Scattered Spider

Scattered Spider, a financially motivated cybercriminal group active since at least 2022, has gained notoriety for its advanced social engineering tactics, including AI-driven voice phishing, and has recently partnered with ransomware groups like RansomHub to escalate its attacks on various sectors, particularly targeting healthcare and financial organizations.

RedGolf

APT41 is a Chinese nation-state hacking group that has conducted sophisticated cyber attacks, including a lengthy operation targeting the gambling industry to gather sensitive data for financial gain.

BlueBravo

BlueBravo is a Russian state-sponsored cyber attacker known for conducting sophisticated spear-phishing campaigns against government, academic, and defense organizations, with recent activities targeting U.S. officials and compromising Microsoft’s email systems.

North Korean Hackers

North Korean hackers, particularly the BlueNoroff group, are intensifying their cyberattacks on cryptocurrency firms using sophisticated tactics such as multi-stage malware campaigns targeting macOS users, phishing emails disguised as crypto news, and exploiting zero-day vulnerabilities in browsers to steal sensitive data and funds.

Play Ransomware

Play Ransomware, which emerged in June 2022, has gained notoriety for its significant impact on over 300 organizations globally, exploiting vulnerabilities in Fortinet SSL VPNs and Microsoft Exchange, while recently collaborating with the North Korean state-sponsored group Jumpy Pisces to enhance its attack capabilities and broaden its victim base.

NoName057(16)

The pro-Russian hacktivist group NoName057(16) has recently conducted a series of coordinated DDoS attacks targeting multiple websites across various countries, including the UK, Ukraine, Czech Republic, South Korea, Austria, and Israel, often in response to geopolitical events or statements regarding military support.

LummaC2

LummaC2, also known as Lumma Stealer, is a sophisticated information-stealing malware that employs deceptive tactics such as fake CAPTCHA pages and phishing campaigns targeting business accounts, particularly on platforms like Facebook in Taiwan, to harvest sensitive data including passwords and cryptocurrency wallet information from compromised Windows and macOS devices.

HijackLoader

The HijackLoader malware, also known as GHOSTPULSE or IDATLOADER, has evolved significantly since its emergence in 2023, utilizing advanced techniques such as hiding malicious payloads within the pixel structure of PNG files and leveraging legitimate code-signing certificates to evade detection while distributing other malware strains like Lumma Stealer.

BugSleep

BugSleep, also known as MuddyRot, is a sophisticated remote access trojan (RAT) developed by the Iranian APT group MuddyWater, characterized by its use of a bespoke command and control protocol over TCP, advanced evasion techniques like file obfuscation and memory-based operations, and ongoing weekly updates that enhance its functionality and capabilities for reverse shell access and file manipulation.

SocGholish

SocGholish, a prevalent downloader malware distributed through malicious websites via fake software updates, has maintained its position as a top threat, accounting for significant infection rates worldwide and prompting recommendations for better security measures to mitigate its impact.

Latest Cyber Security News

Briefs

Five alleged members of Scattered Spider cybercrime group charged for breaches, theft of $11 million

Two brothers indicted for operating illegal sports streaming service that netted $7 million

Phobos ransomware indictment sheds light on long-running, quietly successful scheme