Outages impact Washington state courts after ‘unauthorized activity’ detected on network

SelectBlinds says 200,000 customers impacted after hackers embed malware on site

Cyberattack disables tracking systems and panic alarms on British prison vans

Georgia hospital unable to access record system after ransomware attack

Top US cyber agency says no ‘significant incidents’ impacting election so far

Alleged Snowflake hacker detained in Canada at DOJ's request

Ukraine accuses Google of revealing locations of its military systems

Schneider Electric says hackers accessed internal project execution tracking platform

Cisco notifies ‘limited set’ of customers after hacker accessed non-public files

Click Here Podcasts

The Record-Centered.svg

Home

Subscribe to Cyber Daily®

Jonathan Greig

King County Courthouse.jpg

blinds.jpg

Alexander Martin

A Serco prison van in the United Kingdom.

Serco_van.jpeg

Hong Kong police (1).jpg

Interpol operation nets 41 arrests, takedown of 22,000 malicious IPs

Suzanne Smalley

BkPs464CcAAIpY8.jpeg

Former Pennsylvania Gov. Tom Corbett on the dangers of election disinformation

Doctor's office.jpg

Martin Matishak

cisa-election.jpg

pexels-icon0-479354.jpg

South Korean authorities fine Meta $15.6 million for sharing user data with advertisers

taylor-vick-M5tzZtFCOfs-unsplash.jpg

CVE-2024-40348

CVE-2024-40348 is a vulnerability that allows unauthenticated arbitrary file read access, specifically targeting the /etc/passwd file, and has been associated with multiple proof-of-concept (POC) exploit tools being shared on platforms like GitHub.

CVE-2024-36991

CVE-2024-36991 is a path traversal vulnerability affecting Splunk Enterprise on Windows versions below 9.2.2, 9.1.5, and 9.0.10, allowing attackers to potentially access sensitive files such as /etc/passwd and C:\windows\win.ini, with a CVSS score of 7.5, and proof-of-concept exploits have been reported as of July 2024.

CVE-2024-38112

CVE-2024-38112 is a critical spoofing vulnerability in the Windows MSHTML platform that has been actively exploited by the advanced persistent threat actor Void Banshee to distribute the Atlantida InfoStealer malware, with its exploitation linked to infostealer attacks and identified as part of an exploit chain involving other vulnerabilities.

REMCOS RAT

Recent information indicates that the Remcos RAT, a commodity malware associated with cybercriminal activities, has been extensively utilized in multiple phishing campaigns targeting the finance and insurance sectors, often delivered through malicious links embedded in GitHub repository comments, and was notably employed by the Storm-2049 group to compromise over 50 Ukrainian military devices in June 2024.

CVE-2024-20419

CVE-2024-20419 is a critical vulnerability in Cisco Smart Software Manager (SSM) On-Prem that allows unauthorized password changes and is currently being exploited, with scripts for its exploitation being sold on underground forums for $50,000.

Scattered Spider

Scattered Spider, also known as UNC3944 or Octo Tempest, is a sophisticated cybercriminal group that has gained notoriety for employing advanced social engineering techniques, including AI-driven voice spoofing and SIM swapping, to execute high-profile ransomware attacks across various sectors, notably targeting organizations in the healthcare and entertainment industries while collaborating with ransomware groups like RansomHub to enhance their operations.

RedGolf

APT41 is a Chinese nation-state hacking group that has conducted sophisticated cyber attacks targeting various sectors, including the gambling and gaming industry, with motivations ranging from financial gain to espionage, utilizing advanced techniques and custom malware over extended periods.

BlueBravo

Recent information indicates that the cyber attacker BlueBravo has been actively targeting U.S. officials and organizations through sophisticated spear-phishing campaigns, utilizing Remote Desktop Protocol (RDP) files to gain unauthorized access to sensitive data.

North Korean Hackers

Recent reports indicate that North Korean hackers, particularly the Lazarus Group and APT37, are actively exploiting zero-day vulnerabilities in software such as Google Chrome and Internet Explorer to conduct sophisticated cyberattacks, including theft of cryptocurrency through fake job interviews and malware deployments targeting tech job seekers, while also attempting to infiltrate critical defense contractors in South Korea and Germany.

Play Ransomware

Play Ransomware, an increasingly active threat since its emergence in 2022, has been linked to significant cyberattacks involving collaborations with North Korean state-sponsored groups like Jumpy Pisces (also known as Andariel), exploiting vulnerabilities in systems such as Fortinet SSL VPNs and Microsoft Exchange to gain initial access, and is responsible for numerous high-profile breaches across various industries, including plans to publish stolen data from several victims.

NoName057(16)

The pro-Russian cyber group NoName057(16) has been actively launching DDoS attacks against various targets in the UK, Czech Republic, Belgium, Japan, Ukraine, and Israel, claiming responsibility for multiple high-profile disruptions to government and corporate websites while also coordinating with other hacktivist groups.

LummaC2

The LummaC2 malware is involved in a sophisticated phishing campaign primarily targeting Facebook business accounts in Taiwan, utilizing techniques such as fake legal notifications to distribute information stealers like Lumma Stealer and Rhadamanthys, which harvest sensitive data including passwords and cookies from infected users.

HijackLoader

Recent reports indicate that the HijackLoader malware, also known as Lumma Stealer, is being distributed through malicious campaigns that utilize legitimate code-signing certificates to evade detection, with significant increases in deployment observed since mid-September 2024.

BugSleep

Recent analyses reveal that BugSleep, also known as MuddyRot, is a sophisticated remote access trojan (RAT) developed by the Iranian APT group MuddyWater, featuring advanced evasion techniques, a bespoke command and control protocol, and capabilities for reverse shells and file I/O, with ongoing efforts to detect its traffic using tools like Snort and Wireshark.

SocGholish

SocGholish, a JavaScript-based downloader, remains a leading threat in the malware landscape, responsible for 60% of malware downloader attacks, utilizing techniques such as fake software updates and watering hole attacks to target users, while often evading detection by traditional security measures due to its obfuscated delivery methods and selective targeting.

Latest Cyber Security News

Briefs

Top US cyber official says 'no evidence of malicious activity' impacting election

Major Ukrainian university bans Telegram to reduce cyberthreats

UK orders Chinese owners to relinquish control of Scottish semiconductor business