Outages impact Washington state courts after ‘unauthorized activity’ detected on network

SelectBlinds says 200,000 customers impacted after hackers embed malware on site

Cyberattack disables tracking systems and panic alarms on British prison vans

Georgia hospital unable to access record system after ransomware attack

Top US cyber agency says no ‘significant incidents’ impacting election so far

Alleged Snowflake hacker detained in Canada at DOJ's request

Ukraine accuses Google of revealing locations of its military systems

Schneider Electric says hackers accessed internal project execution tracking platform

Cisco notifies ‘limited set’ of customers after hacker accessed non-public files

Click Here Podcasts

The Record-Centered.svg

Home

Subscribe to Cyber Daily®

Jonathan Greig

King County Courthouse.jpg

blinds.jpg

Alexander Martin

A Serco prison van in the United Kingdom.

Serco_van.jpeg

Hong Kong police (1).jpg

Interpol operation nets 41 arrests, takedown of 22,000 malicious IPs

Suzanne Smalley

BkPs464CcAAIpY8.jpeg

Former Pennsylvania Gov. Tom Corbett on the dangers of election disinformation

Doctor's office.jpg

Martin Matishak

cisa-election.jpg

pexels-icon0-479354.jpg

South Korean authorities fine Meta $15.6 million for sharing user data with advertisers

taylor-vick-M5tzZtFCOfs-unsplash.jpg

CVE-2024-40348

CVE-2024-40348 is a vulnerability in the Bazarr application that allows unauthenticated arbitrary file reading, specifically targeting the /etc/passwd file, and has been exploited using various proof-of-concept tools available on GitHub.

CVE-2024-36991

CVE-2024-36991 is a path traversal vulnerability affecting Splunk Enterprise on Windows versions prior to 9.2.2, 9.1.5, and 9.0.10, which allows attackers to potentially access sensitive files such as /etc/passwd and C:\windows\win.ini, with a CVSS score of 7.5, and proof-of-concept (PoC) exploit code being publicly available.

CVE-2024-38112

CVE-2024-38112 is a spoofing vulnerability in the Windows MSHTML platform that has been actively exploited by the advanced persistent threat actor Void Banshee to distribute the Atlantida InfoStealer malware, marking it as a critical zero-day threat linked to several other vulnerabilities in 2024.

REMCOS RAT

Recent reports indicate that Remcos RAT, a commodity malware often used in phishing campaigns, has been actively exploited by various cybercriminal groups, including Storm-2049 and UAC-0050, to compromise military and financial targets through deceptive tactics such as hiding malicious links in trusted GitHub repository comments and distributing it via virtual hard drive files masquerading as tax documents.

CVE-2024-20419

CVE-2024-20419 is a critical vulnerability in Cisco Smart Software Manager (SSM) On-Prem that allows unauthorized password changes, and a script exploiting this vulnerability is currently being sold for $50,000 on the XSS forum by a user named KeyBit.

Scattered Spider

Scattered Spider, also known as UNC3944 or Octo Tempest, is a financially motivated cybercriminal group that has gained notoriety since 2022 for its sophisticated social engineering tactics, including voice phishing and SIM swapping, and has recently partnered with RansomHub to escalate ransomware attacks across various sectors, notably targeting the healthcare and entertainment industries.

RedGolf

APT41 is a Chinese nation-state actor that has recently executed sophisticated cyber attacks targeting the gaming and gambling industry, stealthily collecting critical data such as user passwords and network configurations over extended periods for financial gain.

BlueBravo

BlueBravo, a Russian state-sponsored cyber attacker, has been actively targeting various sectors, including government and defense organizations, through sophisticated phishing campaigns and exploitation of vulnerabilities in software such as Zimbra and JetBrains TeamCity.

North Korean Hackers

Recent intelligence indicates that North Korean hackers, particularly associated with the Lazarus Group and APT37, are intensifying their cyber operations, exploiting zero-day vulnerabilities in platforms like Google Chrome and Internet Explorer, deploying sophisticated malware through fake job interviews targeting tech professionals, and engaging in high-profile cryptocurrency thefts, with a reported total of $3 billion stolen since 2017 to fund the regime's nuclear and missile programs.

Play Ransomware

Play Ransomware, also known as PlayCrypt, has emerged as a significant cyber threat since its inception in 2022, primarily exploiting unpatched vulnerabilities in systems like Fortinet SSL VPNs and Microsoft Exchange, while recently collaborating with North Korean state-sponsored group Jumpy Pisces to enhance its attack capabilities and broaden its victim base.

NoName057(16)

The pro-Russian cyber attacker group NoName057(16) has been actively launching DDoS attacks against various governmental and private websites across multiple countries, including the UK, Belgium, Japan, Ukraine, and South Korea, often citing political motivations related to military actions and alliances as justifications for their campaigns.

LummaC2

LummaC2 is a sophisticated malware known as Lumma Stealer, actively involved in phishing campaigns targeting Facebook business accounts in Taiwan, leveraging deceptive tactics such as fake legal notifications to distribute malicious files that steal sensitive information like passwords and browser data.

HijackLoader

Recent reports indicate a significant surge in the deployment of HijackLoader malware, also known as Lumma Stealer, which utilizes stolen code-signing certificates to bypass security measures and deliver information-stealing payloads through sophisticated methods including DLL sideloading and hidden content in image files.

BugSleep

BugSleep, also known as MuddyRot, is a sophisticated remote access trojan (RAT) utilized by the Iranian APT group MuddyWater, featuring a bespoke command and control protocol, advanced evasion techniques, and capabilities for reverse shell and file I/O on compromised systems, with ongoing developments and updates observed since its introduction in May 2024.

SocGholish

SocGholish, a versatile JavaScript-based downloader that exploits social engineering by masquerading as fake software updates, continues to be a leading malware threat, responsible for a significant percentage of malware downloads and often evading detection through obfuscation and targeted delivery methods, as evidenced by recent attacks impacting over 1,000 organizations worldwide.

Latest Cyber Security News

Briefs

Top US cyber official says 'no evidence of malicious activity' impacting election

Major Ukrainian university bans Telegram to reduce cyberthreats

UK orders Chinese owners to relinquish control of Scottish semiconductor business