GAO recommends new agency to streamline how US government protects citizens’ data

Heather ‘Razzlekhan’ Morgan sentenced to 18 months in prison, ending Bitfinex saga 

AI company tells SEC that $250,000 stolen in cyberattack

British software company Microlise confirms hackers compromised corporate data

Ohio man behind Helix cryptocurrency mixer gets 3-year sentence

Bigoted text messages after Trump victory also targeted Latinos, LGBTQ+ communities, FBI says

Indian police arrest suspect in $230 million WazirX crypto exchange hack

Malware being delivered by mail, warns Swiss cyber agency

Hungary confirms hack of defense procurement agency

Click Here Podcasts

The Record-Centered.svg

Home

Subscribe to Cyber Daily®

Jonathan Greig

digital.jpg

FBI says BianLian based in Russia, moving from ransomware attacks to extortion

Alexander Martin

getty-images-xQHXLEfMJg0-unsplash.jpg

UK says a new law banning social media for under-16s is 'on the table'

Suzanne Smalley

GAO-headquarters.jpg

railway.jpg

TSA not monitoring transportation sector efforts to stop ransomware, watchdog says

47451116722_68b13f827b_o.jpg

Landmark ruling by Australian regulator sets guardrails for commercial use of facial recognition tech

Daryna Antoniuk

facebook (1).jpg

German court says victims of massive Facebook data breach can be compensated

nso_group_1.jpg

Testimony from NSO Group raises questions about its culpability for spyware abuses

crowd.jpg

Data privacy experts predict some wins under Trump 2.0

Faucet.jpg

Many US water systems exposed to ‘high-risk’ vulnerabilities, watchdog finds

CVE-2024-40348

CVE-2024-40348 is a vulnerability that allows for the exploitation of systems by attempting to read the sensitive file /etc/passwd, with proof-of-concept (POC) tools available on GitHub, specifically indicating that versions of the Bazaar tool up to v1.4.3 are affected.

CVE-2024-36991

CVE-2024-36991 is a critical path traversal vulnerability affecting Splunk Enterprise versions prior to 9.2.2, 9.1.5, and 9.0.10, which allows attackers to potentially list directories and access sensitive files, with a proof of concept available on GitHub demonstrating the exploit's capability to read the /etc/passwd file.

CVE-2024-38112

CVE-2024-38112, a spoofing vulnerability in the Windows MSHTML platform, has been actively exploited by the Advanced Persistent Threat group Void Banshee to facilitate infostealer attacks, prompting concerns about its ongoing exploitation and the potential for additional fixes following its initial discovery in July 2024.

REMCOS RAT

Recent reports indicate that cybercriminals are exploiting the CVE-2017-0199 vulnerability in Microsoft Office through phishing campaigns, using malicious Excel documents to deliver a fileless variant of the Remcos RAT malware, which allows attackers to gain remote control over compromised systems and exfiltrate sensitive data.

CVE-2024-20419

CVE-2024-20419 is a critical vulnerability in Cisco's Smart Software Manager On-Prem that allows unauthenticated remote attackers to change user passwords without prior knowledge of the existing password, and there are reports of a script being sold on hacking forums to exploit this vulnerability.

Scattered Spider

Scattered Spider, a financially motivated cybercrime group known for sophisticated social engineering tactics including AI-driven voice phishing, has recently been linked to significant incidents involving ransomware attacks on major companies, such as MGM Resorts and Caesars Entertainment, and has seen a rise in collaboration with other ransomware groups like RansomHub, leading to the indictment of several alleged members in connection with extensive phishing schemes and cryptocurrency theft totaling over $11 million.

RedGolf

RedGolf, also known as APT41, is a Chinese state-sponsored threat actor engaged in sophisticated cyber-espionage and financial attacks, recently targeting sectors such as gambling and gaming to steal sensitive data and exploit vulnerabilities for financial gain.

BlueBravo

BlueBravo is a Russian cyber attacker linked to the Foreign Intelligence Service (SVR) and is known for conducting sophisticated espionage campaigns targeting government, academic, and defense sectors, primarily through spear-phishing attacks using malicious Remote Desktop Protocol (RDP) files.

North Korean Hackers

North Korean hackers, particularly the BlueNoroff group, have intensified their cyber attacks on cryptocurrency firms using sophisticated multi-stage malware campaigns, including phishing emails luring victims with fake crypto news and exploiting vulnerabilities in macOS applications to steal sensitive data and funds.

Play Ransomware

Play Ransomware, which emerged in June 2022, has become a major threat actor in the cybersecurity landscape, successfully compromising over 300 organizations and collaborating with North Korean state-sponsored group Jumpy Pisces (Andariel) for significant cyber attacks by exploiting unpatched vulnerabilities and employing advanced tactics for data exfiltration and encryption.

NoName057(16)

The pro-Russian hacktivist group NoName057(16) has recently launched a series of coordinated DDoS attacks against various targets in the UK, Ukraine, South Korea, Japan, and other countries, claiming responsibility for disrupting numerous local government websites and critical infrastructure in response to geopolitical tensions.

LummaC2

LummaC2 is a sophisticated information-stealing malware that exploits phishing tactics, including fake AI video generators and deceptive CAPTCHA pages, to target users on platforms like Facebook and other online services, primarily aiming to steal sensitive data such as passwords, browser credentials, and cryptocurrency wallet information.

HijackLoader

Recently, HijackLoader, also known as GHOSTPULSE or IDATLOADER, has evolved to utilize legitimate digital signatures for distribution, often hiding malicious payloads within PNG files' pixel structures and is associated with a rise in infections from other malware strains like Lumma Stealer.

BugSleep

BugSleep is a sophisticated remote access Trojan (RAT) developed by the Iranian APT group MuddyWater, featuring a bespoke command and control (C2) protocol that enables reverse shell operations and file management, while employing advanced evasion techniques to avoid detection and being actively updated with weekly releases.

SocGholish

SocGholish, a JavaScript-based downloader, remains a significant threat as it exploits fake software update lures to distribute malware, leading to increased infections and maintaining its position among the top malware types detected globally, particularly impacting various sectors through coordinated phishing campaigns and compromised websites.

Latest Cyber Security News

Briefs

Five alleged members of Scattered Spider cybercrime group charged for breaches, theft of $11 million

Two brothers indicted for operating illegal sports streaming service that netted $7 million

Phobos ransomware indictment sheds light on long-running, quietly successful scheme