GAO recommends new agency to streamline how US government protects citizens’ data

Heather ‘Razzlekhan’ Morgan sentenced to 18 months in prison, ending Bitfinex saga 

AI company tells SEC that $250,000 stolen in cyberattack

British software company Microlise confirms hackers compromised corporate data

Ohio man behind Helix cryptocurrency mixer gets 3-year sentence

Bigoted text messages after Trump victory also targeted Latinos, LGBTQ+ communities, FBI says

Indian police arrest suspect in $230 million WazirX crypto exchange hack

Malware being delivered by mail, warns Swiss cyber agency

Hungary confirms hack of defense procurement agency

Click Here Podcasts

The Record-Centered.svg

Home

Subscribe to Cyber Daily®

Jonathan Greig

digital.jpg

FBI says BianLian based in Russia, moving from ransomware attacks to extortion

Alexander Martin

getty-images-xQHXLEfMJg0-unsplash.jpg

UK says a new law banning social media for under-16s is 'on the table'

Suzanne Smalley

GAO-headquarters.jpg

railway.jpg

TSA not monitoring transportation sector efforts to stop ransomware, watchdog says

47451116722_68b13f827b_o.jpg

Landmark ruling by Australian regulator sets guardrails for commercial use of facial recognition tech

Daryna Antoniuk

facebook (1).jpg

German court says victims of massive Facebook data breach can be compensated

nso_group_1.jpg

Testimony from NSO Group raises questions about its culpability for spyware abuses

crowd.jpg

Data privacy experts predict some wins under Trump 2.0

Faucet.jpg

Many US water systems exposed to ‘high-risk’ vulnerabilities, watchdog finds

CVE-2024-40348

CVE-2024-40348 is a vulnerability that allows attackers to exploit affected systems by attempting to read the sensitive /etc/passwd file, with proof-of-concept (POC) tools, including a bulk scanning and exploitation tool for versions prior to Bazaar v1.4.3, being publicly available on GitHub.

CVE-2024-36991

CVE-2024-36991 is a significant path traversal vulnerability affecting Splunk Enterprise versions prior to 9.2.2, 9.1.5, and 9.0.10 on Windows, allowing attackers to potentially list directories and access sensitive files such as /etc/passwd, with proof-of-concept exploits already available on platforms like GitHub.

CVE-2024-38112

CVE-2024-38112 is a spoofing vulnerability in the Microsoft Windows MSHTML platform that has been actively exploited in the wild, primarily linked to infostealer attacks by the Advanced Persistent Threat group Void Banshee, and may have prompted additional patches due to its exploitation and the potential bypassing of initial fixes.

REMCOS RAT

Recent reports indicate that cybercriminals are leveraging a phishing campaign to distribute a fileless variant of Remcos RAT malware by exploiting the CVE-2017-0199 vulnerability in Microsoft Excel, allowing attackers to remotely execute malicious code and gain control over victims' devices without traditional file-based detection methods.

CVE-2024-20419

CVE-2024-20419 is a critical vulnerability in Cisco's Smart Software Manager On-Prem that allows unauthenticated remote attackers to change user passwords without prior knowledge of the existing password, and it is currently being exploited through a script available for sale on dark web forums.

Scattered Spider

Scattered Spider, a financially motivated cybercrime group known for sophisticated social engineering tactics including AI-driven voice phishing, has been implicated in high-profile attacks targeting various industries, notably MGM Resorts and Caesars Entertainment, resulting in significant data breaches and cryptocurrency thefts, with recent developments including the indictment of five alleged members involved in a phishing scheme that stole $11 million.

RedGolf

APT41 is a Chinese state-sponsored cyber attack group that has been involved in sophisticated multi-stage cyber-attacks targeting various industries, including the gambling and gaming sectors, for financial gain and espionage.

BlueBravo

BlueBravo is a Russian cyber espionage group that has been actively conducting sophisticated phishing campaigns targeting government officials and organizations, leveraging tactics such as sending signed Remote Desktop Protocol (RDP) files to gain unauthorized access to sensitive information.

North Korean Hackers

Recent reports indicate that North Korean hacker groups, particularly BlueNoroff and Lazarus Group, are intensifying their cyberattacks on cryptocurrency firms by utilizing sophisticated phishing tactics and new malware specifically designed for macOS, including a multi-stage malware campaign dubbed "Hidden Risk," which effectively bypasses Apple’s security measures to steal sensitive information and siphon funds.

Play Ransomware

Play Ransomware, which emerged in June 2022, has become one of the most active ransomware groups, collaborating with the North Korean state-sponsored group Jumpy Pisces (also known as Andariel) to exploit vulnerabilities in Fortinet SSL VPNs and Microsoft Exchange, leading to significant cyberattacks on various organizations globally and employing tactics like credential harvesting and double-extortion strategies.

NoName057(16)

NoName057(16) is a pro-Russian hacktivist group that has recently launched a series of DDoS attacks targeting multiple websites across the UK, Ukraine, South Korea, Japan, and other countries, claiming responsibility for disrupting various governmental and corporate online services in response to geopolitical tensions.

LummaC2

LummaC2 is a sophisticated information-stealing malware that operates as Malware-as-a-Service (MaaS), employing various deceptive tactics such as fake CAPTCHA pages and phishing campaigns to harvest sensitive data, including credentials and cryptocurrency wallet information, particularly targeting users through malicious AI image and video generators on Windows and macOS systems.

HijackLoader

HijackLoader, also known as GHOSTPULSE and IDATLOADER, has evolved to utilize advanced techniques such as hiding malicious payloads within the pixel structure of PNG files and leveraging legitimate digital certificates to distribute various strains of malware, including Lumma Stealer, while being associated with sophisticated threat actor groups like CARBANAK since its emergence in 2023.

BugSleep

BugSleep, a sophisticated remote access trojan (RAT) developed by the Iranian APT group MuddyWater, utilizes a bespoke command-and-control protocol for reverse shell and file I/O capabilities while employing advanced evasion techniques, including multiple file obfuscation methods to avoid detection and is currently under continuous development with weekly updates.

SocGholish

SocGholish, a JavaScript-based downloader distributed through malicious websites under the guise of fake software updates, continues to be a prominent threat, leading to significant infections globally and being associated with various malware attacks, including AsyncRAT and Lumma Stealer.

Latest Cyber Security News

Briefs

Five alleged members of Scattered Spider cybercrime group charged for breaches, theft of $11 million

Two brothers indicted for operating illegal sports streaming service that netted $7 million

Phobos ransomware indictment sheds light on long-running, quietly successful scheme