North Korean hackers spotted using new tools on employees of 'nuclear-related' org 

Romanian Netwalker ransomware affiliate sentenced to 20 years in US prison 

Bipartisan bills to protect car owners’ privacy introduced in House and Senate

Routers with default passwords are attracting Mirai infections, Juniper says

US seeks extradition of alleged LockBit ransomware developer from Israel

A lightweight app comes with some heavy consequences, researchers say

Dutch regulator fines Netflix $5 million for data privacy violations

CISA orders federal agencies to secure Microsoft cloud systems after ‘recent’ intrusions

American private equity firm buys Israeli spyware company Paragon

Click Here Podcasts

The Record-Centered.svg

Home

Subscribe to Cyber Daily®

James Reddick

office, business, company, organization, institution, agency

pexels-carsten-ruthemann-8804932-14711252.jpg

Jonathan Greig

Ascension.jpg

Nearly 6 million people were impacted by ransomware attack on Ascension Health

pexels-kevin-ku-577585.jpg

Alexander Martin

LockBit.jpeg

US unseals complaint against Russian-Israeli accused of working for LockBit

Daryna Antoniuk

Volodymyr Karastelov, acting head of cybersecurity at the Security Service of Ukraine (SBU), speaks to reporters on December 20, 2024, with Olga Stefanishyna, deputy prime minister for European and Euro-Atlantic Integration. Image: SBU via Telegram

photo_2024-12-20 07.40.53.jpeg

Ukraine’s state registers hit with one of Russia’s largest cyberattacks, officials say

Suzanne Smalley

cars-building-city.jpg

Joe Warminsky

moshed-12-19-14-52-20.png

Telegram logo.jpg

Telegram’s algorithms promote extremist content, researchers say

pexels-tima-miroshnichenko-6266772.jpg

CVE-2024-40348

CVE-2024-40348 is a vulnerability in Bazaar v1.4.3 that allows unauthenticated attackers to exploit a directory traversal issue in the component /api/swaggerui/static, with an associated exploit available on GitHub at https://github.com/NingXin2002/Bazaar_poc.

CVE-2024-38112

CVE-2024-38112, a vulnerability in the Windows MSHTML platform that allows exploitation via deprecated Internet Explorer to run HTA files, has been linked to the APT group Void Banshee and was found advertised for sale on the dark web, highlighting its significant threat to Windows users.

REMCOS RAT

Recent reports indicate a significant increase in the use of Remcos RAT, a remote access Trojan that exploits vulnerabilities in Microsoft Office and employs phishing tactics to infiltrate systems, allowing attackers to gain high-level access and steal sensitive data, necessitating robust cybersecurity measures for protection.

Scattered Spider

Scattered Spider, a notorious cybercrime group known for sophisticated phishing and social engineering attacks, has been linked to significant breaches involving major organizations like MGM Resorts and Caesars Entertainment, leading to multiple arrests, including a recent case involving a 19-year-old hacker named Remington Ogletree, who is accused of orchestrating telecom and financial fraud resulting in over $4 million in losses.

RedGolf

RedGolf, also known as APT41, is a Chinese state-sponsored hacking group that has been actively involved in cyberespionage and financial theft campaigns, utilizing sophisticated tools such as the newly discovered Glutton PHP backdoor to target organizations in China and the U.S.

BlueBravo

BlueBravo has been increasingly active in sophisticated cyber espionage campaigns targeting high-value victims, utilizing remote desktop protocol exploits and various malware tools to infiltrate networks and exfiltrate sensitive data.

North Korean Hackers

North Korean hacker groups, particularly TraderTraitor and Lazarus, have recently executed sophisticated cyberattacks, including a $308 million theft from Japan's DMM Bitcoin exchange and a $50 million heist from Radiant Capital, utilizing social engineering tactics and malware to exploit vulnerabilities in the cryptocurrency sector.

Play Ransomware

Play Ransomware, known for its sophisticated attacks and double-extortion tactics, has recently claimed responsibility for a significant data breach at Krispy Kreme, threatening to leak sensitive data obtained from the company's database within two days.

NoName057(16)

NoName057(16) is an active pro-Russian cyber threat group that has launched a series of coordinated DDoS attacks against various countries, including the Czech Republic, Moldova, Australia, Germany, France, Italy, and Ukraine, often aligning with other hacktivist groups like the Holy League and employing tactics to destabilize digital infrastructure in response to perceived political grievances.

LummaC2

LummaC2, also known as Lumma Stealer, is a sophisticated information-stealing malware that targets various sectors, particularly the manufacturing industry, utilizing deceptive tactics such as malicious LNK files disguised as PDFs and exploiting legitimate system tools to exfiltrate sensitive data while being distributed via phishing campaigns, Telegram channels, and fake online ads.

HijackLoader

HijackLoader is a modular malware loader gaining popularity among cybercriminals for delivering various payloads, including Lumma Stealer and AsyncRAT, through techniques like DLL sideloading and executable renaming, while being associated with adversaries such as GHOSTPULSE and frequently observed in campaigns targeting the manufacturing sector.

SocGholish

Recent reports indicate that the SocGholish malware, also known as FakeUpdates, is actively targeting Kaiser Permanente employees through malicious ads that redirect them to fake browser update pages to steal credentials, and it remains one of the most prevalent threats in cyber incidents throughout 2024.

Latest Cyber Security News

Briefs

FCC ‘rip and replace’ provision for Chinese tech tops cyber provisions in defense bill

Inside Operation Destabilise: How a ransomware investigation linked Russian money laundering and street-level drug dealing

Judge rules NSO Group is liable for spyware hacks targeting 1,400 WhatsApp user devices