Police records show ShotSpotter is wildly inaccurate in New York City

Germany arrests suspected admin of country’s largest criminal marketplace

British telecoms giant BT confirms attempted cyberattack after ransomware gang claims hack

Senators urge DOD watchdog to probe ‘failure to secure’ communications amid Salt Typhoon hacks

FTC settles with facial recognition technology company for deceptive marketing

Finland says latest fiber-optic cable break was an accident, not sabotage

Energy industry contractor says ransomware attack has limited access to IT systems

Former Polish spy chief arrested to testify before parliament in spyware probe

Italian football club Bologna FC says company data stolen during ransomware attack

Click Here Podcasts

The Record-Centered.svg

Home

Subscribe to Cyber Daily®

Martin Matishak

CISA_Logo.jpg

Cyber incident board’s Salt Typhoon review to begin within days, CISA leader says

Suzanne Smalley

NYPD (1).jpg

Daryna Antoniuk

F8KRg68W0AAkq5_.jpeg

Alexander Martin

BT Tower PP.jpg

pexels-дмитрий-трепольский-14520859.jpg

Russian cyber company F.A.C.C.T. sells key assets to establish new firm

Pentagon PP.jpg

serge-kutuzov-4FKpSz4l-ZE-unsplash.jpg

Russian money laundering networks uncovered linking narco traffickers, ransomware gangs and Kremlin spies

face-blur-recognition.jpg

getty-images-VKIknvC-CYk-unsplash.jpg

FTC targets companies that collected and sold sensitive location data 

CVE-2024-36991

CVE-2024-36991 is a path traversal vulnerability in Splunk Enterprise on Windows, affecting versions below 9.2.2, 9.1.5, and 9.0.10, which allows attackers to potentially read sensitive files like /etc/passwd through the /modules/messaging/ endpoint.

CVE-2024-38112

CVE-2024-38112 is a 0-day vulnerability that allows attackers to manipulate the user interface to display misleading information, posing a significant threat to Windows users.

REMCOS RAT

Recent reports indicate that cybercriminals are leveraging the CVE-2017-0199 vulnerability in Microsoft Office and WordPad through phishing campaigns involving malicious Excel documents to spread a fileless variant of the Remcos Remote Access Trojan (RAT), allowing them to gain remote control of victims' devices and exfiltrate sensitive data.

Scattered Spider

Scattered Spider is a notorious cybercrime group known for its sophisticated phishing and social engineering attacks, including high-profile ransomware incidents against MGM Resorts and Caesars Entertainment, leading to significant financial losses and recent indictments of five alleged members in connection with an $11 million cryptocurrency theft scheme.

RedGolf

Cyber attacker RedGolf, also known as APT41, is a highly sophisticated Chinese threat group involved in dual operations of cyber espionage and financial cybercrime, utilizing advanced malware and techniques to target various global sectors, including telecommunications and technology.

BlueBravo

BlueBravo is a Russian state-sponsored cyber espionage group that has been actively involved in sophisticated hacking campaigns targeting sensitive information from government, academia, and defense sectors, particularly utilizing tactics such as spear-phishing with signed Remote Desktop Protocol files.

North Korean Hackers

North Korean hackers, particularly the group BlueNoroff, have intensified their cyber campaigns targeting cryptocurrency firms with sophisticated malware, including a new multi-stage malware dubbed "Hidden Risk" designed to exploit macOS systems through phishing emails and fake documents, while also being linked to significant past thefts such as the $50 million Upbit hack in 2019, now valued at over $1 billion.

Play Ransomware

Play Ransomware, also known as PlayCrypt, has emerged as a significant threat since its inception in June 2022, compromising over 300 organizations globally by exploiting unpatched vulnerabilities and compromised accounts, employing a double-extortion model that includes data exfiltration, and notably collaborating with North Korean state-sponsored actors to enhance its operational capabilities and reach across various sectors.

NoName057(16)

NoName057(16) is a pro-Russian hacktivist group that has recently claimed responsibility for a series of DDoS attacks against multiple organizations in Australia, South Korea, the UK, Spain, and the Czech Republic while forming alliances with other hacking groups to disrupt various government and infrastructure websites, reflecting their ongoing geopolitical motivations and cyber warfare strategies.

LummaC2

LummaC2, also known as Lumma Stealer, is a sophisticated information-stealing malware leveraging fake AI image and video generators to infect Windows and macOS systems, targeting users to steal sensitive credentials and cryptocurrency wallets while employing social engineering techniques like fake CAPTCHA prompts and phishing campaigns via platforms like Telegram.

HijackLoader

HijackLoader, also known as IDATLOADER and GHOSTPULSE, has gained prominence in 2024 due to its use of advanced techniques like BPL Sideloading and legitimate digital certificates to distribute various malware strains, including CARBANAK and Lumma Stealer, often utilizing malicious scripts and dynamic execution tactics to evade detection.

BugSleep

BugSleep is a newly identified malware implant associated with the Iranian APT group MuddyWater, designed for remote command execution and file transfer, utilizing advanced evasion techniques and operating primarily over port 443, with ongoing development and deployment as part of a broader cyber-espionage campaign targeting organizations in the Middle East.

SocGholish

Recent information indicates that SocGholish, also known as FakeUpdates, is a prevalent JavaScript downloader malware that continues to affect numerous websites, with ongoing detection of command and control servers across various countries, and it remains a significant threat in cyber incidents, especially targeting users through social engineering tactics disguised as legitimate software updates.

Latest Cyber Security News

Briefs

Russian state hackers hijacked rival servers to spy on targets in India, Afghanistan

At least 8 US telcos, dozens of countries impacted by Salt Typhoon breaches, White House says

EU demands TikTok 'freeze and preserve data' over alleged Russian interference in Romanian elections