Three arrested in Kosovo for operating Rydox cybercriminal marketplace

Texas AG launches investigation into 15 tech companies for violating child privacy law

North Korean hackers behind $50 million crypto heist of Radiant Capital

Online ordering at Krispy Kreme disrupted by cyberattack

French internet operator fined $53 million for unsolicited ads and tracking users without consent

Wyden seeks stricter telecom cyber standards following Salt Typhoon breach

Homeland Security veteran to be interviewed for Trump administration cyber role

Medical device company says shipping processes disrupted by ransomware attack

Key electricity distributor in Romania warns of ‘cyber attack in progress’

Click Here Podcasts

The Record-Centered.svg

Home

Subscribe to Cyber Daily®

Daryna Antoniuk

ukraine SBU PP.jpg

Ukraine uncovers Russian spy network recruiting teens for espionage

Android (1).jpg

Germany cuts hacker access to 30,000 devices infected with BadBox malware

Suzanne Smalley

ken-paxton-texas.jpg

Jonathan Greig

2022-12-Moshed-North-Korea-Flag.jpg

DOJ indicts 14 North Koreans who fraudulently earned $88 million working for US firms

pexels-alessvisuals-12470869.jpg

Texas adds data broker specializing in driver behavior to list of alleged privacy law violators

movies-acting.jpg

Screen Actors Guild Health Plan sued after September data breach exposes healthcare info

The unicameral Legislative Assembly of El Salvador. Image: Wikimedia Commons / Asamblea184577 / CC BY-SA 4.0

Salón_Azul_de_la_nueva_Asamblea_Legislativa.jpg

El Salvador’s cyber laws threaten media freedom and privacy, human rights experts warn 

ferguson3.jpg

Trump FTC pick seen as mixed bag for data privacy enforcement

Ukrainian defenders conduct aerial reconnaissance with a drone. Image:  Vadym Pliashechko / State Border Guard Service of Ukraine

PVV02917-1365x2048.jpg

For Russian spies, existing cybercrime tools become avenues into Ukrainian military devices

CVE-2024-36991

CVE-2024-36991 is a path traversal vulnerability affecting Splunk Enterprise on Windows, specifically on the "/modules/messaging/" endpoint, impacting versions below 9.2.2, 9.1.5, and 9.0.10, and is detailed in various resources including a proof of concept available on GitHub and an industry reference link on the NVD website.

CVE-2024-38112

CVE-2024-38112 is a serious MSHTML spoofing vulnerability that has been exploited by the APT group Void Banshee in an attack chain, with similar exploits found for sale on the dark web, highlighting significant risks to Windows users and the potential for unauthorized command execution during authentication processes.

REMCOS RAT

Recent reports indicate a surge in phishing campaigns leveraging the Remcos RAT (Remote Access Trojan), which exploits the CVE-2017-0199 vulnerability in Microsoft Office and WordPad through malicious Excel files, employing fileless techniques to evade detection and gain backdoor access to systems for data theft and remote control.

Scattered Spider

Recent information indicates that Scattered Spider, a notorious cybercrime group known for sophisticated phishing attacks and ransomware schemes targeting major corporations like MGM Resorts and Caesars Entertainment, has seen several of its alleged members indicted in connection with multi-million dollar cryptocurrency thefts, emphasizing the ongoing threat they pose to cybersecurity.

RedGolf

APT41 is a sophisticated Chinese cyber-espionage group that employs advanced surveillance toolkits to target organizations globally, particularly in South Asia, and has been linked to various high-profile cyber attacks and campaigns involving data theft and espionage.

BlueBravo

BlueBravo is a sophisticated cyber attacker known for employing advanced tactics to infiltrate and compromise corporate networks, particularly targeting email systems and leveraging vulnerabilities for espionage purposes.

North Korean Hackers

Recent reports indicate that North Korean hackers, particularly groups like Lazarus and Andariel, have intensified their cyberattacks, targeting cryptocurrency platforms and utilizing sophisticated tactics such as social engineering and malware to steal billions of dollars, with a significant $50 million heist from Radiant Capital occurring in October 2024.

Play Ransomware

Play Ransomware, which first emerged in June 2022, is a persistent threat known for its sophisticated double-extortion tactics, targeting both public and private organizations by exploiting unpatched vulnerabilities and compromised accounts, while also showing significant collaboration with North Korean state-sponsored actors in various attacks across multiple industries.

NoName057(16)

NoName057(16) is a pro-Russian hacktivist group actively conducting DDoS attacks against various international targets, including websites in Australia, Ukraine, France, the UK, and other countries, often in coordination with allied groups while promoting political messages tied to their ideological stance.

LummaC2

LummaC2, also known as Lumma Stealer, is a sophisticated information-stealing malware that has surged in prevalence, particularly targeting manufacturing and leveraging fake AI tools to compromise systems on Windows and macOS, while utilizing social engineering techniques like ClickFix to bypass security measures and steal sensitive data such as credentials and cryptocurrency wallet information.

HijackLoader

HijackLoader, also known as IDATLOADER or GHOSTPULSE, has gained prominence in 2024 for its advanced techniques like BPL Sideloading and dynamic API resolution to distribute various malware families—including Lumma Stealer and Amadey—through tactics such as phishing and DLL hijacking, while employing methods to evade detection.

BugSleep

BugSleep is a newly developed malware implant utilized by the Iranian APT group MuddyWater for remote command execution and file transfer, which employs sophisticated evasion techniques and operates over plain TCP sockets, with ongoing updates to enhance its functionality and maintain stealth against detection systems.

SocGholish

Recent reports indicate that SocGholish, also known as FakeUpdates, remains a prevalent malware threat, frequently disguising itself as browser updates to compromise systems through malicious downloads, with active command and control (C2) servers identified in the United States and Canada, and having significant impact on numerous compromised websites.

Latest Cyber Security News

Briefs