Schneider Electric says hackers accessed internal project execution tracking platform

Cisco notifies ‘limited set’ of customers after hacker accessed non-public files

Cyberattack disrupts classes at Irish technology university

German police arrest two for alleged ties to DDoS-for-hire platform

California court suffering from tech outages after cyberattack

Russia behind latest election disinformation video, US intel agencies say

Ransomware attack hits German pharmaceutical wholesaler, disrupts medicine supplies

Los Angeles housing agency confirms another cyberattack after 2023 ransomware incident

Young people’s data feared stolen in cyberattack on French government contractor

Click Here Podcasts

The Record-Centered.svg

Home

Subscribe to Cyber Daily®

Jonathan Greig

Schneider_Electric_Torgauer_Straße_auf_dem_EUREF-Campus_Berlin-Schöneberg (1).jpg

Martin Matishak

cisa-seal.jpg

In final check-in before Election Day, CISA cites low-level threats, and not much else

fabian-jones-B9TSJScnBAU-unsplash-cisco2.jpg

50095651437_ed09ffb10c_o.jpg

Ohio's capital says July ransomware attack leaked info of 500,000

Alexander Martin

setu.jpg

Image: President of the Republic of Moldova Maia Sandu / X

Gbe-JiOasAALWHA.jpg

Moldova elects pro-West president Maia Sandu despite Russian interference

computer-digital-hack.jpg

Google uses large language model to discover real-world vulnerability

2024_0913 - The Record Q&A - Yvette Clarke.jpg

Rep. Yvette Clarke on AI-fueled disinformation: ‘We have not protected ourselves in time for this election cycle’

China.jpg

FBI wants more info on hackers behind Sophos exploitation after report on China’s intrusions

CVE-2024-40348

CVE-2024-40348 is a vulnerability targeting the Bazarr application that allows unauthenticated arbitrary file reading, specifically attempting to access the /etc/passwd file, and has been associated with various proof-of-concept (POC) tools available on platforms like GitHub.

CVE-2024-36991

CVE-2024-36991 is a path traversal vulnerability affecting Splunk Enterprise on Windows versions below 9.2.2, 9.1.5, and 9.0.10, allowing attackers to potentially access sensitive files such as /etc/passwd and C:\windows\win.ini, with a CVSS score of 7.5, and proof of concept (PoC) exploits have been reported.

CVE-2024-38112

CVE-2024-38112 is a critical spoofing vulnerability in the Windows MSHTML platform that has been actively exploited by the advanced persistent threat actor Void Banshee to distribute the Atlantida InfoStealer malware, and it is part of a series of MSHTML vulnerabilities disclosed in 2024, with recent patches addressing similar issues.

REMCOS RAT

Recent intelligence indicates that the Remcos Remote Access Trojan (RAT) is being widely exploited in various phishing campaigns, particularly targeting the finance and insurance sectors, with threat actors leveraging tactics such as hiding malware in GitHub repository comments and utilizing virtual hard drive files to bypass security measures, leading to significant compromises including the infection of Ukrainian military devices by the Russian cybercriminal group Storm-2049.

CVE-2024-20419

CVE-2024-20419 is a critical vulnerability in Cisco Smart Software Manager that allows unauthorized password changes, and it is currently being actively exploited, with a script available for sale on the dark web for $50,000.

Scattered Spider

Scattered Spider, a financially motivated cybercriminal group also known as UNC3944 or Octo Tempest, has gained notoriety for its sophisticated social engineering tactics and collaboration with ransomware-as-a-service entities like RansomHub, targeting various sectors including healthcare and financial industries, and is linked to significant breaches such as the attack on MGM Resorts.

RedGolf

APT41, a Chinese nation-state actor, has been actively involved in sophisticated cyber attacks targeting various industries, including a recent multi-stage operation against the gambling sector for financial gain, demonstrating its dual focus on espionage and cybercrime.

BlueBravo

BlueBravo, also known as APT29, is a Russian state-sponsored cyber espionage group that has been actively targeting government and defense sectors in the U.S. and Europe through sophisticated phishing campaigns and exploitation of various vulnerabilities.

North Korean Hackers

North Korean hackers, particularly affiliated with groups like Lazarus and ScarCruft, are increasingly leveraging sophisticated tactics such as fake job interviews to deploy malware, exploiting zero-day vulnerabilities in browsers like Chrome and Internet Explorer, and targeting cryptocurrency users and technology firms while accumulating significant financial gains through cyber theft, including an estimated $3 billion in stolen cryptocurrency since 2017.

Play Ransomware

Recent intelligence indicates that Play Ransomware, an active cyber threat since 2022, has been linked to the North Korean state-sponsored group Jumpy Pisces (also known as Andariel), marking a significant collaboration that combines espionage tactics with financially motivated ransomware operations, primarily exploiting vulnerabilities in systems like Fortinet SSL VPNs and Microsoft Exchange.

NoName057(16)

The pro-Russian cyber attacker group NoName057(16) has recently launched a series of coordinated DDoS attacks targeting various governmental and private websites across the UK, Belgium, Ukraine, Japan, and other countries, often justifying their actions as responses to geopolitical tensions and military activities.

LummaC2

LummaC2 is a sophisticated malware primarily used for stealing sensitive information from compromised systems, recently highlighted in phishing campaigns targeting Facebook business accounts in Taiwan, where users are tricked into downloading malicious files disguised as legal notifications.

HijackLoader

Recent reports indicate that the HijackLoader malware, also known as Lumma Stealer, has evolved significantly since its emergence in September 2023, now leveraging stolen legitimate code-signing certificates to bypass security defenses and deliver information-stealing payloads, with a notable increase in deployment observed since mid-September 2024.

BugSleep

BugSleep, also known as MuddyRot, is a sophisticated remote access Trojan (RAT) used by the Iranian APT group MuddyWater, featuring advanced evasion techniques, a bespoke command and control protocol over TCP, and capabilities for reverse shell and file I/O operations, with ongoing analysis revealing its methods for detection and potential changes due to weekly updates.

SocGholish

SocGholish, a JavaScript-based downloader responsible for 60% of malware downloader attacks, is known for its stealthy tactics involving fake software updates, targeting compromised legitimate websites, and evading detection through obfuscated scripts and modified code, making it a prevalent and favored tool among cybercriminals.

Latest Cyber Security News

Briefs

Exclusive: Nakasone says all the news about influence campaigns ahead of Election Day is actually 'a sign of success'

Lithuania: Russian military intelligence behind plot to parcel bomb cargo planes

Social media and mobile internet restricted in Mozambique amid election protests