Senators call for audit of TSA’s facial recognition tech as use expands in airports

DeliveryHero subsidiary fined $5.2 million for tracking drivers’ geolocation

Gambling and lottery giant disrupted by cyberattack, working to bring systems back online

Dozens of Central Asian targets hit in recent Russia-linked cyber-espionage campaign

GAO recommends new agency to streamline how US government protects citizens’ data

Heather ‘Razzlekhan’ Morgan sentenced to 18 months in prison, ending Bitfinex saga 

AI company tells SEC that $250,000 stolen in cyberattack

British software company Microlise confirms hackers compromised corporate data

Ohio man behind Helix cryptocurrency mixer gets 3-year sentence

Click Here Podcasts

The Record-Centered.svg

Home

Subscribe to Cyber Daily®

Jonathan Greig

palo-alto-networks-firewall.jpg

Experts warn of Palo Alto firewall exploitation after 2,000 compromises spotted

Suzanne Smalley

getty-images-77V4-4zFCzo-unsplash.jpg

food-delivery.jpg

Alexander Martin

yianni-mathioudakis-WqIxnFspLI8-unsplash.jpg

UK drinking water supplies disrupted by record number of undisclosed cyber incidents

Daryna Antoniuk

dima-pechurin-JUbjYFvCv00-unsplash.jpg

China-linked hackers target Linux systems with new spying malware

gambling-casino-slot.jpg

Phishing.jpg

Microsoft seizes 240 websites used by Egyptian phishing-as-a-service operation ‘ONNX’

Jatupat.jpg

Thai court dismisses activist’s closely watched lawsuit against spyware maker

popeyetools-takedown-splash-page.png

'PopeyeTools' marketplace for stolen credit cards disrupted by feds

CVE-2024-40348

CVE-2024-40348 is a vulnerability that allows unauthorized access to the /etc/passwd file on targeted systems, with proof-of-concept (POC) exploits available on GitHub and tools designed for bulk scanning and exploitation.

CVE-2024-38112

CVE-2024-38112 is a Windows MSHTML platform spoofing vulnerability that has been actively exploited by threat actors, including the Void Banshee APT group, to manipulate user interfaces and deliver malware through malicious URL shortcuts, prompting security recommendations for detection and patching.

REMCOS RAT

Recent reports highlight a phishing campaign targeting Windows users that exploits the CVE-2017-0199 vulnerability in Microsoft Office and WordPad through malicious Excel documents to spread a sophisticated, fileless variant of Remcos RAT malware, enabling attackers to gain remote access and control over compromised systems while evading traditional security measures.

CVE-2024-20419

CVE-2024-20419 is a critical vulnerability in Cisco's Smart Software Manager On-Prem that allows unauthenticated remote attackers to change user passwords without prior knowledge, and exploits for this vulnerability are being sold on underground forums for significant sums.

Scattered Spider

Scattered Spider, a financially motivated cybercrime group, has been charged with a series of phishing schemes and ransomware attacks that targeted numerous companies, including MGM Resorts and Caesars Entertainment, resulting in the theft of over $11 million in cryptocurrency and significant disruptions across various sectors through advanced social engineering techniques.

RedGolf

APT41 is a highly sophisticated Chinese cyber threat group known for its dual focus on cyber espionage and financially motivated attacks, utilizing advanced malware and exploit techniques to target a wide range of sectors globally.

BlueBravo

BlueBravo is a cyber attacker linked to Russia's Foreign Intelligence Service (SVR) known for conducting sophisticated espionage operations, including targeted phishing campaigns against government, military, and other critical sectors.

North Korean Hackers

North Korean hackers, particularly the BlueNoroff group and the Lazarus Group, are intensifying their cyber campaigns against cryptocurrency firms by deploying sophisticated multi-stage malware, exploiting vulnerabilities in macOS, and using phishing tactics to steal sensitive data and funds, while also being linked to the infamous $50 million Upbit hack from 2019, with the stolen Ethereum now valued at over $1 billion.

Play Ransomware

Play Ransomware, active since June 2022, has significantly impacted over 300 organizations globally, leveraging compromised valid accounts and exploiting unpatched vulnerabilities, while recent investigations reveal a collaboration with North Korean state-sponsored group Jumpy Pisces for more sophisticated cyber attacks.

NoName057(16)

The pro-Russian hacktivist group NoName057(16) has orchestrated a series of DDoS attacks targeting various government and corporate websites across the UK, Ukraine, South Korea, Czech Republic, and other countries, claiming responsibility for multiple high-profile cyber incidents while forming alliances with other hacking groups.

LummaC2

LummaC2 is a potent information-stealing malware that has recently surged in prevalence due to sophisticated phishing campaigns, particularly targeting Facebook business accounts in Taiwan and utilizing fake AI video generators to infect Windows and macOS systems, effectively harvesting sensitive data such as passwords, browser credentials, and cryptocurrency wallet information.

HijackLoader

HijackLoader, a malware loader that uses advanced evasion techniques such as genuine code-signing certificates and dynamic API resolution, has become prevalent in 2024 for distributing various malware families including Lumma Stealer, while being associated with sophisticated threat actors and campaigns linked to the notorious CARBANAK group.

BugSleep

BugSleep is a sophisticated remote access Trojan (RAT) developed by the Iranian APT group MuddyWater, featuring advanced evasion techniques, a bespoke command and control protocol, and capabilities for reverse shell access and file transfers, with ongoing updates indicating its continued evolution and deployment in cyber operations.

SocGholish

Recent information indicates that SocGholish, a JavaScript-based malware downloader primarily distributed through fake software update prompts and compromised websites, continues to pose a significant threat, often leading to further exploitation with various payloads including remote access tools and ransomware, as it remains prevalent in current threat landscapes.

Latest Cyber Security News

Briefs

RSA Conference to invest $5 million in sandbox contest finalists

McCain Institute’s Evelyn Farkas on Ukraine: ‘Don’t ever count them out’

Google takes down fake news sites, wire services run by Chinese influence operation