Suspected Bohemia dark web marketplace admins arrested by Dutch, Irish police

European Commission finds US agencies are adhering to data protection commitments

Casio says recent cyberattack 'caused system failure'

Ukrainian pleads guilty to running Raccoon Infostealer malware, agrees to pay nearly $1 million

ADT says hacker stole encrypted internal employee data after compromising business partner

Ukraine's defense ministry launches military CERT to counter Russian cyberattacks

Tech platforms urged to tackle Hamas’ and Hezbollah’s online propaganda

Dutch police blame ‘state actor’ for recent data breach

Detroit-area government services impacted by cyberattack

Click Here Podcasts

The Record-Centered.svg

Home

Subscribe to Cyber Daily®

Suzanne Smalley

eu-flag.jpg

Daryna Antoniuk

Prison bars.jpg

Ukraine sentences two hackers from Russia-linked Armageddon group

Jonathan Greig

hiroshi-tsubono-7Iid4mkhh98-unsplash.jpg

jackal.jpg

State-backed ‘GoldenJackal’ hackers deploy new tools against government entities

RaccoonStealer.jpg

security camera.jpg

Ukrainian Deputy Defense Minister Kateryna Chernohorenko speaks at the IT Arena conference in Lviv in September 2024. Image: IT Arena

461318938_1087710220031215_1675878999613775319_n.jpg

Alexander Martin

European Union High Representative Josep Borrell Fontelles in Peru in 2021. Image: European Union / Flickr

51674378721_ff43de7c6b_o.jpg

EU condemns Russia after detecting ‘increasing number’ of hybrid activities

26641193826_cd56f53028_o.jpg

MoneyGram says customer information stolen during September attack

CVE-2024-38112

CVE-2024-38112, a critical zero-day vulnerability in the Windows MSHTML platform discovered by Check Point researchers, has been actively exploited by the advanced persistent threat group Void Banshee to deliver malware, particularly in conjunction with another vulnerability, CVE-2024-43461, prior to July 2024.

REMCOS RAT

Recent information indicates that the Remcos RAT is being delivered through sophisticated phishing campaigns that utilize weaponized Excel documents, exploiting the CVE-2017-0199 vulnerability to execute fileless attacks, primarily targeting companies and critical sectors in regions such as Turkey, Bulgaria, and Japan.

CVE-2024-20419

CVE-2024-20419 is a critical account takeover vulnerability (CVSS 10) in Cisco Smart Software Manager (SSM) On-Prem versions up to 8-202206, with public proof-of-concept exploit code released, allowing attackers to change the admin user's password to one they control.

Scattered Spider

Scattered Spider, a cybercriminal group known for its advanced social engineering techniques such as smishing and vishing, is intensifying attacks on cloud infrastructure within the insurance and financial sectors by exploiting stolen credentials, conducting SIM swaps, and partnering with other ransomware groups like AlphV/BlackCat to deploy ransomware and maintain persistent access to compromised environments.

RedGolf

APT41, a Chinese state-sponsored cyber threat group, has recently intensified its operations, targeting various sectors globally with sophisticated malware and techniques, while also engaging in both espionage and financially motivated cybercrime activities.

BlueBravo

BlueBravo is a sophisticated cyber attacker attributed to Russian state-sponsored activities, known for its complex and stealthy operations targeting various organizations, including government entities and private sectors, primarily using email for initial access and employing advanced exploitation techniques.

North Korean Hackers

North Korean hackers have increasingly targeted various sectors, including the cryptocurrency industry and defense manufacturers like Diehl Defense, utilizing sophisticated tactics such as fake job offers and malware disguised as coding tests to steal sensitive information and assets.

Play Ransomware

Play Ransomware has intensified its activities in 2024, targeting various industries in the U.S. and exploiting known vulnerabilities in public-facing systems, with multiple confirmed victims and plans to publish sensitive data from these breaches on their dark web portal.

CVE-2024-21181

CVE-2024-21181 is a critical remote code execution vulnerability in Oracle WebLogic Server that poses a significant risk to affected systems, prompting organizations to implement temporary workarounds and maintain up-to-date security measures.

NoName057(16)

The pro-Russian hacker group NoName057(16) has recently intensified its cyber operations, launching DDoS attacks on multiple websites across Taiwan, Austria, Belgium, and Israel, targeting government agencies and infrastructure while collaborating with other hacktivist groups in a broader hybrid warfare context.

LummaC2

LummaC2 is currently being used in various cyberattacks, particularly targeting transportation companies in North America through phishing campaigns that deliver information stealers and remote access trojans, while also facilitating the sale of stolen cookies from platforms like Facebook and Reddit, and leveraging new variants that exploit PowerShell for malicious activities.

HijackLoader

HijackLoader is a malicious loader malware primarily used by the Marko Polo cybercrime group to deploy various infostealer payloads, including Stealc and Rhadamanthys, through diverse tactics such as phishing, fake software updates, and social engineering, significantly targeting cryptocurrency influencers and gamers across multiple platforms.

BugSleep

The BugSleep malware, attributed to the Iranian-backed MuddyWater group, utilizes process injection techniques to stealthily infiltrate systems, primarily targeting critical sectors in the Middle East while employing advanced tactics to evade detection and facilitate cyber espionage.

SocGholish

SocGholish is a sophisticated malware that utilizes social engineering tactics, often masquerading as fake software updates to trick users into downloading harmful code, and it has been linked to various cybercriminal activities and campaigns, including the deployment of backdoors like WarmCookie.

Latest Cyber Security News

Briefs

National Cyber Director warns of ransomware, Chinese infrastructure attacks and cyber supply chain concerns

Russia and Turkey ban Discord messaging app