Homeland Security veteran to be interviewed for Trump administration cyber role

Medical device company says shipping processes disrupted by ransomware attack

Key electricity distributor in Romania warns of ‘cyber attack in progress’

Cooperate with Salt Typhoon probe, House chairman tells telecoms

Pirated corporate software infects Russian businesses with info-stealing malware

US org with ‘significant presence in China’ targeted by hackers, Symantec says

Report: Russian authorities seized phone from detainee, infected it with spyware

Police records show ShotSpotter is wildly inaccurate in New York City

Germany arrests suspected admin of country’s largest criminal marketplace

Click Here Podcasts

The Record-Centered.svg

Home

Subscribe to Cyber Daily®

Jonathan Greig

Ito En tea.jpg

US subsidiaries of Japanese water treatment company, green tea maker hit with ransomware

Suzanne Smalley

michael-schofield-ciyuTvF0rUo-unsplash.jpg

national-cancer-institute-auE5M0yI5LE-unsplash.jpg

Daryna Antoniuk

apple-mac.jpg

Russia disrupts internet access in multiple regions to test ‘sovereign internet’

Martin Matishak

Mark Green.jpg

supply chain, warehouse, shipping, logistics

pexels-tiger-lily-4483860.jpg

Blue Yonder says some customers restored as ransomware gang boasts of attack

James Reddick

hands keyboard.jpg

Another teenage hacker charged as feds continue Scattered Spider crackdown  

Alexander Martin

romania-parliament.jpg

Romania annuls presidential election over alleged Russian interference

mohammad-rahmani-d3Ysz1ziusM-unsplash.jpg

CVE-2024-36991

CVE-2024-36991 is a path traversal vulnerability affecting Splunk Enterprise versions prior to 9.2.2, 9.1.5, and 9.0.10, which allows attackers to access sensitive files, such as the /etc/passwd file, through the "/modules/messaging/" endpoint on Windows systems.

CVE-2024-38112

CVE-2024-38112 is a MSHTML spoofing vulnerability that has been exploited as part of an attack chain, with similar exploits available for sale on the dark web since early August 2023, posing a significant threat to Windows users and emphasizing the need for mitigation measures such as denylisting certain email attachments and applying relevant Microsoft patches.

REMCOS RAT

Recent reports indicate that cybercriminals are exploiting the CVE-2017-0199 vulnerability in Microsoft Office through phishing campaigns using malicious Excel documents to deploy a fileless variant of Remcos RAT (Remote Access Trojan), which allows attackers to gain remote control over victims' devices and steal sensitive information.

Scattered Spider

Scattered Spider is a notorious cybercrime group known for its sophisticated phishing tactics and aggressive attacks on major organizations, including high-profile breaches of MGM Resorts and Caesars Entertainment, leading to significant financial losses and recent indictments against multiple members involved in cryptocurrency theft schemes.

RedGolf

APT41 is a sophisticated Chinese cyber-espionage group that has been actively targeting organizations in South Asia using advanced malware tools, including a Windows-based surveillance framework known as LightSpy.

BlueBravo

BlueBravo is a Russian state-sponsored cyber attacker known for conducting sophisticated cyber espionage operations, including large-scale spear-phishing campaigns and exploiting vulnerabilities to gain access to sensitive information from organizations, particularly targeting corporate email systems and cloud environments.

North Korean Hackers

North Korean hackers, particularly the Lazarus and Andariel groups, have intensified their cyberattacks on cryptocurrency firms, utilizing sophisticated malware and social engineering tactics to steal significant amounts of digital assets, including a recent $50 million heist from Radiant Capital and the infamous $1 billion theft from the Upbit exchange in 2019.

Play Ransomware

Play Ransomware, also known as PlayCrypt, has emerged as a significant threat since its inception in June 2022, employing sophisticated tactics such as exploiting unpatched vulnerabilities, double-extortion methods, and maintaining connections to North Korean state-sponsored actors while targeting a wide range of sectors globally, including manufacturing and healthcare.

NoName057(16)

The pro-Russian hacktivist group NoName057(16) has recently intensified its cyberattacks, targeting various countries including Australia, the UK, Ukraine, South Korea, and France, while forming alliances with other hacktivist groups to execute DDoS attacks and defacements against government and critical infrastructure websites in these nations.

LummaC2

LummaC2, a sophisticated information-stealing malware often disguised as fake AI image and video generators, targets both Windows and macOS systems to exfiltrate sensitive data such as credentials and cryptocurrency wallets, utilizing various distribution methods including Telegram channels and social engineering techniques like ClickFix.

HijackLoader

HijackLoader, which has gained prominence in 2024 due to its advanced techniques like BPL Sideloading and dynamic API loading, is a malware loader that distributes various malicious payloads—including Lumma Stealer and AsyncRAT—through sophisticated methods such as DLL hijacking and the use of legitimate digital certificates, making it a significant threat particularly targeting industries such as manufacturing.

BugSleep

BugSleep is a newly developed malware implant used by the MuddyWater APT group, associated with the Iranian government, designed for remote command execution and file transfer, employing sophisticated evasion techniques and targeting organizations in the Middle East through phishing campaigns.

SocGholish

SocGholish, also known as FakeUpdates, is a prevalent JavaScript downloader malware that tricks users into downloading malicious software by posing as legitimate browser updates, with significant detection rates and ongoing activity across multiple command and control servers, impacting numerous websites globally.

Latest Cyber Security News

Briefs

Suspected Russian hackers target Ukrainian defense enterprises in new espionage campaign