Latest Cybersecurity News and Articles

---

BobTheSmuggler: Open-source tool for undetectable payload delivery

The open-source tool supports various payload delivery chains and has future plans to add more image polyglots, file extensions, and EML file support for stealthy payload delivery.

---

European Retailer Pepco Loses $16.8 Million Due to Phishing Attack

While customer, supplier, and colleague information was not compromised, the incident may have involved a social engineering attack known as business email compromise (BEC).

---

GTPDOOR Linux Malware Targets Telecoms, Exploiting GPRS Roaming Networks

Threat hunters have discovered a new Linux malware called GTPDOOR that’s designed to be deployed in telecom networks that are adjacent to GPRS roaming exchanges (GRX) The malware is novel in the fact that it leverages the GPRS Tunnelling Protocol (GTP) for command-and-control (C2) communications. GPRS roaming allows subscribers to access their GPRS services while they are

---

Lazarus Hackers Exploited Windows Kernel Flaw as Zero-Day in Recent Attacks

The notorious Lazarus Group actors exploited a recently patched privilege escalation flaw in the Windows Kernel as a zero-day to obtain kernel-level access and disable security software on compromised hosts. The vulnerability in question is CVE-2024-21338 (CVSS score: 7.8), which can permit an attacker to gain SYSTEM privileges. It was resolved by Microsoft earlier this month as part

---

How to Prioritize Cybersecurity Spending: A Risk-Based Strategy for the Highest ROI

As an IT leader, staying on top of the latest cybersecurity developments is essential to keeping your organization safe. But with threats coming from all around — and hackers dreaming up new exploits every day — how do you create proactive, agile cybersecurity strategies? And what cybersecurity approach gives you the most bang for your buck, mitigating your risks and maximizing the value of your

---

Report: Cyber Espionage France’s Top Threat Ahead of 2024 Paris Olympics

The 2023 Cyber Threat Landscape report from France’s National Cybersecurity Agency (ANSSI) highlights a significant increase in cyber espionage campaigns targeting individuals and non-governmental organizations.

---

German Applied Sciences University Announces Being Hit by Criminal Cyberattack

Hochschule Kempten, a university of applied sciences in Germany, has been targeted by a criminal cyberattack. The attack has affected access to several IT systems, including email, while the telephone system remains operational.

---

Russian Hacktivists Continue Claiming DDoS Disruptions

Russian hacktivist groups' attacks have minimal impact and are more psychological than kinetic, aiming to degrade confidence in governments and rally support for Russian President Vladimir Putin.

---

Update: Chinese Group Runs Highly Persistent Ivanti Zero-Day Exploits

Chinese threat actor UNC5325 is adept at using novel malware and "living off the land" techniques to persist in hacked devices even after factory resets and system upgrades.

---

Report: 69% of Organizations Infected by Ransomware in 2023

Per a Proofpoint report, over two-thirds of organizations experienced a successful ransomware incident in the past year, with close to 60% reporting four or more separate ransomware incidents.

---

Ukraine Expects Billion-Dollar Russian Disinformation Campaign to Peak This Spring

Ukraine's military intelligence has reported that Russia has invested over $1 billion in a disinformation campaign called "Maidan-3" aimed at diminishing Western support for Kyiv and sowing distrust among Ukrainian citizens.

---

FTC’s Khan Warns Tech Industry That Agency Will Strictly Enforce AI Data Privacy

The FTC's aggressive approach to enforcing privacy regulations reflects a commitment to ensuring that AI model refinement does not compromise people's privacy or security.

---

New Backdoor Targeting European Officials Linked to Indian Diplomatic Events

A previously undocumented threat actor dubbed SPIKEDWINE has been observed targeting officials in European countries with Indian diplomatic missions using a new backdoor called WINELOADER. The adversary, according to a report from Zscaler ThreatLabz, used a PDF file in emails that purported to come from the Ambassador of India, inviting diplomatic staff to a wine-tasting

---

Lazarus Exploits Typos to Sneak PyPI Malware into Dev Systems

The notorious North Korean state-backed hacking group Lazarus uploaded four packages to the Python Package Index (PyPI) repository with the goal of infecting developer systems with malware. The packages, now taken down, are pycryptoenv, pycryptoconf, quasarlib, and swapmempool. They have been collectively downloaded 3,269 times, with pycryptoconf accounting for the most

---

Biden Executive Order Seeks to Cut China off From Americans’ Sensitive Data

The new executive order targets the unregulated data broker industry and prohibits the sale of genomic, biometric, health, geolocation, and financial data to the identified countries.

---

Report: Business Logic Abuse Dominates as API Attacks Surge

According to Imperva's State of API Security Report, attacks on the business logic of APIs, including credential stuffing and data scraping, account for the largest share (27%) of API attacks.

---

Researchers Say Iranian Hackers Targeting Israeli Defense Sector

The cybersecurity firm Mandiant has identified a suspected Iranian hacking group, UNC1549, targeting aerospace and defense industries across the Middle East, including in Israel and the United Arab Emirates.

---

Chinese Hackers Exploiting Ivanti VPN Flaws to Deploy New Malware

At least two different suspected China-linked cyber espionage clusters, tracked as UNC5325 and UNC3886, have been attributed to the exploitation of security flaws in Ivanti Connect Secure VPN appliances. UNC5325 abused CVE-2024-21893 to deliver a wide range of new malware called LITTLELAMB.WOOLTEA, PITSTOP, PITDOG, PITJET, and PITHOOK, as well as attempted to maintain

---

President Biden Blocks Mass Transfer of Personal Data to High-Risk Nations

U.S. President Joe Biden has issued an Executive Order that prohibits the mass transfer of citizens' personal data to countries of concern. The Executive Order also "provides safeguards around other activities that can give those countries access to Americans' sensitive data," the White House said in a statement. This includes sensitive information such as genomic data, biometric data,

---

CISA warns that malicious actors are targeting cloud infrastructure

Security experts weigh in on the CISA's advisory, which reveals that cyberattackers are adapting to the increased use of cloud infrastructure.