Latest Cybersecurity News and Articles

---

Superusers Need Super Protection: How to Bridge Privileged Access Management and Identity Management

Traditional perimeter-based security has become costly and ineffective. As a result, communications security between people, systems, and networks is more important than blocking access with firewalls. On top of that, most cybersecurity risks are caused by just a few superusers – typically one out of 200 users. There’s a company aiming to fix the gap between traditional PAM and IdM

---

WordPress LiteSpeed Plugin Vulnerability Puts Five Million Sites at Risk

A security vulnerability (CVE-2023-40000) in the LiteSpeed Cache plugin for WordPress allowed unauthenticated users to escalate their privileges, posing a significant risk to over five million installations.

---

Unmanaged Third-Party Access Threatens OT Environments

The increased connectivity between IT and OT systems, along with the rise in third-party access, introduces serious new risks that can leave organizations exposed to safety and security threats if access and connectivity are not properly controlled.

---

Akira Ransomware Group Threatens to Leak Stolen Data from Swedish Municipality

The notorious Akira ransomware group has targeted the municipality of Bjuv in South Sweden, threatening to leak nearly 200GB of stolen data, including confidential documents and personal HR files.

---

CFOs Take Backseat to CISOs on SEC Cyber Rules

Corporate finance chiefs are less involved in SEC cybersecurity breach disclosure processes compared to chief information security officers, potentially leading to decision-making mistakes.

---

Using AI to Reduce False Positives in Secrets Scanners

Identifying and securing secrets in code is challenging due to the wide variety of secret types, but AI and ML can reduce false positives by as much as 86%, improving risk prioritization.

---

medQ Confirms Data Breach After Software Encryption Incident

The data breach occurred when an unauthorized party encrypted software used by medQ and hosted by a third-party data center, resulting in the exposure of confidential consumer data.

---

Online Travelers at Risk: Agent Tesla Malware Attacks Travel Industry

Malware campaigns are evolving, using email attachments to deliver RAT infections, as demonstrated by the example of a PDF attachment impersonating Booking.com to lure victims.

---

TimbreStealer Malware Spreading via Tax-themed Phishing Scam Targets IT Users

Mexican users have been targeted with tax-themed phishing lures at least since November 2023 to distribute a previously undocumented Windows malware called TimbreStealer. Cisco Talos, which discovered the activity, described the authors as skilled and that the "threat actor has previously used similar tactics, techniques and procedures (TTPs) to distribute a banking trojan known

---

UAC-0184 Targets Ukrainian Entity in Finland with Remcos RAT

Morphisec found that the UAC-0184 threat actor used steganography to deliver the Remcos RAT via the IDAT Loader, targeting a Ukrainian entity in Finland. The incident comes a few weeks after ASEC discovered that Remcos RAT is being distributed disguised as adult games through webhards. Researchers highlight that organizations must deploy behavioral-based endpoint protection solutions as an additional layer of security to thwart such attacks.

---

Cybersecurity Agencies Warn Ubiquiti EdgeRouter Users of APT28's MooBot Threat

In a new joint advisory, cybersecurity and intelligence agencies from the U.S. and other countries are urging users of Ubiquiti EdgeRouter to take protective measures, weeks after a botnet comprising infected routers was felled by law enforcement as part of an operation codenamed Dying Ember. The botnet, named MooBot, is said to have been used by a Russia-linked threat actor known as

---

The rising threat of zero-day attacks

How can security leaders prepare themselves for the unexpected? Answer this question and more on this episode of The Security Podcasts.

---

Open-Source Xeno RAT Trojan Emerges as a Potent Threat on GitHub

The multi-stage dissemination of Xeno RAT via Discord CDN demonstrates the use of deceptive tactics such as disguised shortcut files to deliver and execute the open-source malware.

---

Around 50% of IT leaders believe IoT security is their weakest point

A recent survey has revealed that less than half of IT leaders are assured in their IoT security plans. 

---

Update: LoanDepot Says About 17M Customers Had Personal Data and SSNs Stolen During Cyberattack

The cyberattack left LoanDepot's customers unable to make payments or access their online accounts, and the company expects the incident to impact its fiscal first quarter earnings by $12 to $17 million.

---

FTC bans Avast from selling browser data

The Federal Trade Commission (FTC) has banned software company Avast from selling or licensing web browsing data for advertising purposes. 

---

New Hugging Face Vulnerability Exposes AI Models to Supply Chain Attacks

Cybersecurity researchers discovered a vulnerability in the Hugging Face Safetensors conversion service that could be exploited by attackers to compromise machine learning models submitted by users, leading to supply chain attacks.

---

Zyxel Issues Security Advisory for Multiple Vulnerabilities in Firewalls and APs

Zyxel has identified and patched four critical vulnerabilities in its firewall and access point products, including flaws that could lead to remote code execution and denial-of-service attacks.

---

The average open source vulnerability is 2.5 years old

According to a report, nearly 75% of commercial codebases assessed for risk contain open source components impacted by high-risk vulnerabilities.

---

Pikabot Returns With New Tricks up Its Sleeve

The new version of Pikabot features simpler encryption algorithms, anti-debugging methods, and plaintext bot configuration, indicating a new codebase with potential future improvements.