Latest Cybersecurity News and Articles

---

Record-Breaking Ransomware Profits Surpassed $1B in 2023

The rise in ransomware profits in 2023 marks a significant reversal from the decline observed in 2022, driven by the innovation and resilience of top-tier ransomware groups.

---

Google Fixed an Android Critical Remote Code Execution Flaw

Google has released the February 2024 security patches for Android to fix 46 vulnerabilities, including a critical remote code execution flaw (CVE-2024-0031) in the System component.

---

Critical Cisco Bug Exposes Expressway Gateways to CSRF Attacks

The vulnerabilities impact devices with default configurations and can lead to system configuration modifications, creation of privileged accounts, and denial of service conditions.

---

Kimsuky's New Golang Stealer 'Troll' and 'GoBear' Backdoor Target South Korea

The North Korea-linked nation-state actor known as Kimsuky is suspected of using a previously undocumented Golang-based information stealer called Troll Stealer. The malware steals "SSH, FileZilla, C drive files/directories, browsers, system information, [and] screen captures" from infected systems, South Korean cybersecurity company S2W said in a new technical report. Troll

---

Critical Patches Released for New Flaws in Cisco, Fortinet, VMware Products

Cisco, Fortinet, and VMware have released security fixes for multiple security vulnerabilities, including critical weaknesses that could be exploited to perform arbitrary actions on affected devices. The first set from Cisco consists of three flaws – CVE-2024-20252 and CVE-2024-20254 (CVSS score: 9.6) and CVE-2024-20255 (CVSS score: 8.2) – impacting Cisco Expressway Series that could allow an

---

3 million smart toothbrushes were not used in a DDoS attack after all, but it could happen

[UPDATED] What's next, malware-infected dental floss? But seriously: It's a reminder that even the smallest smart home devices can be a threat. Here's how to protect yourself.

---

3 million smart toothbrushes were just used in a DDoS attack. Or were they?

[UPDATED] What's next, malware-infected dental floss? But seriously: It's a reminder that even the smallest smart home devices can be a threat. Here's how to protect yourself.

---

NCSC and partners issue warning about state-sponsored cyber attackers hiding on critical infrastructure networks

GCHQ’s National Cyber Security Centre and partners share details of how threat actors are using built-in tools to camouflage themselves on victims’ systems.

---

NCSC and partners issue warning about state sponsored cyber attackers hiding on critical infrastructure networks

GCHQ’s National Cyber Security Centre and partners share details of how threat actors are using built-in tools to camouflage themselves on victims’ systems.

---

Malware-as-a-Service Now the Top Threat to Organizations

Malware-as-a-Service (MaaS) infections and Ransomware-as-a-Service (RaaS) attacks were the predominant cybersecurity threats in the second half of 2023, posing a significant danger to organizations, according to a new Darktrace report.

---

From Cybercrime Saul Goodman to the Russian GRU

In 2021, the exclusive Russian cybercrime forum Mazafaka was hacked. The leaked user database shows one of the forum's founders was an attorney who advised Russia's top hackers on the legal risks of their work, and what to do if they got caught. A review of this user's hacker identities shows that during his time on the forums he served as an officer in the special forces of the GRU, the foreign military intelligence agency of the Russian Federation.

---

Medical Center Fined $4.75M in Insider ID Theft Incident

The incident revealed data security failures and led to a corrective action plan, including a thorough security risk analysis and implementation of audit controls, to address vulnerabilities and improve patient information protection.

---

Report: Two Million Brits Victims of Financial Identity Fraud

Nearly two million people in the UK may have had their identity stolen and used by fraudsters to open a financial account in 2023, according to FICO’s new Fraud, Identity and Digital Banking Report.

---

Critical Shim Bug Impacts Every Linux Bootloader Signed in the Past Decade

The maintainers of 'shim' released version 15.8 to address six vulnerabilities, with the most critical one (CVE-2023-40547) potentially leading to remote code execution and Secure Boot bypass.

---

Are Cybersecurity Performance Measures Realistic?

The GAO urged the White House to establish performance measures for federal cybersecurity initiatives, but the ONCD pushed back, citing the difficulty of developing outcome-oriented measures and estimating implementation costs.

---

Critical Bugs in Canon Printers Allow Code Execution, DDoS

Canon has patched critical buffer-overflow bugs in its printers that could allow attackers to remotely perform denial of service or execute arbitrary code, emphasizing the importance of promptly updating firmware.

---

After FBI Takedown, KV-Botnet Operators Shift Tactics in Attempt to Bounce Back

The threat actors behind the KV-botnet made "behavioral changes" to the malicious network as U.S. law enforcement began issuing commands to neutralize the activity. KV-botnet is the name given to a network of compromised small office and home office (SOHO) routers and firewall devices across the world, with one specific cluster acting as a covert data transfer system for other Chinese

---

Three Ways to Achieve Crypto Agility in a Post-Quantum World

Crypto agility, including the ability to rapidly switch between certificate authorities and encryption standards, is essential for securing digital infrastructure in today's automated operational environment.

---

Google Open Sources AI-Boosted Fuzzing Framework

The framework has successfully identified vulnerabilities in C/C++ projects, including two in cJSON and libplist, which might have remained undiscovered without the use of large language models.

---

New Vulnerabilities in Azure HDInsight Could Have Led to Privilege Escalations and Denial of Service

These vulnerabilities could have allowed attackers to gain cluster administrator privileges, disrupt operations, and negatively impact the availability and reliability of the affected systems.