Latest Cybersecurity News and Articles

---

MavenGate Attack Could Let Hackers Hijack Java and Android via Abandoned Libraries

The attack method involves exploiting vulnerabilities in default build configurations and targeting abandoned libraries in public repositories through domain name purchases, making it difficult to detect and prevent.

---

SEC Says X Account Hack was Due to SIM Swapping

The Securities and Exchange Commission (SEC) experienced an account takeover on Twitter due to a SIM swap attack, where the unauthorized party gained control of the SEC's cell phone number.

---

~40,000 Attacks in 3 Days: Critical Confluence RCE Under Active Exploitation

Malicious actors have begun to actively exploit a recently disclosed critical security flaw impacting Atlassian Confluence Data Center and Confluence Server, within three days of public disclosure. Tracked as CVE-2023-22527 (CVSS score: 10.0), the vulnerability impacts out-of-date versions of the software, allowing unauthenticated attackers to achieve remote code execution on susceptible

---

New Chae$ 4.1 Malware Hides in Driver Downloads

The infection chain begins with deceptive emails and websites, ultimately leading to the activation of the Chae$ 4.1 malware, highlighting the importance of cautious online behavior.

---

Australia Sanctions Russian it Says Hacked Health Insurer

Australia has used its significant cyber incidents sanctions regime for the first time against a Russian individual named Aleksandr Gennadievich Ermakov, who is linked to the 2022 cyber attack on health insurer Medibank Private.

---

Info Stealing Packages Hidden in PyPI

Malicious Python packages on PyPI, such as nigpal, figflix, and seGMM, have been identified, with payloads designed to steal sensitive information from victims' devices, particularly targeting Windows users.

---

Thai Court Blocks 9near.org to Avoid Exposure of 55M Citizens

The Criminal Court in Thailand has ordered the blocking of the website 9near.org, which claimed to have accessed the personal information of 55 million Thai citizens from vaccine registration records.

---

Bulletproof Hosting: A Critical Cybercriminal Service

Bulletproof hosting (BPH) providers operate in a complex and persistent manner, making it challenging for defenders to permanently shut them down. Blocking BPH providers can effectively disrupt malicious activities early in the kill chain.

---

Outlook Vulnerability Discovery and New Ways to Leak NTLM Hashes

Attackers can use stolen NTLM v2 hashes for offline brute-force attacks or authentication relay attacks, potentially compromising user accounts and gaining unauthorized access.

---

Update: Hackers Start Exploiting Critical Atlassian Confluence RCE Flaw

Organizations with outdated Confluence instances should treat them as potentially compromised, look for signs of exploitation, perform a thorough cleanup, and update to a safe version to mitigate the risk.

---

The 2 am call: Preparing for a government cyberattack

Fremont County suffered a cyberattack in 2022 that took pieces of the county's law enforcement's systems offline, including communications.

---

Apple Issues Patch for Critical Zero-Day in iPhones, Macs - Update Now

Apple on Monday released security updates for iOS, iPadOS, macOS, tvOS, and Safari web browser to address a zero-day flaw that has come under active exploitation in the wild. The issue, tracked as CVE-2024-23222, is a type confusion bug that could be exploited by a threat actor to achieve arbitrary code execution when processing maliciously crafted web content. The tech giant said the problem

---

Cyberattack attempts increased 104% in 2023

According to a recent cybersecurity report by Armis, geopolitical issues are affecting the cybersecurity landscape, including increased cyberattacks.

---

North Korean Hackers Weaponize Fake Research to Deliver RokRAT Backdoor

Media organizations and high-profile experts in North Korean affairs have been at the receiving end of a new campaign orchestrated by a threat actor known as ScarCruft in December 2023. "ScarCruft has been experimenting with new infection chains, including the use of a technical threat research report as a decoy, likely targeting consumers of threat intelligence like cybersecurity

---

MavenGate Attack Could Let Hackers Hijack Java and Android via Abandoned Libraries

Several public and popular libraries abandoned but still used in Java and Android applications have been found susceptible to a new software supply chain attack method called MavenGate. "Access to projects can be hijacked through domain name purchases and since most default build configurations are vulnerable, it would be difficult or even impossible to know whether an attack was being performed

---

DDoS Barrage Hits Monobank, Ukraine’s Largest Mobile Bank, in Unprecedented Attack

A series of denial of service (DDoS) attacks hit Monobank, Ukraine's largest mobile-only bank, with the CEO confirming a staggering 580 million service requests during one attack.

---

Parrot TDS: A Persistent and Evolving Malware Campaign

The Parrot TDS consists of landing scripts and payload scripts, with the former profiling the victim's web browser and the latter directing the browser to malicious content.

---

DENHAM the Jeanmaker Confirms Cyberattack

The renowned denim brand DENHAM the Jeanmaker confirmed that it fell victim to a cyberattack by the Akira ransomware group, with the incident being discovered on December 27, 2023.

---

Zloader: No Longer Silent in the Night

The Zloader static configuration is now encrypted using RC4 with a hardcoded alphanumeric key, and the network encryption employs 1,024-bit RSA with RC4 and the Zeus "visual encryption" algorithms.

---

Cybercriminals Leaked Massive Volumes of Stolen PII Data From Thailand in Dark Web

Cybercriminals, including one known as Naraka, are targeting Thai e-commerce, fintech, and government bodies to obtain PII for fraudulent activities. The frequency of attacks has this year, with 14 significant data breaches reported in January alone.