Latest Cybersecurity News and Articles

---

NATO Investigates Alleged Cyberattack Affecting Some Unclassified Websites

NATO is currently investigating claims that data was stolen from its unclassified websites by the hacking group SiegedSec. The group allegedly stole 9 GB of data, including documents from various NATO portals.

---

San Francisco Metropolitan Transportation Commission Leaves 26,000 Files Publicly Accessible

A misconfiguration in the Metropolitan Transportation Commission (MTC) systems resulted in the exposure of over 26,000 files, including clients' home addresses and vehicle plate numbers.

---

Wing Disrupts the Market by Introducing Affordable SaaS Security

Today, mid-sized companies and their CISOs are struggling to handle the growing threat of SaaS security with limited manpower and tight budgets. Now, this may be changing. By focusing on the critical SaaS security needs of these companies, a new approach has emerged that can be launched for $1,500 a year. If the name Wing Security (Wing) rings a bell, it is probably because earlier this year,

---

Chinese APT41 Actors Target WeChat Users via Trojanized App Version

APT41, previously associated with web application attacks, has shifted its tactics to develop mobile-specific malware, including the DragonEgg and LightSpy surveillance malware, which share similar configuration patterns and runtime structures.

---

Predator Spyware Linked to Madagascar Government Ahead of Election

The Madagascar government likely used the Cytrox-developed Predator spyware to conduct political domestic surveillance ahead of the country’s presidential election, according to research by Sekoia.

---

EvilProxy Phishing Attack Targets Indeed

Menlo Labs discovered a July to August phishing campaign targeting executives in banking, insurance, real estate, and manufacturing, using the complex EvilProxy phishing kit. The campaign highlights the escalating threats that organizations face from threat actors due to the use of sophisticated tools and trusted platforms to hoodwink their targets.

---

Rogue npm Package Deploys Open-Source Rootkit in New Supply Chain Attack

A new deceptive package hidden within the npm package registry has been uncovered deploying an open-source rootkit called r77, marking the first time a rogue package has delivered rootkit functionality. The package in question is node-hide-console-windows, which mimics the legitimate npm package node-hide-console-window in what's an instance of a typosquatting campaign. It was downloaded 704

---

Wisconsin County Dealing With Ransomware Attack on Public Health Department

The Cuba ransomware gang claimed responsibility for the attack, with concerns raised about potential connections to the Russian state due to their history of targeting government systems in Ukraine and Montenegro.

---

EU Parliament Wants Journalists to Have Better Protections From Spyware

There are differing views between the European Parliament and the European Council regarding the level of protections for journalists from spyware, which will be subject to negotiations.

---

Microsoft Warns of Cyber Attacks Attempting to Breach Cloud via SQL Server Instance

Microsoft has detailed a new campaign in which attackers unsuccessfully attempted to move laterally to a cloud environment through a SQL Server instance. "The attackers initially exploited a SQL injection vulnerability in an application within the target's environment," security researchers Sunders Bruskin, Hagai Ran Kestenberg, and Fady Nasereldeen said in a Tuesday report. "This allowed the

---

Indiana Attorney General Sues Provider Over Violation of Consumer Protection, Privacy Laws

CarePointe, a medical provider in Indiana, is being sued by the state attorney general for allegedly being aware of security risks before a ransomware attack exposed the personal information of 45,000 patients.

---

C-Suite Leaders to Boost Cybersecurity Compliance Amid SEC Disclosure Rule: Deloitte

Almost two-thirds of executives at publicly traded companies plan to strengthen their cybersecurity programs in response to a new rule by the SEC that requires companies to report material cybersecurity incidents within four business days.

---

Ransomware Reinfections on the Rise From Improper Remediation

Ransomware attacks can have devastating financial and reputational consequences, with the potential to close down businesses, highlighting the importance of effective remediation and prevention strategies.

---

Don’t Let Zombie Zoom Links Drag You Down

Many organizations, including Fortune 500 firms, have exposed Zoom links that allow unauthorized individuals to initiate video conference meetings, posing a risk of phishing and social engineering attacks.

---

New ‘Looney Tunables’ Linux Bug Gives Root Privileges on Major Distros

The flaw, introduced in glibc 2.34, highlights the severity and widespread nature of the vulnerability, emphasizing the need for immediate patching by system administrators.

---

ShellTorch Vulnerabilities Put Organizations at Risk of Server Takeover

The vulnerabilities, collectively known as "ShellTorch," have been patched in the latest version of TorchServe (0.8.2), hence, developers are encouraged to update to ensure their systems are secure.

---

LightSpy Spyware Evolves to Add New Plugins for Data Exfiltration

LightSpy, associated with the Chinese APT41 group, was found to contain a Core implant and 14 plugins for data exfiltration, supporting 24 different commands. LightSpy's Core supports 24 different commands, including self and plugin updates, indicating a sophisticated and versatile threat actor behind it.

---

Looney Tunables: New Linux Flaw Enables Privilege Escalation on Major Distributions

A new Linux security vulnerability dubbed Looney Tunables has been discovered in the GNU C library's ld.so dynamic loader that, if successfully exploited, could lead to a local privilege escalation and allow a threat actor to gain root privileges. Tracked as CVE-2023-4911 (CVSS score: 7.8), the issue is a buffer overflow that resides in the dynamic loader's processing of the GLIBC_TUNABLES

---

Qualcomm Releases Patch for Three New Zero-Days Under Active Exploitation

"There are indications from Google Threat Analysis Group and Google Project Zero that CVE-2023-33106, CVE-2023-33107, CVE-2022-22071, and CVE-2023-33063 may be under limited, targeted exploitation," the semiconductor company said in an advisory.

---

Experts Discover Multiple Malicious npm Packages

Researchers at FortiGuard Labs uncovered nine sets of malicious NPM packages designed to steal sensitive data, including system information, user credentials, and source code. These malicious packages use install scripts to exfiltrate data to webhooks or file-sharing links. These npm packages highlight a significant and often overlooked threat within the open-source ecosystem.