Latest Cybersecurity News and Articles

---

Incomplete Disclosures by Apple and Google Create “Huge Blindspot” for Zero-Day Hunters

Google's limited disclosure and the separate CVE designations for the vulnerability by Apple, Google, and Citizen Lab have hindered the detection and patching of the critical vulnerability in other software relying on libwebp.

---

Average Insider Cyberthreat Cost Spikes 40% in Four Years: Report

Containment and remediation after an insider incident are the most expensive areas, with an average cost of $179,209 and $125,221 per incident respectively, and the average time to contain an incident has increased to 86 days.

---

Hong Kong-Based Cryptocurrency Firm Mixin Says Hackers Stole $200 Million in Assets

The incident follows a recent trend of cryptocurrency hacks, with North Korean hackers being suspected in multiple attacks, highlighting the growing threat posed by cybercriminals targeting the industry.

---

Nigerian Man Pleads Guilty to Attempted $6 Million BEC Email Heist

Kosi Goodness Simon-Ebo, a Nigerian national, pleaded guilty to wire fraud and money laundering through business email compromise (BEC) schemes, resulting in millions of dollars in losses.

---

Xenomorph Malware Returns to Strike Customers of Over 30 American Banks

The Xenomorph malware family, known for its advanced capabilities and distribution campaigns, has resurfaced with new overlays targeting institutions and crypto wallets in the United States and Portugal.

---

SANS Survey Shows Drop in 2023 ICS/OT Security Budgets

The budgets allocated for the security of industrial control systems (ICS) and operational technology (OT) have decreased in 2023 compared to the previous year, with over 21% of organizations reporting not having a cybersecurity budget at all.

---

Ukrainian Military Targeted in Phishing Campaign Leveraging Drone Manuals

Ukrainian military entities are the target of a phishing campaign that leverages drone manuals as lures to deliver a Go-based open-source post-exploitation toolkit called Merlin.

---

Tim Roemer hired as Chief Security Officer at Global Market Innovators

Tim Roemer has been hired as CSO at Global Market Innovators. Roemer previously served as the Director of the Arizona Department of Homeland Security.

---

CISA and NFL Collaborate to Secure Super Bowl LVIII

The US Cybersecurity and Infrastructure Security Agency (CISA) and the NFL conducted a cybersecurity tabletop exercise to assess and improve response capabilities for potential cyber-attacks during Super Bowl LVIII.

---

New Modular Deadglyph Backdoor Used in a Government Attack

Security researchers have identified a highly advanced modular backdoor, named Deadglyph, believed to be linked to the Stealth Falcon cyber espionage group. It was discovered during an investigation into a cyberespionage incident in the Middle East. Organizations are advised to leverage the IOCs associated with the malware to protect endpoints or networks vulnerable to attacks.

---

Python Malware Targets Tatar-Language Users: TA866 Threat Actor Strikes Again

The threat actor behind this campaign is the TA866 group, known for targeting Tatar language speakers. The attackers use phishing emails with a malicious RAR file that contains a video file and a Python-based executable disguised as an image file.

---

Ukrainian Military Targeted in Phishing Campaign Leveraging Drone Manuals

Ukrainian military entities are the target of a phishing campaign that leverages drone manuals as lures to deliver a Go-based open-source post-exploitation toolkit called Merlin. "Since drones or Unmanned Aerial Vehicles (UAVs) have been an integral tool used by the Ukrainian military, malware-laced lure files themed as UAVs service manuals have begun to surface," Securonix researchers Den

---

Cyber Insurance Claims Spiked in First Half of 2023 as Ransomware Attacks Surged: Report

Large companies with over $100 million in revenues have been particularly targeted, experiencing a rise in both the frequency and severity of cyber incidents. Funds transfer fraud has also become a prevalent issue.

---

EvilBamboo Targets Tibetans, Uyghurs, and Taiwanese People and Organizations

"The attacker has created fake Tibetan websites, along with social media profiles, likely used to deploy browser-based exploits against targeted users," Volexity security researchers said in a report published last week.

---

The transformative impact of cryptocurrency on digital fraud investigations

Cryptocurrency's rise has reshaped the landscape of digital fraud investigations, presenting new challenges and opportunities for enterprise security leaders.

---

NY College Forced to Invest $3.5 Million in Cybersecurity After Breach Affecting 200,000

New York state attorney general has reached an agreement with Marymount Manhattan College (MMC) following a data breach in 2021. The college will invest $3.5 million into cybersecurity to address the deficiencies exposed during the ransomware attack.

---

New BBTok Banking Trojan Versions Target 40 LATAM Banks

Check Point researchers have uncovered a new variant of the BBTok banking trojan, which focuses its attacks on users of more than 40 banks in Latin America, with a primary focus on Brazil and Mexico. The attack strategies differ between Windows 7 and Windows 10 systems. Banking organizations and individuals in the region are advised to stay cautious.

---

National Student Clearinghouse Discloses Data Breach Impacting 890 Schools

The data breach was caused by the Clop ransomware gang, who exploited a zero-day security flaw in the MOVEit Transfer platform and began extorting organizations that were targeted.

---

Watch the Webinar — AI vs. AI: Harnessing AI Defenses Against AI-Powered Risks

Generative AI is a double-edged sword, if there ever was one. There is broad agreement that tools like ChatGPT are unleashing waves of productivity across the business, from IT, to customer experience, to engineering. That's on the one hand.  On the other end of this fencing match: risk. From IP leakage and data privacy risks to the empowering of cybercriminals with AI tools, generative AI

---

Are You Willing to Pay the High Cost of Compromised Credentials?

Weak password policies leave organizations vulnerable to attacks. But are the standard password complexity requirements enough to secure them? 83% of compromised passwords would satisfy the password complexity and length requirements of compliance standards. That’s because bad actors already have access to billions of stolen credentials that can be used to compromise additional accounts by