Latest Cybersecurity News and Articles

---

Web Control, Crime Patrol or Real Pawns in Cybercrime

A group of young employees in Hyderabad ran a sophisticated scam using VOIP to target unsuspecting people in the U.S. and trick them into buying gift cards, which were then converted into cryptocurrency and Indian Rupees.

---

Study finds increase in cybersecurity attacks fueled by generative AI

A new report analyzes stressors caused by generative AI, with 51% of security professionals saying they are likely to leave their job over the next year.

---

Spainish Police Warns of LockBit Locker Ransomware Phishing Attacks

"A wave of sending emails to architecture companies has been detected, although it is not ruled out that they extend their action to other sectors," reads the machine-translated police announcement.

---

Survey Provides Takeaways for Security Pros to Operationalize their Remediation Life Cycle

Ask any security professional and they’ll tell you that remediating risks from various siloed security scanning tools requires a tedious and labor-intensive series of steps focused on deduplication, prioritization, and routing of issues to an appropriate “fixer” somewhere in the organization. This burden on already resource-strapped security teams is an efficiency killer.  A new study,

---

IT Leaders Alarmed by Generative Ai’s SAAS Security Implications

IT leaders are grappling with anxiety over the risks of generative AI despite continued confidence in their software-as-a-service (SaaS) security posture, according to Snow Software.

---

Global Cybercrime Treaty Could be ‘Disastrous for Human Rights,’ NGOs Warn

Human rights organizations are sounding alarm about a United Nations cybercrime treaty being negotiated this week in New York, warning that the rules could expand government surveillance powers and give dictatorships further tools of repression.

---

Phishing-as-a-Service Gets Smarter: Microsoft Sounds Alarm on AiTM Attacks

Microsoft is warning of an increase in adversary-in-the-middle (AiTM) phishing techniques, which are being propagated as part of the phishing-as-a-service (PhaaS) cybercrime model.

---

Privacy Regulators Tell Social Media Companies to Fear the Scrapers

Social media companies and other businesses have an obligation to protect users’ publicly available information from data scrapers that gather it for unintended purposes, an international group of privacy regulators said last week.

---

Japan's JPCERT Warns of New 'MalDoc in PDF' Attack Technique

Japan’s computer emergency response team (JPCERT) has recently observed a new attack technique, called ‘MalDoc in PDF’, that bypasses detection by embedding a malicious Word file into a PDF file.

---

Citrix NetScaler Alert: Ransomware Hackers Exploiting Critical Vulnerability

Unpatched Citrix NetScaler systems exposed to the internet are being targeted by unknown threat actors in what's suspected to be a ransomware attack. Cybersecurity company Sophos is tracking the activity cluster under the moniker STAC4663. Attack chains involve the exploitation of CVE-2023-3519, a critical code injection vulnerability impacting NetScaler ADC and Gateway servers that could

---

Corporate Boards Expand Cybersecurity Risk Oversight, Report Finds

With new Securities and Exchange Commission disclosure rules set to take effect in early September, a study from the EY Center for Board Matters shows director oversight of cybersecurity at Fortune 100 companies is rapidly evolving.

---

New TZW Ransomware Unlocked; Belongs to Adhubllka Family

Security researchers at Netenrich laid bare a previously misclassified strain of ransomware, TZW, as part of the Adhubllka ransomware family. Unlike other high-profile ransomware campaigns, TZW targets individuals and small businesses, demanding small ransoms ranging from $800 to $1,600. This study underscores how ransomware is intricately designed to confuse those seeking to counter cybercriminals.

---

Attackers can Discover IP Addresses by Sending Links Over the Skype Mobile App

A security researcher discovered that it's possible to discover a target’s IP address by sending a link over the Skype mobile app. The researcher pointed out that the attack only requires the target to open the message.

---

Update: Two Men Arrested Following Poland Railway Hacking

Polish police on Sunday arrested two men suspected of illegally hacking into the national railway’s communications network, which destabilized traffic in some areas of the country this weekend.

---

Cyber Info-Sharing Guide for Healthcare Sector Updated

Public-private cybersecurity councils urged the healthcare industry to be more expansive in sharing signs of hacking, warning that traditional indicators aren't enough to defend against modern cybersecurity threats.

---

Ransomware Attack Cleanup Costs: $10M So Far for Rackspace

The San Antonio, Texas, company's multi-million expenditure includes "costs to investigate and remediate, legal and other professional services, and supplemental staff resources that were deployed to provide support to customers."

---

Attacks on Citrix NetScaler Systems Linked to Ransomware Actor

A threat actor believed to be tied to the FIN8 hacking group exploits the CVE-2023-3519 remote code execution flaw to compromise unpatched Citrix NetScaler systems in domain-wide attacks.

---

Cybercriminals Used Just Three Malware Loaders to Launch 80% of Attacks, Deets Inside

ReliaQuest has identified the top malware loaders that have been causing trouble for SOC teams. These loaders are often used by threat actors to gain initial access to a network and drop payloads for further exploitation. The top seven most observed malware loaders from January 1 to July 31, 2023, include QakBot, SocGholish, Raspberry Robin, Gootloader, Guloader, Chromeloader, and Ursnif.

---

Phishing-as-a-Service Gets Smarter: Microsoft Sounds Alarm on AiTM Attacks

Microsoft is warning of an increase in adversary-in-the-middle (AiTM) phishing techniques, which are being propagated as part of the phishing-as-a-service (PhaaS) cybercrime model. In addition to an uptick in AiTM-capable PhaaS platforms, the tech giant noted that existing phishing services like PerSwaysion are incorporating AiTM capabilities. "This development in the PhaaS ecosystem enables

---

Gregory Thompson appointed as first CISO at Vantage Data Centers

Gregory Thompson has been appointed as Chief Information Security Officer at Vantage Data Centers. Thompson is the first CISO at the company.