Latest Cybersecurity News and Articles

---

Researchers Discover Reply URL Takeover Flaw in Azure

Security researchers are urging Azure Active Directory (AD) users to monitor for abandoned reply URLs after revealing a critical vulnerability in the Microsoft Power Platform.

---

Polish Authorities Investigate Hacking Attack on Local Railways

The attack took place on Saturday. Threat actors transmitted a signal triggering an emergency status that stopped the trains near the city of Szczecin. According to the media, the attack stopped at least 20 trains and paralyzed the traffic for hours.

---

Leaked LockBit 3.0 Ransomware Builder Used by Multiple Actors

Lockbit v3, aka Lockbit Black, was detected in June 2022, but in September 2022 a builder for this variant was leaked online. The availability of the builder allowed anyone to create their own customized version of the ransomware.

---

KmsdBot Malware Gets an Upgrade: Now Targets IoT Devices with Enhanced Capabilities

"The binary now includes support for Telnet scanning and support for more CPU architectures," Akamai security researcher Larry W. Cashdollar said in an analysis published this month.

---

KmsdBot Malware Gets an Upgrade: Now Targets IoT Devices with Enhanced Capabilities

An updated version of a botnet malware called KmsdBot is now targeting Internet of Things (IoT) devices, simultaneously branching out its capabilities and the attack surface. "The binary now includes support for Telnet scanning and support for more CPU architectures," Akamai security researcher Larry W. Cashdollar said in an analysis published this month. The latest iteration,

---

Lazarus Exploits ManageEngine to Deploy QuiteRAT

The Lazarus group was associated with a new campaign against healthcare entities in Europe and the U.S. In this campaign, the attackers exploited a ManageEngine ServiceDesk vulnerability (CVE-2022-47966) to distribute the QuiteRAT malware. The malware has many capabilities similar to MagicRAT, another malware from the Lazarus group.

---

Met police on high alert after ‘staggering IT security’ breach

Potential leaked data from system with access to names, ranks and photos of officers could do ‘incalculable damage in the wrong hands’The Metropolitan police is on high alert after a security breach involving the IT system of one of its suppliers, the force said.Scotland Yard is working with the company to understand the scale of the incident but said on Saturday evening that any leaked data could do “incalculable damage” in the wrong hands. Continue reading...

---

LockBit 3.0 Ransomware Builder Leak Gives Rise to Hundreds of New Variants

The leak of the LockBit 3.0 ransomware builder last year has led to threat actors abusing the tool to spawn new variants. Russian cybersecurity company Kaspersky said it detected a ransomware intrusion that deployed a version of LockBit but with a markedly different ransom demand procedure. "The attacker behind this incident decided to use a different ransom note with a headline related to a

---

UK: Teens Found Responsible for Lapsus$ Cyberattacks

Arion Kurtaj, 18, was deemed by psychiatrists to be unfit to stand trial. Though he could not be found “guilty” of committing the acts with criminal intent, a jury at Southwark Crown Court determined that he was at least the one who carried them out.

---

UnitedHealthcare Fined $80K for Six-Month Records Access Delay

The HHS' Office for Civil Rights said UnitedHealthcare had agreed to settle a case involving potential HIPAA violations related to allegations that the company took six months to fulfill a health plan member's request to access his PHI.

---

The Three Malware Loaders Behind 80% of Incidents

QakBot, SocGholish, and Raspberry Robin are the most prevalent malware loaders causing havoc for security teams, with QakBot being the most versatile and persistent threat.

---

DOJ Charged Tornado Cash Founders With Laundering More Than $1 Billion

The duo operated the Tornado Cash cryptocurrency mixer that facilitated more than $1 billion in money laundering transactions and laundered hundreds of millions of dollars for the Lazarus APT group.

---

Adversary On The Defense: ANTIBOT.PW

The Antibot web traffic filtering service, originally a GitHub project, has evolved into a commercial platform for malicious actors, offering features like cloaking to evade analysis and prolong phishing and malware campaigns.

---

Malwarebytes Announces Acquisition of Online Privacy Company Cyrus

This strategic acquisition reinforces Malwarebytes' commitment to privacy by giving users more control over their information, no matter where or how they choose to browse and interact online.

---

Update: Prospect Medical Stolen Data Listed for Sale by Emerging Ransomware Group

The Rhysida ransomware group claimed responsibility for a ransomware attack against Prospect Medical Holdings that forced multiple hospital closures earlier this month and continues to impact operations.

---

Cypago Raises $13 Million for GRC Automation Platform

The new investment will allow Cypago to expand its research and development, product, and go-to-market teams, and grow its presence in the North American and European markets.

---

Thousands of SSNs Leaked After Ransomware Attack on Ohio State Archive Organization

One of the oldest historical societies in the state of Ohio was hit with a ransomware attack that leaked the sensitive information of thousands, according to a statement the organization released this week.

---

Update: Discord Notifies Users of Data Breach Impacting 180 Accounts

The breach, which was publicly acknowledged by Discord in May 2023, impacted a total of 180 accounts, according to a data breach notification filed with the Office of the Maine Attorney General.

---

Kroll Suffers Data Breach: Employee Falls Victim to SIM Swapping Attack

Risk and financial advisory solutions provider Kroll on Friday disclosed that one of its employees fell victim to a "highly sophisticated" SIM swapping attack. The incident, which took place on August 19, 2023, targeted the employee's T-Mobile account, the company said. "Specifically, T-Mobile, without any authority from or contact with Kroll or its employee, transferred that employee's phone

---

There was a 387% increase in attack activity from Q1 to Q2 2023

Global Distributed Denial of Service (DDoS) attacks during the first half of 2023 were analyzed in a recent report by Zayo Group Holdings.