Latest Cybersecurity News and Articles

---

The significance of CIS Control mapping in the 2023 Verizon DBIR

The mapping of CIS Controls to Verizon’s incident classifications presents organizations with an opportunity to optimize their security resources by aligning them with real-world security incidents.

---

Hackers Exploiting Critical Vulnerability in VMware's Aria Operations Networks

The flaw, tracked as CVE-2023-20887, could allow a malicious actor with network access to the product to perform a command injection attack, resulting in remote code execution.

---

New Sophisticated Toolkit Abuses macOS Systems

Researchers stumbled across a collection of malicious artifacts, dubbed JokerSpy, which they believe to be components of an advanced toolkit specifically designed to target Apple macOS systems. Based on the above and that multiple files were missing from the victim system, the researchers suspect that the malicious artifacts are part of a more intricate attack.

---

New Condi Malware Hijacking TP-Link Wi-Fi Routers for DDoS Botnet Attacks

A new malware called Condi has been observed exploiting a security vulnerability in TP-Link Archer AX21 (AX1800) Wi-Fi routers to rope the devices into a distributed denial-of-service (DDoS) botnet. Fortinet FortiGuard Labs said the campaign has ramped up since the end of May 2023. Condi is the work of a threat actor who goes by the online alias zxcr9999 on Telegram and runs a Telegram channel

---

Alert! Hackers Exploiting Critical Vulnerability in VMware's Aria Operations Networks

VMware has flagged that a recently patched critical command injection vulnerability in Aria Operations for Networks (formerly vRealize Network Insight) has come under active exploitation in the wild. The flaw, tracked as CVE-2023-20887, could allow a malicious actor with network access to the product to perform a command injection attack, resulting in remote code execution. It impacts VMware

---

Philadelphia healthcare facility suffers ransomware attack

Philadelphia healthcare facility Vincera has issued a notice following a ransomware attack in April of 2023 that compromised patient data.

---

Researchers Expose New Severe Flaws in Wago and Schneider Electric OT Products

Three security vulnerabilities have been disclosed in operational technology (OT) products from Wago and Schneider Electric. The flaws, per Forescout, are part of a broader set of shortcomings collectively called OT:ICEFALL, which now comprises a total of 61 issues spanning 13 different vendors. "OT:ICEFALL demonstrates the need for tighter scrutiny of, and improvements to, processes related to

---

Microsoft fixes Azure AD auth flaw enabling account takeover

Microsoft has addressed an Azure Active Directory (Azure AD) authentication flaw that could allow threat actors to escalate privileges and potentially fully take over the target's account.

---

Untrained users are biggest flaw in organizations’ cyber defense layer

A recent report reveals that 33.1% of employees are likely to click on a suspicious link or comply with a fraudulent request. 

---

OT:Icefall: Vulnerabilities Identified in Wago Controllers

The flaws were identified as part of the OT:Icefall research that has led to the public disclosure of 61 vulnerabilities impacting more than 100 OT products from 13 vendors.

---

Compromised Linux SSH servers engage in DDoS attacks, cryptomining

A threat actor is mounting dictionary attacks to log into Linux servers with SSH installed and saddle the server with the Tsunami and ShellBot DDoS bots, the XMRig CoinMiner program, and Log Cleaner – a tool for deleting and modifying logs.

---

Experts Uncover Year-Long Cyberattack on IT Firm Utilizing Custom Malware RDStealer

"The operation was active for more than a year with the end goal of compromising credentials and data exfiltration," Bitdefender security researcher Victor Vrabie said in a technical report shared with The Hacker News.

---

Vulnerable information is discovered within minutes by cybercriminals

Cybercriminal habits were analyzed in a recent report by Orca Security that reveals that attackers typically find exposed secrets in two minutes.

---

Phishing scam takes $950k from DoorDash drivers

The scam involved placing bogus orders, contacting drivers claiming to be from the DoorDash support team, and convincing them to hand over banking details or log in to a fake portal.

---

55% of employees solely use mobile device for work while traveling

Bring your own device (BYOD) policies have become difficult for IT teams to monitor, especially during increased travel in summer months.

---

Inside of the WASP's nest: deep dive into PyPI-hosted malware

Virustotal experts identified a number of specific PyPI-based malware campaigns, including Discord Token Grabber V2, Hazard Token Grabber V2, Chromium Stealer, and W4SP Stealer (with Hyperion obfuscator).

---

Iowa’s Largest School District Confirms Ransomware Attack, Data Theft

Following the January ransomware attack, the school district canceled all classes for several days starting January 10, after internet and network services were also taken offline during the incident's investigation.

---

Western Digital Blocks Unpatched Devices From Cloud Services

The move, which began on June 15, comes one month after the company released firmware updates for its My Cloud product line to address multiple security defects, including a critical path traversal bug that leads to remote code execution (RCE).

---

Federal Authority Warns Health Sector of TimisoaraHackerTeam Threats

Federal authorities are warning the healthcare sector of an apparent resurgence of TimisoaraHackerTeam threats after a recent attack by the "obscure" ransomware group on a U.S. cancer center.

---

Illinois hospital attributes closure to ransomware attack

In what seems to be the first announcement of its kind, two rural healthcare facilities closed last week citing a ransomware attack as part of the reasons why.