Latest Cybersecurity News and Articles

---

Surveilling your employees? You could be putting your company at risk of attack

Even though these tools can provide what appear to be helpful insights to organizations, there are major downsides. The first – and the reason many companies choose not to use it – is that most employees aren’t fond of it.

---

War crimes committed through cyberspace must not escape international justice, says Estonian president

The International Criminal Court should not allow those who commit war crimes or crimes against humanity in cyberspace to escape international justice, said President of Estonia Alar Karis at a conference on cyber conflict last week.

---

Update: Clop ransomware claims responsibility for MOVEit extortion attacks

While Clop would not share the number of organizations breached in the MOVEit Transfer attacks, they said that victims would be displayed on their data leak site if a ransom was not paid.

---

Microsoft Sets Aside $425M for Anticipated GDPR Fine

Microsoft is warning investors it may receive a fine from European privacy regulators adding up to at least hundreds of millions of dollars over targeted advertising on its LinkedIn social network.

---

KeePass fixed the bug that allows the extraction of the cleartext master password

KeePass has addressed the CVE-2023-32784 vulnerability, which allowed the retrieval of the clear-text master password from the client’s memory. The company fixed the bug with the release of KeePass version 2.54.

---

Cyclops Ransomware Gang Offers Go-Based Info Stealer to Cybercriminals

Threat actors associated with the Cyclops ransomware have been observed offering an information stealer malware that's designed to capture sensitive data from infected hosts. "The threat actor behind this [ransomware-as-a-service] promotes its offering on forums," Uptycs said in a new report. "There it requests a share of profits from those engaging in malicious activities using its malware."

---

Chinese PostalFurious Gang Strikes UAE Users with Sneaky SMS Phishing Scheme

A Chinese-speaking phishing gang dubbed PostalFurious has been linked to a new SMS campaign that's targeting users in the U.A.E. by masquerading as postal services and toll operators, per Group-IB. The fraudulent scheme entails sending users bogus text messages asking them to pay a vehicle trip fee to avoid additional fines. The messages also contain a shortened URL to conceal the actual

---

Zyxel Firewalls Under Attack! Urgent Patching Required

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday placed two recently disclosed flaws in Zyxel firewalls to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation. The vulnerabilities, tracked as CVE-2023-33009 and CVE-2023-33010, are buffer overflow vulnerabilities that could enable an unauthenticated attacker to cause a

---

49% of organizations proactively invest in identity protection

A new report reveals that 89% of businesses are somewhat or very concerned that new privacy regulations will impact identity security at their organization.

---

Security leaders plan for changing IT roles

IT professionals find themselves in hybrid roles that combine traditional development with tasks formerly associated with operations professionals.

---

Scrubs & Beyond Leaks 400GB of User PII and Card Data in Plain Text

The database was exposed on May 16, 2023. Researchers identified the exposure on May 25, 2023, and since then, the information has remained exposed. Currently, the server holds over 100,000 customer records, totaling 400 GB in size.

---

66% of organizations have increased their investment in SaaS apps

According to a survey, 58% of organizations estimate their current SaaS security solutions only cover 50% or less of their SaaS applications.

---

Windows 11 to require SMB signing to prevent NTLM relay attacks

Microsoft says SMB signing (aka security signatures) will be required by default for all connections to defend against NTLM relay attacks, starting with today's Windows build (Enterprise edition) rolling out to Insiders in the Canary Channel.

---

Gigabyte Rolls Out BIOS Updates to Remove Backdoor From Motherboards

The issue, disclosed last week by firmware and hardware security company Eclypsium, is that the firmware of more than 270 Gigabyte motherboards drops a Windows binary that is executed at boot-up to fetch and execute a payload from Gigabyte’s servers.

---

Online sellers targeted by new information-stealing malware campaign

Online sellers are being targeted in a new campaign launched this week to push the Vidar information-stealing malware, allowing threat actors to steal credentials for more damaging attacks.

---

Australian cyber-op attacked ISIL with zero-click exploit

The documentary, BREAKING the CODE: Cyber Secrets Revealed, reveals that the Australian Signals Directorate developed three payloads it could deploy to ISIL fighters' smartphones and PCs "without ISIL having to interact with the device in any way."

---

Update: Ransomware Group Used MOVEit Exploit to Steal Data From Dozens of Organizations

Mandiant has attributed the attack to UNC4857, a new threat cluster, and named the delivered webshell LemurLoot. Microsoft, on the other hand, is confident that the threat actor behind the Cl0p ransomware is responsible for the attack.

---

A new wave of sophisticated digital fraud hits Europe

Forced verification and deepfake cases multiply at alarming rates in the UK and continental Europe, according to Sumsub. In Germany alone, forced verification grew by 1500% as a proportion of all fraud cases to 5% of all fraud in Q1 2023.

---

Brazilian Cybercriminals Using LOLBaS and CMD Scripts to Drain Bank Accounts

The attack chain primarily leverages social engineering, banking on Portuguese and Spanish emails containing tax- or traffic violation-themed lures to trigger the infections and gain unauthorized access to victims' systems.

---

Zyxel published guidance for protecting devices from ongoing attacks

Zyxel has published guidance for protecting firewall and VPN devices from ongoing attacks exploiting the CVE-2023-28771, CVE-2023-33009, and CVE-2023-33010 vulnerabilities.