Latest Cybersecurity News and Articles

---

Researchers Uncover SideWinder's Latest Server-Based Polymorphism Technique

The advanced persistent threat (APT) actor known as SideWinder has been accused of deploying a backdoor in attacks directed against Pakistan government organizations as part of a campaign that commenced in late November 2022. "In this campaign, the SideWinder advanced persistent threat (APT) group used a server-based polymorphism technique to deliver the next stage payload," the BlackBerry

---

Microsoft Warns of State-Sponsored Attacks Exploiting Critical PaperCut Vulnerability

Iranian nation-state groups have now joined financially motivated actors in actively exploiting a critical flaw in PaperCut print management software, Microsoft said. The tech giant's threat intelligence team said it observed both Mango Sandstorm (Mercury) and Mint Sandstorm (Phosphorus) weaponizing CVE-2023-27350 in their operations to achieve initial access. "This activity shows Mint

---

AndoryuBot – New Botnet Campaign Targets Ruckus Wireless Admin Remote Code Execution Vulnerability

This botnet, known as AndoryuBot, first appeared in February 2023. It contains DDoS attack modules for different protocols and communicates with its command-and-control server using SOCKS5 proxies.

---

Google Releases Open Source Bazel Plugin for Container Image Security

The new rules_oci plugin can use trusted third-party toolchains, does not require running a docker daemon already on the machine, and does not include language-specific rules.

---

FBI seizes 13 more domains linked to DDoS-for-hire services

This week's seizures are part of a coordinated international law enforcement effort (known as Operation PowerOFF) to disrupt online platforms allowing anyone to launch massive DDoS attacks against any target for the right amount of money.

---

NodeStealer: New Information-stealing Threat Terminated by Facebook

A new malware known as NodeStealer can extract sensitive information of Facebook users. This malware allows cybercriminals to take over accounts on the platform as well as Gmail and Outlook accounts by stealing browser cookies. Facebook's engineers spotted the NodeStealer malware first in late January and linked the attacks to Vietnamese threat actors.

---

New Ransomware Strain 'CACTUS' Exploits VPN Flaws to Infiltrate Networks

Cybersecurity researchers have shed light on a new ransomware strain called CACTUS that has been found to leverage known flaws in VPN appliances to obtain initial access to targeted networks. "Once inside the network, CACTUS actors attempt to enumerate local and network user accounts in addition to reachable endpoints before creating new user accounts and leveraging custom scripts to automate

---

UK and allies expose Snake malware threat from Russian cyber actors

Snake malware and its variants have been a core component in Russian operations carried out by Centre 16 of Russia’s Federal Security Service (FSB).

---

Massive cyber espionage operation uncovered in South Asia

EXECUTIVE SUMMARY: A vicious series of cyber attacks has targeted social media accounts belonging to individuals across South Asia. In this alarming set of incidents, hackers attempted to leverage fictitious Facebook and Instagram personas in order to execute espionage attempts, deliver malware and/or to steal information. But we’re still at the beginning of this story… […] The post Massive cyber espionage operation uncovered in South Asia appeared first on CyberTalk.

---

Microsoft: Iranian hacking groups join Papercut attack spree

"The PaperCut exploitation activity by Mint Sandstorm appears opportunistic, affecting organizations across sectors and geographies," the Microsoft Threat Intelligence team said.

---

HUB Security Raises Up to $16 Million in Growth Investment from The Lind Partners

This investment is expected to provide HUB Security with additional resources to fuel its rapid growth and development, enhance its financial stability, and enable the company to pursue its future plans.

---

Immuta Receives Investment from Databricks Ventures

Immuta, a Boston, MA-based leader in data security, received a strategic investment from Databricks Ventures, the investment arm of Databricks, a data and AI company and pioneer of the lakehouse. The amount of the deal was not disclosed.

---

68% work in a centralized IT model

A recent report by Torii found that 99% of IT professionals say they’re fulfilled in their jobs despite increasing SaaS spend concerns.

---

QR codes used in fake parking tickets, surveys to steal your money

As QR codes continue to be heavily used by legitimate organizations—from Super Bowl advertisements to enforcing parking fees and fines, scammers have crept in to abuse the very technology for their nefarious purposes.

---

Kenya: Kabarak University ICT Manager suspended as hackers table their demand

Kabarak University's Facebook account was seized by hackers who have been using it to spread malicious and misleading images and content that contravenes the institution’s Christian values and have since tabled their demands.

---

Cyberattack at Hong Kong healthcare group may have exposed 100,000 patients’ data

OT&P Healthcare CEO Robin Green on Monday said the cyberattack took place within the clinic’s management and operating system. “That system holds both patient identity and medical records. We have no idea … how much data was taken,” he said.

---

White House official says Counter Ransomware Initiative focused on ‘expanding the tent,’ with Jordan, Costa Rica, Colombia joining

According to White House Deputy National Security Adviser Anne Neuberger, there were more than 6,500 ransomware attacks across the globe between 2020 and 2022, prompting difficult discussions about ways to disrupt the ecosystem.

---

MSI Data Breach: Private Code Signing Keys Leaked on the Dark Web

The threat actors behind the ransomware attack on Taiwanese PC maker MSI last month have leaked the company's private code signing keys on their dark website. "Confirmed, Intel OEM private key leaked, causing an impact on the entire ecosystem," Alex Matrosov, founder and CEO of firmware security firm Binarly, said in a tweet over the weekend. "It appears that Intel Boot Guard may not be

---

One Million Impacted by Data Breach at NextGen Healthcare

Headquartered in Atlanta, Georgia, the company makes and sells electronic health records software and provides doctors and medical professionals with practice management services.

---

SideCopy Using Action RAT and AllaKore RAT to Infiltrate Indian Organizations

The suspected Pakistan-aligned threat actor known as SideCopy has been observed leveraging themes related to the Indian military research organization as part of an ongoing phishing campaign.