Cybersecurity
- Fake North Korean IT Worker Linked to BeaverTail Video Conference App Phishing Attackunit42.paloaltonetworks.com Fake North Korean IT Worker Linked to BeaverTail Video Conference App Phishing Attack
North Korean IT worker cluster CL-STA-0237 instigated phishing attacks via video apps in Laos, exploiting U.S. IT firms and major tech identities. North Korean IT worker cluster CL-STA-0237 instigated phishing attacks via video apps in Laos, exploiting U.S. IT firms and major tech identities.
- Joint Statement from FBI and CISA on the People's Republic of China (PRC) Targeting of Commercial Telecommunications Infrastructure
> we have identified that PRC-affiliated actors have compromised networks at multiple telecommunications companies to enable the theft of customer call records data, the compromise of private communications of a limited number of individuals who are primarily involved in government or political activity, and the copying of certain information that was subject to U.S. law enforcement requests pursuant to court orders. We expect our understanding of these compromises to grow as the investigation continues.
- Inside Intelligence Center: Financially Motivated Chinese Threat Actor SilkSpecter Targeting Black Friday Shoppersblog.eclecticiq.com Inside Intelligence Center: Financially Motivated Chinese Threat Actor SilkSpecter Targeting Black Friday Shoppers
Chinese threat actor SilkSpecter targets Black Friday shoppers with phishing campaigns, exploiting legitimate services to steal sensitive data.
- Simple Include Statement Hides Casino Spamblog.sucuri.net Simple Include Statement Hides Casino Spam
Learn about a WordPress malware attack where a stealthy include statement concealed casino spam links above the webroot.
- Malware being delivered by mail, warns Swiss cyber agencytherecord.media Malware being delivered by mail, warns Swiss cyber agency
The postal letters, dated to 12 November, claim to be offering people in the country a new weather app developed by the country's meteorological agency, however they contain a QR code redirecting people to a malicious application developed by fraudsters.
- Advertisers are pushing ad and pop-up blockers using old trickswww.malwarebytes.com Advertisers are pushing ad and pop-up blockers using old tricks | Malwarebytes
A malvertising campaign using an old school trick was found pushing to different ad blockers.
- Hungary confirms hack of defense procurement agencytherecord.media Hungary confirms hack of defense procurement agency
Hungarian officials said the network of the NATO ally's defense procurement agency had been hacked. A ransomware gang had claimed earlier that it stole data from the agency.
- NIST says exploited vulnerability backlog cleared but end-of-year goal for full list unlikelytherecord.media NIST says exploited vulnerability backlog cleared but end-of-year goal for full list unlikely
The National Institute of Standards and Technology has faced criticism since it became clear that thousands of critical vulnerabilities were not being analyzed or enriched.
- Embargo ransomware claims breach of US pharmacy networkwww.theregister.com Embargo ransomware claims breach of US pharmacy network
American Associated Pharmacies yet to officially confirm infection
- Evaluating Synthetic Command Attacks on Smart Voice Assistants
> Recent advances in voice synthesis, coupled with the ease with which speech can be harvested for millions of people, introduce new threats to applications that are enabled by devices such as voice assistants (e.g., Amazon Alexa, Google Home etc.). We explore if unrelated and limited amount of speech from a target can be used to synthesize commands for a voice assistant like Amazon Alexa. More specifically, we investigate attacks on voice assistants with synthetic commands when they match command sources to authorized users, and applications (e.g., Alexa Skills) process commands only when their source is an authorized user with a chosen confidence level. We demonstrate that even simple concatenative speech synthesis can be used by an attacker to command voice assistants to perform sensitive operations. We also show that such attacks, when launched by exploiting compromised devices in the vicinity of voice assistants, can have relatively small host and network footprint. Our results demonstrate the need for better defenses against synthetic malicious commands that could target voice assistants.
- Strela Stealer: Today's invoice is tomorrow's phishsecurityintelligence.com Strela Stealer: Today's invoice is tomorrow's phish
IBM X-Force has been tracking ongoing Hive0145 campaigns delivering Strela Stealer malware for over a year. Learn more about the malware, the techniques for spreading it, and how to protect against it.
- New PXA Stealer targets government and education sectors for sensitive informationblog.talosintelligence.com New PXA Stealer targets government and education sectors for sensitive information
Cisco Talos discovered a new information stealing campaign operated by a Vietnamese-speaking threat actor targeting government and education entities in Europe and Asia.
> - Cisco Talos discovered a new information stealing campaign operated by a Vietnamese-speaking threat actor targeting government and education entities in Europe and Asia. > - We discovered a new Python program called PXA Stealer that targets victims’ sensitive information, including credentials for various online accounts, VPN and FTP clients, financial information, browser cookies, and data from gaming software. > - PXA Stealer has the capability to decrypt the victim’s browser master password and uses it to steal the stored credentials of various online accounts. > - The attacker has used complex obfuscation techniques for the batch scripts used in this campaign. > - We discovered the attacker selling credentials and tools in the Telegram channel “Mua Bán Scan MINI,” which is where the CoralRaider adversary operates, but we are not sure if the attacker belongs to the CoralRaider threat group or another Vietnamese cybercrime group.
- Hive0145 Targets Europe with Advanced Strela Stealer Campaignswww.infosecurity-magazine.com Hive0145 Targets Europe with Advanced Strela Stealer Campaigns
Hive0145 is targeting Spain, Germany, Ukraine with Strela Stealer malware in invoice phishing tactic
- Global Companies Are Unknowingly Paying North Koreans: Here’s How to Catch Themunit42.paloaltonetworks.com Global Companies Are Unknowingly Paying North Koreans: Here’s How to Catch Them
We discuss North Korea's use of IT workers to infiltrate companies, detailing detection strategies like IT asset management and IP analysis to counter this. We discuss North Korea's use of IT workers to infiltrate companies, detailing detection strategies like IT asset management and IP analysis to ...
> Workers with allegiances to the Democratic People's Republic of Korea (DPRK) have been infiltrating organizations worldwide through a fraudulent remote work scheme. This operation not only violates international sanctions but also poses cybersecurity risks to unwitting employers.
- Russian Hackers Exploit New NTLM Flaw to Deploy RAT Malware via Phishing Emailsthehackernews.com Russian Hackers Exploit New NTLM Flaw to Deploy RAT Malware via Phishing Emails
Russian actors exploit NTLM flaw in attacks on Ukraine, patched by Microsoft this week
- New Zero-Detection Variant of Melofee Backdoor from Winnti Strikes RHEL 7.9blog.xlab.qianxin.com New Zero-Detection Variant of Melofee Backdoor from Winnti Strikes RHEL 7.9
Background On July 27, 2024, XLab's Cyber Threat Insight and Analysis System(CTIA) detected an ELF file named pskt from IP address 45.92.156.166. Currently undetected on VirusTotal, the file triggered two alerts: an Overlay section and a communication domain mimicking Microsoft. Our analysis ident...
- Police Freak Out at iPhones Mysteriously Rebooting Themselves, Locking Cops Outwww.404media.co Police Freak Out at iPhones Mysteriously Rebooting Themselves, Locking Cops Out
Law enforcement believe the activity, which makes it harder to then unlock the phones, may be due to a potential update in iOS 18 which tells nearby iPhones to reboot if they have not been in contact with a cellular network for some time, according to a document obtained by 404 Media.
- Abusing Ubuntu 24.04 features for root privilege escalationsnyk.io Abusing Ubuntu 24.04 features for root privilege escalation | Snyk
With the recent release of Ubuntu 24.04, we at Snyk Security Labs thought it would be interesting to examine the latest version of this Linux distribution to see if we could find any interesting privilege escalation vulnerabilities.
- SecEncoder: Logs are All You Need in Security
> Large and Small Language Models (LMs) are typically pretrained using extensive volumes of text, which are sourced from publicly accessible platforms such as Wikipedia, Book Corpus, or through web scraping. These models, due to their exposure to a wide range of language data, exhibit impressive generalization capabilities and can perform a multitude of tasks simultaneously. However, they often fall short when it comes to domain-specific tasks due to their broad training data. This paper introduces SecEncoder, a specialized small language model that is pretrained using security logs. SecEncoder is designed to address the domain-specific limitations of general LMs by focusing on the unique language and patterns found in security logs. Experimental results indicate that SecEncoder outperforms other LMs, such as BERTlarge, DeBERTa-v3-large and OpenAI's Embedding (textembedding-ada-002) models, which are pretrained mainly on natural language, across various tasks. Furthermore, although SecEncoder is primarily pretrained on log data, it outperforms models pretrained on natural language for a range of tasks beyond log analysis, such as incident prioritization and threat intelligence document retrieval. This suggests that domain specific pretraining with logs can significantly enhance the performance of LMs in security. These findings pave the way for future research into security-specific LMs and their potential applications.
- Iranian Hackers Use "Dream Job" Lures to Deploy SnailResin Malware in Aerospace Attacksthehackernews.com Iranian Hackers Use "Dream Job" Lures to Deploy SnailResin Malware in Aerospace Attacks
Iran's TA455 hackers target aerospace with fake jobs and SnailResin malware, emulating North Korean tactics.
- Visionaries Have Democratised Remote Network Access - Citrix Virtual Apps and Desktops (CVE Unknown)labs.watchtowr.com Visionaries Have Democratised Remote Network Access - Citrix Virtual Apps and Desktops (CVE Unknown)
Well, we’re back again, with yet another fresh-off-the-press bug chain (and associated Interactive Artifact Generator). This time, it’s in Citrix’s “Virtual Apps and Desktops” offering. This is a tech stack that enables end-users (and likely, your friendly neighbourhood ransomware gang) to access t...
- HawkEye Malware: Technical Analysisany.run HawkEye Malware: Technical Analysis - ANY.RUN's Cybersecurity Blog
Read a detailed technical analysis of the HawkEye keylogger malware to discover how it operates and learn about its key attack stages.
- ShrinkLocker (+Decryptor): From Friend to Foe, and Back Againwww.bitdefender.com ShrinkLocker (+Decryptor): From Friend to Foe, and Back Again
Imagine a ransomware attack that's so old-school it's using VBScript and a built-in Windows feature for encryption.
- Citrix Zero-Day Bug Allows Unauthenticated RCEwww.darkreading.com Citrix Zero-Day Bug Allows Unauthenticated RCE
The unpatched security vulnerability, which doesn't have a CVE yet, is due to an exposed Microsoft Message Queuing (MSMQ) instance and the use of the insecure BinaryFormatter.
- Surge in exploits of zero-day vulnerabilities is ‘new normal’ warns Five Eyes alliancetherecord.media Surge in exploits of zero-day vulnerabilities is ‘new normal’ warns Five Eyes alliance
In a co-authored advisory, the agencies list the top 15 most routinely exploited vulnerabilities of 2023, with CVE-2023-3519 — an issue affecting Citrix’s networking product NetScalers — being the most widely used.
- The Botnet is Back: SSC STRIKE Team Uncovers a Renewed Cyber Threatsecurityscorecard.com The Botnet is Back: SSC STRIKE Team Uncovers a Renewed Cyber Threat
Discover the resurgence of Volt Typhoon, a state-sponsored cyber-espionage group targeting the energy sector. Learn how they exploit legacy systems and outdated devices to embed themselves within critical infrastructure, posing a silent yet significant threat. Stay informed about the evolving tactic...
> A silent danger is sweeping through the world’s critical infrastructure. The SecurityScorecard STRIKE Team has uncovered a resurgence of Volt Typhoon—a state-sponsored cyber-espionage group from the Asia-Pacific region, known for its precision and persistence. This is no ordinary attack. Volt Typhoon exploits unprotected, outdated edge devices within targeted critical infrastructure.
- Internet-exposed GNSS receivers pose threat globally in 2024securelist.com Internet-exposed GNSS receivers pose threat globally in 2024
Internet-exposed GNSS receivers pose a significant threat to sensitive operations. Kaspersky shares statistics on internet-exposed receivers for July 2024 and advice on how to protect against GNSS attacks.
- China-linked group hacked Tibetan media and university sites to distribute Cobalt Strike payloadtherecord.media China-linked group hacked Tibetan media and university sites to distribute Cobalt Strike payload
The hacking of websites belonging to the digital news outlet Tibet Post and Gyudmed Tantric University appear to be part of a series of cyberattacks targeting the Tibetan community.
- New Ymir Ransomware Exploits Memory for Stealthy Attacks; Targets Corporate Networksthehackernews.com New Ymir Ransomware Exploits Memory for Stealthy Attacks; Targets Corporate Networks
Ymir ransomware exploits memory management to evade detection, targeting credentials for stealthy network breaches
- Tor Network Thwarts IP Spoofing Attacksecurityonline.info Tor Network Thwarts IP Spoofing Attack
Learn about a recent IP spoofing attack on the Tor network and how the Tor community responded swiftly to mitigate the threat.
- ModeLeak: Privilege Escalation to LLM Model Exfiltration in Vertex AIunit42.paloaltonetworks.com ModeLeak: Privilege Escalation to LLM Model Exfiltration in Vertex AI
New research reveals two vulnerabilities in Google's Vertex AI that may lead to privilege escalation or data theft through custom jobs or malicious models. New research reveals two vulnerabilities in Google's Vertex AI that may lead to privilege escalation or data theft through custom jobs or malici...
