Category: bleepingcomputer

US charges Russian-Israeli as suspected LockBit ransomware coder The US Department of Justice has charged a Russian-Israeli dual-national for his suspected role in developing malware and managing the infrastructure for the notorious LockBit ransomware group. […] Lawrence Abrams Go to bleepingcomputer

Sophos discloses critical Firewall remote code execution flaw Sophos has addressed three vulnerabilities in its Sophos Firewall product that could allow remote unauthenticated threat actors to perform SQL injection, remote code execution, and gain privileged SSH access to devices. […] Bill Toulas Go to bleepingcomputer

Krispy Kreme breach, data theft claimed by Play ransomware gang The Play ransomware gang has claimed responsibility for a cyberattack that impacted the business operations of the U.S. doughnut chain Krispy Kreme in November. […] Sergiu Gatlan Go to bleepingcomputer

Romanian Netwalker ransomware affiliate sentenced to 20 years in prison ​Daniel Christian Hulea, a Romanian man charged for his involvement in NetWalker ransomware attacks, was sentenced to 20 years in prison after pleading guilty to computer fraud conspiracy and wire fraud conspiracy in June. […] Sergiu Gatlan Go to bleepingcomputer

Android malware found on Amazon Appstore disguised as health app A malicious Android spyware application named ‘BMI CalculationVsn’ was discovered on the Amazon Appstore, masquerading as a simple health tool but stealing data from infected devices in the background. […] Bill Toulas Go to bleepingcomputer

Juniper warns of Mirai botnet scanning for Session Smart routers Juniper Networks has warned customers of Mirai malware attacks scanning the Internet for Session Smart routers using default credentials. […] Sergiu Gatlan Go to bleepingcomputer

Raccoon Stealer malware operator gets 5 years in prison after guilty plea ​​Ukrainian national Mark Sokolovsky was sentenced today to five years in prison for his involvement in the Raccoon Stealer malware cybercrime operation. […] Sergiu Gatlan Go to bleepingcomputer

Russian hackers use RDP proxies to steal data in MiTM attacks The Russian hacking group tracked as APT29 (aka “Midnight Blizzard”) is using a network of 193 remote desktop protocol proxy servers to perform man-in-the-middle (MiTM) attacks to steal data and credentials and to install malicious payloads. […] Bill Toulas Go to bleepingcomputer

US considers banning TP-Link routers over cybersecurity risks The U.S. government is considering banning TP-Link routers starting next year if ongoing investigations find that their use in cyberattacks poses a national security risk. […] Sergiu Gatlan Go to bleepingcomputer

HubSpot phishing targets 20,000 Microsoft Azure accounts A phishing campaign targeting automotive, chemical, and industrial manufacturing companies in Germany and the UK is abusing HubSpot to steal Microsoft Azure account credentials. […] Bill Toulas Go to bleepingcomputer

‘Bitter’ cyberspies target defense orgs with new MiyaRAT malware A cyberespionage threat group known as ‘Bitter’ was observed targeting defense organizations in Turkey using a novel malware family named MiyaRAT. […] Bill Toulas Go to bleepingcomputer

New critical Apache Struts flaw exploited to find vulnerable servers A recently patched critical Apache Struts 2 vulnerability tracked as CVE-2024-53677 is actively exploited using public proof-of-concept exploits to find vulnerable devices. […] Bill Toulas Go to bleepingcomputer

FBI spots HiatusRAT malware attacks targeting web cameras, DVRs The FBI warned today that new HiatusRAT malware attacks are now scanning for and infecting vulnerable web cameras and DVRs that are exposed online. […] Sergiu Gatlan Go to bleepingcomputer

Texas Tech University System data breach impacts 1.4 million patients The Texas Tech University Health Sciences Center and its El Paso counterpart suffered a cyberattack that disrupted computer systems and applications, potentially exposing the data of 1.4 million patients. […] Bill Toulas Go to bleepingcomputer

Windows kernel bug now exploited in attacks to gain SYSTEM privileges CISA has warned U.S. federal agencies to secure their systems against ongoing attacks targeting a high-severity Windows kernel vulnerability. […] Sergiu Gatlan Go to bleepingcomputer

Malicious ads push Lumma infostealer via fake CAPTCHA pages A large-scale malvertising campaign distributed the Lumma Stealer info-stealing malware through fake CAPTCHA verification pages that prompt users to run PowerShell commands to verify they are not a bot. […] Bill Toulas Go to bleepingcomputer

Clop ransomware claims responsibility for Cleo data theft attacks The Clop ransomware gang has confirmed to BleepingComputer that they are behind the recent Cleo data-theft attacks, utilizing zero-day exploits to breach corporate networks and steal data. […] Lawrence Abrams Go to bleepingcomputer

Winnti hackers target other threat actors with new Glutton PHP backdoor ​The Chinese Winnti hacking group is using a new PHP backdoor named ‘Glutton’ in attacks on organizations in China and the U.S., and also in attacks on other cybercriminals. […] Bill Toulas Go to bleepingcomputer

390,000 WordPress accounts stolen from hackers in supply chain attack A threat actor tracked as MUT-1244 has stolen over 390,000 WordPress credentials in a large-scale, year-long campaign targeting other threat actors using a trojanized WordPress credentials checker. […] Sergiu Gatlan Go to bleepingcomputer

Auto parts giant LKQ says cyberattack disrupted Canadian business unit Automobile parts giant LKQ Corporation disclosed that one of its business units in Canada was hacked, allowing threat actors to steal data from the company. […] Lawrence Abrams Go to bleepingcomputer

Citrix shares mitigations for ongoing Netscaler password spray attacks Citrix Netscaler is the latest target in widespread password spray attacks targeting edge networking devices and cloud platforms this year to breach corporate networks. […] Lawrence Abrams Go to bleepingcomputer

CISA confirms critical Cleo bug exploitation in ransomware attacks CISA confirmed today that a critical remote code execution bug in Cleo Harmony, VLTrader, and LexiCom file transfer software is being exploited in ransomware attacks. […] Sergiu Gatlan Go to bleepingcomputer

FTC warns of online task job scams hooking victims like gambling The Federal Trade Commission (FTC) warns about a significant rise in gambling-like online job scams, known as “task scams,” that draw people into earning cash through repetitive tasks, with the promises of earning more if they deposit their own money. […] Bill Toulas Go…

CISA warns water facilities to secure HMI systems exposed online CISA and the Environmental Protection Agency (EPA) warned water facilities today to secure Internet-exposed Human Machine Interfaces (HMIs) from cyberattacks. […] Sergiu Gatlan Go to bleepingcomputer

Police shuts down Rydox cybercrime market, arrests 3 admins International law enforcement operation seizes the Rydox cybercrime marketplace and arrests three administrators. […] Sergiu Gatlan Go to bleepingcomputer

New IOCONTROL malware used in critical infrastructure attacks Iranian threat actors are utilizing a new malware named IOCONTROL to compromise Internet of Things (IoT) devices and OT/SCADA systems used by critical infrastructure in Israel and the United States. […] Bill Toulas Go to bleepingcomputer

US offers $5 million for info on North Korean IT worker farms ​The U.S. State Department is offering a reward of up to $5 million for information that could help disrupt the activities of North Korean front companies and employees who generated over $88 million via illegal remote IT work schemes in six years. […] Sergiu…

Cleo patches critical zero-day exploited in data theft attacks Cleo has released security updates for a zero-day flaw in its LexiCom, VLTransfer, and Harmony software, currently exploited in data theft attacks. […] Sergiu Gatlan Go to bleepingcomputer

Hunk Companion WordPress plugin exploited to install vulnerable plugins Hackers are exploiting a critical vulnerability in the “Hunk Companion” plugin to install and activate other plugins with exploitable flaws directly from the WordPress.org repository. […] Bill Toulas Go to bleepingcomputer

Cynet Delivers 100% Protection and 100% Detection Visibility in the 2024 MITRE ATT&CK Evaluation The 2024 MITRE ATT&CK Evaluation results are now available with Cynet achieving 100% Visibility and 100% Protection in the 2024 evaluation. Learn more from Cynet about what these results mean. […] Sponsored by Cynet Go to bleepingcomputer

WPForms bug allows Stripe refunds on millions of WordPress sites A vulnerability in WPForms, a WordPress plugin used in over 6 million websites, could allow subscriber-level users to issue arbitrary Stripe refunds or cancel subscriptions. […] Bill Toulas Go to bleepingcomputer

Ivanti warns of maximum severity CSA auth bypass vulnerability Ivanti warned customers on Tuesday about a new maximum-severity authentication bypass vulnerability in its Cloud Services Appliance (CSA) solution. […] Sergiu Gatlan Go to bleepingcomputer

Ransomware attack hits leading heart surgery device maker ​Artivion, a leading manufacturer of heart surgery medical devices, has disclosed a November 21 ransomware attack that disrupted its operations and forced it to take some systems offline. […] Sergiu Gatlan Go to bleepingcomputer

QR codes bypass browser isolation for malicious C2 communication Mandiant has identified a novel method to bypass contemporary browser isolation technology and achieve command-and-control C2 operations. […] Bill Toulas Go to bleepingcomputer

Blue Yonder SaaS giant breached by Termite ransomware gang ​The Termite ransomware gang has officially claimed responsibility for the November breach of software as a service (SaaS) provider Blue Yonder. […] Sergiu Gatlan Go to bleepingcomputer

Romania’s election systems targeted in over 85,000 cyberattacks A declassified report from Romania’s Intelligence Service says that the country’s election infrastructure was targeted by more than 85,000 cyberattacks. […] Ionut Ilascu Go to bleepingcomputer

U.S. org suffered four month intrusion by Chinese hackers A large U.S. organization with significant presence in China has been reportedly breached by China-based threat actors who persisted on its networks from April to August 2024. […] Bill Toulas Go to bleepingcomputer

US arrests Scattered Spider suspect linked to telecom hacks ​U.S. authorities have arrested a 19-year-old teenager linked to the notorious Scattered Spider cybercrime gang who is now charged with breaching a U.S. financial institution and two unnamed telecommunications firms. […] Sergiu Gatlan Go to bleepingcomputer

Police shuts down Manson cybercrime market, arrests key suspects German law enforcement has seized over 50 servers that hosted the Manson Market cybercrime marketplace and fake online shops used in phishing operations. […] Sergiu Gatlan Go to bleepingcomputer

White House: Salt Typhoon hacked telcos in dozens of countries ​Chinese state hackers, known as Salt Typhoon, have breached telecommunications companies in dozens of countries, President Biden’s deputy national security adviser Anne Neuberger said today. […] Sergiu Gatlan Go to bleepingcomputer

UK disrupts Russian money laundering networks used by ransomware ​A law enforcement operation led by the United Kingdom’s National Crime Agency (NCA) has disrupted two Russian money laundering networks working with criminals worldwide, including ransomware gangs. […] Sergiu Gatlan Go to bleepingcomputer

BT unit took servers offline after Black Basta ransomware breach Multinational telecommunications giant BT Group (formerly British Telecom) has confirmed that its BT Conferencing business division shut down some of its servers following a Black Basta ransomware breach. […] Sergiu Gatlan Go to bleepingcomputer

Vodka maker Stoli files for bankruptcy in US after ransomware attack Stoli Group’s U.S. companies have filed for bankruptcy following an August ransomware attack and Russian authorities seizing the company’s remaining distilleries in the country. […] Sergiu Gatlan Go to bleepingcomputer

Cloudflare’s developer domains increasingly abused by threat actors Cloudflare’s ‘pages.dev’ and ‘workers.dev’ domains, used for deploying web pages and facilitating serverless computing, are being increasingly abused by cybercriminals for phishing and other malicious activities. […] Bill Toulas Go to bleepingcomputer

US shares tips to block hackers behind recent telecom breaches ​CISA released guidance today to help network defenders harden their systems against attacks coordinated by the Salt Typhoon Chinese threat group that breached multiple major global telecommunications providers earlier this year. […] Sergiu Gatlan Go to bleepingcomputer

Exploit released for critical WhatsUp Gold RCE flaw, patch now A proof-of-concept (PoC) exploit for a critical-severity remote code execution flaw in Progress WhatsUp Gold has been published, making it critical to install the latest security updates as soon as possible. […] Bill Toulas Go to bleepingcomputer

Veeam warns of critical RCE bug in Service Provider Console ​Veeam released security updates today to address two Service Provider Console (VSPC) vulnerabilities, including a critical remote code execution (RCE) discovered during internal testing. […] Sergiu Gatlan Go to bleepingcomputer

Russia sentences Hydra dark web market leader to life in prison Russian authorities have sentenced the leader of the criminal group behind the now-closed dark web platform Hydra Market to life in prison. […] Sergiu Gatlan Go to bleepingcomputer

BootKitty UEFI malware exploits LogoFAIL to infect Linux systems The recently uncovered ‘Bootkitty’ UEFI bootkit, the first malware of its kind targeting Linux systems, exploits CVE-2023-40238, aka ‘LogoFAIL,’ to infect computers running on a vulnerable UEFI firmware. […] Bill Toulas Go to bleepingcomputer

New Rockstar 2FA phishing service targets Microsoft 365 accounts A new phishing-as-a-service (PhaaS) platform named ‘Rockstar 2FA’ has emerged, facilitating large-scale adversary-in-the-middle (AiTM) attacks to steal Microsoft 365 credentials. […] Bill Toulas Go to bleepingcomputer

Russia arrests cybercriminal Wazawaka for ties with ransomware gangs Russian law enforcement has arrested and indicted notorious ransomware affiliate Mikhail Pavlovich Matveev (also known as Wazawaka, Uhodiransomwar, m1x, and Boriselcin) for developing malware and his involvement in several hacking groups. […] Sergiu Gatlan Go to bleepingcomputer

Bologna FC confirms data breach after RansomHub ransomware attack Bologna Football Club 1909 has confirmed it suffered a ransomware attack after its stolen data was leaked online by the RansomHub extortion group. […] Bill Toulas Go to bleepingcomputer

Tor needs 200 new WebTunnel bridges to fight censorship The Tor Project has put out an urgent call to the privacy community asking volunteers to help deploy 200 new WebTunnel bridges by the end of the year to fight government censorship. […] Bill Toulas Go to bleepingcomputer

Hackers abuse popular Godot game engine to infect thousands of PCs ​Hackers have used new GodLoader malware exploiting the capabilities of the widely used Godot game engine to evade detection and infect over 17,000 systems in just three months. […] Sergiu Gatlan Go to bleepingcomputer

Hackers exploit ProjectSend flaw to backdoor exposed servers Threat actors are using public exploits for a critical authentication bypass flaw in ProjectSend to upload webshells and gain remote access to servers. […] Bill Toulas Go to bleepingcomputer

Zello asks users to reset passwords after security incident Zello is warning customers to reset their passwords if their account was created before November 2nd in what appears to be another security breach. […] Lawrence Abrams Go to bleepingcomputer

New NachoVPN attack uses rogue VPN servers to install malicious updates A set of vulnerabilities dubbed “NachoVPN” allows rogue VPN servers to install malicious updates when unpatched Palo Alto and SonicWall SSL-VPN clients connect to them. […] Sergiu Gatlan Go to bleepingcomputer

NordVPN Black Friday Deal: Save up to 74% on yearly subscriptions Want the best VPN with a 74% discount? The NordVPN Black Friday deal is live and runs until December 10. This is the perfect chance to lock in a 2-year plan for the low cost of $2.99 per month, with an extra 3 months for…

Get 50% off Malwarebytes during Black Friday 2024 Malwarebytes’ Black Friday 2024 deals are now live, offering a 50% discount for one and two-year subscriptions to personal, family, and business subscriptions to its standalone anti-malware software, VPN, and Personal Data Remover services. […] Lawrence Abrams Go to bleepingcomputer

Why Cybersecurity Leaders Trust the MITRE ATT&CK Evaluations The “MITRE Engenuity ATT&CK Evaluations: Enterprise” stand out as an essential resource for cybersecurity decision makers. Learn more from Cynet on what to expect in the upcoming 2024 MITRE ATT&CK Evaluation results. […] Sponsored by Cynet Go to bleepingcomputer