Skip to main content
Customer Support Customer Support

Security Industry News

We'll post what we hear. You post what you hear!

  • 35,987 Topics
  • 25,888 Replies
10000 Topics
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Govtech giant Conduent confirms client data stolen in January cyberattack

April 14, 2025 By Lawrence Abrams American business services giant and government contractor Conduent disclosed today that client data was stolen in a January 2025 cyberattack. Conduent is a business services company that provides digital platforms and solutions for government and commercial clients in transportation, healthcare, customer experience, and human resources. The company has over 33,000 employees and provides services to half of Fortune 100 companies and over 600 government and transportation agencies. In January, the company suffered a cyberattack that impacted customers' operations across the U.S., including local government agencies. In a new FORM-8K filing with the SEC today, Conduent has now confirmed that threat actors had stolen files containing information about the company's customers. >>Full Article<<

30
Jasper_The_Rasper
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
UnitedHealth is now asking doctors to repay the loans it gave out following major hack

UnitedHealth is now “aggressively” chasing borrowers April 14, 2025 By Ellen Jennings-Trace (Image credit: Rawpixel / Pixabay) Change Healthcare suffered a huge cyberattack in 2024 Disruptions from that attack cost organizations millions The firm is now chasing repayment of loans to cover losses from these disruptions UnitedHealth Group is “aggressively” going after small healthcare organizations that borrowed money following a huge cyberattack on its subsidy Change Healthcare. The attack is said to have affected almost 190 million Americans, and was the largest US healthcare data breach ever, and was incredibly disruptive, with systems only fully restored 9 months later, costing over $2 billion to recover from. After the attack, interest-free loans were offered by Change to help medical practices with short-term cash flow needs. The firm is now demanding these funds be “immediately” repaid, with some organizations asked to repay hundreds of thousands of dollars in just a few days. >>F

40
Jasper_The_Rasper
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Chinese APTs Exploit EDR 'Visibility Gap' for Cyber Espionage

Blind spots in network visibility, including in firewalls, IoT devices, and the cloud, are being exploited by Chinese state-backed threat actors with increasing success, according to new threat intelligence. Here's how experts say you can get eyes on it all. April 14, 2025 By Becky Bracken Beijing-backed hacker groups are known by a variety of benign-sounding monikers, like FishMonger and MirrorFace, and notably, Volt Typhoon and Salt Typhoon — but a handful of these groups, some of them operating as arms of the military, are running ruthless cyber-espionage campaigns against the US's most sensitive critical infrastructure, including utilities and telecommunications networks. While these groups' attribution to China by the US government and cybersecurity researchers hasn't really been in question, China itself isn't even trying to hide the nefarious cyber activity anymore. According to an April 10 Wall Street Journal report about a meeting with US representatives last December, Chinese

40
Jasper_The_Rasper
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Slow Pisces Hackers Attacking Developers With Coding Challenges & Python Malware

April 14, 2025 By Tushar Subhra Dutta A sophisticated threat actor group dubbed “Slow Pisces” has emerged as a significant threat to software developers, employing deceptive coding challenges as an initial attack vector to distribute Python-based malware. The campaign specifically targets developers through professional networking sites, coding forums, and development platforms with seemingly innocuous programming puzzles that conceal malicious payloads. Security researchers have observed these attacks increasing in frequency since January 2025, with victims primarily located in technology hubs across North America and Europe. >>Full Article<<

40
Jasper_The_Rasper
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Tycoon2FA phishing kit rolled out significant updates

April 14, 2025 By Pierluigi Paganini The operators of the Phishing-as-a-Service (PhaaS) platform Tycoon2FA have rolled out significant updates to enhance its evasion capabilities. Tycoon2FA, a phishing kit discovered in 2023 by cybersecurity firm Sekoia, was recently updated to improve its evasion capabilities. The phishing kit now uses advanced evasion tactics such as a custom CAPTCHA via HTML5 canvas, invisible Unicode in obfuscated JavaScript, and anti-debugging scripts to bypass detection and hinder analysis. “Lately, the Tycoon 2FA landing pages have incorporated a clever obfuscation technique using invisible Unicode characters. This technique, when paired with JavaScript Proxy objects, is designed to complicate static analysis and defer script execution until runtime.” reported Trustwave. “This behavior is demonstrated in a real-world Tycoon 2FA phishing landing page, as shown in this Urlscan.io session: https://urlscan.io/result/0195c73f-bfd0-7000-8386-94b11ace6088/dom/“ Source:

40
Jasper_The_Rasper
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Possible Russian Hackers Targeted UK Ministry of Defense

Spear-Phishing Campaign Used RomCom Malware Variant April 14, 2025 By Akshaya Asokan Image: Shutterstock A phishing campaign wielding malware previously associated with Russian-speaking hackers targeted the U.K. Ministry of Defense in late 2024, the British government said Friday. Hackers spear-phished civil servants with emails purporting to originate from a news organization, later also deploying financially themed bait that directed users to a commercial file sharing site. The ministry and the National Cyber Security Centre disclosed the campaign on Friday. Anyone who clicked on the links in the phishing emails ultimately ended up with a malicious downloader known as Damascened Peacock on their computer, they said. >>Full Article<<

40
Jasper_The_Rasper
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
New malware ‘ResolverRAT’ targets healthcare, pharmaceutical firms

April 14, 2025 By Pierluigi Paganini New malware ‘ResolverRAT’ is targeting healthcare and pharmaceutical firms, using advanced capabilities to steal sensitive data. Morphisec researchers discovered a new malware dubbed ‘ResolverRAT’ that is targeting healthcare and pharmaceutical firms, using advanced capabilities to steal sensitive data. ResolverRAT spreads via phishing emails using localized languages and legal lures. Victims download a malicious file triggering the malware. The multi-language tactic suggests a global, targeted campaign aimed at boosting infection success across regions. >>Full Article<<

40
Jasper_The_Rasper
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Cybersecurity firm buying hacker forum accounts to spy on cybercriminals

April 14, 2025 By Bill Toulas Swiss cybersecurity firm Prodaft has launched a new initiative called 'Sell your Source' where the company purchases verified and aged accounts on hacking forums to to spy on cybercriminals. The goal is to use these accounts to infiltrate cybercrime spaces and communities, collecting valuable intelligence that could lead to the exposure of malicious operations and platforms. "As a threat intelligence company, we specialize in obtaining visibility into the infrastructures of cybercriminals, searching for patterns, tactics, techniques, and procedures that help us understand adversarial networks and detect and mitigate potential cyberattacks," explains Prodaft. "As these activities are routinely associated with places such as the deep and dark web, underground forums, or illicit marketplaces, we want to ensure our coverage does not hit any limitations." >>Full Article<<

40
Jasper_The_Rasper
Moderator
TripleHelix
Moderator
TripleHelixModerator
posted in Security Industry News
Release notes for Microsoft Edge Security Updates April 11, 2025

Microsoft Edge (Stable) 135.0.3179.73 Release date: April 11, 2025 Release notes for Microsoft Edge Stable Channel: N/A https://learn.microsoft.com/en-us/DeployEdge/microsoft-edge-relnotes-security Make sure to re-add back in the Privacy Protection area after every update. Click on GIF to see full size!

181
TripleHelix
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
That groan you hear is users’ reaction to Recall going back into Windows

Snapshotting and AI processing a screen every 3 seconds. What could possibly go wrong? Dan Goodin – 11 Apr 2025 Security and privacy advocates are girding themselves for another uphill battle against Recall, the AI tool rolling out in Windows 11 that will screenshot, index, and store everything a user does every three seconds. When Recall was first introduced in May 2024, security practitioners roundly castigated it for creating a gold mine for malicious insiders, criminals, or nation-state spies if they managed to gain even brief administrative access to a Windows device. Privacy advocates warned that Recall was ripe for abuse in intimate partner violence settings. They also noted that there was nothing stopping Recall from preserving sensitive disappearing content sent through privacy-protecting messengers such as Signal. Enshittification at a new scale Following months of backlash, Microsoft later suspended Recall. On Thursday, the company said it was reintroducing Recall. It curren

40
Jasper_The_Rasper
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Researcher uncovers dozens of sketchy Chrome extensions with 4 million installs

Even weirder: Why would Google give so many the "Featured" stamp for trustworthiness? Dan Goodin – 11 Apr 2025 Google is hosting dozens of extensions in its Chrome Web Store that perform suspicious actions on the more than 4 million devices that have installed them and that their developers have taken pains to carefully conceal. The extensions, which so far number at least 35, use the same code patterns, connect to some of the same servers, and require the same list of sensitive systems permissions, including the ability to interact with web traffic on all URLs visited, access cookies, manage browser tabs, and execute scripts. In more detail, the permissions are: Tabs: manage and interact with browser windows Cookies: set and access stored browser cookies based on cookie or domain names (ex., "Authorization" or "all cookies for GitHub.com") WebRequest: intercept and modify web requests the browser makes Storage: ability to store small amounts of information persistently in the browser

40
Jasper_The_Rasper
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Ransomware attack cost IKEA operator in Eastern Europe $23 million

April 11, 2025 By Bill Toulas Fourlis Group, the operator of IKEA stores in Greece, Cyprus, Romania, and Bulgaria, has informed that the ransomware attack it suffered just before Black Friday on November 27, 2024, caused losses estimated to €20 million ($22.8 million). The security incident became public on December 3, 2024, when the group admitted that the technical problems IKEA online shops were facing were due to “malicious external action.” Although the company also operates Intersport, Foot Locker, and Holland & Barrett shops in the said countries, the impact of the attack affected mainly IKEA business operations. “The incident caused temporary disruptions in a store replenishment, primarily impacting the Home Furnishings segment (IKEA stores) and e-commerce operations during December 2024 through February 2025,” reads a press release published earlier this week. In a statement to local media, the Fourlis Group CEO, Dimitris Valachis, clarified that the impact the security incide

20
Jasper_The_Rasper
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
1.6 Million People Impacted by Data Breach at Laboratory Services Cooperative

Laboratory Services Cooperative says the personal and medical information of 1.6 million was stolen in an October 2024 data breach. April 11, 2025 By Ionut Arghire Medical testing services provider Laboratory Services Cooperative (LSC) is notifying 1.6 million individuals that their personal information was stolen in an October 2024 data breach. As part of the cyberattack, which was identified on October 27, a threat actor accessed LSC’s network and accessed and exfiltrated certain files containing patient and employee information. The potentially compromised information includes names, addresses, phone numbers, email addresses, dates of birth, Social Security numbers, driver’s license numbers, government ID or passport numbers, demographic information, and health insurance information such as plan name and type, insurance provider, and member/group ID number. >>Full Article<<

20
Jasper_The_Rasper
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Paper Werewolf Threat Actor Targets Flash Drives With New Malware

The threat actor, also known as Goffee, has been active since at least 2022 and has changed its tactics and techniques over the years while targeting Russian organizations. April 11, 2025 By Kristina Beek A threat actor known as Paper Werewolf is using new malware to target Russian entities and steal sensitive files from flash drives. The actor, also known as Goffee, was observed deploying the malware by researchers at Kaspersky Lab. The malware includes components that are designed to target removable media. Kaspersky said the previously undocumented implant, which it calls "PowerModul," is a PowerShell script downloader that can covertly download other components from command and control servers. One of the components — FlashFileGrabber — steals files from flash drives or scans USB drives for documents before copying them to a local disk. USB Worm is another of these such components and operates by spreading PowerModul malware and infecting any flash drives that are connected to the

60
Jasper_The_Rasper
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
The Pall Mall Pact and why it matters

April 11, 2025 By Pieter Arntz The US State Department reportedly plans to sign an international agreement designed to govern the use of commercial spyware known as the Pall Mall Pact. The Pall Mall Pact, formally known as the Pall Mall Process, was initiated by France and the United Kingdom in February 2024. The goal of the Pall Mall Pact is to regulate Commercial Cyber Intrusion Capabilities (CCICs), or what we usually refer to as spyware and surveillance tools. Signed by France, the UK, Japan, and 18 other EU member states, the Code of Practice is a voluntary non-binding agreement establishing “best practices” among governments in relation to the development, facilitation, purchase, transfer, and use of commercial cyber intrusion tools and services. >>Full Article<<

30
Jasper_The_Rasper
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Palo Alto warns of brute-force login attempts on PAN-OS GlobalProtect gateways indicating possible upcoming attacks

April 11, 2025 By Pierluigi Paganini Experts warn of brute-force login attempts on PAN-OS GlobalProtect gateways following increased scanning activity on its devices. Palo Alto Networks reports brute-force login attempts on PAN-OS GlobalProtect gateways. The security firm pointed out that no known vulnerability has been exploited, but monitoring and analysis continue. “Our teams are observing evidence of activity consistent with password-related attacks, such as brute-force login attempts, which does not indicate exploitation of a vulnerability,” a company spokesperson told The Hacker News. “We continue to actively monitor this situation and analyze the reported activity to determine its potential impact and identify if mitigations are necessary.” Recently, the threat intelligence firm GreyNoise reported a spike in login scanning targeting PAN-OS GlobalProtect portals starting March 17, 2025, peaking at 23,958 unique IPs. The activity, likely coordinated, focused on systems in the U.S.

30
Jasper_The_Rasper
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Western Sydney University discloses security breaches, data leak

April 11, 2025 By Bill Toulas Western Sydney University (WSU) announced two security incidents that exposed personal information belonging to members of its community. WSU is a prominent Australian institution offering various undergraduate, postgraduate, and research programs across multiple disciplines. It serves a student body of 47,000 and employs over 4,500 permanent and seasonal staff, operating with an annual budget of approximately $600 million. One of the incidents disclosed concerns the compromise of one of the University’s single sign-on (SSO) systems between January and February 2025. This breach has reportedly led to the unauthorized access of demographic, enrollment, and progression information for approximately 10,000 current and former students. >>Full Article<<

30
Jasper_The_Rasper
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Malicious NPM Packages Targeting PayPal Users

By Jenna Wang | April 11, 2025 FortiGuard Labs’ AI-driven OSS malware detection system has recently discovered a series of malicious NPM packages designed to steal sensitive information from compromised systems. These packages are believed to have been created between March 5 and March 14 by a threat actor known as tommyboy_h1 and tommyboy_h2 to target PayPal users. PayPal is a widely used platform holding sensitive financial information. Using PayPal-related names helps these malicious packages avoid detection, making it easier for attackers to steal sensitive information. By including "PayPal" in the name of the malicious packages, such as oauth2-paypal and buttonfactoryserv-paypal, the attackers also create a false sense of legitimacy, tricking developers into installing them. The code collects and exfiltrates system data, such as usernames and directory paths, which can then be used to target PayPal accounts or be sold for fraudulent purposes. The code has very similar characterist

40
Jasper_The_Rasper
Moderator
TripleHelix
Moderator
TripleHelixModerator
posted in Security Industry News
Release notes for Microsoft Edge Security Updates April 9, 2025

Microsoft Edge (Stable) 135.0.3179.66 Release date: April 9, 2025 Release notes for Microsoft Edge Stable Channel: N/A https://learn.microsoft.com/en-us/DeployEdge/microsoft-edge-relnotes-security Make sure to re-add back in the Privacy Protection area after every update. Click on GIF to see full size!

171
TripleHelix
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
SpyNote Android malware resurfaces in campaign using spoofed app install pages

April 10, 2025 By Duncan Riley A new report out today from internet intelligence company DomainTools LLC warns that threat actors are using newly registered domains to deliver the SpyNote Android remote access trojan via sites that mimic Google Play app installation pages. In trying to imitate legitimate Google Play app listings, the cloned pages often feature image carousels and familiar visual elements to create the illusion of legitimacy, prompting unsuspecting users to download malicious APK files. One example mimicked the TikTok installation page, using remnants of older app references such as “com.zhiliaoapp.musically” in the site code. The downloaded files include variants of SpyNote, an Android RAT capable of conducting surveillance, harvesting sensitive data and executing remote commands on compromised devices. Spynote first appeared in 2016 and has popped up in various campaigns over the years, including one targeting Netflix Inc. users in 2017. The SpyNote malware is deliver

70
Jasper_The_Rasper
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Study Identifies 20 Most Vulnerable Connected Devices of 2025

Routers are the riskiest devices in enterprise networks as they contain the most critical vulnerabilities, a new Forescout report shows. April 10, 2025 By Ionut Arghire Routers represent the riskiest devices in enterprise networks, containing the largest number of critical vulnerabilities, Forescout notes in a new report. According to the company’s ‘Riskiest Connected Devices of 2025’ report, device risk has increased 15% compared to the previous year, with routers accounting for more than half of the devices plagued by the most dangerous vulnerabilities. The report, which analyzes millions of devices in Forescout’s Device Cloud to identify the riskiest types across IT, IoT, OT, and Internet of Medical Things (IoMT), shows that computers have the largest number of bugs, but not the most dangerous ones. The list of top 20 riskiest devices has changed significantly since last year, with 12 new device types added: ADCs, firewalls, intelligent platform management interfaces (IPMIs), domain

50
Jasper_The_Rasper
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Threat Actors Use 'Spam Bombing' Technique to Hide Malicious Motives

Darktrace researchers detailed "spam bombing," a technique in which threat actors bombard targets with spam emails as a pretense for activity like social engineering campaigns. April 10, 2025 By Alexander Culafi Threat actors are using a technique known as "spam bombing" to overload victims' email inboxes and provide cover for more harmful activity. In research published today by security vendor Darktrace, analysts Maria Geronikolou and Cameron Boyd detailed an example of the technique where the threat actor used a legitimate email campaign product to swarm a victim with spam emails and then attempted to phish them under the guise of a "helpful" IT staffer. The attack is both an example of how threat actors use legitimate products for malicious activities and of how attackers are innovating in the social engineering space. >>Full Article<<

60
Jasper_The_Rasper
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Europol Targets Customers of Smokeloader Pay-Per-Install Botnet

Law enforcement agencies in multiple countries have announced the arrests of users of the malicious Smokeloader botnet. April 10, 2025 By Ionut Arghire Law enforcement agencies in the US and six other countries have been identifying customers of the Smokeloader pay-per-install botnet and have made five arrests, Europol announced. The Smokeloader botnet was disrupted in May 2024 as part of Operation Endgame and led to the destruction of the infrastructure of several malware droppers, including Bumblebee, IcedID, Pikabot, SystemBC, and Trickbot. The botnet’s customers, Europol said on Wednesday, were registered in a database that was seized by law enforcement in May last year. This enabled follow-up actions against the botnet’s users, as authorities were able to link online personas with real-life individuals. >>Full Article<<

50
Jasper_The_Rasper
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
AkiraBot: AI-Powered spam bot evades CAPTCHA to target 80,000+ websites

April 10, 2025 By Pierluigi Paganini AkiraBot, a CAPTCHA-evading Python framework, has spammed over 80,000 websites with AI-generated messages, targeting small and medium-sized businesses. SentinelOne’s SentinelLabs researchers warn that AkiraBot, a spam framework, targets websites’ chats and contact forms to promote low-quality SEO services, AkiraBot has already targeted more than 400,000 websites and successfully spammed at least 80,000 websites since September 2024. AkiraBot uses LLM-generated content and rotating attacker-controlled domains to bypass spam filters. The spam framework evades CAPTCHA and network detection using proxies, unrelated to the Akira ransomware group. The name AkiraBot comes after its “Akira” SEO domains, it was spotted targeting websites like Shopify, GoDaddy, and Wix. “The oldest archive refers to the bot as Shopbot, likely a reference to its targeting of websites using Shopify. As the tool evolved, the targeting expanded to include websites built using GoD

40
Jasper_The_Rasper
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Russian hackers attack Western military mission using malicious drive

April 10, 2025 By Bill Toulas The Russian state-backed hacking group Gamaredon (aka “Shuckworm”) has been targeting a military mission of a Western country in Ukraine in attacks likely deployed from removable drives. Symantec threat researchers say the campaign started in February 2025 and continued until March, with hackers deploying an updated version of the GammaSteel info-stealing malware to exfiltrate data. According to the report, initial access to the infected systems was probably achieved via removable drives containing malicious .LNK files, a vector that Gamaredon has used in the past. The researchers note a change in the threat actor's tactics, including a shift from VBS scripts to PowerShell-based tools, more obfuscation for payloads, and increased use of legitimate services for evasion. >>Full Article<<

40
Jasper_The_Rasper
Moderator

Latest solutions

Leaderboard

Badges

  • Most Wanted
    Tarnakhas earned the badge Most Wanted
  • Beta To The Max
    Tarnakhas earned the badge Beta To The Max
  • Most Wanted
    Muddy7has earned the badge Most Wanted
  • Beta To The Max
    Muddy7has earned the badge Beta To The Max
  • Beta To The Max
    pierrequiroulehas earned the badge Beta To The Max
Show all badges

Popular Tags

Join the Conversation

Terms & Conditions