Skip to main content
Customer Support Customer Support

Security Industry News

We'll post what we hear. You post what you hear!

  • 36,045 Topics
  • 25,905 Replies
10000 Topics
TylerM
Administrator
TylerMSr. Security Analyst & Community Manager
published in Security Industry News
Cyber News Rundown: Cyberattack shuts down Texas cityNews

Late last week, officials for the City of Abilene in Texas identified a cyberattack that was targeting their internal network and worked quickly to take the affected systems offline. As the investigation into this incident continues, some operations are still offline, though systems that control emergency services have remained functional. It remains unclear if any customer or employee information was compromised during this attack, and staff are working to continue processing utilities payments while offering leniency for late payments due to this issue. Legends International confirms data breach It has recently been revealed that the venue management firm, Legends International, suffered a data breach in November of last year and has confirmed that both employee and customer data has been compromised. As the management firm for more than 350 entertainment venues around the world, the impacts of this incident could be astronomical, though there hasn't been any word on the types of dat

234
Ssherjj
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
CEO of cybersecurity firm charged with installing malware on hospital systems

April 26, 2025 By Pierluigi Paganini Veritaco CEO Jeffrey Bowie faces charges for allegedly installing malware on hospital computers, violating Oklahoma’s Computer Crimes Act. Jeffrey Bowie, CEO of the cybersecurity firm Veritaco, is facing two counts of violating Oklahoma’s Computer Crimes Act for allegedly infecting employee computers at the Oklahoma City St. Anthony Hospital. The man is accused of having installed the malware on the hospital computers on August 6, 2024. Bowie was arrested on April 14, following the issuance of an arrest warrant. Security footage reportedly shows the man attempting to access multiple offices before installing malicious software designed to capture screenshots every 20 minutes and transmit them to an external IP address. >>Full Article<<

172
TripleHelix
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Blue Shield of California leaked health data of 4.7 million members to Google

April 23, 2025 By Bill Toulas Blue Shield of California disclosed it suffered a data breach after exposing protected health information of 4.7 million members to Google's analytics and advertisement platforms. The nonprofit health plan, which serves nearly 6 million members across California, published a data breach notification on its website stating that member data was exposed between April 2021 and January 2024. Today, the United States Department of Health and Human Services breach portal was updated to state that the leak exposed 4.7 million members' protected health data. Source: ocrportal.hhs.gov According to the notice, the exposure was caused by a misconfiguration of Google Analytics on certain Blue Shield sites. This resulted in the sensitive data potentially being shared with Google advertising platforms and advertisers. >>Full Article<<

223
TripleHelix
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Windows "inetpub" security fix can be abused to block future updates

April 25, 2025 By Lawrence Abrams A recent Windows security update that creates an ‘inetpub’ folder has introduced a new weakness allowing attackers to prevent the installation of future updates. After people installed this month's Microsoft Patch Tuesday security updates, Windows users suddenly found an "inetpub" folder owned by the SYSTEM account created in the root of the system drive, normally the C: drive. It was strange to see this folder created as it is normally used to hold files associated with Microsoft's Internet Information Service web server, which was not installed on these devices. In an update to a security advisory, Microsoft later confirmed that the C:\inetpub folder was part of a fix for a Windows Process Activation elevation of privilege vulnerability tracked as CVE-2025-21204, with the company warning not to delete the folder. >>Full Article<<

50
Jasper_The_Rasper
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Mobile provider MTN says cyberattack compromised customer data

April 25, 2025 By Bill Toulas African mobile giant MTN Group announced that a cybersecurity incident has compromised the personal information of some of its subscribers in certain countries. MTN Group (formerly M-Cell) is Africa's largest mobile network operator, with a strong Asian market presence. The company has nearly 300 million subscribers across 20 countries and an annual revenue surpassing $11 billion. The telecom giant noted that its network and billing systems weren't impacted by the attack, though an investigation to determine the exact scope and impact is ongoing. "MTN Group would like to inform stakeholders that it has experienced a cybersecurity incident that resulted in unauthorised access to personal information of some MTN customers in certain markets," reads the announcement. >>Full Article<<

20
Jasper_The_Rasper
Moderator
TripleHelix
Moderator
TripleHelixModerator
posted in Security Industry News
Release notes for Microsoft Edge Security Updates April 24, 2025

The Stable channel has been updated to 135.0.3179.98 for Windows. The Stable channel has been updated to 135.0.3179.98 for Linux. The Stable channel has been updated to 135.0.3179.98 for MacOS. Release notes N/A. https://learn.microsoft.com/en-us/deployedge/microsoft-edge-relnote-stable-channel#version-1350317954-april-24-2025 Make sure to re-add back in the Privacy Protection area after every update. Click on GIF to see full size!

121
TripleHelix
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Yale New Haven Health (YNHHS) data breach impacted 5.5 million patients

April 24, 2025 By Pierluigi Paganini Yale New Haven Health (YNHHS) announced that threat actors stole the personal data of 5.5 million patients in a cyberattack. Yale New Haven Health (YNHHS) disclosed a data breach that exposed personal information of 5.5 million patients following a cyberattack that occurred earlier this month. Yale New Haven Health System (YNHHS) is a nonprofit healthcare network headquartered in New Haven, Connecticut. It stands as the largest healthcare system in the state, encompassing a comprehensive array of medical services and facilities.​ The system operates more than 360 locations across Connecticut, southeastern New York, and Rhode Island, managing over 2,400 beds and employing a vast network of healthcare professionals. The healthcare network employs about 30,000 health professionals and has an annual revenue of over $5.6 billion. >>Full Article<<

40
Jasper_The_Rasper
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Microsoft mystery folder fix might need a fix of its own

This one weird trick can stop Windows updates dead in their tracks April 24, 2025 By Richard Speed Turns out Microsoft's latest patch job might need a patch of its own, again. This time, the culprit is a mysterious inetpub folder quietly deployed by Redmond, now hijacked by a security researcher to break Windows updates. The folder, typically c:\inetpub, reappeared on Windows systems in April as part of Microsoft's mitigation for CVE-2025-21204, an exploitable elevation-of-privileges flaw within Windows Process Activation. Rather than patching code directly, Redmond simply pre-created the folder to block a symlink attack path. For many administrators, the reappearance of this old IIS haunt raised eyebrows, especially since the mitigation did little beyond ensuring the folder existed. >>Full Article<<

60
Jasper_The_Rasper
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Hackers claim to hack TikTok, 927,000 passwords might hit the internet

April 24, 2025 By Paulina Okunytė A hacking crew claims it warned TikTok, got ghosted, and is now unleashing nearly a million users' passwords. A group calling itself R00TK1T ISC CYBER TEAM just lobbed a grenade, claiming to have snatched 972,000 TikTok users' passwords. As the attackers claimed, no one at TikTok answered their DMs, so they’re making good on their threat to leak a massive sample set. “We warned Bytedance and TikTok, but their silence speaks volumes. Despite our clear message, they have ignored the cries of users locked out, suspended, or erased from the platform,” the group posted in their communication channel. “Today we’re dropping a sample of 927K TikTok users into the wild,” they add. If the leak proves to be legit, it could mean mass account takeovers, phishing sprees, or even identity theft at scale. >>Full Article<<

50
Jasper_The_Rasper
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Lazarus hackers breach six companies in watering hole attacks

April 24, 2025 By Bill Toulas In a recent espionage campaign, the infamous North Korean threat group Lazarus targeted multiple organizations in the software, IT, finance, and telecommunications sectors in South Korea. The threat actor combined a watering hole attack strategy with an exploit for a vulnerability in a file transfer client that is required in South Korea to complete certain financial and administrative tasks. Researchers at Kasperky named the campaign 'Operation SyncHole' and say that the activity compromised at least half a dozen organizations between November 2024 and February 2025. “We identified at least six software, IT, financial, semiconductor manufacturing and telecommunication organizations in South Korea that fell victim to “Operation SyncHole,” Kasperky notes in a report. Operation SyncHole activity timeline Source: Kaspersky “However, we are confident that there are many more affected organizations across a broader range of industries, given the popularity of t

40
Jasper_The_Rasper
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
North Korean Hackers Use Russian IP Infrastructure

Void Dokkaebi Campaigns Using Russia for Cryptocurrency Theft April 24, 2025 By Prajeet Nair The Korea–Russia Friendship Bridge spanning the Tumen river in a photo dated Aug. 10, 2017. (Image: Stefan Bruder / Shutterstock) North Korean hackers look north toward Russia for the internet infrastructure behind the many online scams that Pyongyang has built to funnel stolen cash into the rouge nation. Trend Micro in a Wednesday report traced cybercrime activities aligned with North Korea to IP addresses assigned to an organization in the Russian city of Khabarovsk, which has cultivated ties with North Korea since the demise of the Soviet Union. It also traced activity to Khasan, a hamlet just across the Russian border from the Hermit Kingdom that's the site of the "Korea–Russia Friendship Bridge." A major Russian telecommunications firm laid a fiber-optic cable across the bridge in 2017. >>Full Article<<

50
Jasper_The_Rasper
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Crooks exploit the death of Pope Francis

April 24, 2025 By Pierluigi Paganini Crooks exploit the death of Pope Francis, using public curiosity and emotion to launch scams and spread malware, an old tactic during global events. After Pope Francis’ death, cybercriminals launched scams and malware attacks, exploiting public curiosity, grief, and confusion. Cybercriminals are ready to exploit any event of global interest, it has already happened in the past during events like Queen Elizabeth II’s death or the COVID-19 pandemic. Check Point Research calls this trend “cyber threat opportunism,” noting similar spikes during COVID-19, when Google saw 18M+ daily virus-related scam emails. These emotionally charged moments are fertile ground for digital exploitation. The emotional vulnerability of users makes them prime targets for attackers seeking clicks, personal data, or financial information. >>Full Article<<

40
Jasper_The_Rasper
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Frederick Health data breach impacts nearly 1 million patients

April 24, 2025 By Sergiu Gatlan ​A ransomware attack in January at Frederick Health Medical Group, a major healthcare provider in Maryland, has led to a data breach affecting nearly one million patients. With almost 4,000 employees and over 25 locations, Frederick Health is one of Frederick County's largest employers. As the health system revealed in a late March notification to patients, the ransomware attack was detected on January 27, which prompted Frederick Health to notify law enforcement and hire a third-party forensic firm to investigate the incident's impact. "On January 27, 2025, we experienced a ransomware event affecting our IT systems," the health system said. "The investigation determined that an unauthorized person gained access to our network and, on January 27, 2025, copied certain files from a file share server." "We are mailing letters to individuals whose information may have been involved and for whom we have sufficient contact information," it added. >>Full Articl

40
Jasper_The_Rasper
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Data Breach at Onsite Mammography Impacts 350,000

Massachusetts medical firm Onsite Mammography discloses data breach impacting the personal information of 350,000 patients. April 23, 2025 By Ionut Arghire Massachusetts medical services provider Onsite Mammography is notifying over 350,000 people that their personal and health information was compromised in a data breach. The incident was discovered in October 2024 and involved unauthorized access to an employee’s email account, the firm reveals in a notification letter mailed to the impacted individuals. Some of the emails in the compromised account’s inbox, Onsite says, exposed both personally identifiable information (PII) and protected health information (PHI). A review of the exposed information that was concluded in February 2025 determined that names, Social Security numbers, dates of birth, driver’s license numbers, credit card numbers, and medical information such as mental and physical health or condition, and received care information was compromised. >>Full Article<<

60
Jasper_The_Rasper
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Ripple NPM supply chain attack hunts for private keys

A mystery thief and a critical CVE involved in crypto cash grab April 23, 2025 By Connor Jones Many versions of the Ripple ledger (XRPL) official NPM package are compromised with malware injected to steal cryptocurrency. The NPM package, xrpl, is a JavaScript/TypeScript library that devs use to interact with and build apps using the cryptocurrency ledger's features. This includes wallet and key management, payment channels, decentralized exchange, escrow, and so on. Xrpl receives a great deal of interest from developers; weekly downloads hit a high of more than 186,000 in April, which offers an indication of how many people may be affected by the recent compromise in the absence of a confirmed number. >>Full Article<<

40
Jasper_The_Rasper
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
ASUS releases fix for AMI bug that lets hackers brick servers

April 23, 2025 By Bill Toulas ASUS has released security updates to address CVE-2024-54085, a maximum severity flaw that could allow attackers to hijack and potentially brick servers. The flaw impacts American Megatrends International's MegaRAC Baseboard Management Controller (BMC) software, used by over a dozen server hardware vendors, including HPE, ASUS, and ASRock. The CVE-2024-54085 flaw is remotely exploitable, potentially leading to malware infections, firmware modifications, and irreversible physical damage through over-volting. "A local or remote attacker can exploit the vulnerability by accessing the remote management interfaces (Redfish) or the internal host to the BMC interface (Redfish)," explained Eclypsium in a related report. "Exploitation of this vulnerability allows an attacker to remotely control the compromised server, remotely deploy malware, ransomware, firmware tampering, bricking motherboard components (BMC or potentially BIOS/UEFI), potential server physical da

60
Jasper_The_Rasper
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Crypto mining campaign targets Docker environments with new evasion technique

April 23, 2025 By Pierluigi Paganini New malware campaign targets Docker environments using unknown methods to secretly mine cryptocurrency, researchers warn. Researchers from Darktrace and Cado Security have spotted a malware campaign that targets Docker environments with a novel technique to mine cryptocurrency. The malware campaign targets Docker environments to deploy a malicious node connected to Teneo, a decentralized infrastructure network. Teneo allows users to earn rewards (Teneo Points) by running Community Nodes that scrape public data from social platforms like Facebook, X, Reddit, and TikTok. These points can be converted to $TENEO tokens. The malware covertly monetizes social media bandwidth via this mechanism. The attack chain begins with a request to launch a container from Docker Hub, specifically the kazutod/tene:ten image. >>Full Article<<

30
Jasper_The_Rasper
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Popular British Retailer Marks & Spencer Addresses 'Cyber Incident'

M&S has launched an investigation and said some customer operations are impacted. April 23, 2025 By Kristina Beek Marks & Spencer has been grappling with a cyber incident for the past few days, it said late yesterday. The update was posted on the London Stock Exchange website, where the company noted that it was forced to make "minor, temporary changes" to its store operations in order to protect the business and its customers. Marks & Spencer has since launched an investigation alongside third-party experts, and reports that it is "taking actions to further protect our network and ensure we can continue to maintain customer service." >>Full Article<<

40
Jasper_The_Rasper
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Chinese Cybercriminals Released Z-NFC Tool for Payment Fraud

April 23, 2025 By Pierluigi Paganini Cybercriminals leverage NFC fraud against ATMs and POS terminals, stealing money from consumers at scale. Resecurity (USA) investigated multiple incidents identified in Q1 2025, exceeding several million dollars in damages for one of the top Fortune 100 financial institutions in the United States due to NFC fraud. Stopping cybercriminals operating from China presents significant challenges due to geopolitical, technical, and organizational factors. Cybersecurity experts identified multiple Chinese cybercriminal groups targeting Google and Apple Wallet customers. Their TTPs center on the abuse of contactless payments and the misuse of the NFC technology to conduct fraud. The analysts from Resecurity’s HUNTER unit identified a group on Telegram offering the Z-NFC tool for sale to facilitate fraudulent transactions. Another tool, called King NFC, was previously marketed on the Dark Web as an alternative. >>Full Article<<

30
Jasper_The_Rasper
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Russian army targeted by new Android malware hidden in mapping app

April 23, 2025 By Bill Toulas A new Android malware has been discovered hidden inside trojanized versions of the Alpine Quest mapping app, which is reportedly used by Russian soldiers as part of war zone operational planning. Attackers promote the trojanized app as a free, cracked version of the premium Alpine Quest Pro, using Telegram channels and Russian app catalogs for distribution. AlpineQuest is a legitimate GPS and topographic mapping app for Android used by adventurers, athletes, search-and-rescue teams, and military personnel, valued for its offline capabilities and precision. The app has two versions: a free Lite version with limited features and a paid Pro version that is free of tracking libraries, analytics, and advertisements. The spyware, which was discovered by researchers at Russian mobile antivirus company Doctor Web, hides inside a fully working Alpine Quest app, reducing suspicion and creating valuable data theft opportunities. Once launched, it attempts to steal co

40
Jasper_The_Rasper
Moderator
C
Administrator
ConnorMThreat Research Analyst
published in Security Industry News
Australian university suffers massive data breachNews

Over the last few months, staff for the Western Sydney University (WSU) in Australia have been investigating a series of security incidents that have led to hackers publishing stolen data from both students and employees. The first incident occurred in November, when an unknown hacker breached the university's network and successfully exfiltrated a significant amount of sensitive information and was only discovered by WSU officials in March. The second incident stemmed from a cyberattack on the WSU single sign-on system in January, with the threat actor being able to compromise data for 10,000 current and former students. ResolverRAT takes aim at healthcare organizations Researchers have been tracking a new remote access malware, known as ResolverRAT, that seems to be taking a specific focus on the healthcare industry. It has been observed as using social engineering tactics to gain initial access to a network, by using localized languages in phishing emails that claim to be regarding

244
Ssherjj
Moderator
TripleHelix
Moderator
TripleHelixModerator
posted in Security Industry News
Google Chrome Stable Channel Update for Desktop Wednesday April 22, 2025

Tuesday, April 22, 2025 The Stable channel has been updated to 135.0.7049.114/.115 for Windows, Mac and 135.0.7049.114 for Linux which will roll out over the coming days/weeks. A full list of changes in this build is available in the Log . https://chromereleases.googleblog.com/search/label/Desktop%20Update Webroot users make sure to re-add back to Privacy Protection!

60
TripleHelix
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Hackers Abuse Cloudflare Tunnel Infrastructure to Deliver Multiple RATs

April 22, 2025 By Tushar Subhra Dutta Cybersecurity experts have identified a sophisticated attack campaign exploiting Cloudflare’s tunnel infrastructure to distribute various remote access trojans (RATs). The infrastructure, which has demonstrated remarkable resilience since February 2024, serves as a distribution platform for malicious files and trojans that enable attackers to gain unauthorized access to victims’ systems. Security vendors including Forcepoint, Fortinet, Orange, and Proofpoint have documented this persistent threat, highlighting its evolving nature and growing impact on organizations worldwide. The primary infection vector begins with deceptive phishing emails containing malicious attachments disguised as invoices or orders. These emails often create false urgency and may include fabricated conversation threads with forged replies to appear legitimate. >>Full Article<<

60
Jasper_The_Rasper
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
SK Telecom warns customer USIM data exposed in malware attack

April 22, 2025 By Bill Toulas South Korea's largest mobile operator, SK Telecom, is warning that a malware infection allowed threat actors to access sensitive USIM-related information for customers. SK Telecom is the largest mobile network operator in South Korea, holding approximately 48.4% of the mobile phone service market in the country, corresponding to 34 million subscribers. The company says they detected malware on their systems at 11 PM local time on Saturday, April 19, 2025, in a weekend cyberattack when most organizations are understaffed. "Once we became aware of the possible leak, we immediately deleted the malware and isolated the equipment suspected of being hacked," reads the security notice. "As of now, there have been no confirmed cases of the leaked information being misused." >>Full Article<<

40
Jasper_The_Rasper
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Whistleblower: DOGE Siphoned NLRB Case Data

April 21, 2025 By Brian Krebs A security architect with the National Labor Relations Board (NLRB) alleges that employees from Elon Musk‘s Department of Government Efficiency (DOGE) transferred gigabytes of sensitive data from agency case files in early March, using short-lived accounts configured to leave few traces of network activity. The NLRB whistleblower said the unusual large data outflows coincided with multiple blocked login attempts from an Internet address in Russia that tried to use valid credentials for a newly-created DOGE user account. The cover letter from Berulis’s whistleblower statement, sent to the leaders of the Senate Select Committee on Intelligence. The allegations came in an April 14 letter to the Senate Select Committee on Intelligence, signed by Daniel J. Berulis, a 38-year-old security architect at the NLRB. NPR, which was the first to report on Berulis’s whistleblower complaint, says NLRB is a small, independent federal agency that investigates and adjudicat

60
Jasper_The_Rasper
Moderator

Latest solutions

Leaderboard

Badges

  • Most Wanted
    Tarnakhas earned the badge Most Wanted
  • Beta To The Max
    Tarnakhas earned the badge Beta To The Max
  • Most Wanted
    Muddy7has earned the badge Most Wanted
  • Beta To The Max
    Muddy7has earned the badge Beta To The Max
  • Beta To The Max
    pierrequiroulehas earned the badge Beta To The Max
Show all badges

Popular Tags

Join the Conversation

Terms & Conditions