Nastiest Malware 2023
News, Announcements, Tech Discussions
September 20, 2024 By Bill Toulas Dell has confirmed to BleepingComputer that they are investigating recent claims that it suffered a data breach after a threat actor leaked the data for over 10,000 employees.The allegations were published yesterday by a threat actor named "grep," who alleges that the computing vendor suffered a "minor data breach" in September 2024, exposing internal employee and partner information.In a post to a hacking forum, the threat actor says the stolen data includes employees' unique identifiers, full names of employees for Dell and partners, status of employees (active or not), and an internal identification string.Alleged Dell data leaked on a hacking forumSource: BleepingComputer >>Full Article<<
Earlier this month, officials for Kawasaki Motors Europe (KME) fell victim to a cyberattack which forced several of their systems to be taken offline while a full investigation was conducted. Shortly after the incident, the threat actors behind the RansomHub ransomware group added KME to their leak site, claiming to have a data trove of 487GB of stolen data which would be released if their demands are met by the deadline.Construction firms compromised in Foundation accounting hackRecently, staff for a variety of firms across the construction industry, from HVAC to plumbing and other sub-contracting services have confirmed network intrusions due to their mutual usage of the accounting software, Foundation. Officials for Foundation have revealed that their systems are being exploited by hackers who are brute forcing credentials for their systems administrator accounts to compromise client’s SQL servers. Unfortunately, many of these clients have used the default credentials for Foundation
Fri 20 Sep 2024 // 00:33 UTC Write better code, urges Jen Easterly. And while you're at it, give crime gangs horrible names like 'Evil Ferret'Software developers who ship buggy, insecure code are the true baddies in the cyber crime story, Jen Easterly, boss of the US government's Cybersecurity and Infrastructure Security Agency, has argued."The truth is: Technology vendors are the characters who are building problems" into their products, which then "open the doors for villains to attack their victims," declared Easterly during a Wednesday keynote address at Mandiant's mWise conference.Easterly also implored the audience to stop "glamorizing" crime gangs with fancy poetic names. How about "Scrawny Nuisance" or "Evil Ferret," Easterly suggested.Even calling security holes "software vulnerabilities" is too lenient, she added. This phrase "really diffuses responsibility. We should call them 'product defects,'" Easterly said. And instead of automatically blaming victims for failing to patc
January 8, 2024 By Brian Krebs In 2020, the United States brought charges against four men accused of building a bulletproof hosting empire that once dominated the Russian cybercrime industry and supported multiple organized cybercrime groups. All four pleaded guilty to conspiracy and racketeering charges. But there is a fascinating and untold backstory behind the two Russian men involved, who co-ran the world’s top spam forum and worked closely with Russia’s most dangerous cybercriminals.From January 2005 to April 2013, there were two primary administrators of the cybercrime forum Spamdot (a.k.a Spamit), an invite-only community for Russian-speaking people in the businesses of sending spam and building botnets of infected computers to relay said spam. The Spamdot admins went by the nicknames Icamis (a.k.a. Ika), and Salomon (a.k.a. Sal). Spamdot forum administrator “Ika” a.k.a. “Icamis” responds to a message from “Tarelka,” the botmaster behind the Rustock botnet. Dmsell said: “I’m ac
September 19, 2024Microsoft has released the latest Microsoft Edge Stable Channel (Version 129.0.2792.52) and Microsoft Edge Extended Stable Channel (128.0.2739.90) which incorporate the latest updates of the Chromium project.This update contains the following Microsoft Edge-specific updates:CVE-2024-43489 CVE-2024-43496 CVE-2024-38221 https://learn.microsoft.com/en-us/DeployEdge/microsoft-edge-relnotes-security Make sure to re-add back in the Privacy Protection area after every update. Click on GIF to see full size!
September 19, 2024 By Pierluigi Paganini An international law enforcement operation infiltrated the encrypted messaging app Ghost, which was widely used by criminals, resulting in the arrest of dozens of individuals.An international law enforcement operation infiltrated the encrypted communications app Ghost, designed for criminal use, leading to numerous arrests. The alleged administrator of the app, Jay Je Yoon Jung (32), was charged with supporting a criminal organization and profiting from illegal activities. Jung remains in custody.Ghost encrypted messaging platform was created about nine years ago, but it became a target for law enforcement in 2022.The Ghost app supports advanced security features, it allowed thousands of customers subscribing the service by paying in cryptocurrency. The app supported three layers of encryption and message self-destruction system that erased messages from both the sender’s and recipient’s devices. >>Full Article<<
CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation.CVE-2024-8963 Ivanti Cloud Services Appliance (CSA) Path Traversal VulnerabilityThese types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the Known Exploited Vulnerabilities Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the BOD 22-01 Fact Sheet for more information.Although BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizi
September 19, 2024 By Bill Toulas The Tor Project is attempting to assure users that the network is still safe after a recent investigative report warned that law enforcement from Germany and other countries are working together to deanonymize users through timing attacks.The team behind the specialized web browser claims that adequate protections are in place for those using the latest versions of its tools, noting that timing analysis is a known technique for which effective mitigations exist. >>Full Article<<
September 19, 2024 By Sergiu Gatlan A joint law enforcement operation has dismantled an international criminal network that used the iServer automated phishing-as-a-service platform to unlock the stolen or lost mobile phones of 483,000 victims worldwide. The global operation, codenamed "Operation Kaerb," began in 2022 after Europol received information from cybersecurity firm Group-IB, which contributed to identifying the victims and the criminals behind the phishing network.According to Group-IB's findings, the iServer platform automated phishing attacks by creating malicious pages that mimicked popular cloud-based mobile platforms."Operation Kaerb" involved law enforcement and judicial authorities from Spain, Argentina, Chile, Colombia, Ecuador, and Peru.They discovered 483,000 victims globally, primarily Spanish-speaking individuals from Europe, North America, and South America, who were phished while attempting to regain access to their devices.iServer's crimeware-as-a-service mode
September 19, 2024 By Connor Jones Germany's Federal Office for Information Security (BSI) says one in ten organizations in the country affected by CrowdStrike's outage in July are dropping their current vendor's products.Four percent of organizations have already abandoned their existing solutions, while a further 6 percent plan to do so in the near future. It wasn't explicitly said whether this referred to CrowdStrike's Falcon product specifically or was a knee-jerk reaction to security vendors generally.One in five will also change the selection criteria when it comes to reviewing which security vendor gets their business.The whole fiasco doesn't seem to have hurt the company much though, at least not yet. >>Full Article<<
Iranian hackers sought to interest President Joe Biden’s campaign in information stolen from rival Donald Trump’s campaign. September 19, 2024 By Associated Press Iranian hackers sought to interest President Joe Biden’s campaign in information stolen from rival Donald Trump’s campaign, sending unsolicited emails to people associated with the then-Democratic candidate in an effort to interfere in the 2024 election, the FBI and other federal agencies said Wednesday.There’s no indication that any of the recipients responded, officials said, and several media organizations who have said they also were approached with stolen material did not publish it. Kamala Harris’ presidential campaign called the emails from Iran “unwelcome and unacceptable malicious activity” that were received by only a few people who regarded them as spam or phishing attempts.The emails were received before the hack of the Trump campaign was publicly acknowledged, and there’s no evidence the recipients of the emails
Hackers sent a convincing lure document, but after 20 years of similar attacks, the target organization was well prepared. September 19, 2024 By Nate Nelson A meeting of influential figures in and around the US and Taiwanese defense industries has been targeted by a phishing attack carrying fileless malware.The 23rd US-Taiwan Defense Industry Conference will be held next week in Philadelphia's Logan Square neighborhood. Closed to the press, it will feature speakers from government, defense, academia, and commercial sectors in the US and Taiwan. The focus, according to its website, will be "addressing the future of US defense cooperation with Taiwan, the defense procurement process, and Taiwan's defense and national security needs."Recently, the US-Taiwan Business Council — the organization behind the event — was sent a malicious forgery of its own registration form. The form was paired with information-stealing malware designed to execute entirely in memory, making it more difficult to
September 19, 2024 By Pierluigi Paganini Russian anti-virus firm Doctor Web (Dr.Web) disconnected all servers following a cyberattack over the weekend.This week, the Russian anti-malware firm Doctor Web (Dr.Web) announced that it had disconnected all servers following a cyberattack on Saturday, September 14.The company revealed it has detected “signs of unauthorised interference” to its IT infrastructure. The company pointed out that the security breach had no impact on its customers.“On Saturday, September 14, Doctor Web specialists recorded a targeted attack on the company’s resources. The attempt to harm our infrastructure was prevented in a timely manner, and no user whose system was protected by Dr.Web was affected.” reads a statement published by the company. >>Full Article<<
