North Korea-linked ScarCruft APT uses large LNK files in infection chains

North Korea-linked ScarCruft APT group started using oversized LNK files to deliver the RokRAT malware starting in early July 2022.

Check Point researchers reported that the infection chains observed in the attacks attributed to North Korea-linked ScarCruft APT group (aka …

CISA adds TP-Link, Apache, and Oracle bugs to its Known Exploited Vulnerabilities catalog

US Cybersecurity and Infrastructure Security Agency (CISA) added TP-Link, Apache, and Oracle vulnerabilities to its Known Exploited Vulnerabilities catalog.

U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added the following three new issues to its Known Exploited Vulnerabilities Catalog:

CVE-2023-1389

New Lobshot hVNC malware spreads via Google ads

The previously undetected LOBSHOT malware is distributed using Google ads and gives operators VNC access to Windows devices.

Researchers from Elastic Security Labs spotted a new remote access trojan dubbed LOBSHOT was being distributed through Google Ads.

Threat actors are …

T-Mobile suffered the second data breach in 2023

T-Mobile disclosed the second data breach of 2023, threat actors had access to the personal information of hundreds of customers since February.

T-Mobile suffered the second data breach of 2023, threat actors had access to the personal information of hundreds …

Experts spotted a new sophisticated malware toolkit called Decoy Dog

Infoblox researchers discovered a new sophisticated malware toolkit, dubbed Decoy Dog, targeting enterprise networks.

While analyzing billions of DNS records, Infoblox researchers discovered a sophisticated malware toolkit, dubbed Decoy Dog, that was employed in attacks aimed at enterprise networks.

Threat actors behind …

Iranian govt uses BouldSpy Android malware for internal surveillance operations

Iranian authorities have been spotted using the BouldSpy Android malware to spy on minorities and traffickers.

Researchers at the Lookout Threat Lab have discovered a new Android surveillance spyware, dubbed BouldSpy, that was used by the Law Enforcement Command of …

Russian APT Nomadic Octopus hacked Tajikistani carrier

Russian APT group Nomadic Octopus hacked a Tajikistani carrier to spy on government officials and public service infrastructures.

Russian cyber espionage group Nomadic Octopus (aka DustSquad) has hacked a Tajikistani telecoms provider to spy on 18 entities, including high-ranking government …

Google banned 173k developer accounts in 2022

In 2022, Google prevented 1.43 million policy-violating apps from being published in the official Google Play store.

Google announced that it prevented 1.43 million policy-violating applications from being published on Google Play in 2022. The IT giant also announced it …

Crooks broke into AT&T email accounts to empty their cryptocurrency wallets

Threat actors are gaining access to AT&T email accounts in an attempt to hack into the victim’s cryptocurrency exchange accounts.

Hackers are breaking into the AT&T email accounts and then using the access they are logging into the victim’s cryptocurrency …

Russia-linked APT28 uses fake Windows Update instructions to target Ukraine govt bodies

CERT-UA warns of a spear-phishing campaign conducted by APT28 group targeting Ukrainian government bodies with fake ‘Windows Update’ guides.

Russia-linked APT28 group is targeting Ukrainian government bodies with fake ‘Windows Update’ guides, Computer Emergency Response Team of Ukraine (CERT-UA) warns. …

White hat hackers showed how to take over a European Space Agency satellite

Thales cybersecurity researchers have shown this week how they seized control of a European Space Agency (ESA) satellite.

This week, during the third edition of CYSAT, the European event dedicated to cybersecurity for the space industry, the European Space Agency …

Security Affairs newsletter Round 417 by Pierluigi Paganini – International edition

A new round of the weekly SecurityAffairs newsletter arrived! Every week the best security articles from Security Affairs are free for you in your email box.

Enjoy a new round of the weekly SecurityAffairs newsletter, including the international press.

ViperSoftX

ViperSoftX uses more sophisticated encryption and anti-analysis techniques

A new variant of the information-stealing malware ViperSoftX implements sophisticated techniques to avoid detection.

Trend Micro researchers observed a new ViperSoftX malware campaign that unlike previous attacks relies on DLL sideloading for its arrival and execution technique.

Atomic macOS Stealer is advertised on Telegram for $1,000 per month

Atomic macOS Stealer is a new information stealer targeting macOS that is advertised on Telegram for $1,000 per month.

Cyble Research and Intelligence Labs (CRIL) recently discovered a Telegram channel advertising a new information-stealing malware, named Atomic macOS Stealer (AMOS). …

CISA warns of a critical flaw affecting Illumina medical devices

U.S. CISA released an Industrial Control Systems (ICS) medical advisory warning of a critical flaw affecting Illumina medical devices.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has released an Industrial Control Systems (ICS) medical advisory warning of vulnerabilities that …

OpenAI reinstates ChatGPT service in Italy after meeting Garante Privacy’s demands

OpenAI announced that access to its chatbot service ChatGPT is allowed again in Italy after the company met the demands of regulators.

OpenAI restored access to ChatGPT in Italy after the company met the demands of the Italian Data Protection …

Cisco discloses a bug in the Prime Collaboration Deployment solution

Cisco is working on a patch for a bug in the Prime Collaboration Deployment solution that was reported by a member of NATO’s Cyber Security Centre (NCSC).

Cisco informed its customers that it’s working on a patch for cross-site scripting …

Zyxel fixed a critical RCE flaw in its firewall devices and urges customers to install the patches

A vulnerability impacting Zyxel firewalls, tracked as CVE-2023-28771, can be exploited to execute arbitary code on vulnerable devices.

Researchers from TRAPA Security have discovered a critical remote code execution vulnerability, tracked as CVE-2023-28771 (CVSS score 9.8), impacting Zyxel Firewall.

The …

Ukraine cyber police arrested a man for selling data of 300M people

The Ukrainian cyber police arrested a Ukraine man for selling the data of over 300 million people from different countries.

The Ukrainian cyber police have arrested a man (36) from the city of Netishyn for selling the personal data and …

文 » A