👉 What’s happening in cybersecurity today?
Python Package, macOS, Google Cloud Logins, SideWinder APT, Asia, Maritime Facilities, Phishing, Gh0st RAT, China, Windows Users, Fake Chrome, Void Banshee, MSHTML, Atlantida, Microsoft Office, Phishing Attack, Spytech, Casper Network, Vivamax, Personal Information, Philippines, Department of Energy, Dhaka Stock Exchange, UK, Quantum Hubs, Tony Burke, Australia, Cybersecurity Minister, Malaysia, Kill Switch Law, Russia, India, China, Cyber Firms, Iran Agreement, Europe, AI Controls
Listen to the full podcast
Cybersecurity researchers at Checkmarx have uncovered a malicious Python package, “lr-utils-lib,” targeting macOS developers to steal Google Cloud Platform (GCP) credentials. The package contains hidden code in the setup.py file that activates during installation, specifically targeting macOS by checking the system’s type and IOPlatformUUID against a list of predefined hashes. Once a match is found, the malware exfiltrates sensitive data to a remote server.
Researchers have uncovered a new campaign by the SideWinder APT group, targeting maritime facilities in the Indian Ocean and Mediterranean Sea. The campaign, believed to be aimed at espionage, targets countries such as Pakistan, Egypt, and Sri Lanka, with potential expansion to Bangladesh, Myanmar, Nepal, and the Maldives. SideWinder uses sophisticated spear-phishing tactics, leveraging older vulnerabilities in Microsoft Office to gain initial access.
The Gh0st RAT Trojan has been observed targeting Chinese-speaking Windows users through a deceptive drive-by download scheme involving a fake website, “chrome-web[.]com.” The site masquerades as the Google Chrome browser and distributes a malicious installer named “WindowsProgram.msi.” This installer deploys Gh0stGambit, which then retrieves the Gh0st RAT malware from a command-and-control server.
Hackers are leveraging the MSHTML vulnerability CVE-2024-38112 to deploy Atlantida InfoStealer malware, according to recent reports. The threat actor Void Banshee has ingeniously exploited this flaw, which affects Internet Explorer’s rendering engine even though the browser itself is disabled. The attack vector involves enticing users with downloadable archives claiming to contain PDF books. Once these files are opened, Atlantida malware is activated, targeting sensitive login information from applications like Telegram, Steam, and various cryptocurrency wallets.
Cybercriminals are increasingly leveraging Microsoft Office Forms to execute sophisticated two-step phishing attacks, targeting users’ Microsoft 365 (M365) credentials. By crafting seemingly legitimate forms that contain harmful links, attackers impersonate reputable brands like Adobe or Microsoft, tricking victims into revealing their login information. These forms, which often appear as requests for password changes or document access, are designed to bypass traditional email security measures by using compromised legitimate accounts, making the malicious emails harder to detect.
Spytech, a Minnesota-based spyware provider, has been hacked, leading to the exposure of sensitive data from over 10,000 devices, including Windows PCs, Macs, Android devices, and Chromebooks. The breach revealed detailed logs of device activity, including keystrokes, browsing history, and precise geolocation data. The spyware, which is marketed for parental and spousal monitoring, had its data logs unencrypted, raising serious concerns about the company’s security practices.
The Casper Network has paused all operations following a significant cyberattack detected on July 29, 2024. The breach, which led to the immediate suspension of transactions, minting, and staking at block 3,329,418, prompted a swift response from the Casper Association, Casper Labs, and network validators. These teams are collaborating to address the security issues, with a detailed post-mortem report and code updates planned for release.
Vivamax, a leading mature video streaming service, has recently faced a significant data breach. The attack exposed 2.08GB of subscriber data, including over 6.8 million records containing personal and transactional details such as full names, phone numbers, email addresses, subscription IDs, and parental control PINs. The breach, which involved unauthorized access through API scraping of authenticated admin privileges, has led to the compromised data being listed for sale.
On July 27, 2024, the Philippine Department of Energy (DoE) reported a security breach on its Government Energy Management Program website. The attack, which occurred around 6 p.m., led to the defacement of the site. In response, the DoE took the affected system offline and is collaborating with the National Computer Emergency Response Team (NCERT) and the website’s developer to address vulnerabilities.
The Dhaka Stock Exchange (DSE), Bangladesh’s primary capital market, has shut down its website due to concerns over a potential cyber attack. The closure, which began on the morning of July 26, 2024, follows ongoing threats and previous unsuccessful hacking attempts against the site. DSE officials, citing a “national threat,” decided to take the website offline as a precautionary measure to safeguard data and ensure security. The DSE is working to address the threat and is expected to resume operations by July 28, pending successful security assessments.
📢 Cyber News
The UK government has unveiled a significant investment of over £100 million ($128.6 million USD) to establish five new quantum research hubs across Glasgow, Edinburgh, Birmingham, Oxford, and London. These hubs will focus on advancing quantum technologies in critical areas such as healthcare, cybersecurity, and transport. Key projects include developing advanced medical scanners, secure communication networks, and next-generation positioning systems.
Australia’s Prime Minister Anthony Albanese has appointed Tony Burke as the new Minister for Cybersecurity and Home Affairs in a significant cabinet reshuffle announced on July 28, 2024. Burke, who retains his roles in immigration, multicultural affairs, and as Minister for the Arts and Leader of the House, replaces Clare O’Neil, who moves to the housing portfolio. This reshuffle also introduces Julie Collins as Minister for Agriculture, Fisheries, and Forestry, and establishes a new advisory role for MP Andrew Charlton as Special Envoy for Cybersecurity and Digital Resilience.
Malaysia is set to introduce groundbreaking online safety legislation this October, announced by Datuk Seri Azalina Othman Said, Minister in the Prime Minister’s Department (Law and Institutional Reform). The new law will mandate social media and internet messaging service providers to take responsibility for combating online crimes, including scams, cyberbullying, and the dissemination of harmful materials. The legislation aims to enhance cybersecurity by implementing a ‘kill switch’ mechanism, similar to measures adopted in other countries.
Three major cybersecurity firms from Russia, India, and China Positive Technologies, Acron, and Sangfour are set to begin operations in Iran. Under a new agreement with the AFTA Center for Strategic Management, these companies will provide managed threat detection and response (MDR) services within the country. This arrangement requires the firms to supply their cybersecurity products and designate an official domestic representative with full legal authority in Iran.
A recent Sapio Research Finance Pulse report has highlighted a significant gap in AI governance among European businesses. While 93% of organizations recognize the risks associated with AI, such as data security, lack of accountability, and skills gaps, only 46% have formal guidelines for acceptable AI use. The study also found that just 48% of companies restrict the type of data inputted into AI tools and less than two-fifths enforce strict access controls.
Copyright © 2024 CyberMaterial. All Rights Reserved.
