👉 What are the latest cybersecurity alerts, incidents, and news?
CISA, Cisco, Smart Install, MongoDB, Windows, Downgrade Attack, North Korea, APT, Kimsuky, Phishing, STAC6451, MSSQL, India, ADT, Breach, Sensitive Information, easySim, Server, Netflix, Arcane, Heartstopper, Episodes Leak, City of Killeen, Texas, BlackSuit, Ransomware, Kursk Region, Russia, DDoS, Ukraine, United Nations, Cybercrime Treaty, Nashville, North Korea, US, Tech Jobs, Iran, Fake News, 2024, US Election Voters, Malaysia, Banks, Malware Shielding, Turkey, Roblox Ban.
Listen to the full podcast
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning about cybercriminals exploiting the legacy Cisco Smart Install (SMI) feature to gain unauthorized access to sensitive data. This tactic involves acquiring system configuration files, which could lead to deeper compromises of victim networks. CISA has also noted the continued use of weak password types on Cisco network devices, making them vulnerable to password-cracking attacks.
A critical vulnerability, identified as CVE-2024-7553, has been discovered in MongoDB, posing a significant threat to Windows systems. This flaw, which arises from improper validation of files loaded from a local untrusted directory, could allow attackers to escalate privileges and gain complete control over affected systems. The vulnerability impacts several versions of MongoDB Server, C Driver, and PHP Driver.
A new security threat has been identified in Windows operating systems, revealing that fully-updated systems may still be vulnerable to downgrade attacks. Security researcher Alon Leviev from SafeBreach has demonstrated how the ‘Windows Downdate’ tool exploits flaws in the Windows Update process to perform undetectable and irreversible downgrades on critical OS components. This attack bypasses built-in security measures and reintroduces previously patched vulnerabilities, affecting components like Credential Guard and Hyper-V’s hypervisor.
North Korean APT group Kimsuky has intensified its espionage operations by targeting universities worldwide through sophisticated phishing attacks. According to a recent advisory from Resilience, Kimsuky has been posing as academics or journalists to infiltrate university networks and steal sensitive data, including research and login credentials. The group’s activities, which align with the goals of North Korea’s Reconnaissance General Bureau, focus on extracting valuable information related to scientific research and technology.
A newly identified hacker group, STAC6451, has been targeting Microsoft SQL (MSSQL) servers, particularly in India, to compromise organizations and deploy ransomware. By exploiting exposed MSSQL servers, the group uses weak credentials to gain unauthorized access and enable the xp_cmdshell stored procedure, allowing them to execute arbitrary commands.
ADT Inc. has reported a data breach involving unauthorized access to customer order databases, exposing limited personal information such as email addresses, phone numbers, and postal addresses. The company acted swiftly to contain the breach and enlisted third-party cybersecurity experts to investigate. ADT reassures customers that no sensitive financial information was compromised, and its home security systems remained secure.
easySim has disclosed a recent security breach involving unauthorized access to one of its servers. The company confirmed that a small number of customer records were compromised, including names, email addresses, and in a few cases, telephone numbers. Despite this, no sensitive data such as passwords or payment details was exposed. The attacker contacted some affected customers via email, prompting easySim to advise vigilance against suspicious messages.
Netflix is facing a major crisis following a significant data breach that resulted in the leak of several unreleased shows and movies online. The breach, which occurred on August 7 and 8, exposed full, unfinished episodes of highly anticipated series such as Arcane Season 2 and Heartstopper Season 3. The breach is attributed to a compromise at one of Netflix’s post-production partners, leading to unauthorized distribution of the content. Netflix has responded aggressively, working to remove the leaked material and track down those responsible.
The City of Killeen, Texas, is recovering from a cyberattack attributed to the BlackSuit Ransomware, which occurred on August 7, 2024. The breach mainly affected internal systems, causing temporary disruptions in essential services, particularly at the Utility Collections division. Although the City has taken swift measures to secure its systems and prevent further access, it does not currently believe that residents’ personal or financial information has been compromised.
On August 8, 2024, Russia’s Kursk region experienced a massive distributed denial-of-service (DDoS) attack, reportedly amidst a surprise Ukrainian incursion. The attack targeted government and business websites, as well as critical infrastructure, causing temporary disruptions in online services. According to Russia’s digital ministry, the attack peaked with over 100,000 junk requests per second, although larger DDoS attacks can involve millions of requests. The ministry confirmed that despite the intensity of the attack, e-government services remained secure, with no access to user data compromised.
📢 Cyber News
On August 8, 2024, the United Nations passed its first global cybercrime treaty in a historic unanimous vote by the Ad Hoc Committee on Cybercrime. This landmark agreement, initially proposed by Russia, establishes an international legal framework for addressing cybercrime and facilitating cross-border data access. The treaty, which aims to enhance global cooperation in combating digital threats, will next be presented to the General Assembly for approval this fall.
Matthew Isaac Knoot, a 38-year-old from Nashville, Tennessee, has been charged by the U.S. Department of Justice with multiple offenses, including conspiracy to commit wire fraud and aggravated identity theft. Knoot allegedly operated a “laptop farm” to facilitate remote IT jobs for North Korean nationals using stolen U.S. identities. This scheme, which reportedly helped fund North Korea’s weapons program, involved Knoot hosting company laptops, installing unauthorized software, and laundering payments.
Microsoft’s Threat Analysis Center (MTAC) has uncovered a sophisticated campaign by Iranian state-linked groups aimed at influencing the 2024 U.S. presidential election. The report reveals that these operatives have launched fake news websites designed to polarize voters and conduct phishing attacks against political campaigns. Two notable sites, “Nio Thinker” and “Savannah Time,” target left- and right-leaning voters respectively with inflammatory and divisive content.
Malaysian banks are enhancing security for mobile banking users by introducing a new feature called “malware shielding,” effective from August 9, 2024. This feature aims to protect customers’ funds and prevent unauthorized transactions by detecting high-risk malware and suspicious remote access on their devices. When threats are identified, access to banking apps will be temporarily restricted.
Turkey has banned the popular children’s game Roblox, citing concerns over inappropriate content and child exploitation. The ban follows a similar action against Instagram on August 2, 2024, which was reportedly due to the platform’s censorship of posts related to the death of Hamas official Ismail Haniyeh. Turkish authorities criticized Instagram’s actions as “digital fascism,” and have now taken action against Roblox after discovering problematic virtual gatherings and content on the gaming platform.
Copyright © 2024 CyberMaterial. All Rights Reserved.
