👉 What are the latest cybersecurity alerts, incidents, and news?
HTML Smuggling, DCRat, WalletConnect, Google Play, Cryptocurrency, Android, CUPS, Linux, Watering Hole, Kurdistan Websites, NVIDIA, Container Toolkit, Host Access, Richardson Texas, Operational Disruptions, Kuwait Health Ministry, Tulsa Oklahoma, Email Scam, Naperville High School, Confidential Student Information, Zacros, Japan, Ransomware, CISA, Guide, Active Directory, Pennsylvania, Fraud Legislation, NATO Azerbaijan Cooperation, Cybersecurity, US Sanctions, Cryptocurrency Exchanges, Russia, WordPress, WP Engine.
Listen to the full podcast
🚨 Cyber Alerts
A new cybercrime campaign is targeting Russian-speaking users by delivering the DCRat (DarkCrystal RAT) malware through a technique known as HTML smuggling. This method marks a shift from traditional tactics like phishing emails and macro-laced attachments. Attackers use malicious HTML files, disguised as trusted platforms like TrueConf and VK, to smuggle a password-protected ZIP archive into victims’ systems. Once opened, the archive deploys DCRat, a powerful backdoor trojan capable of executing commands, logging keystrokes, and stealing credentials.
A malicious app posing as “WalletConnect” was discovered on Google Play, stealing cryptocurrency from Android users. The fake app, called “WallConnect,” mimicked the legitimate Web3 tool and was available for five months, amassing over 10,000 downloads through fake reviews. Once installed, the app redirected users to a malicious website where they unknowingly authorized transactions, resulting in the theft of sensitive wallet information and digital assets. At least 150 victims lost over $70,000 in total.
Recent vulnerabilities in the Common UNIX Printing System (CUPS) could enable remote code execution on unprotected Linux machines. Discovered by Simone Margaritelli and tracked as CVE-2024-47076 and others, these flaws require the cups-browsed daemon to be enabled, which is typically not the case in default configurations. Attackers can exploit this by advertising a malicious PostScript Printer Description (PPD), tricking users into printing and executing harmful commands.
A recent watering hole attack has targeted approximately 25 websites associated with the Kurdish minority, compromising them to harvest sensitive information over the past year and a half. Disclosed by French cybersecurity firm Sekoia, this long-running campaign, dubbed “SilentSelfie,” was first detected in December 2022 and involved the delivery of four different variants of an information-stealing framework. These attacks primarily affected Kurdish media, the Rojava administration, and various revolutionary political organizations, utilizing malicious JavaScript to gather data on site visitors, including their location and device information.
A critical security vulnerability has been identified in the NVIDIA Container Toolkit that could allow attackers to escape container confines and gain full access to the underlying host system. Tracked as CVE-2024-0132, this vulnerability has a CVSS score of 9.0, indicating a severe risk. It affects all versions of the toolkit up to v1.16.1 and the NVIDIA GPU Operator up to version 24.6.1, allowing threat actors to execute arbitrary commands on the host system with root privileges.
💥 Cyber Incidents
Richardson City in Texas has fallen victim to a cyberattack that has significantly disrupted its operations. An external party gained access to the city’s servers early Wednesday morning, attempting to encrypt data files within the network. Although a small number of files were compromised, city security systems successfully prevented further damage. While officials are still assessing the nature of the affected data, they report no indications that sensitive information was accessed.
Kuwait’s Health Ministry is actively recovering from a cyberattack that disrupted operations at several hospitals and rendered the Sahel healthcare app inoperable. As of Thursday afternoon, the Ministry of Health’s website remains down, but officials have utilized backups to restore systems at the Kuwait Cancer Control Center and other health insurance management offices. Despite the impact, officials assured the public that essential healthcare services continue to operate.
The City of Tulsa, Oklahoma, has reported a significant financial loss of $191,972 due to an email hacking scheme that compromised vendor communication. The fraudulent activity occurred during the transfer of hotel tax funds intended for tourism promotion, leading to the inadvertent deposit of taxpayer money into a counterfeit bank account on April 4, 2024. As the FBI investigates the incident, city officials have confirmed that the vendor’s email used for the payment was hacked, prompting the city to strengthen its vendor change processes.
A significant data leak occurred at Naperville Central High School in Illinois, unintentionally exposing confidential student information as part of the School Improvement Plan released on September 20, 2024. The leak included sensitive data such as student grades, IEP and 504 status, and eligibility for free and reduced lunch, affecting all 2,433 students enrolled for the 2023-24 academic year. The breach was discovered by Central Times staff, prompting a swift response from Principal Jackie Thornton and District 203, who promptly removed the documents and initiated a thorough review of data privacy measures.
On September 14, 2024, Zacros, also known as Fujimori Kogyo Co., Ltd., reported a ransomware attack that compromised its production management and core systems, leading to the encryption of sensitive information. Despite receiving a ransom demand from the attackers, the company opted not to comply, demonstrating resilience in the face of cyber threats. Zacros has isolated the affected systems and initiated forensic investigations while implementing a backup system to restore operations.
📢 Cyber News
The Cybersecurity and Infrastructure Security Agency (CISA), in collaboration with several international cybersecurity organizations, has released a comprehensive guide aimed at detecting and mitigating compromises in Active Directory systems. This guide highlights the common techniques employed by cybercriminals to exploit vulnerabilities in Active Directory, including Kerberoasting, AS-REP Roasting, and password spraying.It offers robust mitigation strategies such as implementing Microsoft’s Enterprise Access Model and minimizing service principal names (SPNs) to protect high-access user objects.
As cyber fraud targeting senior citizens escalates, Pennsylvania is taking proactive measures by introducing House Bill 2064, which empowers banks to identify and halt suspicious transactions. This legislation, currently under consideration in the Senate, has garnered significant bipartisan support and aims to fill gaps in fraud protection often overlooked by the federal Consumer Financial Protection Bureau. Similar initiatives are underway in Florida, California, Connecticut, Maine, and Delaware, with states implementing varying degrees of liability for banks that fail to protect vulnerable seniors.
On September 25 and 26, 2024, NATO’s Science for Peace and Security (SPS) Programme convened in Baku, Azerbaijan, to assess ongoing scientific collaborations and launch a new project aimed at enhancing the protection of critical infrastructure from cyber-attacks. The initiative will develop a cyber platform enabling organizations to train personnel, test innovative technologies, and evaluate their systems under simulated cyber threats. This two-year project will be a collaborative effort between the National Institute for Research and Development in Informatics in Romania and Azerbaijan’s Special Communication and Information Security State Service.
On September 27, 2024, the U.S. government announced sanctions against two cryptocurrency exchanges, Cryptex and PM2BTC, for their alleged roles in facilitating cybercrime and money laundering. This action, part of Operation Endgame, followed an indictment against a Russian national linked to money laundering services for cybercriminals. The exchanges are accused of laundering cryptocurrencies connected to illegal activities, including ransomware attacks, and have reportedly received over $720 million in transactions related to such crimes.
In a significant move within the WordPress ecosystem, WordPress.org has banned hosting provider WP Engine from accessing its resources, including themes and plugins. This decision, announced by WordPress co-creator Matt Mullenweg, stems from legal disputes and allegations that WP Engine seeks to control the WordPress experience through its proprietary systems. As a result, WP Engine customers are now unable to install or update plugins and themes, potentially leaving their sites vulnerable to security risks.
Copyright © 2024 CyberMaterial. All Rights Reserved.
