👉 What are the latest cybersecurity alerts, incidents, and news?
North Korea, Malicious, npm Packages, Rocinante Malware, Brazil, Banking Customers, Android Devices, Cobalt Strike, Payloads, Chinese, Businesses, AVTECH, IP Camera, Botnet, Malware, Distribution, Confluence, Crypto Mining, RansomHub, Breach, Sensitive Information, Kylian Mbappé, Twitter, Fake Cryptocurrency, Scam, Durex, India, Texas Dow Credit Union, Iowa, Pharmacy, Patient Information, SANS Institute, ICS/OT, Security Guide, EU, WiFi, Enhancement, Google, Data Center, Expansion, Ho Chi Minh, CATL, US, Lawmaker Scrutiny, Security Risks, Atlassian, Rewatch, AI Meeting Bots, Loom Integration
Listen to the full podcast
🚨 Cyber Alerts
North Korean hackers have launched a new campaign targeting developers by publishing malicious npm packages to the registry between August 12 and 27, 2024. These packages, including temp-etherscan-api, telegram-con, and helmet-validate, are linked to the “Contagious Interview” campaign, which lures developers into downloading malware disguised as legitimate tools. The ultimate goal is to deploy the Python-based InvisibleFerret malware, which steals sensitive data from cryptocurrency wallets and establishes persistence using legitimate remote desktop software like AnyDesk.
Rocinante, a new strain of banking malware, is targeting Brazilian financial institutions by hijacking Android devices remotely. Discovered by cybersecurity researchers at ThreatFabric, Rocinante leverages the Android Accessibility Service to log keystrokes, create phishing screens that mimic legitimate banks, and steal personally identifiable information (PII). The malware is primarily distributed through phishing websites, with malicious APKs masquerading as security updates or banking apps.
A new cyberattack campaign, codenamed SLOW#TEMPEST, has been targeting Chinese-speaking businesses using sophisticated Cobalt Strike payloads. Researchers at Securonix discovered that the attackers deploy malicious ZIP files through phishing emails, which, when unpacked, initiate a chain of infections on Windows systems. The malware, disguised as a Microsoft Word document, employs DLL side-loading to execute a Cobalt Strike implant, granting persistent and stealthy access to compromised devices.
A critical vulnerability in AVTECH IP cameras, identified as CVE-2024-7029, has been exploited by cybercriminals to recruit devices into a botnet. This high-severity command injection flaw, affecting firmware versions up to FullImg-1023-1007-1011-1009, allows remote code execution and has been weaponized to spread a variant of the Mirai botnet known as Corona. Despite the vulnerability being publicly documented and a proof-of-concept exploit available since February 2019, a formal CVE designation and patch have only recently been issued.
Threat actors are exploiting a critical vulnerability in Atlassian Confluence Data Center and Server, identified as CVE-2023-22527, to conduct illicit cryptocurrency mining on compromised systems. This flaw, which allows unauthenticated remote code execution, was patched in January 2024 but remains a significant threat as attackers deploy XMRig miners and employ various tactics to maintain persistence and evade detection. Trend Micro has reported a surge in exploitation attempts between mid-June and July 2024, highlighting the ongoing risks associated with unpatched Confluence instances.
💥 Cyber Incidents
The Florida Department of Health has informed citizens that their sensitive data has been compromised following a major breach by the ransomware group RansomHub. Discovered on June 26, 2024, the attack resulted in the theft of 100 gigabytes of data, including personal details like names, Social Security numbers, and banking information. The breach targeted the department’s vital statistics system used for issuing birth and death certificates.
On August 29, 2024, soccer star Kylian Mbappé’s Twitter account was hijacked by hackers who used it to promote a fraudulent cryptocurrency token named MBAPPE. The scam saw the token’s value surge to millions before crashing, resulting in substantial losses for many investors. While a few individuals profited, the majority were left with significant financial damage. The attack underscores the growing trend of celebrity-driven crypto scams, where high-profile accounts are exploited to create false hype around digital assets, leading to devastating financial repercussions for unsuspecting followers.
Durex India’s website has experienced a significant data breach, exposing sensitive customer information. The breach was uncovered by security researcher Sourajeet Majumder, who discovered that the order confirmation page lacked proper authentication, allowing unauthorized access to customer data. This compromised data includes names, phone numbers, email addresses, shipping details, and order information. Despite the breach being reported to India’s Computer Emergency Response Team (CERT-In), the issue remains unresolved, leaving affected customers vulnerable to potential social harassment and phishing attacks.
The Texas Dow Employees Credit Union has disclosed a significant data breach linked to the ‘Move It’ cyberattacks from May 2023, affecting over 500,000 individuals. The breach compromised sensitive personal information, including full names, birthdays, credit and debit card numbers, and social security numbers. The credit union has notified impacted individuals and is offering free credit monitoring services to mitigate potential risks. This breach underscores the ongoing threats facing financial institutions and the importance of robust cybersecurity measures to protect personal data.
Crescent Community Health Center’s InFocus Pharmacy in Dubuque, Iowa, has reported a significant data breach that occurred between December 10 and 13, 2023. The breach potentially exposed sensitive patient information, including names, addresses, dates of birth, driver’s license numbers, government ID numbers, medical details, and health insurance information. The health care provider disclosed the breach in a press release on August 30, 2024. Affected individuals are being advised to monitor their information and take necessary precautions.
📢 Cyber News
The SANS Institute has announced its new strategy guide, “ICS Is the Business: Why Securing ICS/OT Environments Is Business-Critical in 2024,” authored by Dean Parsons, CEO of ICS Defense Force. This essential guide addresses the alarming rise in ransomware attacks targeting industrial control systems (ICS), which saw a 50% increase in 2023. Parsons outlines critical steps for safeguarding these vital systems, including the need for specialized controls and the role of artificial intelligence in enhancing security.
The European Union is committed to transforming Europe into the most connected continent by 2030 through its ambitious Digital Decade framework. Key to this initiative is the expansion of high-speed internet and gigabit networks, alongside the WiFi4EU program, which provides free Wi-Fi in public spaces across the region. With over 90,000 access points already established, this effort has significantly improved connectivity in underserved areas. The EU also aims to ensure high-speed internet access for all households by 2025 and promote digital skills and inclusion to drive economic growth and enhance quality of life for European citizens.
Google is considering a significant investment in Vietnam with plans to build its first large-scale data center near Ho Chi Minh City, potentially operational by 2027. This project, still under internal review, would mark Google as the first major US tech firm to establish such infrastructure in the country. Driven by Vietnam’s growing digital economy and increasing demand for cloud services, the proposed facility could be one of the largest in the region, with an estimated cost of up to $650 million.
Chinese battery manufacturer CATL is under intense scrutiny from U.S. lawmakers, who are urging the Defense Department to add the company to a restricted list due to alleged ties with the Chinese government and military. Senator Marco Rubio and Congressman John Moolenaar have voiced concerns that CATL’s involvement in U.S. energy infrastructure could pose national security risks, particularly due to potential overreliance on Chinese technology. CATL has denied these allegations, asserting that its battery products are passive and do not compromise national security.
Atlassian has acquired Rewatch, an AI-powered meeting notetaker and video hub, to enhance its AI-driven solutions and integrate the technology with its existing platforms. The acquisition aims to bolster Loom, Atlassian’s asynchronous video messaging platform, and integrate Rewatch’s capabilities into the Rovo AI platform. This integration will enable more efficient conversion of meeting notes into actionable Jira issues and improve transcript searchability across business contexts.
Copyright © 2024 CyberMaterial. All Rights Reserved.
