👉 What’s trending in cybersecurity today?
Apache, HugeGraph-Server, Oracle, July 2024 Patch, Atlassian, Data Center, Server Products, Vietnamese Hackers, Maorris Bot, WhatsApp, E-Challan Scam, Konfety, Ad Fraud, Android Malware Campaign, MNGI Digestive Health, Bassett Furniture, Ransomware Attack, LIFI Protocol, Cyber Attack, Call Injection, Allegheny County, Pennsylvania, District Attorney’s Office, Hacktivist, Romania, DDoS Attacks, EU-Ukraine Cybersecurity Partnership, Interpol, West African, Cybercrime ,Syndicates, South Korea, UN Cybersecurity Debate, Andrej Karpathy, Eureka Labs, AI Education, Exa, Series A, Funding.
Listen to the full podcast
A critical vulnerability in Apache HugeGraph-Server, tracked as CVE-2024-27348, is currently under active exploitation by threat actors, enabling remote code execution (RCE) attacks. This flaw, affecting all versions prior to 1.3.0, resides in the Gremlin graph traversal language API. The Apache Software Foundation urges users to upgrade to version 1.3.0 with Java11 and enable the Auth system to mitigate the issue, and to use the ‘Whitelist-IP/port’ function for enhanced security.
Oracle has released its July 2024 Critical Patch Update (CPU), addressing 386 new security patches to resolve approximately 240 unique CVEs across its product portfolio. Highlighted are over 260 fixes for vulnerabilities that can be exploited remotely without authentication. Oracle Communications received the most patches, followed by Financial Services Applications and Fusion Middleware. The update includes fixes for MySQL, Communications Applications, Analytics, and various other products, underscoring Oracle’s effort to mitigate remote code execution risks.
Atlassian has released critical security updates addressing multiple high-severity vulnerabilities in its Data Center and Server products, including issues like file inclusion and XSS vulnerabilities. These flaws, discovered through Atlassian’s Bug Bounty program and penetration testing, pose significant risks by potentially allowing attackers to execute arbitrary code. Organizations using Confluence, Jira Software, Jira Service Management, and Bitbucket are urged to promptly update to the latest patched versions to mitigate the threat of unauthorized access and data compromise.
CloudSEK has uncovered a sophisticated Android malware campaign targeting Indian users through fake traffic e-challan messages on WhatsApp. Scammers impersonating Parivahan Sewa or Karnataka Police send messages with links to download a malicious app, which, once installed, steals personal information and facilitates financial fraud. Identified as part of the Wromba family, this malware has infected over 4,400 devices, leading to fraudulent transactions exceeding Rs. 16 lakhs. The malware intercepts OTPs and sensitive messages, enabling attackers to log into victims’ e-commerce accounts and purchase gift cards.
A sophisticated ad fraud operation dubbed “Konfety” has been uncovered, exploiting over 250 decoy apps on Google Play to conceal malicious counterparts designed for ad fraud and data theft. Operated through a Russian ad network’s SDK, these apps masquerade as legitimate versions while engaging in activities such as installing browser extensions, monitoring web searches, and sideloading APK files. This scheme allows threat actors to exploit the ad rendering capabilities of the SDK, generating fraudulent traffic that mimics legitimate user interactions.
In a significant disclosure, MNGI Digestive Health has reported a data breach affecting 765,000 individuals, where hackers accessed a wide range of personal and protected health information. The breach, occurring in August 2023 and attributed to the Alphv/BlackCat ransomware group, compromised details such as names, Social Security numbers, medical records, and financial data. Despite no evidence of misuse so far, MNGI has initiated notification processes and is offering affected individuals one year of free credit and identity protection services.
Bassett Furniture Industries, one of the largest furniture companies in the U.S., was forced to shut down its manufacturing facilities following a ransomware attack discovered on July 10, 2024. The attack led to unauthorized access and the encryption of some data files, severely disrupting business operations and prompting the company to activate its incident response plan. While Bassett’s retail stores and e-commerce platform remain operational, the company’s ability to fulfill orders has been significantly impacted. Efforts are underway to bring affected systems back online and implement workarounds to minimize disruption.
In a significant cyber incident, the LI.FI Protocol, a cross-chain bridging and swapping platform, experienced a sophisticated attack resulting in the theft of approximately $9.7 million worth of various cryptocurrencies. The exploit primarily targeted users who had set infinite approvals on specific contracts within the protocol. Detected after urgent warnings from LI.FI Protocol and subsequent confirmation by security firms, the breach involved vulnerabilities such as call injection techniques across multiple blockchain networks, including Ethereum and Arbitrum.
A recent cyberattack has severely disrupted operations at the Allegheny County District Attorney’s Office in Pennsylvania, prompting officials to shut down their computer network as a precaution. The attack, detected early thanks to alerts from the Department of Homeland Security and FBI, has left prosecutors and staff without access to email, desk phones, or automated filing systems. While the specific nature of the cyber intrusion remains under investigation, efforts are underway to contain the breach and protect sensitive data.
Amid escalating geopolitical tensions, hacktivist groups like CyberDragon and the Cyber Army of Russia have intensified distributed denial-of-service (DDoS) attacks targeting Romania. ASERT’s recent findings highlight a surge in attacks coinciding with Romania’s discussions on defense cooperation, including the potential transfer of Patriot missiles to Ukraine. The attacks, primarily aimed at government and banking sectors, peaked with 1,016 incidents in early June 2024.
📢 Cyber News
The EU-Ukraine Cybersecurity Partnership has deepened following the 3rd EU-Ukraine Cyber Dialogue in Brussels, where Ukraine committed to aligning its legislation with the EU’s NIS 2 Directive. This alignment aims to fortify critical infrastructure and supply chain resilience against cyber threats, particularly amidst ongoing geopolitical tensions and Ukraine’s pursuit of EU membership. The dialogue emphasized collaborative efforts in responsible state behavior in cyberspace and enhanced information sharing to effectively counter Russian cyberattacks.
In a sweeping international effort dubbed Operation Jackal III, law enforcement agencies from 21 countries collaborated to dismantle West African organized crime networks involved in online financial fraud. The operation, spanning five continents and conducted over three months, resulted in approximately 300 arrests and the seizure of assets valued at USD 3 million. Targeting groups like Black Axe, notorious for cyber fraud and other illicit activities, the operation uncovered extensive networks using money mules to launder funds globally.
South Korea is grappling with a significant uptick in data breaches, coinciding with its involvement in a crucial cybersecurity debate at the United Nations Security Council. This surge in cyber incidents underscores the intersection of geopolitical events and cybersecurity threats, where international discussions can potentially spur increased malicious activities. The breaches have exposed a range of sensitive information, including personal details and corporate data, heightening concerns among cybersecurity experts about the country’s digital security landscape.
Andrej Karpathy, former head of AI at Tesla and key figure at OpenAI, has launched Eureka Labs, a new educational startup aimed at integrating artificial intelligence into learning environments. Based in San Francisco and registered recently as an LLC, Eureka Labs plans to develop AI-driven teaching assistants to collaborate with human instructors, starting with the creation of LLM101n, an undergraduate-level course on building AI models. While the startup aims to revolutionize education through AI, details on funding, operational strategy, and timeline for course deployment remain undisclosed.
Exa, a startup pioneering AI-driven search innovation, has raised $17 million in a Series A funding round led by Lightspeed, with participation from Nvidia and Y Combinator. Founded by Harvard alumni Will Bryk and Jeff Wang, Exa aims to transform how AI models navigate the internet by predicting and prioritizing links rather than words, using advanced vector database and embedding technologies. This approach aims to enhance the efficiency and relevance of information retrieval for AI applications, catering to diverse needs from chatbot interactions to data curation for machine learning.
Copyright © 2024 CyberMaterial. All Rights Reserved.
