👉 What’s going on in the cyber world today?
CISA, BIND 9, DNS Software, Nvidia, AI Products, Networking, Docker, National Security Agencies, Risky Investments, Stargazer Goblin, GitHub Malware, Fake Accounts, DDoS Attack, Russian Banks, Croatia, Split Airport, Louisville Jefferson, County Clerk, Sydney Sweeney, X Account, NC State Bureau of Investigation, Vendor Breach, CrowdStrike, Fortune 500, Uninsured Loss, Malware, New Variants, Meta, Nigeria, Scam Accounts, Vanta, Series C, Funding, AI, Mimecast, Code42, Insider Threat Defense
Listen to the full podcast
The Internet Systems Consortium has patched multiple vulnerabilities in the BIND 9 DNS software that could lead to denial-of-service conditions. Exploitation of these flaws might result in server crashes, CPU depletion, and slow query processing. Updated versions 9.18.28, 9.20.0, and 9.18.28-S1 address these issues, with no current evidence of active exploitation.
Nvidia has released patches for vulnerabilities in its AI and networking products, including a high-severity flaw in Jetson products and issues in the Mellanox OS switch system. Exploiting these vulnerabilities could lead to denial of service, code execution, and escalation of privileges. Nvidia has reported over 60 vulnerabilities this year, highlighting the importance of timely updates.
Docker has released patches for a critical vulnerability in Docker Engine that could let attackers bypass authorization plugins. Discovered in April 2024, this flaw had persisted since Docker Engine v18.09.1 but was not fixed in subsequent versions, potentially leaving systems vulnerable for five years. Users are urged to update to the latest versions to mitigate risks of unauthorized access and privilege escalation.
U.S. national security agencies are cautioning technology startups to scrutinize foreign venture capital investments closely, especially from Chinese sources. The warning highlights that such investments might be attempts to gain access to sensitive technology and intellectual property, with recent concerns escalating since 2018. Startups must balance the need for funding with the potential risks of losing proprietary data or facing legal and financial repercussions if foreign investments are found to threaten national security.
Stargazer Goblin has launched a massive malware Distribution-as-a-Service operation using over 3,000 fake GitHub accounts. This network, known as Stargazers Ghost Network, distributes password-protected malware through compromised WordPress sites and GitHub repositories. Despite GitHub’s efforts to remove malicious repositories, the network persists, exploiting the platform’s trust to target victims with sophisticated infostealers.
Several major Russian banks faced significant disruptions to their mobile apps and websites due to a DDoS attack. Complaints surged in the morning, with issues affecting banks like Gazprombank, Alfa-Bank, VTB, and Rosbank, leaving users unable to make payments or access accounts. Authorities are investigating politically motivated cyber attacks as the situation evolves and defenses are reinforced.
The St Jeronim Airport in Split, Croatia, faced major disruptions this week due to a cyberattack. The IT system experienced failures around 7:30 pm on Monday, leading to flight cancellations and delays, and forcing passengers to stay overnight. The attack, linked to the Akira group, has been described as ransomware, and efforts are ongoing to resolve the issues and restore normal operations.
Jefferson County Clerk’s Offices in Louisville, Kentucky, are closed for the third consecutive day due to a cyberattack. The attack, discovered early Monday morning, has led to the temporary closure of all eight branches, affecting services like vehicle registration, real estate transactions, and marriage licenses. Officials are collaborating with cybersecurity experts and law enforcement to investigate and repair the system, with no evidence yet suggesting that personal information has been compromised. There is no current estimate for when the offices will reopen.
Sydney Sweeney’s cellphone was hijacked by scammers on the same day her X account was compromised to promote a cryptocurrency scam. A Verizon Wireless receipt, dated July 2, was leaked, revealing that changes were made to her cellphone account, suggesting a SIM swapping attack. On that day, Sweeney’s X account posted cryptic messages linking to a meme coin scam, amplifying the impact of the breach.
The North Carolina State Bureau of Investigation is currently probing a cyberattack that targeted a vendor-managed system in May. The breach, which involved encrypted data on a server, was detected through an email alert received on May 13, following earlier warnings of network compromise. Despite the attack, SBI confirmed that no personal information was accessed, and measures were swiftly implemented to secure the affected system.
📢 Cyber News
A recent report by the Royal United Services Institute (RUSI) reveals that Russia has shifted its cyber focus in Ukraine from targeting civilian infrastructure to concentrating on battlefield intelligence. The Kremlin’s cyber units are now concentrating on hacking frontline military computers and mobile devices as part of preparations for a major summer offensive. The report highlights that Russian intelligence agencies have adapted their strategies to provide tactical advantages, emphasizing signals intelligence and exploiting vulnerabilities in Ukrainian military communications and systems.
India’s Union Budget 2024, unveiled by Finance Minister Nirmala Sitharaman, marks a significant advancement in the nation’s cybersecurity and technology landscape. The budget allocates substantial funds to enhance cybersecurity infrastructure, including advanced threat detection systems and strengthened government agencies like CERT-In. It also prioritizes investment in cutting-edge technologies such as AI-driven threat detection, quantum-resistant cryptography, and secure IoT ecosystems.
Verizon Communications has agreed to a $16 million settlement with the Federal Communications Commission (FCC) over multiple data breaches at its subsidiary, TracFone Wireless, which occurred between 2021 and 2023. The breaches involved unauthorized access to customer data, including personally identifiable information and customer proprietary network information, leading to SIM-swapping incidents.
Elon Musk has announced that Tesla’s Optimus humanoid robot is set to go on sale in 2026, marking a significant milestone for the company. During Tesla’s earnings call, Musk revealed that Optimus has already begun performing tasks autonomously at Tesla facilities, such as handling batteries. He estimates that the long-term demand for general-purpose humanoid robots could exceed 20 billion units, driven by both consumer and industrial needs. Despite the ambitious timeline, which has seen past delays, Musk’s announcement highlights Tesla’s commitment to advancing robotics technology.
Alphabet has announced a substantial $5 billion investment in Waymo, its self-driving subsidiary, as part of a new multi-year funding commitment. This investment, disclosed by Alphabet CFO Ruth Porat during the company’s second-quarter earnings call, aims to bolster Waymo’s efforts to advance its autonomous driving technology. The funding will support Waymo’s ongoing operations and expansion, enhancing its capabilities and operational performance.
Copyright © 2024 CyberMaterial. All Rights Reserved.
