👉 What are the latest cybersecurity alerts, incidents, and news?
Aiohttp Bug, RisePro Info Stealer, Github, WordPress, miniOrange, Keyboard Acoustic, Android, Chrome, Cerberus, IMF, Fujitsu Pennsylvanian, Scranton, Ransomware, Scottish, Mozaic, Pentagon, AI, Microsoft, Codezero, E-Root, Diaconu.
Listen to the full podcast
Cybersecurity experts detect ShadowSyndicate’s aggressive scanning for servers vulnerable to CVE-2024-23334, a high-severity path traversal flaw in aiohttp Python library. With aiohttp’s widespread usage among tech firms and developers, the exploit poses a significant threat, especially considering the challenge of identifying and patching outdated library versions.
Cyber researchers uncover GitHub repositories offering cracked software, housing RisePro, an information stealer. The campaign, dubbed gitgub, featured 17 repositories before being dismantled by Microsoft-owned G DATA, offering a sense of legitimacy with fake build statuses. RisePro, initially distributed via a pay-per-install service, now poses a significant threat, highlighting the evolving landscape of data exfiltration tactics.
A critical security flaw discovered in miniOrange’s Malware Scanner and Web Application Firewall plugins prompts urgent action, urging WordPress users to delete the affected plugins from their websites. Rated 9.8 on the CVSS scoring system, the vulnerability allows unauthenticated attackers to gain administrative privileges, potentially compromising sites with over 10,000 active installations.
Researchers unveil a novel acoustic side-channel attack on keyboards, capable of deciphering user input based on typing patterns, even amidst noisy environments. Achieving an average success rate of 43%, this method doesn’t necessitate controlled recording conditions, rendering it applicable in real-world scenarios with various typing platforms and environmental conditions. By training a statistical model with captured typing patterns, the attack predicts text input accurately, though its effectiveness may vary depending on factors like typing speed and keyboard type.
Android users face a new threat as cybercriminals deploy fake Chrome updates to deliver the dangerous Cerberus banking malware. This malicious tactic exploits trust in software updates, endangering personal security by infiltrating unsuspecting devices with potent malware. Stay vigilant and verify the authenticity of updates to protect yourself from this evolving cyber threat.
The International Monetary Fund (IMF) faced a cyber incident, detecting a breach on February 16, 2024. Following a thorough investigation, the IMF confirmed that 11 of its email accounts were compromised, though no further intrusion beyond these accounts was identified. While details remain undisclosed for security reasons, the IMF reassured that remediation measures were promptly implemented to address the breach.
Fujitsu confirms malware on business computers, sparking fears of personal data exposure. The breach prompts swift action, isolating affected devices and intensifying monitoring to prevent further infiltration. Fujitsu vows to investigate thoroughly and enhance cybersecurity measures to protect sensitive information.
Scranton, Pennsylvania, schools face a ransomware attack, causing IT outages and disruptions. The district is collaborating with forensic specialists to investigate the breach and restore systems. Despite the challenges, efforts are underway to swiftly resolve the incident and resume normal operations.
NHS Dumfries and Galloway, part of Scotland’s healthcare system, is targeted by a cyber attack, potentially disrupting services. The health board warns of potential data breaches and urges vigilance among staff and the public. Authorities, including the Scottish Government and the National Cyber Security Centre, are collaborating to investigate the incident and mitigate its impact.
Mozaic Finance, a decentralized finance and yield-optimization protocol, suffered an exploit resulting in over $2 million in losses. Security firm CertiK identified the attack, revealing a compromised private key used to drain funds through a specific contract. This incident underscores ongoing security challenges in the blockchain space, with recent hacks impacting various decentralized finance protocols, prompting calls for enhanced security measures and legal recourse for affected parties.
Craig Martell, the inaugural head of the Pentagon’s Chief Digital and Artificial Intelligence Office (CDAO), is leaving his position in April, having shaped the division into a key part of departmental operations. Under Martell’s leadership, the CDAO released essential guidance, toolkits, and resources, fostering the adoption of data, analytics, and AI across the Department of Defense. Defense Secretary Lloyd Austin praised Martell’s contributions, emphasizing his significant impact on national security through innovative data and AI initiatives.
The U.S. Department of Justice is reclaiming $2.3 million in cryptocurrency from a “pig butchering” scam that defrauded 37 individuals nationwide. Victims were duped through social engineering tactics into depositing crypto into fake investment sites, only to find their funds stolen by the scammers. This recovery underscores the prevalence of crypto scams and the importance of verifying investment platforms independently to avoid falling victim to such schemes.
Moldovan national Sandu Boris Diaconu faces a 42-month prison term for operating E-Root, a notorious online marketplace peddling hacked computer access globally. Diaconu, also known as ‘utmsandu,’ orchestrated a sophisticated cybercrime operation facilitating unauthorized access to compromised systems, resulting in widespread ransomware attacks and identity theft schemes. The sentence follows Diaconu’s guilty plea to conspiracy and computer fraud charges, underscoring law enforcement’s crackdown on cybercriminal enterprises.
Microsoft unveils Office LTSC 2024, set for commercial preview next month, promising enhanced performance, security, and accessibility. The new release brings refined features, including expanded meeting options in Outlook and additions like Dynamic Charts and Arrays in Excel. While lacking cloud-based capabilities, LTSC 2024 maintains its perpetual licensing model and aligns with the forthcoming Windows 11 LTSC release.
Codezero secures $3.5M in seed funding led by Ballistic Ventures, enhancing Kubernetes development workflows. Their Teamspaces product simplifies access management, creating identical production environments for seamless collaboration. The investment will fuel expansion into enterprise DevOps and cloud migration sectors.
Copyright © 2024 CyberMaterial. All Rights Reserved.
