👉 What’s going on in the cyber world today?
Shortcut Files, CHM Malware, FBI, Retailers, Phishing Scams, Gift Cards, F5 Manager, Rogue Admins, Go Language, Security Patches, Google, Android, Final Fantasy, DDoS Attacks, Van Gogh Museum, Steals, Credit Card Details, Ascension Healthcare System, Zscaler, Test Environment, India’s Regional Cancer Center, CISA, Launches, Vulnrichment, CVE Data Gap, UK’s Ofcom, Safer Algorithms, Protect, Children, US, Crypto Mixers, New Bill, OpenAI, Stack Overflow, Partnership.
Listen to the full podcast
Cybersecurity experts have uncovered a new tactic where hackers weaponize shortcut files to stealthily deploy CHM malware, exploiting their ubiquity and trustworthiness to bypass security measures effectively. This sophisticated scheme involves CHM files that, upon execution, display a help file while secretly running malicious scripts to steal user data and register harmful services. Given its focus on Korean targets, users are advised to exercise extreme caution and avoid opening files from unknown or suspicious sources.
The FBI has issued a warning about a financially motivated hacking group, known as Storm-0539, which has been targeting retail employees in the gift card departments through sophisticated phishing attacks. The hackers utilize phishing kits capable of bypassing multi-factor authentication to infiltrate employee accounts, move laterally within the network, and manipulate gift card processes for fraudulent purposes. Retail companies are advised to strengthen their security measures, including updating incident response plans and training employees to recognize and resist phishing attempts to mitigate the impact of these targeted attacks.
Security researchers at Eclypsium have discovered two critical vulnerabilities in the F5 Next Central Manager that pose significant risks to network security. These flaws, identified as CVE-2024-21793 and CVE-2024-26026, both allow unauthenticated attackers to execute SQL injections, potentially granting them full administrative control and the ability to create hidden rogue administrator accounts. Although there are no current reports of these vulnerabilities being exploited in the wild, organizations are urged to update their systems to version 20.2.0 to safeguard against these severe security threats.
The Go programming language, praised for its efficiency, has rolled out urgent security updates to tackle two serious vulnerabilities. These flaws, designated CVE-2024-24787 and CVE-2024-24788, allow attackers to execute arbitrary code and trigger service-disrupting infinite loops in DNS functions, respectively. With CVSS scores indicating high severity, developers and administrators using Go are strongly encouraged to update their software to versions 1.22.3 or 1.21.10 to safeguard their systems against potential exploits.
Google has rolled out significant security updates for Android, including a critical fix for a severe flaw in the System component, tracked as CVE-2024-23706. This vulnerability, affecting Android 14, could enable attackers to gain elevated privileges on impacted devices without needing additional permissions. The update, part of the 2024-05-01 security patch, also tackles multiple elevation of privilege issues in both the Framework and System components, reinforcing Android’s defenses against potential exploits.
This week, the Final Fantasy game servers, particularly those for Final Fantasy 14, suffered from multiple distributed denial-of-service (DDoS) attacks, causing significant login disruptions for players globally. The initial onslaught began on Monday, lasting more than 24 hours, with subsequent attacks continuing into the week, affecting primarily European, North American, and Oceanic data centers. As the popular video game series gears up for the release of its new expansion, Dawntrail, Square Enix is actively working on mitigating these attacks, though no specific perpetrator has been identified yet.
The Van Gogh Museum in Amsterdam recently fell victim to a sophisticated cyber attack involving a cloned version of its official website, which was used to steal credit card details from unsuspecting customers buying tickets online. This incident, described as “malvertising,” marks a first-of-its-kind attack on the art market in the Netherlands. Although the fake site was quickly shut down and fewer than fifty people were affected, the swift response highlights the ongoing vigilance and improvements in cybersecurity measures within cultural institutions.
Ascension, a major U.S. healthcare provider, has temporarily disabled some of its systems following a cybersecurity event detected on May 8, involving unusual activity in its technology network. The organization, which includes 140 hospitals and numerous other facilities, has launched a thorough investigation with the help of cybersecurity firm Mandiant and has informed relevant authorities. While clinical operations have been disrupted, Ascension is taking preventive measures by advising business partners to disconnect from its network until it is safe to reconnect, ensuring further protection against potential data breaches.
Zscaler, a major cybersecurity firm, recently responded to rumors about a potential security breach after it was alleged that a threat actor was selling access to their systems. The company clarified that their investigation revealed an exposed “isolated test environment” on a non-Zscaler server, which did not contain any customer data and was not connected to their primary networks. This environment was taken offline for forensic analysis, and Zscaler has confirmed that no customer or production environments were affected by this incident.
India’s Regional Cancer Center (RCC) suffered a severe cyberattack on April 30, with hackers compromising the health records of over 2 million patients and disrupting services across multiple departments. The attack, attributed to the Daixin Team, affected 11 out of 14 servers, severely impacting operations, including the Radiation Department. Additionally, there are claims that a Korean-based cybercriminal group accessed data of approximately 8 million patients, demanding a ransom of $100 million in cryptocurrency.
The US Cybersecurity and Infrastructure Agency (CISA) has initiated “Vulnrichment,” a project designed to enhance the enrichment of CVE records amid slowdowns in the National Vulnerability Database (NVD) managed by NIST. This slowdown has resulted from an uptick in software vulnerabilities and shifts in interagency support, causing significant backlogs in vulnerability analyses. Vulnrichment aims to categorize and update public CVE records swiftly, leveraging a decision tree model to prioritize remediation actions based on the severity and exploitability of vulnerabilities, ensuring that stakeholders can integrate these insights into their security protocols efficiently.
The UK’s media regulator, Ofcom, has called on online platforms to implement new safety measures within their recommendation algorithms to enhance online child safety. This move is part of a draft proposal under the newly approved Online Safety Act, which aims to shield children from harmful content like pornography and self-harm material on platforms like Instagram, YouTube, Google, and Facebook. Ofcom’s guidelines require these services to adjust their algorithms to prevent harmful content from appearing in children’s feeds and allow young users to give negative feedback on unsuitable recommendations, enhancing overall online safety for minors.
The newly introduced Blockchain Integrity Act in the U.S. House of Representatives aims to ban cryptocurrency mixers for two years, imposing significant fines for violations. Sponsored by Democratic Representative Sean Casten and co-sponsored by other members, the bill targets financial institutions and registered money services, prohibiting them from handling funds associated with crypto mixers. The legislation, still pending committee review, includes a provision for the Treasury to research and report on the legitimate uses and risks of crypto mixers, as well as the effectiveness of current regulatory approaches internationally.
OpenAI’s recent partnership with Stack Overflow, which grants OpenAI access to Stack Overflow’s API and incorporates feedback mechanisms for developers, has stirred unease among some Stack Overflow members. Concerns center around the use of their content without explicit permission, compounded by difficulties in deleting their posts as a form of protest, leading to account suspensions. The situation highlights the tension between individual data rights under GDPR, specifically the ‘right to be forgotten’, and the platform’s policies on content preservation to maintain the integrity of discussions, raising questions about the balance between user privacy and freedom of expression.
The Cybersecurity and Infrastructure Security Agency (CISA) announces voluntary commitments from 68 major software manufacturers to enhance product security through its Secure by Design pledge. This initiative aims to fortify software against cyber threats, with participating companies pledging to make measurable progress toward seven key security goals within a year. By encouraging collaboration and accountability within the industry, CISA seeks to bolster national cybersecurity efforts and protect critical infrastructure from evolving threats.
Copyright © 2024 CyberMaterial. All Rights Reserved.
