👉 What’s going on in the cyber world today?
Mirai-Based Botnet ‘InfectedSlurs’, DDoS, North Korea, Biometric Bypass, Windows Hello, CyberLink, ‘Looney Tunables’ Bug, Blender, Cyber Toufan, Ikea, Israel, Nassau Bay, Ransomware, Tri Counties Bank, Ingo Money, U.S.Navy, UK Regulator, Australia, EuropeParliamentary Elections, Clop.
🚨 Cyber Alerts
1. Â InfectedSlurs Mirai Variant Targets Devices
A newly discovered Mirai-based malware botnet, dubbed ‘InfectedSlurs,’ is actively exploiting two undisclosed zero-day vulnerabilities to compromise routers and video recorders (NVR). Akamai first detected the botnet in late October 2023, noting its potential for creating a distributed denial-of-service (DDoS) swarm for profit. The affected vendors have yet to patch the exploited flaws, raising concerns about the botnet’s potential impact on vulnerable devices.
2. North Korea’s Cyber Ops Target Developers
North Korean threat actors, identified as the source of two cyber campaigns, engage in a dual role as job recruiters and seekers to distribute malware and gain unauthorized employment with organizations globally, with a focus on the U.S. These activities, named Contagious Interview and Wagemole by Palo Alto Networks Unit 42, employ tactics ranging from infecting software developers with malware through fake job interviews to financial gain and espionage. The Contagious Interview attacks introduce cross-platform malware named BeaverTail and InvisibleFerret, while Wagemole involves fraudulent job-seeking using GitHub repositories with forged identities, creating opportunities for embedding insiders in targeted companies.
3. Fingerprint Sensor Bypass Risks in Laptops
Researchers at Blackwing Intelligence have unveiled critical vulnerabilities in fingerprint sensors from Goodix, Synaptics, and ELAN, affecting laptops like Dell Inspiron 15, Lenovo ThinkPad T14, and Microsoft Surface Pro X. These flaws, exploiting “match on chip” technology, enable unauthorized access despite Windows Hello authentication. To curb such risks, experts recommend OEMs enable Secure Device Connection Protocol (SDCP) and undergo thorough sensor audits.
4. Diamond Sleet Cyberattack on CyberLink
Microsoft has revealed that a North Korean hacking group, identified as Diamond Sleet, breached Taiwanese multimedia software company CyberLink in a supply chain attack. The attackers trojanized one of CyberLink’s installers, using a legitimate code signing certificate issued to CyberLink to sign the malicious executable. This trojanized installer has been detected on over 100 devices globally, with the second-stage payload, known as LambLoad, interacting with infrastructure previously compromised by the threat actors. Microsoft, after detecting the attack, has taken measures to protect customers and informed both CyberLink and affected Microsoft Defender for Endpoint users.
5. CISA Urges Patching ‘Looney Tunables’
The Cybersecurity and Infrastructure Security Agency (CISA) has mandated U.S. federal agencies to patch vulnerable Linux devices by December 12, following the discovery of an actively exploited security flaw named “Looney Tunables” (CVE-2023-4911). Exploited by threat actors like Kinsing, this flaw in the GNU C Library enables buffer overflow attacks, granting unauthorized system access and code execution with elevated privileges across various Linux distributions, posing a significant threat to cloud environments and containerized systems.
6. Blender Battles Ongoing DDoS Attacks
Blender, a popular 3D design suite, has been hit by continuous DDoS attacks since Saturday, causing severe disruptions to its operations. The attacks overwhelmed blender.org servers with requests, making it difficult to process legitimate connections. While the team has moved its main website to CloudFlare to mitigate the impact, disruptions may persist, and users are warned against downloading Blender from third-party sites due to potential malware risks.
7. Cyber Toufan Claimed Ikea Israel Data Breach
The relatively new cybercriminal group, Cyber Toufan, has claimed responsibility for the recent data breach targeting Ikea Israel. In a dark web post titled “Day Four, Leak Two,” the hacker collective alleges possession of over 400,000 Ikea Israel users’ information, including names, numbers, hashes (passwords), and emails. The purported claims are connected to Cyber Toufan’s stated mission of conducting cyberattacks in retaliation for the ongoing Israel-Hamas conflict, citing grievances related to the war, occupation, and displacement of individuals from their homes.
8. Nassau Bay Ransomware Incident Affects 8,000
Nassau Bay, a Texas city, has confirmed falling victim to a ransomware attack, impacting more than 8,000 individuals. The incident occurred on May 23, 2023, and an internal investigation revealed the unauthorized access and removal of files, including sensitive financial information and access credentials. Despite the breach, Nassau Bay officials state there is no evidence of financial fraud or identity theft, and no credit monitoring or identity theft protection services have been offered to the affected individuals.
9. Tri Counties Bank Faces Data Breach
Tri Counties Bank, primarily serving the US West Coast, has experienced a system breach resulting in the exposure of personal customer and employee data, including financial information. The bank disclosed the breach to impacted individuals, revealing that names, Social Security numbers, driver’s license numbers, and financial account details were compromised in the attack. Despite the breach occurring in February, the bank only completed a review of potentially impacted data in October, impacting a total of 74,385 individuals, according to information submitted to the Maine Attorney General.
10. Ingo Money Faces Dark Web Exposure
Ingo Money, a prominent instant money service provider, has fallen victim to a ransomware attack, with the hacker gang Inc showcasing the incident on the dark web. The attackers, affiliated with the Inc ransomware, have not specified the type of data accessed in the breach. With over one million downloads on Google Play Store, Ingo Money serves as a financial technology company offering payment services to individuals and businesses, counting Geico, Goldman Sachs, Paypal, and American Express among its clients.
11. U.S.Navy Cyber Security Strategy
The U.S. Navy has officially unveiled its detailed cyber strategy, emphasizing a robust approach to enhancing its cyber enterprise and collaborating with allies. Navy Secretary Carlos Del Toro highlighted the focus on bolstering cyber posture through seven distinct lines of effort, including securing critical infrastructure, supporting the cyber workforce, conducting cyber operations, and defending IT and networks. The strategy aims to prioritize warfighting excellence within cyberspace and address cybersecurity challenges that the Navy has acknowledged in comparison to other military branches.
12. Privacy Ultimatum to Top UK Sites
The UK’s privacy regulator, ICO, has issued a stern warning to website owners, threatening enforcement action if they fail to swiftly comply with data protection laws regarding advertising cookies. ICO demands websites offer users an equally simple choice to reject or accept advertising cookies, emphasizing concerns about targeted ads infringing on privacy rights and violating GDPR/Data Protection Act 2018 and PECR regulations.
13. Australia’s $3857M Cybercrime Plan
The Australian government unveils a $3857M cybersecurity strategy aiming to mandate ransomware reporting, enhance law enforcement capabilities, and support innovative cybersecurity startups. Despite increased cyber threats and rising costs for businesses due to cybercrime, critics, like Senator James Patterson, deem the strategy insufficient, citing previous cyber incidents and suggesting a delayed response from the government.
14. Europe Gears Up for Cyber-Secure Elections
European authorities are intensifying efforts to safeguard the upcoming parliamentary elections, scheduled in less than 200 days, against cybersecurity threats and disinformation. A joint exercise, attended by European electoral and cybersecurity agencies, focused on evaluating risk mitigation measures, crisis management plans, and strategies to prevent, detect, and respond to cyber threats and hybrid attacks. With concerns about deepfake images and videos influencing the elections, the exercise involved testing established structures, networks, and collaborations to secure the electoral process from potential cyberattacks, information manipulation, and disinformation campaigns.
15. MOVEit Hack Hits 2,620 Organizations So Far
Cybersecurity firm Emsisoft reports that the recent hacking of file transfer service MOVEit, claimed by the Russian-linked Clop ransomware group, has affected 2,620 organizations and 77.2 million people since May. The United States is the worst-hit, accounting for 78.1% of affected organizations, followed by Canada, Germany, and the UK. Education is the most impacted sector, comprising 40.6% of affected organizations, with notable entities like Avast reporting compromised customer data.
