[SPONSOREDNUBIVANCE]
Know a small business winging it on security?
No IT department, no security budget, real exposure. Nubivance builds right-sized security foundations for small companies. Send them this.
Send it alongEmerging Threats
German Police Unmask REvil Leader in Cyber Crackdown
In a major cyber crackdown, German police have unmasked the leader of the notorious REvil gang, dealing a significant blow to the ransomware group, but also highlighting the ever-shifting threat landscape. As one threat subsides, new ones emerge, leaving defenders to prioritize scarce resources against an array of evolving threats.
LucidRook Malware Targets NGOs, Universities in Taiwan
A sneaky new malware called LucidRook has set its sights on non-governmental organizations and universities in Taiwan, using spear-phishing to catch its victims off guard. This Lua-based threat is the latest cyber attacker to target these vulnerable sectors.
VENOM Phishing Attacks Target C-Suite Microsoft Logins
A new phishing-as-a-service platform called VENOM is making it alarmingly easy for hackers to target senior executives, specifically seeking their Microsoft logins. This compact toolkit is putting the keys to the corner office within reach of any motivated adversary, leaving security teams scrambling to respond.
EngageLab SDK Flaw Compromises 50M Android Users
A security flaw in the EngageLab SDK has put a whopping 50 million Android users at risk, allowing apps on the same device to bypass Android's security sandbox and gain unauthorized access to sensitive information. This vulnerability, now patched, exposed cryptocurrency wallet users and others to potential data breaches.
Ransomware Attack Cripples Dutch Healthcare IT Firm ChipSoft
A ransomware attack on Dutch healthcare IT firm ChipSoft has left patients and clinicians scrambling, as clinical portals and scheduling tools went dark, disrupting critical care management systems. The devastating cyber incident forced ChipSoft to take its website and digital services offline, leaving many wondering who's left holding the chart.
Chinese Supercomputer Breach Exposes Massive 10-Petabyte Data Heist
A massive 10-petabyte data heist has been reported from a state-run Chinese supercomputer, raising urgent questions about the breach and its potential consequences. The staggering scale of the alleged theft has sparked widespread concern, but details about the incident remain scarce.
Bithumb Unveils Post-Hack Recovery Strategy
In the wake of a crypto crisis, can the digital-asset ecosystem bounce back without shaking user trust? Bithumb's newly unveiled recovery strategy is a step in the right direction, but will it be enough to restore confidence after a string of high-profile hacks and mishaps?
Law Enforcement Disrupts $45 Million Global Cryptocurrency Scam
In a major breakthrough, law enforcement agencies in the US, UK, and Canada joined forces to disrupt a massive $45 million global cryptocurrency scam, freezing $12 million in stolen funds and identifying over 20,000 linked wallet addresses. This significant action not only recovered funds for victims but also shed light on the darker side of digital cash and the challenges of accountability in the crypto world.
Mythos Model Unleashes Zero-Day Exploit Capabilities for Mass Use
The game has changed: a new AI model called Mythos can now uncover devastating zero-day flaws in software and chain them together to create powerful exploits, putting this potent capability in the hands of anyone with an internet connection. This development blurs the lines between nation-state hackers and amateur cyber attackers, raising urgent questions about the future of cybersecurity.
Phishing Gang Targets Dozens of Corporations in Helpdesk Scam Spree
Beware of the person on the other end of the line - a new phishing gang is impersonating IT helpdesks to scam dozens of major corporations, leaving investigators racing to keep up. Google is sounding the alarm on this latest extortion tactic, which uses clever social engineering to catch victims off guard.
UAT-10362 Launches LucidRook Malware in Taiwanese NGO Spear-Phishing Attacks
A mysterious threat cluster, UAT-10362, has launched a targeted spear-phishing attack on Taiwanese NGOs and universities, deploying a newly discovered malware called LucidRook. This sophisticated attack raises urgent concerns for Taiwanese civil-society groups, highlighting the need for heightened vigilance and robust defenses.
Hackers Exploit Smart Slider Plugin to Deploy Malicious Code
Hackers have hijacked the update system for the popular Smart Slider 3 Pro plugin, deploying a malicious release that lets them take control of affected websites. This alarming breach highlights the vulnerability of even trusted software update channels to exploitation.
Bitcoin Depot Suffers $3.6m Crypto Heist After System Breach
In a shocking turn of events, Bitcoin Depot fell victim to a cunning cyber-attack, allowing hackers to siphon off over 50 Bitcoin worth a staggering $3.66m from its internal systems. The breach has left the company scrambling to rebuild trust and protect its customers.
New Trojan STX RAT Targets Finance Sector with Sophisticated Stealth Methods
Meet STX RAT, a sneaky new remote access trojan that's got its sights set on the finance sector, using advanced stealth methods and command-and-control capabilities to evade detection. This latest threat is a wake-up call for defenders, testing their readiness to respond to increasingly sophisticated attacks.
FBI Disrupts APT28's Router-Based Espionage Operations
The FBI recently disrupted a sneaky espionage operation run by APT28, a Russian GRU-linked group notorious for its broad reach, by cutting off their access to a network of routers they used as a launching pad for further attacks. This bold move effectively severed the group's tremendous access, putting a stop to their clever tactics.
Chevin Disrupts FleetWave Software Amid Security Incident
Imagine your fleet management software suddenly going dark - who takes the wheel then? A cybersecurity incident has taken Chevin's FleetWave SaaS platform offline in the UK and US, leaving customers in the dark.
[SPONSOREDNUBIVANCE]
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramble
Malware Delivers ClipBanker Through Sophisticated Infection Chain
Beware of a sneaky malware that can swap out the cryptocurrency wallet address you copied with a fake one, just by pasting a malicious software masquerading as Proxifier - putting your digital assets at risk. This Trojan uses a multi-stage infection chain to deliver ClipBanker, a stealthy threat that hijacks your clipboard.
Adobe Reader Zero-Day Exploits PDFs to Profile Targets
Malicious PDFs are being used to secretly profile targets, leveraging legitimate features to harvest system data and decide which victims are worthy of a second, more invasive attack. This sneaky tactic uses booby-trapped PDFs to quietly gather intel and determine if you're a high-value target.
Botnets Revive 13-Year-Old Apache Flaw in Global Campaign
A shocking resurgence of a 13-year-old Apache flaw has been exploited in a global campaign, highlighting the ongoing threat of old vulnerabilities getting new life. A hybrid P2P botnet and 18 other alarming stories have been uncovered, serving as a stark reminder to stay vigilant in the face of evolving cyber threats.
India-Tied Hack-for-Hire Group Targets MENA Journalists
Meet the shadowy hack-for-hire group with ties to India that's targeting journalists and activists in the Middle East and North Africa, silencing voices and stifling free speech. Their sinister operations have been uncovered by security researchers, revealing a chilling espionage trade where reporters, officials, and dissenting voices are prime targets.
Bitter APT Group Exploits Middle East Spear-Phishing Campaign
The Bitter APT Group has been linked to a sophisticated year-long spear-phishing campaign that targeted the Middle East, using deceptive emails to spread its reach. This hack-for-hire effort, attributed to a South Asian connection, signals a sustained threat to the region's security.
Adobe Reader Zero-Day Exploited in Targeted Attacks Since December
A previously unknown zero-day vulnerability in Adobe Reader has been exploited in targeted attacks since December, using maliciously crafted PDF documents to quietly turn trusted files into stealthy threats. This highly sophisticated exploit raises serious questions about the security of everyday file formats and our trust in them.
Zephyr Energy Hit by $900K Cyber Heist via Contractor Payment Redirect
Zephyr Energy plc lost a staggering £700,000 in a shocking cyber heist, where attackers cleverly redirected a single payment meant for a contractor into their own account. This brazen attack serves as a stark reminder of the devastating consequences of cyber risk.
MacOS ClickFix Attack Exploits Script Editor to Evade Apple Warnings
The cat-and-mouse game continues: after Apple added security warnings to Terminal, attackers behind the Atomic Stealer family adapted their ClickFix attack to exploit Script Editor instead. This latest move shows how adversaries constantly evolve to evade detection.