Tag: nation state
1338 articles
Breeze Comet Exploits Brazilian Payment Systems in Hundreds of Fraudulent Transactions
Meet Breeze Comet, a financially motivated threat actor that's been wreaking havoc on Brazilian payment systems with hundreds of fraudulent transactions, exploiting customized malware and compromised websites to siphon off tens of thousands of dollars. Their tactics are evolving, and Latin American countries should beware of potential expansion.
Hackers exploit BGP hijacking to deliver malicious Virtualizor updates
Malicious actors hijacked internet traffic to deliver fake Virtualizor updates to a small number of users, exploiting a vulnerability in the Border Gateway Protocol (BGP) to divert update requests to their own servers. This sneaky move allowed them to push malicious updates to unsuspecting users.
Iranian Hackers Deploy Cross-Platform Malware via Coding Tests
Iranian hackers are using clever tactics to deploy cross-platform malware, disguising it as coding challenges on LinkedIn and other job search platforms to trick developers into installing the threat. This malware, tracked as NodeRabbit and PollCat, can infect Windows, Linux, and macOS workstations, allowing hackers to gain remote access.
US Bolsters Water Infrastructure with Cybersecurity Pilot
The alarming number of cyber incident reports from water providers - 27 in just seven states - has prompted a swift response from the White House and Texas officials with the launch of Project Watershed 250, a six-month pilot aimed at bolstering water infrastructure cybersecurity. This innovative program will deploy top-notch cyber-defense resources to water and wastewater utilities at no cost, starting with a test run in Texas.
DoD Refrigerator Outages Spark Hacking Fears
A defense official has warned of possible refrigeration disruptions at some Defense Commissary Agency commissaries, sparking concerns about the security of military food storage systems. Several bases have already reported outages, including Fort Irwin, F.E. Warren Air Force Base, and Naval Station Newport.
Mirage Kitten Unveils Node.js Malware Targeting Aviation, FinTech
Kaspersky's threat research uncovered a sneaky Node.js malware campaign targeting aviation and FinTech organizations in the Middle East and Africa, with victims initially tricked by fake job offers on LinkedIn. The malware, known as NodeRabbit, was delivered through cleverly disguised coding-challenge archives.
US Strikes Iranian Rocket Launchers Capable of Deploying Sea Mines
The US has taken decisive action against Iranian forces preparing to launch sea mines into the Strait of Hormuz, striking two rocket launchers on Larak Island after spotting Islamic Revolutionary Guard Corps personnel ready to fire. This swift move aims to protect the vital waterway from potential threats.
Cyber Firms' AI Defense Push Sparks Scrutiny Over Commitments
More than 200 companies, including tech giants like Microsoft and Google, have joined forces to supercharge cyber defense capabilities and shield against AI-enabled attacks. They're calling for a united front to share threat intel, track progress, and swiftly contain attacks.
Russia-Aligned Hackers Inject Nuclear Prompt to Evade AI Analysis
Hackers have found a sneaky way to outsmart AI-powered security tools by injecting a provocative phrase, like a threat to create a nuclear weapon, into malicious code to disable analysis. This clever trick, dubbed GuardBreaker, tricks AI scanners into failing to examine the rest of the script.
PaperCut Zero-Days Exploited in Data Theft Attacks
Hackers are actively exploiting two zero-day vulnerabilities in PaperCut NG and MF, using them to bypass authentication and steal sensitive data from vulnerable print management servers. Attackers have already been spotted chaining these flaws to launch data theft attacks, prompting emergency patches from PaperCut Software.
McKesson Discloses Data Theft After ShinyHunters Extortion Attack
McKesson has confirmed a data theft incident following a cyberattack by ShinyHunters, but has assured customers that its business and distribution centers are up and running with no ongoing unauthorized activity. The company sprang into action, activating incident response protocols and launching an investigation to minimize disruption.
Microsoft Warns of TerminalFix Malware Hiding in PNGs
Microsoft researchers have uncovered a sneaky malware campaign, dubbed TerminalFix, that hides in plain sight by masquerading as harmless PNG images - only to delete them after extraction, leaving behind a trail of PowerShell commands that can compromise your system. This fresh variant of the ClickFix social-engineering trick tricks victims into pasting malicious commands into Windows Terminal or PowerShell.
Chinese Hackers Exploit Cisco Routers for Covert Surveillance
Chinese hackers have cleverly exploited Cisco routers, transforming them from mere transit devices to covert surveillance platforms, as discovered by incident responders at Sygnia. This sinister manipulation allows hackers to secretly collect data, with one of the first clues being an unexplained GRE tunnel interface on a Cisco IOS XR router.
US Disrupts Chinese Cyber Espionage Proxy Network
The FBI has struck a major blow against Chinese cyber espionage, disrupting a proxy network used to sell reconnaissance and operational routing capabilities to malicious actors. This key takedown targeted a technical quartermaster tied to Nanjing Xinjiuwei Network Technology Company, a company linked to the notorious QTYF spy-proxy network.
Berlin Hit by Rhysida Ransomware, Data Theft Confirmed
Berlin's administrative network has been hit by a massive Rhysida ransomware attack, with hackers claiming to have stolen a whopping 5.79 TB of sensitive data, including 1.44 million files, and are now threatening to publish it unless paid a ransom. The breach exposes a vast array of confidential records, from government and financial data to personal info like names, email addresses, and phone numbers.
Aurora Ransomware Operators Leverage AI Tool Cursor in Targeted Attacks
Aurora ransomware operators are using AI tool Cursor to plan and execute targeted attacks, even going so far as to instruct it in Russian to exclude certain regions and domains. This sophisticated approach has enabled the group to breach over 20 organizations across nine countries in just a few months.
US Agencies Targeted in Chinese Cyber Espionage Operation
The US Department of Justice made a telling edit to their recent press release, quietly changing the wording from "victims" to "among the targets" of a China-linked hacking group that hit several high-profile US agencies. This subtle shift highlights the scope of a brazen cyber espionage operation that compromised sensitive government networks.
Defence Urges Uniformed Voice Amid Heightened Strategic Threats
As strategic threats escalate, Australians are crying out for a unified voice to guide them through uncertain times, with many still unclear about the real nature of China's intentions. Despite 62% fearing China could become a military threat, 61% still see them as a vital economic partner, revealing a jarring disconnect between concern and understanding.
Microsoft Warns of TerminalFix Backdoor Deploying via Fake Cloudflare CAPTCHAs
Beware of fake Cloudflare CAPTCHAs that can lead to a sneaky backdoor invasion, giving attackers direct access to your organization's internal network. A new variant of malware, called TerminalFix, tricks victims into executing a malicious PowerShell command, allowing hackers to gain control.
Russia Shifts Missile and Drone Attack Strategy on Kyiv
Kyiv endured a grueling 15 hours of air raid alerts on August 27, as Russia switched up its attack strategy with repeated waves of small drone groups, disrupting daily life and forcing residents to seek shelter. This new approach, described as a shift from amplitude to frequency, has left the city on high alert with 13 separate air raid alerts in a single day.
US Special Ops Commanders Warn of Asymmetric War Shift
The US advantage in conventional forces is pushing adversaries to wage war in new, unpredictable ways - below the threshold of direct confrontation, using tactics like proxies, cyber attacks, and economic coercion. This shift to asymmetric warfare demands a fresh approach to defense, warns Army Brig. Gen. Michael Rose.
Chinese Actor Exploits ownCloud Flaw to Breach Philippine Nuclear Research Body
A Chinese actor exploited a high-severity ownCloud vulnerability, CVE-2023-49105, to breach a Philippine nuclear research body and steal 176 files, totaling 372 MB of sensitive data. The flaw allowed unauthorized access to files without authentication, highlighting the importance of prompt patching and robust security measures.
FBI Disrupts China-Linked Hacking Tools Targeting US Agencies
The FBI has cracked down on a massive China-linked hacking operation that used automated tools to scan for and exploit vulnerabilities in US agencies' systems, processing over 2 million attacks in a single day. At the heart of the operation were two powerful tools, QScan and QTRouter, which worked together to identify targets and cleverly conceal the hackers' tracks.
NSA Seeks Access to All Commercial AI Models
The NSA is on a mission to tap into the full potential of commercial AI models, with Deputy Director Tim Kosiba revealing the agency's ambitious plan to access all models and leverage their capabilities. This move marks a significant escalation in the NSA's AI strategy, as it seeks to harness the power of advanced artificial intelligence systems.