Researchers Uncover MirrorFace Cyber Attacks Targeting Japanese Political Entities

Researchers Uncover MirrorFace Cyber Attacks Targeting Japanese Political Entities,

A Chinese-speaking advanced persistent threat (APT) actor codenamed MirrorFace has been attributed to a spear-phishing campaign targeting Japanese political establishments.
The activity, dubbed Operation LiberalFace by ESET, specifically focused on members of an unnamed political party in the nation with the goal of delivering an implant called LODEINFO and a hitherto unseen credential stealer

,

A Chinese-speaking advanced persistent threat (APT) actor codenamed MirrorFace has been attributed to a spear-phishing campaign targeting Japanese political establishments.
The activity, dubbed Operation LiberalFace by ESET, specifically focused on members of an unnamed political party in the nation with the goal of delivering an implant called LODEINFO and a hitherto unseen credential stealer

, ,
https://thehackernews.com/2022/12/researchers-uncover-mirrorface-cyber.html

Microsoft Reclassifies SPNEGO Extended Negotiation Security Vulnerability as ‘Critical’

Microsoft Reclassifies SPNEGO Extended Negotiation Security Vulnerability as ‘Critical’

,

Microsoft has revised the severity of a security vulnerability it originally patched in September 2022, upgrading it to « Critical » after it emerged that it could be exploited to achieve remote code execution.
Tracked as CVE-2022-37958 (CVSS score: 8.1), the flaw was previously described as an information disclosure vulnerability in SPNEGO Extended Negotiation (NEGOEX) Security Mechanism.
SPNEGO,

,

Microsoft has revised the severity of a security vulnerability it originally patched in September 2022, upgrading it to « Critical » after it emerged that it could be exploited to achieve remote code execution.
Tracked as CVE-2022-37958 (CVSS score: 8.1), the flaw was previously described as an information disclosure vulnerability in SPNEGO Extended Negotiation (NEGOEX) Security Mechanism.
SPNEGO,

, ,
https://thehackernews.com/2022/12/microsoft-reclassifies-spnego-extended.html

Android Malware Campaign Leverages Money-Lending Apps to Blackmail Victims

Android Malware Campaign Leverages Money-Lending Apps to Blackmail Victims,

A previously undocumented Android malware campaign has been observed leveraging money-lending apps to blackmail victims into paying up with personal information stolen from their devices.
Mobile security company Zimperium dubbed the activity MoneyMonger, pointing out the use of the cross-platform Flutter framework to develop the apps.
MoneyMonger « takes advantage of Flutter’s framework to

,

A previously undocumented Android malware campaign has been observed leveraging money-lending apps to blackmail victims into paying up with personal information stolen from their devices.
Mobile security company Zimperium dubbed the activity MoneyMonger, pointing out the use of the cross-platform Flutter framework to develop the apps.
MoneyMonger « takes advantage of Flutter’s framework to

, ,
https://thehackernews.com/2022/12/android-malware-campaign-leverages.html

Top 5 Web App Vulnerabilities and How to Find Them

Top 5 Web App Vulnerabilities and How to Find Them,

Web applications, often in the form of Software as a Service (SaaS), are now the cornerstone for businesses all over the world. SaaS solutions have revolutionized the way they operate and deliver services, and are essential tools in nearly every industry, from finance and banking to healthcare and education. 
Most startup CTOs have an excellent understanding of how to build highly functional

,

Web applications, often in the form of Software as a Service (SaaS), are now the cornerstone for businesses all over the world. SaaS solutions have revolutionized the way they operate and deliver services, and are essential tools in nearly every industry, from finance and banking to healthcare and education. 
Most startup CTOs have an excellent understanding of how to build highly functional

, ,
https://thehackernews.com/2022/12/top-5-web-app-vulnerabilities-and-how.html

Hackers Bombard Open Source Repositories with Over 144,000 Malicious Packages

Hackers Bombard Open Source Repositories with Over 144,000 Malicious Packages,

NuGet, PyPi, and npm ecosystems are the target of a new campaign that has resulted in over 144,000 packages being published by unknown threat actors.
« The packages were part of a new attack vector, with attackers spamming the open-source ecosystem with packages containing links to phishing campaigns, » researchers from Checkmarx and Illustria said in a report published Wednesday.
Of the 144,294

,

NuGet, PyPi, and npm ecosystems are the target of a new campaign that has resulted in over 144,000 packages being published by unknown threat actors.
« The packages were part of a new attack vector, with attackers spamming the open-source ecosystem with packages containing links to phishing campaigns, » researchers from Checkmarx and Illustria said in a report published Wednesday.
Of the 144,294

, ,
https://thehackernews.com/2022/12/hackers-bombard-open-source.html

FBI Charges 6, Seizes 48 Domains Linked to DDoS-for-Hire Service Platforms

FBI Charges 6, Seizes 48 Domains Linked to DDoS-for-Hire Service Platforms,

The U.S. Department of Justice (DoJ) on Wednesday announced the seizure of 48 domains that offered services to conduct distributed denial-of-service (DDoS) attacks on behalf of other threat actors, effectively lowering the barrier to entry for malicious activity.
It also charged six suspects – Jeremiah Sam Evans Miller (23), Angel Manuel Colon Jr. (37), Shamar Shattock (19), Cory Anthony Palmer

,

The U.S. Department of Justice (DoJ) on Wednesday announced the seizure of 48 domains that offered services to conduct distributed denial-of-service (DDoS) attacks on behalf of other threat actors, effectively lowering the barrier to entry for malicious activity.
It also charged six suspects – Jeremiah Sam Evans Miller (23), Angel Manuel Colon Jr. (37), Shamar Shattock (19), Cory Anthony Palmer

, ,
https://thehackernews.com/2022/12/fbi-charges-6-seizes-48-domains-linked.html

Hacking Using SVG Files to Smuggle QBot Malware onto Windows Systems

Hacking Using SVG Files to Smuggle QBot Malware onto Windows Systems,

Phishing campaigns involving the Qakbot malware are using Scalable Vector Graphics (SVG) images embedded in HTML email attachments.
The new distribution method was spotted by Cisco Talos, which said it identified fraudulent email messages featuring HTML attachments with encoded SVG images that incorporate HTML script tags.
HTML smuggling is a technique that relies on using legitimate features of

,

Phishing campaigns involving the Qakbot malware are using Scalable Vector Graphics (SVG) images embedded in HTML email attachments.
The new distribution method was spotted by Cisco Talos, which said it identified fraudulent email messages featuring HTML attachments with encoded SVG images that incorporate HTML script tags.
HTML smuggling is a technique that relies on using legitimate features of

, ,
https://thehackernews.com/2022/12/hacking-using-svg-files-to-smuggle-qbot.html

« Mon téléphone est cassé » : attention à cette redoutable arnaque par SMS

« Mon téléphone est cassé » : attention à cette redoutable arnaque par SMS,

voler argent billet euros

Les personnes mal intentionnées ne manquent pas d’imagination pour piéger leurs victimes, comme le prouve cette nouvelle arnaque de « l’urgence familiale », aussi simple qu’efficace. On vous explique tout.

,

voler argent billet euros

Les personnes mal intentionnées ne manquent pas d’imagination pour piéger leurs victimes, comme le prouve cette nouvelle arnaque de « l’urgence familiale », aussi simple qu’efficace. On vous explique tout.

, ,
https://www.01net.com/actualites/mon-telephone-est-casse-attention-a-cette-redoutable-arnaque-par-sms.html

New GoTrim Botnet Attempting to Break into WordPress Sites’ Admin Accounts

New GoTrim Botnet Attempting to Break into WordPress Sites’ Admin Accounts

,

A new Go-based botnet has been spotted scanning and brute-forcing self-hosted websites using the WordPress content management system (CMS) to seize control of the targeted systems.
« This new brute forcer is part of a new campaign we have named GoTrim because it was written in Go and uses ‘:::trim:::’ to split data communicated to and from the C2 server, » Fortinet FortiGuard Labs researchers

,

A new Go-based botnet has been spotted scanning and brute-forcing self-hosted websites using the WordPress content management system (CMS) to seize control of the targeted systems.
« This new brute forcer is part of a new campaign we have named GoTrim because it was written in Go and uses ‘:::trim:::’ to split data communicated to and from the C2 server, » Fortinet FortiGuard Labs researchers

, ,
https://thehackernews.com/2022/12/new-gotrim-botnet-attempting-to-break.html

Ransomware Attackers Use Microsoft-Signed Drivers to Gain Access to Systems

Ransomware Attackers Use Microsoft-Signed Drivers to Gain Access to Systems,

Microsoft on Tuesday disclosed it took steps to suspend accounts that were used to publish malicious drivers that were certified by its Windows Hardware Developer Program were used to sign malware.
The tech giant said its investigation revealed the activity was restricted to a number of developer program accounts and that no further compromise was detected.
Cryptographically signing malware is

,

Microsoft on Tuesday disclosed it took steps to suspend accounts that were used to publish malicious drivers that were certified by its Windows Hardware Developer Program were used to sign malware.
The tech giant said its investigation revealed the activity was restricted to a number of developer program accounts and that no further compromise was detected.
Cryptographically signing malware is

, ,
https://thehackernews.com/2022/12/ransomware-attackers-use-microsoft.html