NSA Releases Guide to Combat Powerful BlackLotus Bootkit Targeting Windows Systems

NSA Releases Guide to Combat Powerful BlackLotus Bootkit Targeting Windows Systems,

The U.S. National Security Agency (NSA) on Thursday released guidance to help organizations detect and prevent infections of a Unified Extensible Firmware Interface (UEFI) bootkit called BlackLotus.
To that end, the agency is recommending that « infrastructure owners take action by hardening user executable policies and monitoring the integrity of the boot partition. »
BlackLotus is an advanced 

,

The U.S. National Security Agency (NSA) on Thursday released guidance to help organizations detect and prevent infections of a Unified Extensible Firmware Interface (UEFI) bootkit called BlackLotus.
To that end, the agency is recommending that « infrastructure owners take action by hardening user executable policies and monitoring the integrity of the boot partition. »
BlackLotus is an advanced 

, ,
https://thehackernews.com/2023/06/nsa-releases-guide-to-combat-powerful.html

New Cryptocurrency Mining Campaign Targets Linux Systems and IoT Devices

New Cryptocurrency Mining Campaign Targets Linux Systems and IoT Devices,

Internet-facing Linux systems and Internet of Things (IoT) devices are being targeted as part of a new campaign designed to illicitly mine cryptocurrency.
« The threat actors behind the attack use a backdoor that deploys a wide array of tools and components such as rootkits and an IRC bot to steal device resources for mining operations, » Microsoft threat intelligence researcher Rotem Sde-Or said.

,

Internet-facing Linux systems and Internet of Things (IoT) devices are being targeted as part of a new campaign designed to illicitly mine cryptocurrency.
« The threat actors behind the attack use a backdoor that deploys a wide array of tools and components such as rootkits and an IRC bot to steal device resources for mining operations, » Microsoft threat intelligence researcher Rotem Sde-Or said.

, ,
https://thehackernews.com/2023/06/new-cryptocurrency-mining-campaign.html

MULTI#STORM Campaign Targets India and U.S. with Remote Access Trojans

MULTI#STORM Campaign Targets India and U.S. with Remote Access Trojans,

A new phishing campaign codenamed MULTI#STORM has set its sights on India and the U.S. by leveraging JavaScript files to deliver remote access trojans on compromised systems.
« The attack chain ends with the victim machine infected with multiple unique RAT (remote access trojan) malware instances, such as Warzone RAT and Quasar RAT, » Securonix researchers Den Iuzvyk, Tim Peck, and Oleg Kolesnikov

,

A new phishing campaign codenamed MULTI#STORM has set its sights on India and the U.S. by leveraging JavaScript files to deliver remote access trojans on compromised systems.
« The attack chain ends with the victim machine infected with multiple unique RAT (remote access trojan) malware instances, such as Warzone RAT and Quasar RAT, » Securonix researchers Den Iuzvyk, Tim Peck, and Oleg Kolesnikov

, ,
https://thehackernews.com/2023/06/multistorm-campaign-targets-india-and.html

Generative-AI apps & ChatGPT: Potential risks and mitigation strategies

Generative-AI apps & ChatGPT: Potential risks and mitigation strategies

,

Losing sleep over Generative-AI apps? You’re not alone or wrong. According to the Astrix Security Research Group, mid size organizations already have, on average, 54 Generative-AI integrations to core systems like Slack, GitHub and Google Workspace and this number is only expected to grow. Continue reading to understand the potential risks and how to minimize them. 
Book a Generative-AI

,

Losing sleep over Generative-AI apps? You’re not alone or wrong. According to the Astrix Security Research Group, mid size organizations already have, on average, 54 Generative-AI integrations to core systems like Slack, GitHub and Google Workspace and this number is only expected to grow. Continue reading to understand the potential risks and how to minimize them. 
Book a Generative-AI

, ,
https://thehackernews.com/2023/06/generative-ai-apps-chatgpt-potential.html

Alert: Million of GitHub Repositories Likely Vulnerable to RepoJacking Attack

Alert: Million of GitHub Repositories Likely Vulnerable to RepoJacking Attack,

Millions of software repositories on GitHub are likely vulnerable to an attack called RepoJacking, a new study has revealed.
This includes repositories from organizations such as Google, Lyft, and several others, Massachusetts-based cloud-native security firm Aqua said in a Wednesday report.
The supply chain vulnerability, also known as dependency repository hijacking, is a class of attacks that

,

Millions of software repositories on GitHub are likely vulnerable to an attack called RepoJacking, a new study has revealed.
This includes repositories from organizations such as Google, Lyft, and several others, Massachusetts-based cloud-native security firm Aqua said in a Wednesday report.
The supply chain vulnerability, also known as dependency repository hijacking, is a class of attacks that

, ,
https://thehackernews.com/2023/06/alert-million-of-github-repositories.html

Camaro Dragon Hackers Strike with USB-Driven Self-Propagating Malware

Camaro Dragon Hackers Strike with USB-Driven Self-Propagating Malware,

The Chinese cyber espionage actor known as Camaro Dragon has been observed leveraging a new strain of self-propagating malware that spreads through compromised USB drives.
« While their primary focus has traditionally been Southeast Asian countries, this latest discovery reveals their global reach and highlights the alarming role USB drives play in spreading malware, » Check Point said in new

,

The Chinese cyber espionage actor known as Camaro Dragon has been observed leveraging a new strain of self-propagating malware that spreads through compromised USB drives.
« While their primary focus has traditionally been Southeast Asian countries, this latest discovery reveals their global reach and highlights the alarming role USB drives play in spreading malware, » Check Point said in new

, ,
https://thehackernews.com/2023/06/camaro-dragon-hackers-strike-with-usb.html

Unveiling the Unseen: Identifying Data Exfiltration with Machine Learning

Unveiling the Unseen: Identifying Data Exfiltration with Machine Learning,

Why Data Exfiltration Detection is Paramount?
The world is witnessing an exponential rise in ransomware and data theft employed to extort companies. At the same time, the industry faces numerous critical vulnerabilities in database software and company websites. This evolution paints a dire picture of data exposure and exfiltration that every security leader and team is grappling with. This

,

Why Data Exfiltration Detection is Paramount?
The world is witnessing an exponential rise in ransomware and data theft employed to extort companies. At the same time, the industry faces numerous critical vulnerabilities in database software and company websites. This evolution paints a dire picture of data exposure and exfiltration that every security leader and team is grappling with. This

, ,
https://thehackernews.com/2023/06/unveiling-unseen-identifying-data.html

Critical Flaw Found in WordPress Plugin for WooCommerce Used by 30,000 Websites

Critical Flaw Found in WordPress Plugin for WooCommerce Used by 30,000 Websites,

A critical security flaw has been disclosed in the WordPress « Abandoned Cart Lite for WooCommerce » plugin that’s installed on more than 30,000 websites.
« This vulnerability makes it possible for an attacker to gain access to the accounts of users who have abandoned their carts, who are typically customers but can extend to other high-level users when the right conditions are met, » Defiant’s

,

A critical security flaw has been disclosed in the WordPress « Abandoned Cart Lite for WooCommerce » plugin that’s installed on more than 30,000 websites.
« This vulnerability makes it possible for an attacker to gain access to the accounts of users who have abandoned their carts, who are typically customers but can extend to other high-level users when the right conditions are met, » Defiant’s

, ,
https://thehackernews.com/2023/06/critical-flaw-found-in-wordpress-plugin.html

Zero-Day Alert: Apple Releases Patches for Actively Exploited Flaws in iOS, macOS, and Safari

Zero-Day Alert: Apple Releases Patches for Actively Exploited Flaws in iOS, macOS, and Safari,

Apple on Wednesday released a slew of updates for iOS, iPadOS, macOS, watchOS, and Safari browser to address a set of flaws it said were actively exploited in the wild.
This includes a pair of zero-days that have been weaponized in a mobile surveillance campaign called Operation Triangulation that has been active since 2019. The exact threat actor behind the campaign is not known.

,

Apple on Wednesday released a slew of updates for iOS, iPadOS, macOS, watchOS, and Safari browser to address a set of flaws it said were actively exploited in the wild.
This includes a pair of zero-days that have been weaponized in a mobile surveillance campaign called Operation Triangulation that has been active since 2019. The exact threat actor behind the campaign is not known.

, ,
https://thehackernews.com/2023/06/zero-day-alert-apple-releases-patches.html

ScarCruft Hackers Exploit Ably Service for Stealthy Wiretapping Attacks

ScarCruft Hackers Exploit Ably Service for Stealthy Wiretapping Attacks,

The North Korean threat actor known as ScarCruft has been observed using an information-stealing malware with previous undocumented wiretapping features as well as a backdoor developed using Golang that exploits the Ably real-time messaging service.
« The threat actor sent their commands through the Golang backdoor that is using the Ably service, » the AhnLab Security Emergency response Center (

,

The North Korean threat actor known as ScarCruft has been observed using an information-stealing malware with previous undocumented wiretapping features as well as a backdoor developed using Golang that exploits the Ably real-time messaging service.
« The threat actor sent their commands through the Golang backdoor that is using the Ably service, » the AhnLab Security Emergency response Center (

, ,
https://thehackernews.com/2023/06/scarcruft-hackers-exploit-ably-service.html