U.S. and U.K. Warn of Russian Hackers Exploiting Cisco Router Flaws for Espionage

U.S. and U.K. Warn of Russian Hackers Exploiting Cisco Router Flaws for Espionage,

U.K. and U.S. cybersecurity and intelligence agencies have warned of Russian nation-state actors exploiting now-patched flaws in networking equipment from Cisco to conduct reconnaissance and deploy malware against targets.
The intrusions, per the authorities, took place in 2021 and targeted a small number of entities in Europe, U.S. government institutions, and about 250 Ukrainian victims.
The

,

U.K. and U.S. cybersecurity and intelligence agencies have warned of Russian nation-state actors exploiting now-patched flaws in networking equipment from Cisco to conduct reconnaissance and deploy malware against targets.
The intrusions, per the authorities, took place in 2021 and targeted a small number of entities in Europe, U.S. government institutions, and about 250 Ukrainian victims.
The

, ,
https://thehackernews.com/2023/04/us-and-uk-warn-of-russian-hackers.html

Iranian Government-Backed Hackers Targeting U.S. Energy and Transit Systems

Iranian Government-Backed Hackers Targeting U.S. Energy and Transit Systems,

An Iranian government-backed actor known as Mint Sandstorm has been linked to attacks aimed at critical infrastructure in the U.S. between late 2021 to mid-2022.
« This Mint Sandstorm subgroup is technically and operationally mature, capable of developing bespoke tooling and quickly weaponizing N-day vulnerabilities, and has demonstrated agility in its operational focus, which appears to align

,

An Iranian government-backed actor known as Mint Sandstorm has been linked to attacks aimed at critical infrastructure in the U.S. between late 2021 to mid-2022.
« This Mint Sandstorm subgroup is technically and operationally mature, capable of developing bespoke tooling and quickly weaponizing N-day vulnerabilities, and has demonstrated agility in its operational focus, which appears to align

, ,
https://thehackernews.com/2023/04/iranian-government-backed-hackers.html

Critical Flaws in vm2 JavaScript Library Can Lead to Remote Code Execution

Critical Flaws in vm2 JavaScript Library Can Lead to Remote Code Execution,

A fresh round of patches has been made available for the vm2 JavaScript library to address two critical flaws that could be exploited to break out of the sandbox protections.
Both the flaws – CVE-2023-29199 and CVE-2023-30547 – are rated 9.8 out of 10 on the CVSS scoring system and have been addressed in versions 3.9.16 and 3.9.17, respectively.
Successful exploitation of the bugs, which allow

,

A fresh round of patches has been made available for the vm2 JavaScript library to address two critical flaws that could be exploited to break out of the sandbox protections.
Both the flaws – CVE-2023-29199 and CVE-2023-30547 – are rated 9.8 out of 10 on the CVSS scoring system and have been addressed in versions 3.9.16 and 3.9.17, respectively.
Successful exploitation of the bugs, which allow

, ,
https://thehackernews.com/2023/04/critical-flaws-in-vm2-javascript.html

YouTube Videos Distributing Aurora Stealer Malware via Highly Evasive Loader

YouTube Videos Distributing Aurora Stealer Malware via Highly Evasive Loader,

Cybersecurity researchers have detailed the inner workings of a highly evasive loader named « in2al5d p3in4er » (read: invalid printer) that’s used to deliver the Aurora information stealer malware.
« The in2al5d p3in4er loader is compiled with Embarcadero RAD Studio and targets endpoint workstations using advanced anti-VM (virtual machine) technique, » cybersecurity firm Morphisec said in a report

,

Cybersecurity researchers have detailed the inner workings of a highly evasive loader named « in2al5d p3in4er » (read: invalid printer) that’s used to deliver the Aurora information stealer malware.
« The in2al5d p3in4er loader is compiled with Embarcadero RAD Studio and targets endpoint workstations using advanced anti-VM (virtual machine) technique, » cybersecurity firm Morphisec said in a report

, ,
https://thehackernews.com/2023/04/youtube-videos-distributing-aurora.html

Goldoson Android Malware Infects Over 100 Million Google Play Store Downloads

Goldoson Android Malware Infects Over 100 Million Google Play Store Downloads,

A new Android malware strain named Goldoson has been detected in the official Google Play Store spanning more than 60 legitimate apps that collectively have over 100 million downloads.
An additional eight million installations have been tracked through ONE store, a leading third-party app storefront in South Korea.
The rogue component is part of a third-party software library used by the apps in

,

A new Android malware strain named Goldoson has been detected in the official Google Play Store spanning more than 60 legitimate apps that collectively have over 100 million downloads.
An additional eight million installations have been tracked through ONE store, a leading third-party app storefront in South Korea.
The rogue component is part of a third-party software library used by the apps in

, ,
https://thehackernews.com/2023/04/goldoson-android-malware-infects-over.html

DFIR via XDR: How to expedite your investigations with a DFIRent approach

DFIR via XDR: How to expedite your investigations with a DFIRent approach,

Rapid technological evolution requires security that is resilient, up to date and adaptable.
In this article, we will cover the transformation in the field of DFIR (digital forensics and incident response) in the last couple years, focusing on the digital forensics’ aspect and how XDR fits into the picture.
Before we dive into the details, let’s first break down the main components of DFIR and

,

Rapid technological evolution requires security that is resilient, up to date and adaptable.
In this article, we will cover the transformation in the field of DFIR (digital forensics and incident response) in the last couple years, focusing on the digital forensics’ aspect and how XDR fits into the picture.
Before we dive into the details, let’s first break down the main components of DFIR and

, ,
https://thehackernews.com/2023/04/dfir-via-xdr-how-to-expedite-your.html

Iranian Hackers Using SimpleHelp Remote Support Software for Persistent Access

Iranian Hackers Using SimpleHelp Remote Support Software for Persistent Access,

The Iranian threat actor known as MuddyWater is continuing its time-tested tradition of relying on legitimate remote administration tools to commandeer targeted systems.
While the nation-state group has previously employed ScreenConnect, RemoteUtilities, and Syncro, a new analysis from Group-IB has revealed the adversary’s use of the SimpleHelp remote support software in June 2022.
MuddyWater,

,

The Iranian threat actor known as MuddyWater is continuing its time-tested tradition of relying on legitimate remote administration tools to commandeer targeted systems.
While the nation-state group has previously employed ScreenConnect, RemoteUtilities, and Syncro, a new analysis from Group-IB has revealed the adversary’s use of the SimpleHelp remote support software in June 2022.
MuddyWater,

, ,
https://thehackernews.com/2023/04/iranian-hackers-using-simplehelp-remote.html

LockBit Ransomware Now Targeting Apple macOS Devices

LockBit Ransomware Now Targeting Apple macOS Devices,

Threat actors behind the LockBit ransomware operation have developed new artifacts that can encrypt files on devices running Apple’s macOS operating system.
The development, which was reported by the MalwareHunterTeam over the weekend, appears to be the first time a big-game ransomware crew has created a macOS-based payload.
Additional samples identified by vx-underground show that the macOS

,

Threat actors behind the LockBit ransomware operation have developed new artifacts that can encrypt files on devices running Apple’s macOS operating system.
The development, which was reported by the MalwareHunterTeam over the weekend, appears to be the first time a big-game ransomware crew has created a macOS-based payload.
Additional samples identified by vx-underground show that the macOS

, ,
https://thehackernews.com/2023/04/lockbit-ransomware-now-targeting-apple.html

Israeli Spyware Vendor QuaDream to Shut Down Following Citizen Lab and Microsoft Expose

Israeli Spyware Vendor QuaDream to Shut Down Following Citizen Lab and Microsoft Expose,

Israeli spyware vendor QuaDream is allegedly shutting down its operations in the coming days, less than a week after its hacking toolset was exposed by Citizen Lab and Microsoft.
The development was reported by the Israeli business newspaper Calcalist, citing unnamed sources, adding the company « hasn’t been fully active for a while » and that it « has been in a difficult situation for several

,

Israeli spyware vendor QuaDream is allegedly shutting down its operations in the coming days, less than a week after its hacking toolset was exposed by Citizen Lab and Microsoft.
The development was reported by the Israeli business newspaper Calcalist, citing unnamed sources, adding the company « hasn’t been fully active for a while » and that it « has been in a difficult situation for several

, ,
https://thehackernews.com/2023/04/israeli-spyware-vendor-quadream-to-shut.html

New QBot Banking Trojan Campaign Hijacks Business Emails to Spread Malware

New QBot Banking Trojan Campaign Hijacks Business Emails to Spread Malware,

A new QBot malware campaign is leveraging hijacked business correspondence to trick unsuspecting victims into installing the malware, new findings from Kaspersky reveal.
The latest activity, which commenced on April 4, 2023, has primarily targeted users in Germany, Argentina, Italy, Algeria, Spain, the U.S., Russia, France, the U.K., and Morocco.
QBot (aka Qakbot or Pinkslipbot) is a banking

,

A new QBot malware campaign is leveraging hijacked business correspondence to trick unsuspecting victims into installing the malware, new findings from Kaspersky reveal.
The latest activity, which commenced on April 4, 2023, has primarily targeted users in Germany, Argentina, Italy, Algeria, Spain, the U.S., Russia, France, the U.K., and Morocco.
QBot (aka Qakbot or Pinkslipbot) is a banking

, ,
https://thehackernews.com/2023/04/new-qbot-banking-trojan-campaign.html