Chinese Hackers Targeting Russian Military Personnel with Updated PlugX Malware

Chinese Hackers Targeting Russian Military Personnel with Updated PlugX Malware,

A China-linked government-sponsored threat actor has been observed targeting Russian speakers with an updated version of a remote access trojan called PlugX.
Secureworks attributed the attempted intrusions to a threat actor it tracks as Bronze President, and by the wider cybersecurity community under the monikers Mustang Panda, TA416, HoneyMyte, RedDelta, and PKPLUG.
« The war in Ukraine has

,

A China-linked government-sponsored threat actor has been observed targeting Russian speakers with an updated version of a remote access trojan called PlugX.
Secureworks attributed the attempted intrusions to a threat actor it tracks as Bronze President, and by the wider cybersecurity community under the monikers Mustang Panda, TA416, HoneyMyte, RedDelta, and PKPLUG.
« The war in Ukraine has

, ,
https://thehackernews.com/2022/04/chinese-hackers-targeting-russian.html

Google’s New Safety Section Shows What Data Android Apps Collect About Users

Google’s New Safety Section Shows What Data Android Apps Collect About Users

,

Google on Tuesday officially began rolling out a new « Data safety » section for Android apps on the Play Store to highlight the type of data being collected and shared with third-parties.
« Users want to know for what purpose their data is being collected and whether the developer is sharing user data with third parties, » Suzanne Frey, Vice President of product for Android security and privacy, 

,

Google on Tuesday officially began rolling out a new « Data safety » section for Android apps on the Play Store to highlight the type of data being collected and shared with third-parties.
« Users want to know for what purpose their data is being collected and whether the developer is sharing user data with third parties, » Suzanne Frey, Vice President of product for Android security and privacy, 

, ,
https://thehackernews.com/2022/04/googles-new-safety-section-shows-what.html

U.S. Offers $10 Million Bounty for Information on 6 Russian Military Hackers

U.S. Offers $10 Million Bounty for Information on 6 Russian Military Hackers,

The U.S. government on Tuesday announced up to $10 million in rewards for information on six hackers associated with the Russian military intelligence service.
« These individuals participated in malicious cyber activities on behalf of the Russian government against U.S. critical infrastructure in violation of the Computer Fraud and Abuse Act, » the State Department’s Rewards for Justice Program 

,

The U.S. government on Tuesday announced up to $10 million in rewards for information on six hackers associated with the Russian military intelligence service.
« These individuals participated in malicious cyber activities on behalf of the Russian government against U.S. critical infrastructure in violation of the Computer Fraud and Abuse Act, » the State Department’s Rewards for Justice Program 

, ,
https://thehackernews.com/2022/04/us-offers-10-million-bounty-for.html

Plusieurs hôpitaux français victimes de piratage, des données sensibles de patients en vente sur le dark web

Plusieurs hôpitaux français victimes de piratage, des données sensibles de patients en vente sur le dark web,

Le groupement hospitalier de territoire de la région Grand Est a été piraté, et une archive de 28 Go de données mise en vente sur le dark web. On y trouve, pêle-mêle, des passeports, des analyses médicales, des données bancaires, des dossiers patients…

,

Le groupement hospitalier de territoire de la région Grand Est a été piraté, et une archive de 28 Go de données mise en vente sur le dark web. On y trouve, pêle-mêle, des passeports, des analyses médicales, des données bancaires, des dossiers patients…

, ,
https://www.01net.com/actualites/plusieurs-hopitaux-francais-victimes-de-piratage-des-donnees-sensibles-de-patients-en-vente-sur-le-dark-web-2056026.html

NPM Bug Allowed Attackers to Distribute Malware as Legitimate Packages

NPM Bug Allowed Attackers to Distribute Malware as Legitimate Packages,

A « logical flaw » has been disclosed in NPM, the default package manager for the Node.js JavaScript runtime environment, that enables malicious actors to pass off rogue libraries as legitimate and trick unsuspecting developers into installing them.
The supply chain threat has been dubbed « Package Planting » by researchers from cloud security firm Aqua. Following responsible disclosure on February

,

A « logical flaw » has been disclosed in NPM, the default package manager for the Node.js JavaScript runtime environment, that enables malicious actors to pass off rogue libraries as legitimate and trick unsuspecting developers into installing them.
The supply chain threat has been dubbed « Package Planting » by researchers from cloud security firm Aqua. Following responsible disclosure on February

, ,
https://thehackernews.com/2022/04/npm-bug-allowed-attackers-to-distribute.html

Microsoft Discovers New Privilege Escalation Flaws in Linux Operating System

Microsoft Discovers New Privilege Escalation Flaws in Linux Operating System,

Microsoft on Tuesday disclosed a set of two privilege escalation vulnerabilities in the Linux operating system that could potentially allow threat actors to carry out an array of nefarious activities.
Collectively called « Nimbuspwn, » the flaws « can be chained together to gain root privileges on Linux systems, allowing attackers to deploy payloads, like a root backdoor, and perform other

,

Microsoft on Tuesday disclosed a set of two privilege escalation vulnerabilities in the Linux operating system that could potentially allow threat actors to carry out an array of nefarious activities.
Collectively called « Nimbuspwn, » the flaws « can be chained together to gain root privileges on Linux systems, allowing attackers to deploy payloads, like a root backdoor, and perform other

, ,
https://thehackernews.com/2022/04/microsoft-discovers-new-privilege.html

Emotet Testing New Delivery Ideas After Microsoft Disables VBA Macros by Default

Emotet Testing New Delivery Ideas After Microsoft Disables VBA Macros by Default,

The threat actor behind the prolific Emotet botnet is testing new attack methods on a small scale before co-opting them into their larger volume malspam campaigns, potentially in response to Microsoft’s move to disable Visual Basic for Applications (VBA) macros by default across its products.
Calling the new activity a « departure » from the group’s typical behavior, ProofPoint alternatively 

,

The threat actor behind the prolific Emotet botnet is testing new attack methods on a small scale before co-opting them into their larger volume malspam campaigns, potentially in response to Microsoft’s move to disable Visual Basic for Applications (VBA) macros by default across its products.
Calling the new activity a « departure » from the group’s typical behavior, ProofPoint alternatively 

, ,
https://thehackernews.com/2022/04/emotet-testing-new-delivery-ideas-after.html

Cette entreprise peut géolocaliser 3 milliards de smartphones en permanence

Cette entreprise peut géolocaliser 3 milliards de smartphones en permanence,

En récoltant les données GPS envoyées par les applications mobiles, Anomaly Six s’est construit un réseau de surveillance mondial particulièrement impressionnant. Et probablement illégal.

,

En récoltant les données GPS envoyées par les applications mobiles, Anomaly Six s’est construit un réseau de surveillance mondial particulièrement impressionnant. Et probablement illégal.

, ,
https://www.01net.com/actualites/cette-entreprise-peut-geolocaliser-3milliards-de-smartphones-en-permanence-2056012.html

Gold Ulrick Hackers Still in Action Despite Massive Conti Ransomware Leak

Gold Ulrick Hackers Still in Action Despite Massive Conti Ransomware Leak,

The infamous ransomware group known as Conti has continued its onslaught against entities despite suffering a massive data leak of its own earlier this year, according to new research.
Conti, attributed to a Russia-based threat actor known as Gold Ulrick, is one of the most prevalent malware strains in the ransomware landscape, accounting for 19% of all attacks during the three-month-period

,

The infamous ransomware group known as Conti has continued its onslaught against entities despite suffering a massive data leak of its own earlier this year, according to new research.
Conti, attributed to a Russia-based threat actor known as Gold Ulrick, is one of the most prevalent malware strains in the ransomware landscape, accounting for 19% of all attacks during the three-month-period

, ,
https://thehackernews.com/2022/04/gold-ulrick-hackers-still-in-action.html

North Korean Hackers Target Journalists with GOLDBACKDOOR Malware

North Korean Hackers Target Journalists with GOLDBACKDOOR Malware,

A state-backed threat actor with ties to the Democratic People’s Republic of Korea (DRPK) has been attributed to a spear-phishing campaign targeting journalists covering the country with the ultimate goal of deploying a backdoor on infected Windows systems.
The intrusions, said to be the work of Ricochet Chollima, resulted in the deployment of a novel malware strain called GOLDBACKDOOR, an

,

A state-backed threat actor with ties to the Democratic People’s Republic of Korea (DRPK) has been attributed to a spear-phishing campaign targeting journalists covering the country with the ultimate goal of deploying a backdoor on infected Windows systems.
The intrusions, said to be the work of Ricochet Chollima, resulted in the deployment of a novel malware strain called GOLDBACKDOOR, an

, ,
https://thehackernews.com/2022/04/north-korean-hackers-target-journalists.html