« Mysterious Team Bangladesh » Targeting India with DDoS Attacks and Data Breaches

« Mysterious Team Bangladesh » Targeting India with DDoS Attacks and Data Breaches

,

A hacktivist group known as Mysterious Team Bangladesh has been linked to over 750 distributed denial-of-service (DDoS) attacks and 78 website defacements since June 2022.
« The group most frequently attacks logistics, government, and financial sector organizations in India and Israel, » Singapore-headquartered cybersecurity firm Group-IB said in a report shared with The Hacker News. « The group is

,

A hacktivist group known as Mysterious Team Bangladesh has been linked to over 750 distributed denial-of-service (DDoS) attacks and 78 website defacements since June 2022.
« The group most frequently attacks logistics, government, and financial sector organizations in India and Israel, » Singapore-headquartered cybersecurity firm Group-IB said in a report shared with The Hacker News. « The group is

, ,
https://thehackernews.com/2023/08/mysterious-team-bangladesh-targeting.html

Microsoft Exposes Russian Hackers’ Sneaky Phishing Tactics via Microsoft Teams Chats

Microsoft Exposes Russian Hackers’ Sneaky Phishing Tactics via Microsoft Teams Chats

,

Microsoft on Wednesday disclosed that it identified a set of highly targeted social engineering attacks mounted by a Russian nation-state threat actor using credential theft phishing lures sent as Microsoft Teams chats.
The tech giant attributed the attacks to a group it tracks as Midnight Blizzard (previously Nobelium). It’s also called APT29, BlueBravo, Cozy Bear, Iron Hemlock, and The Dukes.

,

Microsoft on Wednesday disclosed that it identified a set of highly targeted social engineering attacks mounted by a Russian nation-state threat actor using credential theft phishing lures sent as Microsoft Teams chats.
The tech giant attributed the attacks to a group it tracks as Midnight Blizzard (previously Nobelium). It’s also called APT29, BlueBravo, Cozy Bear, Iron Hemlock, and The Dukes.

, ,
https://thehackernews.com/2023/08/microsoft-exposes-russian-hackers.html

Researchers Discover Bypass for Recently Patched Critical Ivanti EPMM Vulnerability

Researchers Discover Bypass for Recently Patched Critical Ivanti EPMM Vulnerability,

Cybersecurity researchers have discovered a bypass for a recently fixed actively exploited vulnerability in some versions of Ivanti Endpoint Manager Mobile (EPMM), prompting Ivanti to urge users to update to the latest version of the software.
Tracked as CVE-2023-35082 (CVSS score: 10.0) and discovered by Rapid7, the issue « allows unauthenticated attackers to access the API in older unsupported

,

Cybersecurity researchers have discovered a bypass for a recently fixed actively exploited vulnerability in some versions of Ivanti Endpoint Manager Mobile (EPMM), prompting Ivanti to urge users to update to the latest version of the software.
Tracked as CVE-2023-35082 (CVSS score: 10.0) and discovered by Rapid7, the issue « allows unauthenticated attackers to access the API in older unsupported

, ,
https://thehackernews.com/2023/08/researchers-discover-bypass-for.html

Russian Cyber Adversary BlueCharlie Alters Infrastructure in Response to Disclosures

Russian Cyber Adversary BlueCharlie Alters Infrastructure in Response to Disclosures,

A Russa-nexus adversary has been linked to 94 new domains, suggesting that the group is actively modifying its infrastructure in response to public disclosures about its activities.
Cybersecurity firm Recorded Future linked the new infrastructure to a threat actor it tracks under the name BlueCharlie, a hacking crew that’s broadly known by the names Blue Callisto, Callisto (or Calisto),

,

A Russa-nexus adversary has been linked to 94 new domains, suggesting that the group is actively modifying its infrastructure in response to public disclosures about its activities.
Cybersecurity firm Recorded Future linked the new infrastructure to a threat actor it tracks under the name BlueCharlie, a hacking crew that’s broadly known by the names Blue Callisto, Callisto (or Calisto),

, ,
https://thehackernews.com/2023/08/russian-cyber-adversary-bluecharlie.html

Industrial Control Systems Vulnerabilities Soar: Over One-Third Unpatched in 2023

Industrial Control Systems Vulnerabilities Soar: Over One-Third Unpatched in 2023,

About 34% of security vulnerabilities impacting industrial control systems (ICSs) that were reported in the first half of 2023 have no patch or remediation, registering a significant increase from 13% the previous year.
According to data compiled by SynSaber, a total of 670 ICS product flaws were reported via the U.S. Cybersecurity and Infrastructure Security Agency (CISA) in the first half of

,

About 34% of security vulnerabilities impacting industrial control systems (ICSs) that were reported in the first half of 2023 have no patch or remediation, registering a significant increase from 13% the previous year.
According to data compiled by SynSaber, a total of 670 ICS product flaws were reported via the U.S. Cybersecurity and Infrastructure Security Agency (CISA) in the first half of

, ,
https://thehackernews.com/2023/08/industrial-control-systems.html

Phishers Exploit Salesforce’s Email Services Zero-Day in Targeted Facebook Campaign

Phishers Exploit Salesforce’s Email Services Zero-Day in Targeted Facebook Campaign

,

A sophisticated Facebook phishing campaign has been observed exploiting a zero-day flaw in Salesforce’s email services, allowing threat actors to craft targeted phishing messages using the company’s domain and infrastructure.
« Those phishing campaigns cleverly evade conventional detection methods by chaining the Salesforce vulnerability and legacy quirks in Facebook’s Web Games platform, »

,

A sophisticated Facebook phishing campaign has been observed exploiting a zero-day flaw in Salesforce’s email services, allowing threat actors to craft targeted phishing messages using the company’s domain and infrastructure.
« Those phishing campaigns cleverly evade conventional detection methods by chaining the Salesforce vulnerability and legacy quirks in Facebook’s Web Games platform, »

, ,
https://thehackernews.com/2023/08/phishers-exploit-salesforces-email.html

Top Industries Significantly Impacted by Illicit Telegram Networks

Top Industries Significantly Impacted by Illicit Telegram Networks,

In recent years the rise of illicit activities conducted within online messaging platforms has become a growing concern for countless industries. One of the most notable platforms that has been host to many malicious actors and nefarious activities has been Telegram. Thanks to its accessibility, popularity, and user anonymity, Telegram has attracted a large number of threat actors driven by

,

In recent years the rise of illicit activities conducted within online messaging platforms has become a growing concern for countless industries. One of the most notable platforms that has been host to many malicious actors and nefarious activities has been Telegram. Thanks to its accessibility, popularity, and user anonymity, Telegram has attracted a large number of threat actors driven by

, ,
https://thehackernews.com/2023/08/top-industries-significantly-impacted.html

Researchers Uncover AWS SSM Agent Misuse as a Covert Remote Access Trojan

Researchers Uncover AWS SSM Agent Misuse as a Covert Remote Access Trojan,

Cybersecurity researchers have discovered a new post-exploitation technique in Amazon Web Services (AWS) that allows the AWS Systems Manager Agent (SSM Agent) to be run as a remote access trojan on Windows and Linux environments
« The SSM agent, a legitimate tool used by admins to manage their instances, can be re-purposed by an attacker who has achieved high privilege access on an endpoint with

,

Cybersecurity researchers have discovered a new post-exploitation technique in Amazon Web Services (AWS) that allows the AWS Systems Manager Agent (SSM Agent) to be run as a remote access trojan on Windows and Linux environments
« The SSM agent, a legitimate tool used by admins to manage their instances, can be re-purposed by an attacker who has achieved high privilege access on an endpoint with

, ,
https://thehackernews.com/2023/08/researchers-uncover-aws-ssm-agent.html

Iranian Company Cloudzy Accused of Aiding Cybercriminals and Nation-State Hackers

Iranian Company Cloudzy Accused of Aiding Cybercriminals and Nation-State Hackers,

Services offered by an obscure Iranian company known as Cloudzy are being leveraged by multiple threat actors, including cybercrime groups and nation-state crews.
« Although Cloudzy is incorporated in the United States, it almost certainly operates out of Tehran, Iran – in possible violation of U.S. sanctions – under the direction of someone 
going by the name Hassan Nozari, » Halcyon said in a

,

Services offered by an obscure Iranian company known as Cloudzy are being leveraged by multiple threat actors, including cybercrime groups and nation-state crews.
« Although Cloudzy is incorporated in the United States, it almost certainly operates out of Tehran, Iran – in possible violation of U.S. sanctions – under the direction of someone 
going by the name Hassan Nozari, » Halcyon said in a

, ,
https://thehackernews.com/2023/08/iranian-company-cloudzy-accused-of.html

Norwegian Entities Targeted in Ongoing Attacks Exploiting Ivanti EPMM Vulnerability

Norwegian Entities Targeted in Ongoing Attacks Exploiting Ivanti EPMM Vulnerability,

Advanced persistent threat (APT) actors exploited a recently disclosed critical flaw impacting Ivanti Endpoint Manager Mobile (EPMM) as a zero-day since at least April 2023 in attacks directed against Norwegian entities, including a government network.
The disclosure comes as part of a new joint advisory released by the Cybersecurity and Infrastructure Security Agency (CISA) and the Norwegian

,

Advanced persistent threat (APT) actors exploited a recently disclosed critical flaw impacting Ivanti Endpoint Manager Mobile (EPMM) as a zero-day since at least April 2023 in attacks directed against Norwegian entities, including a government network.
The disclosure comes as part of a new joint advisory released by the Cybersecurity and Infrastructure Security Agency (CISA) and the Norwegian

, ,
https://thehackernews.com/2023/08/norwegian-entities-targeted-in-ongoing.html