U.K. Electoral Commission Breach Exposes Voter Data of 40 Million Britons

U.K. Electoral Commission Breach Exposes Voter Data of 40 Million Britons,

The U.K. Electoral Commission on Tuesday disclosed a « complex » cyber attack on its systems that went undetected for over a year, allowing the threat actors to access years worth of voter data belonging to 40 million people.
« The incident was identified in October 2022 after suspicious activity was detected on our systems, » the regulator said. « It became clear that hostile actors had first

,

The U.K. Electoral Commission on Tuesday disclosed a « complex » cyber attack on its systems that went undetected for over a year, allowing the threat actors to access years worth of voter data belonging to 40 million people.
« The incident was identified in October 2022 after suspicious activity was detected on our systems, » the regulator said. « It became clear that hostile actors had first

, ,
https://thehackernews.com/2023/08/uk-electoral-commission-breach-exposes.html

New Android 14 Security Feature: IT Admins Can Now Disable 2G Networks

New Android 14 Security Feature: IT Admins Can Now Disable 2G Networks,

Google has introduced a new security feature in Android 14 that allows IT administrators to disable support for 2G cellular networks in their managed device fleet.
The search giant said it’s introducing a second user setting to turn off support, at the model level, for null-ciphered cellular connections.
« The Android Security Model assumes that all networks are hostile to keep users safe from

,

Google has introduced a new security feature in Android 14 that allows IT administrators to disable support for 2G cellular networks in their managed device fleet.
The search giant said it’s introducing a second user setting to turn off support, at the model level, for null-ciphered cellular connections.
« The Android Security Model assumes that all networks are hostile to keep users safe from

, ,
https://thehackernews.com/2023/08/new-android-14-security-feature-it.html

Microsoft Releases Patches for 74 New Vulnerabilities in August Update

Microsoft Releases Patches for 74 New Vulnerabilities in August Update,

Microsoft has patched a total of 74 flaws in its software as part of the company’s Patch Tuesday updates for August 2023, down from the voluminous 132 vulnerabilities the company fixed last month.
This comprises six Critical and 67 Important security vulnerabilities. Also released by the tech giant are two defense-in-depth updates for Microsoft Office (ADV230003) and the Memory Integrity System

,

Microsoft has patched a total of 74 flaws in its software as part of the company’s Patch Tuesday updates for August 2023, down from the voluminous 132 vulnerabilities the company fixed last month.
This comprises six Critical and 67 Important security vulnerabilities. Also released by the tech giant are two defense-in-depth updates for Microsoft Office (ADV230003) and the Memory Integrity System

, ,
https://thehackernews.com/2023/08/microsoft-releases-patches-for-74-new.html

QakBot Malware Operators Expand C2 Network with 15 New Servers

QakBot Malware Operators Expand C2 Network with 15 New Servers,

The operators associated with the QakBot (aka QBot) malware have set up 15 new command-and-control (C2) servers as of late June 2023.
The findings are a continuation of the malware’s infrastructure analysis from Team Cymru, and arrive a little over two months after Lumen Black Lotus Labs revealed that 25% of its C2 servers are only active for a single day.
« QakBot has a history of taking an

,

The operators associated with the QakBot (aka QBot) malware have set up 15 new command-and-control (C2) servers as of late June 2023.
The findings are a continuation of the malware’s infrastructure analysis from Team Cymru, and arrive a little over two months after Lumen Black Lotus Labs revealed that 25% of its C2 servers are only active for a single day.
« QakBot has a history of taking an

, ,
https://thehackernews.com/2023/08/qakbot-malware-operators-expand-c2.html

Hackers Abusing Cloudflare Tunnels for Covert Communications

Hackers Abusing Cloudflare Tunnels for Covert Communications,

New research has revealed that threat actors are abusing Cloudflare Tunnels to establish covert communication channels from compromised hosts and retain persistent access.

« Cloudflared is functionally very similar to ngrok, » Nic Finn, a senior threat intelligence analyst at GuidePoint Security, said. « However, Cloudflared differs from ngrok in that it provides a lot more usability for free,

,

New research has revealed that threat actors are abusing Cloudflare Tunnels to establish covert communication channels from compromised hosts and retain persistent access.

« Cloudflared is functionally very similar to ngrok, » Nic Finn, a senior threat intelligence analyst at GuidePoint Security, said. « However, Cloudflared differs from ngrok in that it provides a lot more usability for free,

, ,
https://thehackernews.com/2023/08/hackers-abusing-cloudflare-tunnels-for.html

Understanding Active Directory Attack Paths to Improve Security

Understanding Active Directory Attack Paths to Improve Security,

Introduced in 1999, Microsoft Active Directory is the default identity and access management service in Windows networks, responsible for assigning and enforcing security policies for all network endpoints. With it, users can access various resources across networks. As things tend to do, times, they are a’changin’ – and a few years back, Microsoft introduced Azure Active Directory, the

,

Introduced in 1999, Microsoft Active Directory is the default identity and access management service in Windows networks, responsible for assigning and enforcing security policies for all network endpoints. With it, users can access various resources across networks. As things tend to do, times, they are a’changin’ – and a few years back, Microsoft introduced Azure Active Directory, the

, ,
https://thehackernews.com/2023/08/understanding-active-directory-attack.html

New Yashma Ransomware Variant Targets Multiple English-Speaking Countries

New Yashma Ransomware Variant Targets Multiple English-Speaking Countries,

An unknown threat actor is using a variant of the Yashma ransomware to target various entities in English-speaking countries, Bulgaria, China, and Vietnam at least since June 4, 2023.
Cisco Talos, in a new write-up, attributed the operation with moderate confidence to an adversary of likely Vietnamese origin.
« The threat actor uses an uncommon technique to deliver the ransom note, » security

,

An unknown threat actor is using a variant of the Yashma ransomware to target various entities in English-speaking countries, Bulgaria, China, and Vietnam at least since June 4, 2023.
Cisco Talos, in a new write-up, attributed the operation with moderate confidence to an adversary of likely Vietnamese origin.
« The threat actor uses an uncommon technique to deliver the ransom note, » security

, ,
https://thehackernews.com/2023/08/new-yashma-ransomware-variant-targets.html

LOLBAS in the Wild: 11 Living-Off-The-Land Binaries That Could Be Used for Malicious Purposes

LOLBAS in the Wild: 11 Living-Off-The-Land Binaries That Could Be Used for Malicious Purposes,

Cybersecurity researchers have discovered a set of 11 living-off-the-land binaries-and-scripts (LOLBAS) that could be maliciously abused by threat actors to conduct post-exploitation activities. 
« LOLBAS is an attack method that uses binaries and scripts that are already part of the system for malicious purposes, » Pentera security researcher Nir Chako said. « This makes it hard for security teams

,

Cybersecurity researchers have discovered a set of 11 living-off-the-land binaries-and-scripts (LOLBAS) that could be maliciously abused by threat actors to conduct post-exploitation activities. 
« LOLBAS is an attack method that uses binaries and scripts that are already part of the system for malicious purposes, » Pentera security researcher Nir Chako said. « This makes it hard for security teams

, ,
https://thehackernews.com/2023/08/lolbas-in-wild-11-living-off-land.html

New Malware Campaign Targets Inexperienced Cyber Criminals with OpenBullet Configs

New Malware Campaign Targets Inexperienced Cyber Criminals with OpenBullet Configs,

A new malware campaign has been observed making use of malicious OpenBullet configuration files to target inexperienced cyber criminals with the goal of delivering a remote access trojan (RAT) capable of stealing sensitive information.
Bot mitigation company Kasada said the activity is designed to « exploit trusted criminal networks, » describing it as an instance of advanced threat actors « 

,

A new malware campaign has been observed making use of malicious OpenBullet configuration files to target inexperienced cyber criminals with the goal of delivering a remote access trojan (RAT) capable of stealing sensitive information.
Bot mitigation company Kasada said the activity is designed to « exploit trusted criminal networks, » describing it as an instance of advanced threat actors « 

, ,
https://thehackernews.com/2023/08/new-malware-campaign-targets.html

North Korean Hackers Targets Russian Missile Engineering Firm

North Korean Hackers Targets Russian Missile Engineering Firm,

Two different North Korean nation-state actors have been linked to a cyber intrusion against the major Russian missile engineering company NPO Mashinostroyeniya.
Cybersecurity firm SentinelOne said it identified « two instances of North Korea related compromise of sensitive internal IT infrastructure, » including a case of an email server compromise and the deployment of a Windows backdoor dubbed

,

Two different North Korean nation-state actors have been linked to a cyber intrusion against the major Russian missile engineering company NPO Mashinostroyeniya.
Cybersecurity firm SentinelOne said it identified « two instances of North Korea related compromise of sensitive internal IT infrastructure, » including a case of an email server compromise and the deployment of a Windows backdoor dubbed

, ,
https://thehackernews.com/2023/08/north-korean-hackers-targets-russian.html