Activities in the Cybercrime Underground Require a New Approach to Cybersecurity

Activities in the Cybercrime Underground Require a New Approach to Cybersecurity,

As Threat Actors Continuously Adapt their TTPs in Today’s Threat Landscape, So Must You
Earlier this year, threat researchers at Cybersixgill released the annual report, The State of the Cybercrime Underground. The research stems from an analysis of Cybersixgill’s collected intelligence items throughout 2022, gathered from the deep, dark and clear web. The report examines the continuous

,

As Threat Actors Continuously Adapt their TTPs in Today’s Threat Landscape, So Must You
Earlier this year, threat researchers at Cybersixgill released the annual report, The State of the Cybercrime Underground. The research stems from an analysis of Cybersixgill’s collected intelligence items throughout 2022, gathered from the deep, dark and clear web. The report examines the continuous

, ,
https://thehackernews.com/2023/06/activities-in-cybercrime-underground.html

20-Year-Old Russian LockBit Ransomware Affiliate Arrested in Arizona

20-Year-Old Russian LockBit Ransomware Affiliate Arrested in Arizona,

The U.S. Department of Justice (DoJ) on Thursday unveiled charges against a Russian national for his alleged involvement in deploying LockBit ransomware to targets in the U.S., Asia, Europe, and Africa.
Ruslan Magomedovich Astamirov, 20, of Chechen Republic has been accused of perpetrating at least five attacks between August 2020 and March 2023. He was arrested in the state of Arizona last

,

The U.S. Department of Justice (DoJ) on Thursday unveiled charges against a Russian national for his alleged involvement in deploying LockBit ransomware to targets in the U.S., Asia, Europe, and Africa.
Ruslan Magomedovich Astamirov, 20, of Chechen Republic has been accused of perpetrating at least five attacks between August 2020 and March 2023. He was arrested in the state of Arizona last

, ,
https://thehackernews.com/2023/06/20-year-old-russian-lockbit-ransomware.html

Third Flaw Uncovered in MOVEit Transfer App Amidst Cl0p Ransomware Mass Attack

Third Flaw Uncovered in MOVEit Transfer App Amidst Cl0p Ransomware Mass Attack,

Progress Software on Thursday disclosed a third vulnerability impacting its MOVEit Transfer application, as the Cl0p cybercrime gang deployed extortion tactics against affected companies.
The new flaw, which is yet to be assigned a CVE identifier, also concerns an SQL injection vulnerability that « could lead to escalated privileges and potential unauthorized access to the environment. »
The

,

Progress Software on Thursday disclosed a third vulnerability impacting its MOVEit Transfer application, as the Cl0p cybercrime gang deployed extortion tactics against affected companies.
The new flaw, which is yet to be assigned a CVE identifier, also concerns an SQL injection vulnerability that « could lead to escalated privileges and potential unauthorized access to the environment. »
The

, ,
https://thehackernews.com/2023/06/third-flaw-uncovered-in-moveit-transfer.html

Ransomware Hackers and Scammers Utilizing Cloud Mining to Launder Cryptocurrency

Ransomware Hackers and Scammers Utilizing Cloud Mining to Launder Cryptocurrency,

Ransomware actors and cryptocurrency scammers have joined nation-state actors in abusing cloud mining services to launder digital assets, new findings reveal.
« Cryptocurrency mining is a crucial part of our industry, but it also holds special appeal to bad actors, as it provides a means to acquire money with a totally clean on-chain original source, » blockchain analytics firm Chainalysis said in

,

Ransomware actors and cryptocurrency scammers have joined nation-state actors in abusing cloud mining services to launder digital assets, new findings reveal.
« Cryptocurrency mining is a crucial part of our industry, but it also holds special appeal to bad actors, as it provides a means to acquire money with a totally clean on-chain original source, » blockchain analytics firm Chainalysis said in

, ,
https://thehackernews.com/2023/06/ransomware-hackers-and-scammers.html

Chinese UNC4841 Group Exploits Zero-Day Flaw in Barracuda Email Security Gateway

Chinese UNC4841 Group Exploits Zero-Day Flaw in Barracuda Email Security Gateway,

A suspected China-nexus threat actor dubbed UNC4841 has been linked to the exploitation of a recently patched zero-day flaw in Barracuda Email Security Gateway (ESG) appliances since October 2022.
« UNC4841 is an espionage actor behind this wide-ranging campaign in support of the People’s Republic of China, » Google-owned Mandiant said in a new report published today, describing the group as « 

,

A suspected China-nexus threat actor dubbed UNC4841 has been linked to the exploitation of a recently patched zero-day flaw in Barracuda Email Security Gateway (ESG) appliances since October 2022.
« UNC4841 is an espionage actor behind this wide-ranging campaign in support of the People’s Republic of China, » Google-owned Mandiant said in a new report published today, describing the group as « 

, ,
https://thehackernews.com/2023/06/chinese-unc4841-group-exploits-zero-day.html

Vidar Malware Using New Tactics to Evade Detection and Anonymize Activities

Vidar Malware Using New Tactics to Evade Detection and Anonymize Activities,

The threat actors behind the Vidar malware have made changes to their backend infrastructure, indicating attempts to retool and conceal their online trail in response to public disclosures about their modus operandi.
« Vidar threat actors continue to rotate their backend IP infrastructure, favoring providers in Moldova and Russia, » cybersecurity company Team Cymru said in a new analysis shared

,

The threat actors behind the Vidar malware have made changes to their backend infrastructure, indicating attempts to retool and conceal their online trail in response to public disclosures about their modus operandi.
« Vidar threat actors continue to rotate their backend IP infrastructure, favoring providers in Moldova and Russia, » cybersecurity company Team Cymru said in a new analysis shared

, ,
https://thehackernews.com/2023/06/vidar-malware-using-new-tactics-to.html

Warning: GravityRAT Android Trojan Steals WhatsApp Backups and Deletes Files

Warning: GravityRAT Android Trojan Steals WhatsApp Backups and Deletes Files,

An updated version of an Android remote access trojan dubbed GravityRAT has been found masquerading as messaging apps BingeChat and Chatico as part of a narrowly targeted campaign since June 2022.
« Notable in the newly discovered campaign, GravityRAT can exfiltrate WhatsApp backups and receive commands to delete files, » ESET researcher Lukáš Štefanko said in a new report published today.
« The

,

An updated version of an Android remote access trojan dubbed GravityRAT has been found masquerading as messaging apps BingeChat and Chatico as part of a narrowly targeted campaign since June 2022.
« Notable in the newly discovered campaign, GravityRAT can exfiltrate WhatsApp backups and receive commands to delete files, » ESET researcher Lukáš Štefanko said in a new report published today.
« The

, ,
https://thehackernews.com/2023/06/warning-gravityrat-android-trojan.html

New Research: 6% of Employees Paste Sensitive Data into GenAI tools as ChatGPT

New Research: 6% of Employees Paste Sensitive Data into GenAI tools as ChatGPT,

The revolutionary technology of GenAI tools, such as ChatGPT, has brought significant risks to organizations’ sensitive data. But what do we really know about this risk? A new research by Browser Security company LayerX sheds light on the scope and nature of these risks. The report titled « Revealing the True GenAI Data Exposure Risk » provides crucial insights for data protection stakeholders and

,

The revolutionary technology of GenAI tools, such as ChatGPT, has brought significant risks to organizations’ sensitive data. But what do we really know about this risk? A new research by Browser Security company LayerX sheds light on the scope and nature of these risks. The report titled « Revealing the True GenAI Data Exposure Risk » provides crucial insights for data protection stakeholders and

, ,
https://thehackernews.com/2023/06/new-research-6-of-employees-paste.html

New Supply Chain Attack Exploits Abandoned S3 Buckets to Distribute Malicious Binaries

New Supply Chain Attack Exploits Abandoned S3 Buckets to Distribute Malicious Binaries,

In what’s a new kind of software supply chain attack aimed at open source projects, it has emerged that threat actors could seize control of expired Amazon S3 buckets to serve rogue binaries without altering the modules themselves.
« Malicious binaries steal the user IDs, passwords, local machine environment variables, and local host name, and then exfiltrates the stolen data to the hijacked

,

In what’s a new kind of software supply chain attack aimed at open source projects, it has emerged that threat actors could seize control of expired Amazon S3 buckets to serve rogue binaries without altering the modules themselves.
« Malicious binaries steal the user IDs, passwords, local machine environment variables, and local host name, and then exfiltrates the stolen data to the hijacked

, ,
https://thehackernews.com/2023/06/new-supply-chain-attack-exploits.html

Microsoft Warns of New Russian State-Sponsored Hacker Group with Destructive Intent

Microsoft Warns of New Russian State-Sponsored Hacker Group with Destructive Intent,

Microsoft on Wednesday took the lid off a « novel and distinct Russian threat actor, » which it said is linked to the General Staff Main Intelligence Directorate (GRU) and has a « relatively low success rate. »
The tech giant’s Threat Intelligence team, which was previously tracking the group under its emerging moniker DEV-0586, has graduated it to a named actor dubbed Cadet Blizzard.
« Cadet

,

Microsoft on Wednesday took the lid off a « novel and distinct Russian threat actor, » which it said is linked to the General Staff Main Intelligence Directorate (GRU) and has a « relatively low success rate. »
The tech giant’s Threat Intelligence team, which was previously tracking the group under its emerging moniker DEV-0586, has graduated it to a named actor dubbed Cadet Blizzard.
« Cadet

, ,
https://thehackernews.com/2023/06/microsoft-warns-of-new-russian-state.html