China’s Stealthy Hackers Infiltrate U.S. and Guam Critical Infrastructure Undetected

China’s Stealthy Hackers Infiltrate U.S. and Guam Critical Infrastructure Undetected

,

A stealthy China-based group managed to establish a persistent foothold into critical infrastructure organizations in the U.S. and Guam without being detected, Microsoft and the « Five Eyes » nations said on Wednesday.
The tech giant’s threat intelligence team is tracking the activity, which includes post-compromise credential access and network system discovery, under the name Volt Typhoon.
The

,

A stealthy China-based group managed to establish a persistent foothold into critical infrastructure organizations in the U.S. and Guam without being detected, Microsoft and the « Five Eyes » nations said on Wednesday.
The tech giant’s threat intelligence team is tracking the activity, which includes post-compromise credential access and network system discovery, under the name Volt Typhoon.
The

, ,
https://thehackernews.com/2023/05/chinas-stealthy-hackers-infiltrate-us.html

Iranian Agrius Hackers Targeting Israeli Organizations with Moneybird Ransomware

Iranian Agrius Hackers Targeting Israeli Organizations with Moneybird Ransomware,

The Iranian threat actor known as Agrius is leveraging a new ransomware strain called Moneybird in its attacks targeting Israeli organizations.
Agrius, also known as Pink Sandstorm (formerly Americium), has a track record of staging destructive data-wiping attacks aimed at Israel under the guise of ransomware infections.
Microsoft has attributed the threat actor to Iran’s Ministry of

,

The Iranian threat actor known as Agrius is leveraging a new ransomware strain called Moneybird in its attacks targeting Israeli organizations.
Agrius, also known as Pink Sandstorm (formerly Americium), has a track record of staging destructive data-wiping attacks aimed at Israel under the guise of ransomware infections.
Microsoft has attributed the threat actor to Iran’s Ministry of

, ,
https://thehackernews.com/2023/05/iranian-agrius-hackers-targeting.html

GUAC 0.1 Beta: Google’s Breakthrough Framework for Secure Software Supply Chains

GUAC 0.1 Beta: Google’s Breakthrough Framework for Secure Software Supply Chains

,

Google on Wednesday announced the 0.1 Beta version of GUAC (short for Graph for Understanding Artifact Composition) for organizations to secure their software supply chains.
To that end, the search giant is making available the open source framework as an API for developers to integrate their own tools and policy engines.
GUAC aims to aggregate software security metadata from different sources

,

Google on Wednesday announced the 0.1 Beta version of GUAC (short for Graph for Understanding Artifact Composition) for organizations to secure their software supply chains.
To that end, the search giant is making available the open source framework as an API for developers to integrate their own tools and policy engines.
GUAC aims to aggregate software security metadata from different sources

, ,
https://thehackernews.com/2023/05/guac-01-beta-googles-breakthrough.html

Quand l’IA sert à piéger des mineurs et créer des images pédopornographiques

Quand l’IA sert à piéger des mineurs et créer des images pédopornographiques,

enfant ecran

Les prédateurs sexuels exploitent les technologies d’IA générative pour partager sur des forums de fausses vidéos de violences sexuelles commises sur des enfants. Ils échangent aussi des astuces pour contourner les mesures de sécurité des IA, ou pour mieux piéger leurs victimes. Pour l’instant, il n’existe que peu de garde-fous pour limiter ce type de pratiques.

,

enfant ecran

Les prédateurs sexuels exploitent les technologies d’IA générative pour partager sur des forums de fausses vidéos de violences sexuelles commises sur des enfants. Ils échangent aussi des astuces pour contourner les mesures de sécurité des IA, ou pour mieux piéger leurs victimes. Pour l’instant, il n’existe que peu de garde-fous pour limiter ce type de pratiques.

, ,
https://www.01net.com/actualites/quand-lia-sert-a-pieger-des-mineurs-et-creer-des-images-pedopornographiques.html

Iranian Tortoiseshell Hackers Targeting Israeli Logistics Industry

Iranian Tortoiseshell Hackers Targeting Israeli Logistics Industry,

At least eight websites associated with shipping, logistics, and financial services companies in Israel were targeted as part of a watering hole attack.
Tel Aviv-based cybersecurity company ClearSky attributed the attacks with low confidence to an Iranian threat actor tracked as Tortoiseshell, which is also called Crimson Sandstorm (previously Curium), Imperial Kitten, and TA456.
« The infected

,

At least eight websites associated with shipping, logistics, and financial services companies in Israel were targeted as part of a watering hole attack.
Tel Aviv-based cybersecurity company ClearSky attributed the attacks with low confidence to an Iranian threat actor tracked as Tortoiseshell, which is also called Crimson Sandstorm (previously Curium), Imperial Kitten, and TA456.
« The infected

, ,
https://thehackernews.com/2023/05/iranian-tortoiseshell-hackers-targeting.html

What to Look for When Selecting a Static Application Security Testing (SAST) Solution

What to Look for When Selecting a Static Application Security Testing (SAST) Solution,

If you’re involved in securing the applications your organization develops, there is no question that Static Application Security Testing (SAST) solutions are an important part of a comprehensive application security strategy. SAST secures software, supports business more securely, cuts down on costs, reduces risk, and speeds time to development, delivery, and deployment of mission-critical

,

If you’re involved in securing the applications your organization develops, there is no question that Static Application Security Testing (SAST) solutions are an important part of a comprehensive application security strategy. SAST secures software, supports business more securely, cuts down on costs, reduces risk, and speeds time to development, delivery, and deployment of mission-critical

, ,
https://thehackernews.com/2023/05/what-to-look-for-when-selecting-static.html

Data Stealing Malware Discovered in Popular Android Screen Recorder App

Data Stealing Malware Discovered in Popular Android Screen Recorder App,

Google has removed a screen recording app named « iRecorder – Screen Recorder » from the Play Store after it was found to sneak in information stealing capabilities nearly a year after the app was published as an innocuous app.
The app (APK package name « com.tsoft.app.iscreenrecorder »), which accrued over 50,000 installations, was first uploaded on September 19, 2021. The malicious functionality

,

Google has removed a screen recording app named « iRecorder – Screen Recorder » from the Play Store after it was found to sneak in information stealing capabilities nearly a year after the app was published as an innocuous app.
The app (APK package name « com.tsoft.app.iscreenrecorder »), which accrued over 50,000 installations, was first uploaded on September 19, 2021. The malicious functionality

, ,
https://thehackernews.com/2023/05/data-stealing-malware-discovered-in.html

Legion Malware Upgraded to Target SSH Servers and AWS Credentials

Legion Malware Upgraded to Target SSH Servers and AWS Credentials,

An updated version of the commodity malware called Legion comes with expanded features to compromise SSH servers and Amazon Web Services (AWS) credentials associated with DynamoDB and CloudWatch.
« This recent update demonstrates a widening of scope, with new capabilities such the ability to compromise SSH servers and retrieve additional AWS-specific credentials from Laravel web applications, »

,

An updated version of the commodity malware called Legion comes with expanded features to compromise SSH servers and Amazon Web Services (AWS) credentials associated with DynamoDB and CloudWatch.
« This recent update demonstrates a widening of scope, with new capabilities such the ability to compromise SSH servers and retrieve additional AWS-specific credentials from Laravel web applications, »

, ,
https://thehackernews.com/2023/05/legion-malware-upgraded-to-target-ssh.html

N. Korean Lazarus Group Targets Microsoft IIS Servers to Deploy Espionage Malware

N. Korean Lazarus Group Targets Microsoft IIS Servers to Deploy Espionage Malware,

The infamous Lazarus Group actor has been targeting vulnerable versions of Microsoft Internet Information Services (IIS) servers as an initial breach route to deploy malware on targeted systems.
The findings come from the AhnLab Security Emergency response Center (ASEC), which detailed the advanced persistent threat’s (APT) continued abuse of DLL side-loading techniques to run arbitrary payloads

,

The infamous Lazarus Group actor has been targeting vulnerable versions of Microsoft Internet Information Services (IIS) servers as an initial breach route to deploy malware on targeted systems.
The findings come from the AhnLab Security Emergency response Center (ASEC), which detailed the advanced persistent threat’s (APT) continued abuse of DLL side-loading techniques to run arbitrary payloads

, ,
https://thehackernews.com/2023/05/n-korean-lazarus-group-targets.html

Cyber Attacks Strike Ukraine’s State Bodies in Espionage Operation

Cyber Attacks Strike Ukraine’s State Bodies in Espionage Operation

,

The Computer Emergency Response Team of Ukraine (CERT-UA) has warned of cyber attacks targeting state bodies in the country as part of an espionage campaign.
The intrusion set, attributed to a threat actor tracked by the authority as UAC-0063 since 2021, leverages phishing lures to deploy a variety of malicious tools on infected systems. The origins of the hacking crew are presently unknown.
In

,

The Computer Emergency Response Team of Ukraine (CERT-UA) has warned of cyber attacks targeting state bodies in the country as part of an espionage campaign.
The intrusion set, attributed to a threat actor tracked by the authority as UAC-0063 since 2021, leverages phishing lures to deploy a variety of malicious tools on infected systems. The origins of the hacking crew are presently unknown.
In

, ,
https://thehackernews.com/2023/05/cyber-attacks-strike-ukraines-state.html