Western Digital Confirms Customer Data Stolen by Hackers in March Breach

Western Digital Confirms Customer Data Stolen by Hackers in March Breach,

Digital storage giant Western Digital confirmed that an « unauthorized third party » gained access to its systems and stole personal information belonging to the company’s online store customers.
« This information included customer names, billing and shipping addresses, email addresses and telephone numbers, » the San Jose-based company said in a disclosure last week.
« In addition, the database

,

Digital storage giant Western Digital confirmed that an « unauthorized third party » gained access to its systems and stole personal information belonging to the company’s online store customers.
« This information included customer names, billing and shipping addresses, email addresses and telephone numbers, » the San Jose-based company said in a disclosure last week.
« In addition, the database

, ,
https://thehackernews.com/2023/05/western-digital-confirms-customer-data.html

SideCopy Using Action RAT and AllaKore RAT to infiltrate Indian Organizations

SideCopy Using Action RAT and AllaKore RAT to infiltrate Indian Organizations,

The suspected Pakistan-aligned threat actor known as SideCopy has been observed leveraging themes related to the Indian military research organization as part of an ongoing phishing campaign.
This involves using a ZIP archive lure pertaining to India’s Defence Research and Development Organization (DRDO) to deliver a malicious payload capable of harvesting sensitive information, Fortinet

,

The suspected Pakistan-aligned threat actor known as SideCopy has been observed leveraging themes related to the Indian military research organization as part of an ongoing phishing campaign.
This involves using a ZIP archive lure pertaining to India’s Defence Research and Development Organization (DRDO) to deliver a malicious payload capable of harvesting sensitive information, Fortinet

, ,
https://thehackernews.com/2023/05/sidecopy-using-action-rat-and-allakore.html

How to Set Up a Threat Hunting and Threat Intelligence Program

How to Set Up a Threat Hunting and Threat Intelligence Program,

Threat hunting is an essential component of your cybersecurity strategy. Whether you’re getting started or in an advanced state, this article will help you ramp up your threat intelligence program.
What is Threat Hunting?
The cybersecurity industry is shifting from a reactive to a proactive approach. Instead of waiting for cybersecurity alerts and then addressing them, security organizations are

,

Threat hunting is an essential component of your cybersecurity strategy. Whether you’re getting started or in an advanced state, this article will help you ramp up your threat intelligence program.
What is Threat Hunting?
The cybersecurity industry is shifting from a reactive to a proactive approach. Instead of waiting for cybersecurity alerts and then addressing them, security organizations are

, ,
https://thehackernews.com/2023/05/how-to-set-up-threat-hunting-and-threat.html

CERT-UA Warns of SmokeLoader and RoarBAT Malware Attacks Against Ukraine

CERT-UA Warns of SmokeLoader and RoarBAT Malware Attacks Against Ukraine,

An ongoing phishing campaign with invoice-themed lures is being used to distribute the SmokeLoader malware in the form of a polyglot file, according to the Computer Emergency Response Team of Ukraine (CERT-UA).
The emails, per the agency, are sent using compromised accounts and come with a ZIP archive that, in reality, is a polyglot file containing a decoy document and a JavaScript file.
The

,

An ongoing phishing campaign with invoice-themed lures is being used to distribute the SmokeLoader malware in the form of a polyglot file, according to the Computer Emergency Response Team of Ukraine (CERT-UA).
The emails, per the agency, are sent using compromised accounts and come with a ZIP archive that, in reality, is a polyglot file containing a decoy document and a JavaScript file.
The

, ,
https://thehackernews.com/2023/05/cert-ua-warns-of-smokeloader-and.html

Attention, ces 38 applications Android cachent quelque chose…

Attention, ces 38 applications Android cachent quelque chose…,

play store android

Un nouveau lot d’applications Android frauduleuses vient d’être banni du Play Store. Ces apps embarquent des fonctionnalités cachées destinées à enrichir les développeurs… au détriment des utilisateurs.

,

play store android

Un nouveau lot d’applications Android frauduleuses vient d’être banni du Play Store. Ces apps embarquent des fonctionnalités cachées destinées à enrichir les développeurs… au détriment des utilisateurs.

, ,
https://www.01net.com/actualites/attention-ces-38-applications-android-cachent-quelque-chose.html

Dragon Breath APT Group Using Double-Clean-App Technique to Target Gambling Industry

Dragon Breath APT Group Using Double-Clean-App Technique to Target Gambling Industry,

An advanced persistent threat (APT) actor known as Dragon Breath has been observed adding new layers of complexity to its attacks by adopting a novel DLL side-loading mechanism.
« The attack is based on a classic side-loading attack, consisting of a clean application, a malicious loader, and an encrypted payload, with various modifications made to these components over time, » Sophos researcher

,

An advanced persistent threat (APT) actor known as Dragon Breath has been observed adding new layers of complexity to its attacks by adopting a novel DLL side-loading mechanism.
« The attack is based on a classic side-loading attack, consisting of a clean application, a malicious loader, and an encrypted payload, with various modifications made to these components over time, » Sophos researcher

, ,
https://thehackernews.com/2023/05/dragon-breath-apt-group-using-double.html

New Vulnerability in Popular WordPress Plugin Exposes Over 2 Million Sites to Cyberattacks

New Vulnerability in Popular WordPress Plugin Exposes Over 2 Million Sites to Cyberattacks,

Users of Advanced Custom Fields plugin for WordPress are being urged to update version 6.1.6 following the discovery of a security flaw.
The issue, assigned the identifier CVE-2023-30777, relates to a case of reflected cross-site scripting (XSS) that could be abused to inject arbitrary executable scripts into otherwise benign websites.
The plugin, which is available both as a free and pro

,

Users of Advanced Custom Fields plugin for WordPress are being urged to update version 6.1.6 following the discovery of a security flaw.
The issue, assigned the identifier CVE-2023-30777, relates to a case of reflected cross-site scripting (XSS) that could be abused to inject arbitrary executable scripts into otherwise benign websites.
The plugin, which is available both as a free and pro

, ,
https://thehackernews.com/2023/05/new-vulnerability-in-popular-wordpress.html

New Android Malware ‘FluHorse’ Targeting East Asian Markets with Deceptive Tactics

New Android Malware ‘FluHorse’ Targeting East Asian Markets with Deceptive Tactics

,

Various sectors in East Asian markets have been subjected to a new email phishing campaign that distributes a previously undocumented strain of Android malware called FluHorse that abuses the Flutter software development framework.
« The malware features several malicious Android applications that mimic legitimate applications, most of which have more than 1,000,000 installs, » Check Point said in

,

Various sectors in East Asian markets have been subjected to a new email phishing campaign that distributes a previously undocumented strain of Android malware called FluHorse that abuses the Flutter software development framework.
« The malware features several malicious Android applications that mimic legitimate applications, most of which have more than 1,000,000 installs, » Check Point said in

, ,
https://thehackernews.com/2023/05/new-android-malware-fluhorse-targeting.html

Hackers Targeting Italian Corporate Banking Clients with New Web-Inject Toolkit DrIBAN

Hackers Targeting Italian Corporate Banking Clients with New Web-Inject Toolkit DrIBAN,

Italian corporate banking clients are the target of an ongoing financial fraud campaign that has been leveraging a new web-inject toolkit called drIBAN since at least 2019.
« The main goal of drIBAN fraud operations is to infect Windows workstations inside corporate environments trying to alter legitimate banking transfers performed by the victims by changing the beneficiary and transferring

,

Italian corporate banking clients are the target of an ongoing financial fraud campaign that has been leveraging a new web-inject toolkit called drIBAN since at least 2019.
« The main goal of drIBAN fraud operations is to infect Windows workstations inside corporate environments trying to alter legitimate banking transfers performed by the victims by changing the beneficiary and transferring

, ,
https://thehackernews.com/2023/05/hackers-targeting-italian-corporate.html

N. Korean Kimsuky Hackers Using New Recon Tool ReconShark in Latest Cyberattacks

N. Korean Kimsuky Hackers Using New Recon Tool ReconShark in Latest Cyberattacks,

The North Korean state-sponsored threat actor known as Kimsuky has been discovered using a new reconnaissance tool called ReconShark as part of an ongoing global campaign.
« [ReconShark] is actively delivered to specifically targeted individuals through spear-phishing emails, OneDrive links leading to document downloads, and the execution of malicious macros, » SentinelOne researchers Tom Hegel

,

The North Korean state-sponsored threat actor known as Kimsuky has been discovered using a new reconnaissance tool called ReconShark as part of an ongoing global campaign.
« [ReconShark] is actively delivered to specifically targeted individuals through spear-phishing emails, OneDrive links leading to document downloads, and the execution of malicious macros, » SentinelOne researchers Tom Hegel

, ,
https://thehackernews.com/2023/05/n-korean-kimsuky-hackers-using-new.html