Microsoft Uncovers New Post-Compromise Malware Used by Nobelium Hackers

Microsoft Uncovers New Post-Compromise Malware Used by Nobelium Hackers,

The threat actor behind the SolarWinds supply chain attack has been linked to yet another « highly targeted » post-exploitation malware that could be used to maintain persistent access to compromised environments.
Dubbed MagicWeb by Microsoft’s threat intelligence teams, the development reiterates Nobelium’s commitment to developing and maintaining purpose-built capabilities.
Nobelium is the tech

,

The threat actor behind the SolarWinds supply chain attack has been linked to yet another « highly targeted » post-exploitation malware that could be used to maintain persistent access to compromised environments.
Dubbed MagicWeb by Microsoft’s threat intelligence teams, the development reiterates Nobelium’s commitment to developing and maintaining purpose-built capabilities.
Nobelium is the tech

, ,
https://thehackernews.com/2022/08/microsoft-uncovers-new-post-compromise.html

U.S. Government Spending Billions on Cybersecurity

U.S. Government Spending Billions on Cybersecurity,

In recent months, the House of Representatives has been hard at work drafting various spending bills for the 2023 fiscal year. While these bills provide funding for a vast array of government programs and agencies, there was one thing that really stands out. Collectively, the bills that are making their way through the house allocate a staggering $15.6 billion to cybersecurity spending.
As you

,

In recent months, the House of Representatives has been hard at work drafting various spending bills for the 2023 fiscal year. While these bills provide funding for a vast array of government programs and agencies, there was one thing that really stands out. Collectively, the bills that are making their way through the house allocate a staggering $15.6 billion to cybersecurity spending.
As you

, ,
https://thehackernews.com/2022/08/us-government-spending-billions-on.html

Researchers Uncover Kimusky Infra Targeting South Korean Politicians and Diplomats

Researchers Uncover Kimusky Infra Targeting South Korean Politicians and Diplomats,

The North Korean nation-state group Kimusky has been linked to a new set of malicious activities directed against political and diplomatic entities located in its southern counterpart in early 2022.
Russian cybersecurity firm Kaspersky codenamed the cluster GoldDragon, with the infection chains leading to the deployment of Windows malware designed to file lists, user keystrokes, and stored web

,

The North Korean nation-state group Kimusky has been linked to a new set of malicious activities directed against political and diplomatic entities located in its southern counterpart in early 2022.
Russian cybersecurity firm Kaspersky codenamed the cluster GoldDragon, with the infection chains leading to the deployment of Windows malware designed to file lists, user keystrokes, and stored web

, ,
https://thehackernews.com/2022/08/researchers-uncover-kimusky-infra.html

PyPI Repository Warns Python Project Maintainers About Ongoing Phishing Attacks

PyPI Repository Warns Python Project Maintainers About Ongoing Phishing Attacks,

The Python Package Index, PyPI, on Wednesday sounded the alarm about an ongoing phishing campaign that aims to steal developer credentials and inject malicious updates to legitimate packages.
« This is the first known phishing attack against PyPI, » the maintainers of the official third-party software repository said in a series of tweets.
The social engineering attack entails sending

,

The Python Package Index, PyPI, on Wednesday sounded the alarm about an ongoing phishing campaign that aims to steal developer credentials and inject malicious updates to legitimate packages.
« This is the first known phishing attack against PyPI, » the maintainers of the official third-party software repository said in a series of tweets.
The social engineering attack entails sending

, ,
https://thehackernews.com/2022/08/pypi-repository-warns-python-project.html

Crypto Miners Using Tox P2P Messenger as Command and Control Server

Crypto Miners Using Tox P2P Messenger as Command and Control Server,

Threat actors have begun to use the Tox peer-to-peer instant messaging service as a command-and-control method, marking a shift from its earlier role as a contact method for ransomware negotiations.
The findings from Uptycs, which analyzed an Executable and Linkable Format (ELF) artifact (« 72client ») that functions as a bot and can run scripts on the compromised host using the Tox protocol.
Tox

,

Threat actors have begun to use the Tox peer-to-peer instant messaging service as a command-and-control method, marking a shift from its earlier role as a contact method for ransomware negotiations.
The findings from Uptycs, which analyzed an Executable and Linkable Format (ELF) artifact (« 72client ») that functions as a bot and can run scripts on the compromised host using the Tox protocol.
Tox

, ,
https://thehackernews.com/2022/08/crypto-miners-using-tox-p2p-messenger.html

Air-Gapped Devices Can Send Covert Morse Signals via Network Card LEDs

Air-Gapped Devices Can Send Covert Morse Signals via Network Card LEDs,

A security researcher who has a long line of work demonstrating novel data exfiltration methods from air-gapped systems has come up with yet another technique that involves sending Morse code signals via LEDs on network interface cards (NICs).
The approach, codenamed ETHERLED, comes from Dr. Mordechai Guri, the head of R&D in the Cyber Security Research Center in the Ben Gurion University of the

,

A security researcher who has a long line of work demonstrating novel data exfiltration methods from air-gapped systems has come up with yet another technique that involves sending Morse code signals via LEDs on network interface cards (NICs).
The approach, codenamed ETHERLED, comes from Dr. Mordechai Guri, the head of R&D in the Cyber Security Research Center in the Ben Gurion University of the

, ,
https://thehackernews.com/2022/08/air-gapped-devices-can-send-covert.html

Guide: How Service Providers can Deliver vCISO Services at Scale

Guide: How Service Providers can Deliver vCISO Services at Scale,

From ransomware to breaches, from noncompliance penalties to reputational damage – cyberthreats pose an existential risk to any business. But for SMEs and SMBs, the danger is compounded. These companies realize they need an in-house Chief Information Security Officer (CISO) – someone who can assess risks and vulnerabilities, create and execute a comprehensive cybersecurity plan, ensure

,

From ransomware to breaches, from noncompliance penalties to reputational damage – cyberthreats pose an existential risk to any business. But for SMEs and SMBs, the danger is compounded. These companies realize they need an in-house Chief Information Security Officer (CISO) – someone who can assess risks and vulnerabilities, create and execute a comprehensive cybersecurity plan, ensure

, ,
https://thehackernews.com/2022/08/guide-how-service-providers-can-deliver.html

Hackers Using Fake DDoS Protection Pages to Distribute Malware

Hackers Using Fake DDoS Protection Pages to Distribute Malware,

WordPress sites are being hacked to display fraudulent Cloudflare DDoS protection pages that lead to the delivery of malware such as NetSupport RAT and Raccoon Stealer.
« A recent surge in JavaScript injections targeting WordPress sites has resulted in fake DDoS prevent prompts which lead victims to download remote access trojan malware, » Sucuri’s Ben Martin said in a write-up published last week

,

WordPress sites are being hacked to display fraudulent Cloudflare DDoS protection pages that lead to the delivery of malware such as NetSupport RAT and Raccoon Stealer.
« A recent surge in JavaScript injections targeting WordPress sites has resulted in fake DDoS prevent prompts which lead victims to download remote access trojan malware, » Sucuri’s Ben Martin said in a write-up published last week

, ,
https://thehackernews.com/2022/08/hackers-using-fake-ddos-protection.html

Researchers Warn of AiTM Attack Targeting Google G-Suite Enterprise Users

Researchers Warn of AiTM Attack Targeting Google G-Suite Enterprise Users,

The threat actors behind a large-scale adversary-in-the-middle (AiTM) phishing campaign targeting enterprise users of Microsoft email services have also set their sights on Google Workspace users.
« This campaign specifically targeted chief executives and other senior members of various organizations which use [Google Workspace], » Zscaler researchers Sudeep Singh and Jagadeeswar Ramanukolanu 

,

The threat actors behind a large-scale adversary-in-the-middle (AiTM) phishing campaign targeting enterprise users of Microsoft email services have also set their sights on Google Workspace users.
« This campaign specifically targeted chief executives and other senior members of various organizations which use [Google Workspace], » Zscaler researchers Sudeep Singh and Jagadeeswar Ramanukolanu 

, ,
https://thehackernews.com/2022/08/researchers-warn-of-aitm-attack.html

GitLab Issues Patch for Critical Flaw in its Community and Enterprise Software

GitLab Issues Patch for Critical Flaw in its Community and Enterprise Software,

DevOps platform GitLab this week issued patches to address a critical security flaw in its software that could lead to arbitrary code execution on affected systems.
Tracked as CVE-2022-2884, the issue is rated 9.9 on the CVSS vulnerability scoring system and impacts all versions of GitLab Community Edition (CE) and Enterprise Edition (EE) starting from 11.3.4 before 15.1.5, 15.2 before 15.2.3,

,

DevOps platform GitLab this week issued patches to address a critical security flaw in its software that could lead to arbitrary code execution on affected systems.
Tracked as CVE-2022-2884, the issue is rated 9.9 on the CVSS vulnerability scoring system and impacts all versions of GitLab Community Edition (CE) and Enterprise Edition (EE) starting from 11.3.4 before 15.1.5, 15.2 before 15.2.3,

, ,
https://thehackernews.com/2022/08/gitlab-issues-patch-for-critical-flaw.html