News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Articles per day, last 14 days
Most articles on Wed 21 Oct (96); 13–17 on weekend days.
- On CISA KEV CVEs
- Other coverage
- Closed-day average
Show as tableHide table
| Day | Articles | On CISA KEV CVEs |
|---|---|---|
| Tue 20 Oct | 86 | 16 |
| Wed 21 Oct | 96 | 18 |
| Thu 22 Oct | 84 | 11 |
| Fri 23 Oct | 68 | 16 |
| Sat 24 Oct | 13 | 4 |
| Sun 25 Oct | 13 | 2 |
| Mon 26 Oct | 76 | 21 |
| Tue 27 Oct | 95 | 18 |
| Wed 28 Oct | 87 | 16 |
| Thu 29 Oct | 78 | 17 |
| Fri 30 Oct | 69 | 10 |
| Sat 31 Oct | 14 | 3 |
| Sun 1 Nov | 17 | 0 |
| Mon 2 Nov | 80 | 7 |
| Today, Tue 3 Nov | 37 so far | 2 |
Developing
Mon 9 Sep 202452 articles
- Experts demonstrated how to bypass WhatsApp View Once feature
Users are exploiting a privacy flaw in WhatsApp to bypass the app’s “View once” feature, allowing them to re-view messages. The ‘View Once‘ feature in WhatsApp allows users to send photos, videos, and voice messages that can only be viewed once by the…
Security Affairs - Critical SonicWall SSLVPN bug exploited in ransomware attacks
Ransomware affiliates exploit a critical security vulnerability in SonicWall SonicOS firewall devices to breach victims' networks. [...]
BleepingComputer - Quad7 botnet targets more SOHO and VPN routers, media servers
The Quad7 botnet is expanding its targeting scope with the addition of new clusters and custom implants that now also target Zyxel VPN appliances and Ruckus wireless routers. [...]
BleepingComputer - Akira Ransomware Actors Exploit SonicWall Bug for RCE
CISA has added CE-2024-40766 to its known exploited vulnerabilities catalog.
Dark Reading - Chinese hackers use new data theft malware in govt attacks
New attacks attributed to China-based cyber espionage group Mustang Panda show that the threat actor switched to new strategies and malware called FDMTP and PTSOCKET to download payloads and steal information from breached networks. [...]
BleepingComputer - Highline Public Schools closes schools following cyberattack
Highline Public Schools, a K-12 district in Washington state, has shut down all schools and canceled school activities after its technology systems were compromised in a cyberattack. [...]
BleepingComputer - Google Pushes Rust in Legacy Firmware to Tackle Memory Safety Flaws
Google’s adoption of memory safe programming languages now includes the deployment of Rust in legacy low-level firmware codebases.
SecurityWeek - 300K Victims' Data Compromised in Avis Car Rental Breach
Though the company reports that data was exfiltrated in the breach, it has been remained tightlipped regarding the kind of data that was exposed.
Dark Reading - Meta fixes easily bypassed WhatsApp ‘View Once’ privacy feature
A privacy flaw in WhatsApp, an instant messenger with over 2 billion users worldwide, is being exploited by attackers to bypass the app's "View once" feature and view messages again. [...]
BleepingComputer - New RAMBO Attack Uses RAM Radio Signals to Steal Data from Air-Gapped Networks
A novel side-channel attack has been found to leverage radio signals emanated by a device's random access memory (RAM) as a data exfiltration mechanism, posing a threat to air-gapped networks. The technique has been codenamed RAMBO by Dr. Mordechai Guri, the…
The Hacker News - What the arrest of Telegram’s CEO means, with Eva Galperin (Lock and Code S05E19)
This week on the Lock and Code podcast… On August 24, at an airport just outside of Paris, a man named Pavel Durov was detained for questioning by French investigators. Just days later, the same man was charged in crimes related to the distribution of child…
Malwarebytes - Predator spyware operation is back with a new infrastructure
Researchers warn of a fresh cluster of activity associated with the Predator spyware using a new infrastructure, following the U.S. sanctions against the Intellexa Consortium. Recorded Future researchers warn that the Predator spyware has resurfaced with…
Security Affairs - Akira Ransomware Actively Exploiting SonicWall firewall RCE Vulnerability
SonicWall disclosed a critical remote code execution vulnerability (CVE-2024-40766) in SonicOS on August 22nd, 2024. While no active exploitation was initially confirmed, the advisory was updated on September 6th to indicate potential active attacks. The…
gbhackers.com - Payment gateway data breach affects 1.7 million credit card owners
Payment gateway provider Slim CD has disclosed a data breach that compromised credit card and personal data belonging to almost 1.7 million individuals. [...]
BleepingComputer - 300,000 Impacted by Data Breach at Car Rental Firm Avis
Avis Car Rental is notifying roughly 300,000 individuals that their personal information was stolen in an August 2024 data breach.
SecurityWeek - COLDRIVER Crooks Take Pro Democracy NGOs For A Phishy Ride
No content available.
packetstormsecurity.com - New RAMBO Attack Allows Air-Gapped Data Theft Via RAM Radio Signals
No content available.
packetstormsecurity.com - How to defend against brute force and password spray attacks
While not very sophisticated, brute force password attacks pose a significant threat to an organization's security. Learn more from Specops Software about these types of attacks and how to defend against them. [...]
BleepingComputer - How to Establish & Enhance Endpoint Security
Endpoint security has been around for decades, but changes in device use and the quick evolution of new attacks have triggered the development of new security techniques.
Dark Reading - Two Indicted in US for Running Dark Web Marketplaces Offering Stolen Information
A Kazakhstani and a Russian national were indicted in the US for operating dark web sites facilitating PII, card, and banking information trading.
SecurityWeek - One More Tool Will Do It? Reflecting on the CrowdStrike Fallout
The proliferation of cybersecurity tools has created an illusion of security. Organizations often believe that by deploying a firewall, antivirus software, intrusion detection systems, identity threat detection and response, and other tools, they are…
The Hacker News - Blind Eagle Targets Colombian Insurance Sector with Customized Quasar RAT
The Colombian insurance sector is the target of a threat actor tracked as Blind Eagle with the end goal of delivering a customized version of a known commodity remote access trojan (RAT) known as Quasar RAT since June 2024. "Attacks have originated with…
The Hacker News - New RAMBO Attack Allows Air-Gapped Data Theft via RAM Radio Signals
An academic researcher has devised a new method of exfiltrating data from air-gapped systems using radio signals from memory buses.
SecurityWeek - Akira Ransomware Targets SonicWall Vulnerability (CVE-2024-40766) – Immediate Patching Required
Akira Ransomware Targets SonicWall Vulnerability (CVE-2024-40766) – Immediate Patching Required A recently patched SonicWall vulnerability, CVE-2024-40766, has been found to affect the SSLVPN feature of SonicWall firewalls in addition to management access in…
SOCRadar - Chinese Hackers Exploit Visual Studio Code in Southeast Asian Cyberattacks
The China-linked advanced persistent threat (APT) group known as Mustang Panda has been observed weaponizing Visual Studio Code software as part of espionage operations targeting government entities in Southeast Asia. "This threat actor used Visual Studio…
The Hacker News - Webinar: How to Protect Your Company from GenAI Data Leakage Without Losing It’s Productivity Benefits
GenAI has become a table stakes tool for employees, due to the productivity gains and innovative capabilities it offers. Developers use it to write code, finance teams use it to analyze reports, and sales teams create customer emails and assets. Yet, these…
The Hacker News - Critical SonicWall Vulnerability Possibly Exploited in Ransomware Attacks
A recently patched SonicWall vulnerability tracked as CVE-2024-40766 may have been exploited in ransomware attacks.
SecurityWeek - Wing Security SaaS Pulse: Continuous Security & Actionable Insights — For Free
Designed to be more than a one-time assessment— Wing Security’s SaaS Pulse provides organizations with actionable insights and continuous oversight into their SaaS security posture—and it’s free! Introducing SaaS Pulse: Free Continuous SaaS Risk Management…
The Hacker News - Predator Spyware Resurfaces With Fresh Infrastructure
Recorded Future observes renewed Predator spyware activity on fresh infrastructure after a drop caused by US sanctions.
SecurityWeek - TIDRONE APT targets drone manufacturers in Taiwan
A previously undocumented threat actor tracked TIDRONE targets organizations in military and satellite industries in Taiwan. Trend Micro spotted an allegedly China-linked threat actor, tracked TIDRONE, targeting drone manufacturers in Taiwan. The group,…
Security Affairs - Alleged Leaks Affect Millions: VK, BMW Hong Kong, Shopee Logistics, and More
Alleged Leaks Affect Millions: VK, BMW Hong Kong, Shopee Logistics, and More The SOCRadar Dark Web Team has uncovered several major cyber threats on the Dark Web, including the alleged database leaks of VK, Shopee Logistics, and English Central. The leaks…
SOCRadar - One Million US Kaspersky Customers Transferred to Pango’s UltraAV
Kaspersky’s customers in the US are being acquired by cybersecurity firm Pango and will be offered UltraAV antimalware software.
SecurityWeek - Progress Software Issues Patch for Vulnerability in LoadMaster and MT Hypervisor
Progress Software has released security updates for a maximum-severity flaw in LoadMaster and Multi-Tenant (MT) hypervisor that could result in the execution of arbitrary operating system commands. Tracked as CVE-2024-7591 (CVSS score: 10.0), the…
The Hacker News - New Android SpyAgent Malware Uses OCR to Steal Crypto Wallet Recovery Keys
Android device users in South Korea have emerged as a target of a new mobile malware campaign that delivers a new type of threat dubbed SpyAgent. The malware "targets mnemonic keys by scanning for images on your device that might contain them," McAfee Labs…
The Hacker News - A week in security (September 2 – September 8)
Last week on Malwarebytes Labs: Lowe’s employees phished via Google ads Planned Parenthood partly offline after ransomware attack “Hello pervert” sextortion scam includes new threat of Pegasus—and a picture of your home How to avoid election related...
Malwarebytes - Loki: a new private agent for the popular Mythic framework
In July 2024, we discovered the previously unknown Loki backdoor, which was used in a series of targeted attacks. By analyzing the malicious file and open sources, we determined that Loki is a private version of an agent for the open-source Mythic framework.…
securelist.com - Multiple malware families delivered exploiting GeoServer GeoTools flaw CVE-2024-36401
Multiple threat actors actively exploited the recently disclosed OSGeo GeoServer GeoTools flaw CVE-2024-36401 in malware-based campaigns. Researchers at Fortinet FortiGuard Labs reported that threat actors exploited the recently disclosed OSGeo GeoServer…
Security Affairs - TIDRONE Espionage Group Targets Taiwan Drone Makers in Cyber Campaign
A previously undocumented threat actor with likely ties to Chinese-speaking groups has predominantly singled out drone manufacturers in Taiwan as part of a cyber attack campaign that commenced in 2024. Trend Micro is tracking the adversary under the moniker…
The Hacker News