News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 9–13 on weekend days.
Show as table
| Day | Articles published |
|---|---|
| Sun 11 Oct | 9 |
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Today, Sun 25 Oct | 12 so far |
Sat 18 Apr· 11 articles
-
Attackers Use QEMU VMs to Hide PayoutsKing Ransomware, Steal Data
Sophos researchers have reported a rise in attackers abusing QEMU, an open-source emulator, to hide malicious activity inside virtual machines, enabling malware to run in a VM while bypassing endpoint security controls and leaving minimal traces on the host.…
Security AffairsGOLD ENCOUNTER -
Ukrainian hospitals hit by AgingFly malware espionage campaign
Ukrainian emergency services and hospitals have been targeted in a new espionage campaign using a malware tool dubbed AgingFly, according to CERT-UA. The activity was carried out by a group tracked as UAC-0247, which launched multiple attacks over the past…
DataBreachesUAC-0247 -
LA schools probe fraudulent tax returns after Rhysida breach
The Los Angeles County Office of Education is investigating the possibility that fraudulent tax return filings were submitted in employees’ names after some school staff received letters indicating tax filings had been fraudulent, according to the Los…
DataBreachesRhysida -
Montana judge allows audit into BCBSMT data breach to proceed
A Montana judge has allowed the state auditor’s investigation into a data breach affecting Blue Cross Blue Shield of Montana members to move forward, following a legal challenge from BCBSMT’s parent company, Health Care Service Corporation. The case centres…
DataBreaches -
Helpdesk Impersonation via Teams Leads to Rclone Data Exfiltration
Cross-tenant helpdesk impersonation is shown as a multi-stage intrusion where threat actors begin by leveraging cross-tenant Microsoft Teams communications, impersonating IT or helpdesk staff to socially engineer users into granting remote access. With…
Microsoft -
Tycoon 2FA down, attackers shift to Mamba, EvilProxy phishing
Threat actors have migrated to other phishing-as-a-service platforms after Tycoon 2FA’s disruption, with the tools being reused across new campaigns, according to Barracuda Networks. Active since at least 2023, Tycoon 2FA has been used to bypass two-factor…
SecurityWeek -
TBK DVR-41042 articles this day · The Hacker News first
Nexcorium Mirai Botnet Exploits CVE-2024-3721 on TBK DVRs · Nexcorium hijacks TBK DVRs via CVE-2024-3721 for DDoS botnet
-
Nexcorium Mirai Botnet Exploits CVE-2024-3721 on TBK DVRs
Nexcorium, a Mirai variant, is exploiting a flaw in TBK DVR devices to infect IoT gear and recruit it into DDoS attacks, with FortiGuard Labs noting that the campaign also targets outdated TP-Link routers. According to FortiGuard Labs, the attackers exploit…
-
Nexcorium hijacks TBK DVRs via CVE-2024-3721 for DDoS botnet
The Hacker News reports that a Mirai variant named Nexcorium is exploiting CVE-2024-3721 to hijack TBK DVRs and turn infected devices into part of a DDoS botnet, with Fortinet FortiGuard Labs and Palo Alto Networks Unit 42 identifying the activity. The…
-
-
API keys and service accounts drive 68% of cloud breaches
In 2024, compromised service accounts and forgotten API keys accounted for 68% of cloud breaches, with unmanaged non-human identities left unattended as a major threat to enterprise data. For every employee in an organisation, there are 40 to 50 automated…
The Hacker News -
Grinex blames foreign spy agencies for $13.7M crypto hack
Grinex, a Kyrgyzstan-incorporated cryptocurrency exchange sanctioned by the U.K. and the U.S. last year, has said it is suspending operations after blaming Western intelligence agencies for a $13.74 million hack. The firm described the attack as large-scale…
The Hacker News -
Microsoft Defender under attack as three zero-days, two of them still unpatched, enable elevated access
Attackers are exploiting three recently disclosed Microsoft Defender zero-days, code-named BlueHammer, RedSun, and UnDefend, to gain elevated privileges on compromised systems, with BlueHammer locally escalating privileges and UnDefend triggering a…
