Biden administration finalizes rule to block sale of Americans’ bulk data to adversaries

Texas hits data brokers for not registering, underscoring a larger privacy problem

Japan Airlines resumes operations after cyberattack delays flights

Nearly half a million people had data stolen after cyberattack on American Addiction Centers

Pittsburgh Regional Transit attributes recent service disruptions to ransomware attack

North Korean hackers spotted using new tools on employees of 'nuclear-related' org 

Romanian Netwalker ransomware affiliate sentenced to 20 years in US prison 

Bipartisan bills to protect car owners’ privacy introduced in House and Senate

Routers with default passwords are attracting Mirai infections, Juniper says

Click Here Podcasts

The Record-Centered.svg

Home

Subscribe to Cyber Daily®

Joe Warminsky

doj.jpg

Daryna Antoniuk

Google Chrome browser extensions page. Image: Recorded Future News

chrome-browser-extensions.jpg

Cyber startup employee hacked to distribute malicious Chrome extension

Jonathan Greig

marek-piwnicki.jpg

Blue Yonder says November ransomware attack not connected to Cleo vulnerability

united nations (1).jpg

UN General Assembly approves cybercrime treaty despite industry backlash

japan-airlines.jpg

ukraine-flag.jpg

Cyberattack on Ukraine’s state registers disrupts marriage registration, real estate deals

american-addiction-centers.jpg

north-korea-flags-roman-harak.jpg

FBI attributes largest crypto hack of 2024 to North Korea’s TraderTraitor

light-rail-train.jpg

CVE-2024-40348

CVE-2024-40348 is a directory traversal vulnerability in Bazaar v1.4.3 that allows unauthenticated attackers to access arbitrary files, with an exploit available on GitHub at the repository link https://github.com/NingXin2002/Bazaar_poc.

CVE-2024-38112

CVE-2024-38112, a vulnerability in the MSHTML platform, has been exploited by threat actors, including the APT group Void Banshee, facilitating the delivery of various malware strains, with exploits available for sale on the dark web and patches issued by Microsoft in July 2024.

REMCOS RAT

Recent information highlights a significant surge in the use of Remcos RAT, a remote access Trojan, particularly in phishing campaigns exploiting vulnerabilities in Microsoft Office documents, leading to unauthorized access and data theft across various sectors globally.

Scattered Spider

Recent information highlights that Scattered Spider, a notorious cybercrime group primarily composed of young hackers, has been linked to significant phishing attacks and ransomware incidents affecting major organizations such as MGM Resorts and Caesars Entertainment, leading to multiple arrests, including that of 19-year-old Remington Ogletree for orchestrating telecom hacks that resulted in substantial financial losses.

RedGolf

RedGolf has been actively exploiting vulnerabilities and employing a variety of tools, including a new PHP backdoor named 'Glutton', as part of sophisticated cyber espionage and financial theft campaigns targeting organizations in both China and the U.S.

BlueBravo

BlueBravo is a Russian state-sponsored cyber attacker known for sophisticated espionage campaigns targeting high-value victims, utilizing advanced techniques such as rogue Remote Desktop Protocol attacks and credential theft.

North Korean Hackers

North Korean hackers, particularly the group known as TraderTraitor, have been implicated in multiple high-profile cyberattacks, including a $308 million theft from the Japanese cryptocurrency exchange DMM Bitcoin in May 2024 and a $50 million breach of Radiant Capital in October 2024, highlighting their ongoing threat to global cybersecurity and the cryptocurrency sector.

Play Ransomware

Play Ransomware, known for its sophisticated double-extortion tactics, has recently claimed responsibility for a significant data breach at Krispy Kreme, threatening to release sensitive data obtained from the attack, which is part of a broader trend of increased activity by this group since its emergence in 2022, with connections to North Korean state-sponsored actors and numerous high-profile victims.

NoName057(16)

The pro-Russian hacker group NoName057(16) has recently claimed responsibility for numerous DDoS cyberattacks targeting critical infrastructure and government websites in various countries, including Italy, Belgium, Moldova, and Ukraine, framing these actions as responses to perceived anti-Russian sentiments and policies.

LummaC2

LummaC2, an advanced infostealer malware, has seen a significant surge in activity and popularity, particularly targeting the manufacturing sector and cryptocurrency wallets, with detections increasing by approximately 400% in the latter half of 2024 due to its sophisticated distribution methods, including phishing campaigns and malicious downloads.

HijackLoader

HijackLoader, also known as IDAT Loader or GHOSTPULSE, is a modular malware loader gaining popularity in the cybercriminal community for delivering various payloads like Lumma Stealer and Amadey through advanced techniques such as DLL sideloading, and has seen significant use in recent months, particularly in connection with LummaC2.

BugSleep

In July 2024, the malware BugSleep, also known as MuddyRot, was noted to be increasingly targeted by the threat actor Static Kitten against entities in Israel, with additional insights into its operational methods available through various analyses.

SocGholish

Recent reports indicate that Kaiser Permanente employees have been targeted by a malicious SocGholish malware campaign, which utilizes fraudulent Google ads to phish for login credentials and redirect victims to fake browser update pages, highlighting ongoing threats from this malware variant within the healthcare sector.

Latest Cyber Security News

Briefs

US adds 9th telecom company to list of known Salt Typhoon targets

HIPAA to be updated with cybersecurity regulations, White House says