Cyber Security News Weekly Round-Up : Vulnerabilities, Cyber Attacks, Threats & New Cyber Stories

Cyber Writes Team / Report
Source : https://cybersecuritynews.com/cyber-security-news-weekly-round-up/

Stay updated with the most recent advancements in the cybersecurity industry with our weekly recap of cybersecurity news.

Get comprehensive insights into the latest technical details and cutting-edge technologies being employed to safeguard against cyber threats.

This will help you stay informed about the latest trends, vulnerabilities, cutting-edge advancements, cyber attacks, threats, and stories.

Discover new threats and fixes in our recap. Learn about the latest tactics harming your devices. These key things will help you to stay updated on cybersecurity issues for timely fixes and complete coverage.

Threats

SSO-Based Phishing Attack

In SSO-based phishing attacks, threat actors use phishing scams to deceive individuals into sharing sensitive information like login credentials.

This method exploits human trust through social engineering, posing a significant risk for unauthorized access and identity theft.

Cybersecurity researchers identified this new tactic targeting users to disclose their login details by mimicking legitimate SSO pages.

The attackers employ various phishing techniques like email, SMS, and voice phishing to trick victims into revealing their credentials.

GTPDOOR

The GTPDOOR Linux malware is a newly discovered threat targeting telecom networks, specifically systems within the closed GRX network used by multiple telecommunication operators.

This malware operates stealthily by leveraging the GTP-C protocol, a legitimate protocol in mobile networks, to blend in with regular traffic and evade detection.

It communicates with a command and control server using the GTP-C protocol, allowing threat actors to send commands and receive stolen data.

GTPDOOR uses covert communication through GTP Echo Request messages and can modify its process name to mimic legitimate system processes for enhanced stealth.

Zoom & Google Meet Lures

Fake Google Meet and Zoom sites are being used by hackers who target Android and Windows users, where they distribute NjRAT malware.

Zoom rooms, on the other hand, have a crucial weakness that can enable unauthorized individuals to take over meetings, resulting in organization tenant account penetration.

Zoom is also grappling with security lapses that affect its customers. As a result, users were advised to upgrade their software to the most recent versions for safety concerns. These events demonstrate the ongoing cyber risks related to popular online meeting platforms.

Linux Malware Attacking Apache, Docker, Redis & Confluence Servers

New Linux malware exploits misconfigurations and known vulnerabilities to target popular servers (Apache, Docker, Confluence, Redis) using Golang binaries.

Attackers gain access, execute code, deploy a crypto miner, and create a reverse shell. Krasue RAT threatens Thai telecom companies with remote access and embedded rootkits.

Linux malware landscape includes CloudSnooper, Mirai, RansomExx, EvilGnome, GonnaCry, and Tycoon, posing diverse threats. Users were urged to prioritize system security with updates and vigilance.

Server Killers Alliances

This alliance indicates the changing problems countries encounter when protecting digital materials, which indicates the importance of international cooperation. The alliance unites many groups of hackers, which typically operate apart but show a high level of coordination.

This development shows how vital it is to share information and strengthen global collaboration in addressing the threats posed by such alliances.

Android Malware-as-a-Service: Coper

Android Malware-as-a-Service “Coper” highlights its evolution from a fake version of Bancolombia’s ‘Personas’ app to a present-day malware-as-a-service offering advanced features like keylogging, message interception, and screen control.

This descendant of the Exobot malware family targets Colombian Android users by impersonating legitimate apps. The malware collects victim device information and sends updates to a C2 server that enables threat actors to control devices.

xStealer Malware

The malware xStealer has recently been introduced, and it follows a long line of developments that have resulted from its evolution. For example, this software carries multiple complicated functionalities that efficiently enable it to steal personal data and, hence, pose serious risks to cyber space.

Updates and improvements on xStealer keep the malware in the top position as far as stealing information is concerned. The appearance of xStealer highlights how dynamic and fluid the cyber threat landscape is, stressing the significance of always being on the lookout for new dangers and continuously developing nimble security frameworks.

WogRAT Malware

WogRAT is a highly sophisticated malware that targets Windows and Linux systems. It takes advantage of the aNotepad service to save and spread malicious codes with tricks to go unnoticed.

This malware can be very dangerous since it can exploit system resources and user privileges on popular operating systems. The Linux variant of WogRAT uses the ELF format, while Tiny Shell is used for command execution, thereby indicating its unique strategies for Linux systems.

CISA & FBI Releases TTPs & IOCs Used by Phobos Ransomware Group

The FBI, CISA, and MS-ISAC have issued a joint advisory as part of the #StopRansomware initiative to warn critical infrastructure organizations about the Phobos ransomware group.

Since May 2019, this ransomware-as-a-service (RaaS) has been targeting sectors like municipal and county governments, emergency services, education, and public healthcare.

The advisory details Phobos ransomware tactics, indicators of compromise, and mitigation strategies to enhance defenses against this threat.

Cyber Attack

Russian Spies Hacked Microsoft Email Systems

In response to the theft of its source code, Microsoft has increased security and helped those affected by an attack from a Russian group of hackers known as “Midnight Blizzard,” who infiltrated its corporate email systems.

Since November, this breach is part of a continuing cyber-attack that is worrying because it demonstrates national threats to technology infrastructures.

Microsoft disclosed this on March 8th, 2024. This highlights how serious this problem is and how the company is reacting proactively to overcome cybersecurity threats posed by such criminals.

CACTUS Hackers

Two companies were attacked by CACTUS hackers. The hackers took advantage of a recently published software vulnerability in their systems and launched ransomware that infected them within just one day.

These networks are attacked simultaneously to gain unauthorized entry, where remote access tools are introduced, desktops are encrypted, and virtualization infrastructure is aimed at multiple servers.

The attackers showed remarkable coordination abilities, which enabled the expansion of the attack to ESXi and Hyper-V hosts. Because of this, the affected firms requested Bitdefender Labs for forensics help instead of giving money to cyber crooks.

Hackers Exploit WordPress Plugin Flaw to Deploy Godzilla Web Shell

The importance of proactive cybersecurity measures like software updates and robust access controls was highlighted by hackers who deployed Godzilla Web Shell by exploiting a flaw in a WordPress plugin.

These cases illustrate the dangers of vulnerabilities in popular plugins, which led to over 200,000 and 300,000 websites being attacked due to flaws.

Project DDoSia

Project DDoSia involves Russian hackers from the group “NoName057(16)” planning massive DDoS attacks, particularly targeting pro-Ukraine entities like NATO members.

The group’s activities have heightened since the Ukraine conflict began, with a focus on disrupting online services through large-scale attacks.

Despite the group’s ties possibly extending to the state, their operations continue to evolve with new features like enhanced encryption and collaboration with other hacktivist groups.

MacOS Malware Spread via Weaponized Calendar Invites

Hackers exploit email system vulnerabilities by using weaponized calendar invites to trick users into clicking on malicious links or downloading malware disguised as event attachments.

This tactic leverages trust in calendar invitations to increase the success of phishing attacks and gain unauthorized access to sensitive information.

Cybersecurity researchers have identified active exploitation of these weaponized calendar invites to install macOS malware, particularly targeting Mac users interested in cryptocurrency opportunities.

Active Password Cracking Attacks

PetSmart has conveyed caution over a surge in password-cracking attempts on their website, resulting in the adoption of precautionary measures without any system breach.

The firm is aware that strong passwords are key to fighting online threat actors who could compromise customers’ accounts. As a result, it advises its clients to come up with unique and regularly updated passwords.

Hacked WordPress Sites Conducting Browser-Based Brute Force Attacks

In a recent attack, Hacked WordPress sites were used to conduct distributed brute force attacks through the browsers of their visitors.

The attack was conducted by malicious actors who hacked into websites to target several thousand other sites by getting their URLs, extracting author usernames, injecting malicious scripts, trying different passwords until they were successful, and verifying validated credentials.

This attack aimed to use legitimate visitors as weapons against WordPress websites, especially targeting Web3 and cryptocurrency assets.

New Python Infostealer Targeting Facebook Messenger Users

Facebook Messenger users are under attack from a new threat called “Python Infostealer,” which attempts to steal login details through clever ways of using platforms like GitHub and GitLab for malicious activities.

This malware attacks with legitimate platforms such as messaging apps thereby complicating its detection. The first stage involves Facebook Messenger messages which trick victims into downloading archived files. This causes a two-stage infection process that has three different variants.

UAC-0050 Hacked Thousands Of Emails

The report on UAC-0050 reveals a significant cyber threat where threat actors from UAC-0050, also known as the DaVinci Group, have been targeting and hacking thousands of email addresses to launch malspam attacks.

This group has been linked to Russian-speaking mercenary organizations and has targeted Ukrainian organizations since the 2022 Russian invasion.

TA4903 Hackers Spoofing U.S. Government Entities

TA4903 hackers have been detected targeting US government entities and companies to hijack staff access credentials using high-volume email campaigns.

The cyber-criminals, who pose as both government agencies and private firms are focused mainly on the USA but also other countries. They carry out their operations in various forms such as stealing passwords through phishing, hacking of mailboxes and participating in business email compromise activities.

New Money Laundering Attack Targeting UPI Users

A new money laundering attack hits UPI users, exploiting convenience and weaker security.

This malicious scheme uses the compromised accounts to funnel the funds to China through fraudulent channels.

.NET Framework & Visual Studio Flaw

A vulnerability, CVE-2023-36049, has been discovered in the Microsoft .NET Framework and Visual Studio, posing a significant threat to FTP servers by allowing attackers to write or delete files.

This flaw arises from improper user input validation related to handling FTP commands that potentially lead to data loss or unauthorized access.

Vulnerabilities

VMware Critical Flaws

VMware software is exposed to remote code execution falws that are found in VMware products such as ESXi, Workstation, and Fusion which were patched by the company after private disclosure.

The specific vulnerabilities include use-after-free issues with USB controllers and out-of-bounds write bugs.

Gitlab Authorization Bypass Vulnerability

Among the critical vulnerabilities that have been fixed in GitLab, there were flaws in an authorization bypass (CVE-2024-0199) and privilege escalation (CVE-2024-1299). These flaws would allow an attacker to access protected variables and steal runner registration tokens.

For this reason, users are strongly advised to update to the latest versions for both CVE-2024-0199 (16.9.2, 16.8.4, 16.7.7) and CVE-2022-0735 (14.8.2, 14.7.4, 14.6.5), which will help them mitigate these risks and maintain their data’s security on GitLab servers as well as databases hosted by GitLab themselves thereby enhancing the platform’s security posture accordingly.”

Snort 2.9.8.3 and Snort 2.9.13.0 End of Life for Talos Rules

The end-of-life for Talos rules support has been announced for Snort versions 2.9.8.3 and 2.9.13.0, impacting users’ access to updates and security patches and potentially leaving systems vulnerable to new threats.

Users of version 2.9.8.3 will no longer receive updates, while support for version 2.9.13.0 will cease around July 1, 2024.

Cisco Secure Client Flaw

The report discusses a Cisco Secure Client Flaw that allows attackers to trigger a CRLF Injection Attack. Cisco has addressed this vulnerability by releasing software updates.

Versions earlier than 4.10.04065 are not vulnerable, while versions 4.10.04065 and later, including 5.0 and 5.1, are vulnerable.

The first fixed release for affected versions is 4.10.08025, with specific fixes for version 5.0 and 5.1.

ArubaOS Security Flaw

The ArubaOS has a security hole where one can execute remote code thereby leading to risks of leakage of sensitive information and arbitrary file deletion.

ArubaOS-Switches have multiple vulnerabilities, like command injections and memory corruptions, that range from low to high severity.

Aruba Networks released patches for these vulnerabilities, stressing the need to update Mobility Controllers, Conductors, and Gateways with specific ArubaOS versions.

Foxit PDF Reader Flaw

Foxit Software has addressed critical security vulnerabilities in its Foxit PDF Reader and Foxit PDF Editor for Windows, including a Heap Buffer Overflow Remote Code Execution vulnerability and a Type Confusion Remote Code Execution vulnerability.

These flaws could allow attackers to execute remote code on a user’s system. Users are advised to update to the latest versions, such as Foxit PDF Reader 2024.1 and Foxit PDF Editor 2024.1, to mitigate these risks and prevent potential cyber threats.

iOS 0-day

Hackers have exploited two zero-day vulnerabilities in iOS and iPadOS 17.4 versions, bypassing memory protections and performing arbitrary kernel read and write on affected devices.

These vulnerabilities, assigned CVE-2024-23225 and CVE-2024-23296, have been patched by Apple in their recent security advisory.

The company has issued updates to fix these vulnerabilities and warned of potential exploitation by threat actors.

Data Exposure

ChatGPT Credentials Up For Sale

The report “Hi-Tech Crime Trends 2023/2024” by Group-IB highlights a significant cybersecurity threat with over 225,000 compromised ChatGPT credentials being sold on dark web markets.

It underscores the increasing collaboration between ransomware and Initial Access Brokers, leading to a surge in global cyber threats.

Threat actors are exploiting AI technologies like ChatGPT to develop advanced malware, and there has been a substantial increase in ransomware attacks, with 4,583 companies affected.

Fidelity Investments Third-party Data Breach

More than thirty thousand individuals have suffered a third-party data breach at Fidelity Investments Life Insurance Company indicating possible security risks on customer’s data.

This incident highlighted the vulnerability of people, especially when sensitive information like names, social security numbers and bank details is exposed during such breaches.

Additionally, it shows the impact of third-party breaches as well as the need for strong cybersecurity systems to protect personal data.

Threats

Cyber Attack

Vulnerabilities

Data Exposure

Other Stories