By Waqas
New AI-Dodging Phishing Attack AI Security and Exploits Machine Learning.
This is a post from HackRead.com Read the original post: Cybercriminals Beta Test New Attack to Bypass AI Security

Hackers develop a new attack (Conversation Overflow) to bypass AI security. Learn how this technique fools Machine Learning and what businesses can do to stay protected.

A recent discovery by SlashNext threat researchers reveals a dangerous cyberattack method termed “Conversation Overflow.” This technique involves cloaked emails designed to bypass machine learning (ML) security controls, allowing malicious payloads to infiltrate enterprise networks.

In a typical Conversation Overflow attack, cybercriminals employ cloaked emails designed to deceive ML tools into categorizing them as harmless. These emails contain two distinct sections: one visible to the recipient, prompting them to take action such as entering credentials or clicking links and another hidden portion filled with innocuous text.

Threat actors exploit ML algorithms by strategically inserting blank spaces to separate these sections, often focusing on deviations from “known good” communications rather than identifying malicious content.

According to SlashNext’s research shared with Hackread.com ahead of publication on Tuesday, this novel approach poses a significant challenge to traditional cybersecurity measures, which rely on databases of “known bad” signatures. Unlike these methods, ML systems analyze patterns to detect anomalies, making them susceptible to manipulation by attackers mimicking legitimate communication styles.

Once a Conversation Overflow attack breaches security defences, attackers can deliver seemingly genuine messages requesting credential reauthentication, particularly targeting high-level executives. The stolen credentials are then sold on dark web forums, highlighting the lucrative nature of such cybercrime.

SlashNext threat researchers express deep concern regarding the potential ramifications of this attack becoming widespread. There is a significant risk that cybercriminals are actively developing an entirely new toolkit, which could exacerbate the impact of such attacks, potentially leading to devastating consequences for organizations and individuals alike.

> _“This is not your same old credential harvesting attack, because it is smart enough to confuse certain sophisticated AI and ML engines. From these findings, we should conclude that cyber crooks are morphing their attack techniques in this dawning age of AI security. As a result, we are concerned that this development reveals an entirely new toolkit being refined by criminal hacker groups in real-time today.”_
> 
> SlashNext

The implications of this discovery are profound, signalling a shift in cybercriminal tactics to exploit vulnerabilities in AI and ML-driven security platforms. As cyber criminals adapt and refine their techniques, it becomes increasingly imperative for organizations to remain vigilant and proactive in fortifying their defences.

1.  Ivanti VPN Flaws Exploited to Spread KrustyLoader Malware
2.  Telekopye Toolkit Used as Telegram Bot to Scam Marketplace Users
3.  RIG Exploit Toolkit Spread CeidPageLock Malware to Hijack Browsers

Cybercriminals Beta Test New Attack to Bypass AI Security

By Waqas
Another day, another healthcare-related cyber attack putting already vulnerable individuals at risk.
This is a post from HackRead.com Read the original post: NHS Dumfries and Galloway Faces Cyberattack, Patient Data at Risk

NHS Dumfries and Galloway suffered a cyberattack, potentially compromising patient data. The health board is working with authorities. Learn more about the attack, its potential impact, and how to stay vigilant.

NHS Dumfries and Galloway, a health board serving the southwestern region of Scotland, announced on Friday, March 15, 2024, that it has been targeted by a “focused and ongoing cyber attack.”

The nature of the cyber attack remains undisclosed, but the health board has warned that a “significant quantity of data” belonging to patients and staff may have been compromised.

The health board has activated its established protocols in response to the attack and is working closely with partner agencies, including Police Scotland, the National Cyber Security Centre (NCSC), and the Scottish Government. Their primary focus is on containing the attack, investigating the scope of the breach, and mitigating any potential damage.

NHS Dumfries and Galloway has also acknowledged the possibility of service disruptions due to the ongoing incident. While the specific nature of these disruptions is yet to be determined, they could potentially impact patient appointments, access to online services, or internal administrative functions.

The most concerning aspect of the attack is the potential compromise of patient and staff data. The health board has not yet confirmed the exact type of data accessed, but it could potentially include sensitive information such as names, addresses, medical records, and National Insurance numbers.

NHS Dumfries and Galloway is urging both staff and patients to be vigilant for any suspicious activity. This includes emails or phone calls attempting to gain access to personal information or financial details. They advise individuals to never click on links or open attachments from unknown senders and to report any suspicious activity immediately.

For insights into the incident, we reached out to Richard Staynings, Chief Security Strategist for Cylera, a healthcare cybersecurity that secures 25 NHS Trusts in the UK, who warned of potentially devastating and additional cyber attacks including ransomware on the targeted NHS Dumfries and Galloway systems.

“Police Scotland and the NCSA will now be looking for malware or simple droppers that could be used to launch a more lucrative ransomware attack on NHS Dumfries and Galloway.”

Richard emphasised that while the attack is concerning and unfortunate, it may not pose an immediate threat to people’s lives. He further explained that for a cyberattack to directly endanger lives, it would typically need to compromise not only confidentiality (as in the case of potential data exposure) but also system availability or data integrity.

“It’s a cyberattack that’s unlikely to be a direct risk to life unless a systems availability attack or a data integrity attack accompanies this particular attack against confidentiality. Confidentiality, Integrity and Availability (CIA) are the three pillars of the Security Triad, he explained.” “All three are required for security. To date, most hospitals have focussed their limited security budgets on protection of confidentiality at the expense of integrity and availability and this is one reason why so many hospitals have been extorted by cyber criminals through ransomware attacks.”

Nevertheless, the attack on NHS Dumfries and Galloway goes on to show the growing threat of cyberattacks on healthcare institutions. With vast amounts of sensitive patient data stored electronically, healthcare providers are becoming increasingly attractive targets for cybercriminals.

The full impact of the attack on NHS Dumfries and Galloway is still unfolding. The health board has assured the public that they are taking all necessary steps to investigate the incident, secure their systems, and protect patient data. However, it is likely to take some time before the full extent of the damage is known.

In the meantime, patients of NHS Dumfries and Galloway are advised to stay informed by checking the health board’s website for updates. They should also be extra cautious with any unsolicited communication claiming to be from the NHS.

1.  Hackers set up fake NHS website to spread malware
2.  7TB of Healthcare Data Leak Affects 12 Million Patients
3.  Chinese Malware Targets European Healthcare via USB Drives
4.  NHS data breach exposed sensitive health data of 150,000 patients
5.  Apria Healthcare Discloses Major Data Breach Impacting 1.8M Users

NHS Dumfries and Galloway Faces Cyberattack, Patient Data at Risk

By Uzair Amir
Explore unique cryptocurrencies beyond Bitcoin & Ether! AI tokens, meme coins and more. Discover the future of digital assets.
This is a post from HackRead.com Read the original post: 5 Types of Crypto You Didn’t Know Existed

When you think of cryptocurrency, what springs to mind for you? For a lot of us, cryptocurrency conjures up images of Bitcoin and Ether, which are quite ‘traditional’ cryptos in every sense of the word. But as we know, the crypto industry is nothing if not dynamic and all sorts of tokens exist for consumers.

If you planning to get started with crypto (or are already on your crypto journey), you should know about the many options in the market. From the creative to the controversial to the downright bizarre, here are some of the unique types of crypto you should know about.

****AI Crypto****

AI is probably the most trendy technology these days, so it comes as no surprise that cryptocurrency has found itself in the mix with the creation of AI cryptos. These tokens are those that incorporate AI technology into their processes or whose underlying blockchain project leverages AI.

If you look into AI crypto, you’ll see a plethora of these applications. Some blockchains have AI systems integrated into them to detect fraudulent transactions and some projects offer AI-infused experiences such as metaverses to users. Either way, AI is used to deliver a better experience to users and as time goes on, we can expect AI crypto to be a constant feature within the industry.

As Kane Pepi says, “The _AI crypto industry is still nascent, and as such, we can expect many more innovative products to come out in the near future – fueled by the success of projects such as Fetch.ai and SingularityNET_”.

****Meme Tokens****

This is perhaps one of the more entertaining types of cryptos. If you’re on the internet, then you know all about memes and how they bring people together. But did you know that there are cryptos based on memes? There is Dogecoin, which is based on the Shiba Inu dog meme, as well as SHIBA, BONK, and several other tokens. There is also the PEPE token, based on the Pepe the Frog meme. 

Honestly, for every popular meme online, there is probably at least one token based on it. And these tokens are doing quite well. Dogecoin, for example, has a market cap of over $24 billion. For any lover of memes, there will be many options in the market to invest in. 

****Privacy Tokens****

One of the reasons why people love using cryptocurrency is because transactions completed on a blockchain can be done with more control and privacy than with fiat currency. Nothing quite exemplifies that like privacy cryptos. 

Typically, crypto transactions are recorded on a public blockchain and can be viewed by anyone, even if the identity of the user is kept secret. Privacy tokens go a step further as these transactions cannot be viewed or traced by anyone. Naturally, they are the go-to option for crypto users who want maximum privacy. 

They have also been quite controversial as some have been used for crime in the past and some users believe they are too much of a risk. 

****Gaming Tokens****

Blockchain has been used in the gaming space for years now and this has given rise to a class of tokens used just for gaming. If you take a look at the average blockchain gaming project, you’ll probably come across its native token. These tokens can be used to buy in-game items, upgrade characters, engage with other users, staked, and so on. 

One thing that is also very unique about these tokens is that they typically cannot be used outside of the gaming projects that they are attached to. Still, they have proven to be quite valuable to gaming fans and thus, have retained their popularity. 

****CBDCs****

One of the core features of traditional cryptos is that they are currencies issued by other people and institutions besides central banks. But believe it or not, there are cryptocurrencies issued by central banks of various countries. 

As crypto became more popular, several countries decided that it would be beneficial to release official digital versions of their national fiat currencies. China, The Bahamas, the British Virgin Islands, and more have released central bank digital currencies (CBDCs) and others like Canada and the US are in various stages of developing their own. 

These currencies can be used for domestic payments and transfers and seem to act as a middle-ground for crypto sceptics. China, for example, has banned third-party cryptos but was willing to create the digital yuan.

****Conclusion** **

To get the best experience out of your crypto use, you should know about the different types of cryptos, even those you would not have imagined. From cryptos issued by central banks to those based entirely on memes, the industry has a lot to offer consumers and this is ever-growing.

These tokens show the creativity within the industry and how, with the power to create currencies, everyday people and experts alike are virtually unlimited in what they can do. Consider if any of the above tokens would meet your needs for privacy, community, entertainment, security, and anything else. 

1.  The Future of MATIC and What to Expect in 2024
2.  Navigating the new frontier of cryptocurrency futures
3.  What the Bitcoin ETF Approval Mean for the Crypto Market
4.  Enhancing Blockchain Randomness To Eliminate Trust Issues
5.  Exploring the Phenomenal Rise of Ethereum as a Digital Asset

5 Types of Crypto You Didn’t Know Existed

By Deeba Ahmed
While Fujitsu did not disclose in-depth details, the company confirmed investigating a cyberattack that may have led to a data breach.
This is a post from HackRead.com Read the original post: Fujitsu Scrambles After Malware Attack: Customer Data Potentially Breached

Japanese tech giant Fujitsu is investigating a potential data leak after malware infected company systems – This could expose the personal information of customers and employees.

Fujitsu is investigating a possible data leak caused by a malware infection that may have allowed unauthorized access to personal information, according to its press release on Friday.

Fujitsu confirmed the presence of malware on multiple work computers, suggesting a potential entry point for unauthorized access. The company quickly launched an investigation. Initial probing has revealed that the malware could have accessed and extracted sensitive personal and customer information. 

“We discovered that files containing personal information and customer information could be illegally taken out,” Fujitsu stated in its press release.

However, the tech giant is yet to confirm the nature of malware used to target its computers, the number of affected computers, and the type of data breached in the attack. Fujitsu discovered the cyberattack on 15 March but has not disclosed other details, including whether contact details, passwords, and payment details were compromised and the time of the attack.

It has implemented strict security measures, isolating affected computers and strengthening network surveillance. The company has disconnected affected systems from its network and is investigating the type of malware used, the nature of the cyberattack, and the method of the intrusion. 

Fujitsu has not disclosed who has been affected, including employees, corporate customers, and citizens using the company’s technologies. 

The company claims to be informing “the targeted individuals and customers” about the possible data breach and has notified the Personal Information Protection Commission, Japan’s data protection authority.

“To date, we have not received any reports that personal information or information about our customers has been misused” the company concluded.

Fujitsu is a leading Japanese ICT company, employing 124,000 people in over 100 countries. The company has been involved in wrongful convictions due to bugs in its Horizon computer software.

1.  Top Japanese dating app Omiai hacked; 1.71 million users at risk
2.  CutOut.Pro AI Tool Data Breach: Hacker Leak 20 Million User Info
3.  Acer Data Breach: Hacker Claims to Sell 160GB Trove of Stolen Data
4.  American Express Users Impacted by 3rd-Party Vendor Data Breach
5.  Nissan Confirms Data Breach Affected 100,000 Users and Employees

Fujitsu Scrambles After Malware Attack: Customer Data Potentially Breached

By Waqas
Another day, another malware threat emerges in a country already at war.
This is a post from HackRead.com Read the original post: New AcidRain Linux Malware Variant “AcidPour” Found Targeting Ukraine

SentinelLabs researchers have discovered “AcidPour,” a variant of the AcidRain Linux malware targeting Linux systems in Ukraine. This new strain expands on its predecessor and poses a risk to users.

Researchers at SentinelLabs have uncovered a new variant of the Acid Rain malware, dubbed “Acid Pour,” which has emerged in Ukraine. The discovery was made over the weekend, with J. A. Guerrero-Saade, AVP of SentinelLabs, sharing insights via X (formally Twitter).

The original AcidRain malware surfaced in March 2022, notably used during the ‘Viasat hack,’ which disrupted KA-SAT Surfbeam2 modems at the onset of the Russian invasion of Ukraine.

> It's been an interesting weekend! Eagle-eyed @TomHegel spotted what appears to be a new variant of AcidRain. Notably this sample was compiled for Linux x86 devices, we are calling it 'AcidPour'. Those of you that analyzed AcidRain will recognize some of the strings. Analysis 🧵 pic.twitter.com/wY3PJKaOwK
> 
> — J. A. Guerrero-Saade (@juanandres\_gs) March 18, 2024

TomHegel, Principal Threat Researcher at SentinelLabs, identified the new variant, compiled specifically for Linux x86 devices. While AcidPour shares similarities with AcidRain in certain strings, it separates significantly in its codebase, compiled for x86 architecture rather than MIPS.

It is worth noting that popular Linux distros for x86 devices include Ubuntu, Mint, Fedora, and Debian. On the other hand, MIPS (Microprocessor without Interlocked Pipelined Stages) is a type of instruction set architecture (ISA), which essentially defines the language a processor understands and uses to execute instructions. Similar to x86, it’s a set of rules and specifications for how a processor operates.

AcidRain operated as a generic wiper, targeting common directories and device paths on embedded Linux distros. AcidPour, however, introduces new elements, referencing Unsorted Block Images (UBI) and virtual block devices associated with Logical Volume Manager (LVM), suggesting a potential expansion of targets beyond previous iterations.

Despite the similarities, there are notable differences, including a distinct wiping logic for devices like LVMs, indicating a potentially evolved strategy by threat actors. The good news is that SentinelLabs has raised awareness of AcidPour among stakeholders in Ukraine, although the specific targets and scope of the operation remain unclear.

The discovery goes on to show how fast malware threats are evolving, with attackers adapting their tactics to exploit vulnerabilities in various systems. From the perspective of an unsuspecting user or an organization in the business, both must keep an eye on cybersecurity threats like AcidRain and AcidPour.

Begin by prioritizing training for yourself and your employees, as phishing attacks act as a primary gateway for malware infection. Consider leveraging AI-powered chatbots such as ChatGPT or Gemini AI to compile a concise yet essential guide outlining preventive measures against phishing, malware, ransomware, and data breaches.

1.  Someone DDoSed Ukraine’s national postal service for 48 hours
2.  DDoS Attack and Data Wiper Malware hit Computers in Ukraine
3.  Hackers Using Old WinRAR Flaw in New Cyberattack on Ukraine
4.  ‘Destructive malware’ fakes ransomware to target Ukrainian orgs
5.  Backdoor Attack Uses Russian-Ukrainian Conflict Phishing Emails

New AcidRain Linux Malware Variant “AcidPour” Found Targeting Ukraine

By Owais Sultan
Web3 infrastructure leader COTI is excited to announce a significant community rewards initiative, with the platform airdropping up…
This is a post from HackRead.com Read the original post: COTI Announces Upcoming V2 Airdrop Campaign Worth +10M USD

COTI V2 is thrilled to announce a massive 40 million token Airdrop Campaign

Web3 infrastructure leader COTI is excited to announce a significant community rewards initiative, with the platform airdropping up to 40 million COTI V2 tokens, currently worth approximately $10 million, to its Native and ERC-20 $COTI holders. The need for COTI V2 as a confidentiality layer on Ethereum has resulted in a large, vocal community of supporters, and the platform is thrilled to reward that critical support.

The COTI V2 Airdrop Campaign will begin on Monday, March 25th, 2024. The planned distribution of the COTI V2 tokens will take place in Q4 2024, shortly after the COTI V2 TGE.  All Treasury participants will automatically be included in the airdrop of 40 million tokens, whether they are holding Native or ERC-20 $COTI.

Note, that this airdrop is in addition to all APY rewards for token holders. Users simply need to have a deposit in the Treasury to participate, but those who have made deposits before February 28th 2024 will receive an additional bonus as a show of the COTI team’s gratitude for their early support.

The Airdrop rewards will be determined for each member through a combination of each deposit’s current APY, the other deposit settings including multiplier and locking period, and the amount of time and activity spent in the Treasury itself.

****COTI V2 Ecosystem and Treasury****

COTI has quickly become a major Web3 infrastructure developer, building the lightest and fastest confidentiality layer for the Ethereum ecosystem. The key to this data protection breakthrough is a cryptographic protocol that is derived from Garbled Circuits, allowing for the privacy of on-chain data.  This layer is secured by Ethereum’s L1, which creates the most comprehensive data privacy solution that maintains full compliance. 

This breakthrough is nothing less than the key to unlocking brand new use cases for the Web3 economy, allowing confidentiality while utilizing all the data integrity and trustless benefits of blockchain.  Web3 companies will soon build applications for decentralized identification, DeFi, private auctions, data broker analysis (while protecting data privacy), and even Artificial Intelligence applications.

****QUOTE ABOUT THE AIRDROP HERE****

The COTI Treasury was launched in 2022 to provide a reward structure for those wishing to deposit $COTI and earn APY in the form of $COTI and $gCOTI.  As an indication of the COTI community’s overwhelming support, members have deposited over 500 million $COTI into the Treasury. 

In addition, to support, depositors have also been drawn to the Treasury by the strength of its rewards, allowing a member to customize their desired potential APY by setting the amount to deposit, a multiplier, a lock period, and an APY boost. The team plans to extend rewards even further by offering longer lock periods of 180, 270, and 360 days starting 25 March.

This campaign is also notable because, for the first time, the community’s $COTI ERC-20 token holders without VIPER wallets can also participate in Treasury rewards, both APY and the Airdrop Campaign. 

For those who don’t have a deposit in the Treasury yet, there is still time to visit Treasury.coti.io, connect a VIPER or Metamask Wallet, and set up a deposit by selecting the amount, multiplier, lock period, and APY boost (tutorial). Those with deposits already set up in the Treasury do not need to take further action, but do have the option to extend the locking period of their deposit to earn additional rewards.

The COTI V2 Airdrop Campaign is another successful step in COTI’s roadmap toward a thriving community of developers and users who are passionate about building an ever-improving Web3 ecosystem. 

With COTI’s compliant confidentiality layer, entire new industries within Web3 can be unlocked, which will continue COTI, Ethereum, and the rest of Web3 toward mass adoption across the globe. The airdrop is a very heartfelt thank you to the community that joins in COTI’s vision, rewarding both new and long-standing members for their continued support.

****About COTI****

COTI is the fastest and lightest confidentiality layer on Ethereum. Powered by the breakthrough cryptographic protocol Garbled Circuits and secured by Ethereum, COTI introduces the most advanced and compliant solution for data protection on the public blockchain.

Paving the way for the next wave of Web3 innovation and adoption, COTI unlocks a whole new world of use cases, including confidential transactions, Artificial Intelligence, DeFi, decentralized identification, and more.

COTI Announces Upcoming V2 Airdrop Campaign Worth +10M USD

By Waqas
Cyber Warfare Takes Flight: Geopolitics Fuel Attacks on Airlines - Dark Web Tool Aims at E-commerce!
This is a post from HackRead.com Read the original post: Dark Web Tool Arms Ransomware Gangs: E-commerce & Aviation Industries Targeted

Cybersecurity researchers have published two concerning reports where the first report highlights the surge in cyber attacks against the aviation and aerospace industries – And the second report exposes a dark web tool called TMChecker fueling attacks against E-commerce platforms.

Recent cyber incidents targeting the aerospace and aviation sectors have raised concerns about the industry’s vulnerability to malicious attacks, according to a report by Resecurity. The report highlights the critical need for strong cybersecurity risk assessments to protect airports and aviation infrastructure.

The aerospace sector, including the design, manufacturing, and maintenance of aircraft and spacecraft, has become a prime target for cyberattacks due to its reliance on interconnected digital infrastructures and global supply chains.

The integration of Industrial Internet of Things (IIoT) technologies has further strengthened this threat, making aerospace organizations more vulnerable and susceptible to cyber attacks.

Credit: Resecurity

****Ransomware Attacks & The Aviation Industry****

Ransomware emerges as a top threat facing the aviation industry, with a 600% increase in occurrences reported by Boeing Chief Security Officer Richard Puckett at the 2023 Aviation Week MRO Americas Conference.

The European Organisation for the Safety of Air Navigation (Eurocontrol) also highlighted ransomware as the sector’s leading attack trend in 2022, accounting for 22% of all malicious incidents. Some of the examples highlighted in the report include the LockBit ransomware gang’s attack on Boeing in November 2023, which the aviation giant later confirmed.

****Geopolitical tensions & The Aviation Industry****

According to Resecurity’s blog post titled “The Aviation And Aerospace Sectors Face Skyrocketing Cyber Threats,” geopolitical tensions and the designation of aerospace and aviation as critical infrastructure by the U.S. government have fueled cyberattacks targeting the industry.

Threat actors, including hacktivist collectives, are increasingly targeting aviation organizations to advance political agendas or disrupt operations. One such example is the hacktivist group Anonymous Sudan which targeted FlyDubai, an Emirati government-owned airline in Dubai, United Arab Emirates in February 2024 citing the company’s alleged support to the Rapid Support Forces (RSF) in Sudan.

Other recent cyberattacks targeting the aerospace sector include Distributed Denial of Service (DDoS) attacks by groups such as Mysterious Team Bangladesh (MTB) against Saudi Arabian airports and ALTOUFAN TEAM against Gulf Air.

> In stand with our steadfast Palestinian people in Gaza Strip in their brave and honorable resistance,ALTOUFAN TEAM targets companies normalized with the Zionist entity , Bahrain International Airport and the Bahraini national carrier “Gulf Air” servers and website…… pic.twitter.com/OKOhR12M3S
> 
> — ALTOUFAN TEAM (@altoufanteam) November 22, 2023

Additional incidents involve ransomware attacks on airlines like Air Albania and Continental Aerospace Technologies, compromising critical data and disrupting operations.

**T**MChecker – Dark Web Tool Targeting Remote Access and E-Commerce Platforms****

In another report published on March 13, 2024, Resecurity detailed a new cybersecurity threat named TMChecker that has surfaced on the Dark Web, posing a notable risk to remote-access services and popular e-commerce applications.

Developed by an actor known as “M762” on the Russian language XSS cybercrime forum, TMChecker is a sophisticated tool that combines corporate access login (log) checking capabilities with a brute-force attack kit. Available for a monthly subscription fee of $200, TMChecker has garnered attention for its ability to target a wide range of VPN gateways, email servers, and e-commerce platforms.

Credit: Resecurity

TMChecker stands out from similar tools like ParanoidChecker due to its focus on corporate remote access gateways, which are often primary targets for ransomware attacks and other malicious activities. The tool supports 17 solutions, including Cisco VPN, Citrix VPN, Office 365, WordPress, Magento, and cPanel, among others, making it a versatile and powerful weapon.

Cybercriminals exploit TMChecker to identify compromised data containing valid credentials for corporate VPN and email accounts. In one observed incident, threat actors used TMChecker to target the email server of a government organization in Ecuador, demonstrating the tool’s real-world impact.

M762 operates a Telegram channel with over 3,270 subscribers, potentially indicating a sizable user base for TMChecker. The addition of such tools aligns with a concerning trend highlighted in recent Microsoft research, which noted a significant increase in human-operated ransomware attacks.

These attacks often involve the abuse of remote monitoring and management tools, leaving behind less evidence compared to automated attacks delivered through malicious documents.

As TMChecker and similar tools lower the barriers to obtaining remote access credentials, the risk of destructive ransomware attacks and other malicious campaigns amplifies. This threat is particularly acute in the context of mergers and acquisitions, where cybercriminals target vulnerable organizations to exploit for financial gain.

1.  Cl0p ransomware gang hits Aviation giant Bombardier
2.  Hackers Uncover Airbus EFB App Flaws, Risking Aircraft Data
3.  Israeli: Hackers Targeted EL AL Flights in Mid-Air Hijack Attempt
4.  Military Satellite Access Sold on Russian Hacker Forum for $15,000
5.  Hackers posing as LinkedIn recruiters to scam military, aerospace firms

Dark Web Tool Arms Ransomware Gangs: E-commerce & Aviation Industries Targeted

By Deeba Ahmed
40% of 2024 CVEs Missing Key Info: NVD Data Gap Raises Security Risks!
This is a post from HackRead.com Read the original post: NIST NVD Halt Leaves Thousands of Vulnerabilities Untagged

Alert! Missing NVD Data Leaves Businesses Vulnerable. Patching Delays Due to Disruption. Security Experts Urge Action.

A disruption at the National Institute of Standards and Technology (NIST) is causing problems for organizations that rely on its National Vulnerability Database (NVD). The NVD is a central repository for information about software vulnerabilities, serving as a critical resource for organizations to identify and address security weaknesses in their systems. 

Security policies mandate governments and commercial organizations to address vulnerabilities based on NVD-provided severity levels within specific days, making it the world’s most significant vulnerability database.

Therefore, it is concerning that NIST has stopped enriching software vulnerabilities in NVD since February 12, 2024. This significant drop in enrichment was first discovered by software security provider Anchore’s VP of Security, Josh Bressers, and subsequently noted by Cisco Threat Detection & Response’s principal engineer, Jerry Gamblin, Gamblin and NetRise.

The NVD announced on February 15th that it is working to establish a consortium to address challenges in the NVD program and develop “improved tools and methods.” This may cause temporary delays in analysis efforts, the NVD explained. However, security analysts opine that the NVD is lagging in fully reporting CVEs.

> _“NIST is currently working to establish a consortium to address challenges in the NVD program and develop improved tools and methods. You will temporarily see delays in analysis efforts during this transition. We apologize for the inconvenience and ask for your patience as we work to improve the NVD program.”_

Hackread.com captured a screenshot from the website, which has been displayed since February 14, 2024.

Screenshot: Hackread.com

As pointed out by a report referring to NetRise CEO Tom Pace, reported that only 200 out of 2700 Common Vulnerabilities and Exposures (CVEs) have been enriched. This means over 2500 vulnerabilities added to the database have been uploaded without crucial metadata information.

These include the description of the vulnerability and software ‘weakness’ potentially leading to an exploit (called Common Weakness and Exposure/CWE), the names of affected software products, the vulnerability’s criticality/CVSS score, and patching status. Bressers shared an updated graph showing few CVEs have been enriched in the past 30 days.

The issue is attributed to a decrease in CVEs enriched with crucial metadata, such as Common Product Enumerators (CPEs) and criticality scores (CVSS). The NVD has left thousands of CVEs untagged since mid-February, leaving around 40% of this year’s CVEs without vital information. This is concerning as CPE is the main way to match a CVE to a component and relies on many home-grown vulnerability solutions.

For your information, MITRE developed the CVE framework to identify known security flaws. CVE IDs are reported by CVE Numbering Authorities, which include 350 tech companies, security vendors, and researchers.

CVEs are tagged with other cybersecurity acronyms like Common Weakness Enumerators (CWEs), Common Vulnerability Scoring System (CVSS), and Common Platform Enumerator (CPE). CWEs describe coding flaws, CVSS scores describe CVE impact severity, and CPEs identify systems in danger.

This disruption poses a significant challenge to organizations that depend on the NVD for vulnerability management. Without access to this comprehensive data, organizations cannot efficiently identify vulnerable systems within their networks. This can lead to delayed patching or remediation efforts, potentially exposing these systems to exploitation by malicious actors.

The cybersecurity researchers are urging NIST to prioritize resolving this interruption and resume providing complete vulnerability data within the NVD. Transparency regarding the cause of this issue is also essential to ensure continued trust and collaboration within the cybersecurity community.

1.  Vulnerability Risk Management for External Assets
2.  ZombieBoy crypto malware exploits CVEs to evade detection
3.  NIST’s Cybersecurity Framework 2.0: Guide for All Organizations
4.  Flashpoint Uncovers 100K+ Hidden Vulnerabilities, Including 0-Days
5.  Ethical Hackers Reported 835 Vulnerabilities, Earned $450K in 2023

NIST NVD Halt Leaves Thousands of Vulnerabilities Untagged

By Waqas
Hackers claim to have breached Viber, stealing 740GB of data, including source code, and are now demanding ransom of 8 Bitcoin.
This is a post from HackRead.com Read the original post: Hackers Claim Accessing 740GB of Data from Viber Messaging App

Pro-Palestinian hackers calling themselves “Handala Hack” claim to have accessed 740GB of data from the messaging app Viber, including source code – Viber denies the breach but is investigating – Users are advised to change passwords.

Messaging app **Viber** is facing a potential data breach after a pro-Palestinian hacktivist group, Handala Hack, claimed responsibility for accessing its servers and stealing a trove of data.

In its Telegram post, Handala Hack alleged they stole over 740GB of data, including Viber’s source code. The group demands a ransom of 8 Bitcoin, or $583,000, for the stolen information.

“Have you seen the management panel of Viber Messenger before? Can you imagine the technology giants affiliated with the occupying regime, what information of citizens they store?” the group’s post read. As seen by Hackread.com, the claim was accompanied by an image allegedly showing a directory listing.

Handala Hack group on Telegram (Screenshot credit: Hackread.com)

Viber, a messaging app introduced in 2010 and acquired by Japanese multinational firm Rakuten in 2014 for $900 million, has responded to the hackers’ claims.

The company has denied any evidence of intrusion into its systems or data compromise but confirmed that it has already launched an investigation to verify if a security breach has occurred. 

“We are aware of the claim and are investigating the validity of the alleged breach with utmost urgency,” the company said. “The security of our users’ data is our top priority,” the company reiterated.

If confirmed, this could be one of the largest data breaches in recent history. Experts opine that this breach, potentially involving personal messages, call logs, contact details, and financial information, can devastate Viber users. 

Handala Hack is a controversial group known for targeting Israeli entities and their allies to support the Palestinian cause. It has been active since establishing its Telegram channel in December 2023 and later joining **Breach Forums**.

Handala Hack group on Breach Forums (Screenshot credit: Hackread.com)

This group claims to have targeted Israeli infrastructure, healthcare providers, community centers, tech companies, media outlets, and defence contractors with sophisticated techniques.

Some of these techniques include phishing emails mimicking F5 BIG-IP zero-day security updates and SQL injection attacks, compromising databases and highlighting their intent to disrupt political messages through cyber means. Their claimed targets include Hadarom Port, Home Medics, Rosh Ha’ayin Municipal Society, and DRS RADA Technologies.

Whether verified or not, the incident involving Viber raises questions about the app’s data security practices. Viber needs to address user concerns by clearly explaining the situation and any potential risks to user data. 

In the meantime, Viber users should exercise caution and change their passwords, be cautious of phishing attempts, and stay informed about any updates regarding the alleged data breach by checking Viber’s official channels.

1.  Pro-Palestinian TA402 APT Using IronWind Malware
2.  Hacktivists Hit Critical ICS Infrastructure in Israel -Palestine
3.  Hackers Target Israeli Rocket Alert App Users with Spyware
4.  Palestinian Engineer Jailed for Hacking Israeli CCTVs & Drones
5.  Hamas-Linked Group Revives SysJoker Malware, Leverages OneDrive

Hackers Claim Accessing 740GB of Data from Viber Messaging App

By Waqas
Another day, another cybersecurity threat hits unsuspected users!
This is a post from HackRead.com Read the original post: New Malware “BunnyLoader 3.0” Steals Credentials and Crypto

New high-performance malware “BunnyLoader 3.0” steals logins, crypto & lurks undetected. Palo Alto Unit 42 reveals its tricks to help businesses & individuals fight back. Learn how to protect yourself from this evolving cyber threat.

In the scenario where cybersecurity threats are peeking, staying one step ahead of malicious actors is crucial to protecting your online business and identity. Recently, Palo Alto’s Unit 42 released a report shedding light on a dangerous new malware called BunnyLoader, and its latest version, BunnyLoader 3.0. Here’s what you need to know:

****The BunnyLoader Menace:****

BunnyLoader is not your average malware. It’s a sophisticated tool developed by cybercriminals to steal sensitive information, credentials, and even cryptocurrency from unsuspecting victims. What’s more, it’s constantly evolving, making it a challenging threat for the cybersecurity community.

****A Constantly Evolving Threat:****

Since its discovery in September 2023 on **Breach Forums**, BunnyLoader has undergone multiple updates and enhancements, each aimed at outsmarting security measures and staying under the radar of cybersecurity researchers. From bug fixes to advanced keylogging capabilities, the creators of BunnyLoader are constantly tweaking their creation to maximize its effectiveness.

****The Release of BunnyLoader 3.0:****

On February 11, 2024, the threat actors behind BunnyLoader unveiled their latest version, BunnyLoader 3.0, boasting a 90% improvement in performance. This new iteration comes with a reduced payload size and enhanced keylogging capabilities, making it even more dangerous than before.

****Behind the Scenes of BunnyLoader:****

Unit 42’s **technical write-up** provides a glimpse into the inner workings of BunnyLoader, revealing the tactics and techniques used by its creators to evade detection. From changing file names to mimicking legitimate applications, BunnyLoader employs various strategies to stay hidden from cybersecurity experts.

****Protecting Yourself Against BunnyLoader:****

With the threat of BunnyLoader looming large, it’s more important than ever to stay vigilant and take proactive measures to protect yourself and your online assets. By staying informed about the latest cyber threats and implementing robust security measures, you can minimize the risk of **falling victim to malicious actors**.

1.  95.6% of New Malware in 2022 Targeted Windows
2.  SpyNote Android Spyware Poses as Legit Crypto Wallets
3.  Malware Turns Windows, macOS Devices into Proxy Nodes
4.  Mispadu Stealer’s New Variant Targets Browser Data of Mexicans
5.  Bifrost RAT Variant Targets Linux Devices, Mimics VMware Domain

Source

HackRead