By Deeba Ahmed
Another day, another Linux malware!
This is a post from HackRead.com Read the original post: New Linux Malware Alert: ‘Spinning YARN’ Hits Docker, Other Key Apps

Linux Users Beware: “Spinning YARN” Malware Campaign Targets Misconfigured Servers Running on Apache Hadoop YARN, Docker, Confluence and Redis.

Cado Security Labs has discovered an emerging Linux malware campaign dubbed Spinning Yarn targeting misconfigured servers running Apache Hadoop YARN, Docker, Confluence, and Redis web-facing services. 

The emergence of the new Linux malware shouldn’t come as a surprise, given the recent surge in threats targeting Linux devices and servers. Just a couple of days ago, an old Linux malware known as Bifrost RAT resurfaced with a new variant that mimics VMware domains.

According to Cado Security’s research research shared with Hackread.com ahead of publication on Wednesday, Spinning Yarn is a malicious campaign that exploits weaknesses in popular Linux software used by businesses across various sectors. 

These services are crucial components in organizations’ IT infrastructure. Docker is critical for developing, deploying, and managing containerized applications. Apache Hadoop allows distributed processing of large datasets. Redis, a widely used in-memory data store, helps in caching real-time applications, and Confluence allows collaboration and knowledge management.

By compromising these applications, attackers can gain unauthorized access to systems, steal sensitive data, disrupt operations, or deploy ransomware, posing a significant threat to servers and critical infrastructure.

In Spinning Yarn, threat actors have used several unique payloads, including four Golang binaries that automate the discovery and infection of hosts and let them exploit code. They use Confluence to exploit common misconfigurations and vulnerabilities, launching Remote Code Execution (RCE) attacks and infecting new hosts.

The attackers exploit CVE-2022-26134, an n-day vulnerability in Confluence, and deploy a container for the Docker compromise. The vulnerability has been exploited since 2022, including by Mirai malware variant V3G4 against IoT devices for DDoS attacks

Further probing revealed a series of shell scripts and standard Linux attack techniques used to deliver a cryptocurrency miner, spawn a reverse shell, and enable persistent access to compromised hosts. They also deploy an instance of the Platypus open-source reverse shell utility to maintain access.

In an attempt to evade detection, multiple user-mode rootkits are deployed. Researchers observed that the shell script payloads employed in this campaign share similarities with those used in previous cloud attacks.

In their blog post, Cado Security Labs detailed initial access activity on a docker Engine API honeypot on this IP address: 47966971. The attacker spawned a new container using Alpine Linux and created a bind mount for the underlying server’s root directory. This technique is common in Docker attacks, allowing attackers to write files to the host and execute a job for the Cron scheduler eventually achieving RCE.

In this campaign, the attacker wrote an executable and registered a Cron job to execute base64-encoded shell commands. Such extensive attack on Linux applications demonstrates attackers’ growing sophistication in targeting web-facing services in cloud environments, keeping abreast of vulnerabilities.

To mitigate the risks from campaigns like Spinning Yarn, regularly update software, enable strong passwords, educate employees on cybersecurity best practices, segment your network to limit potential damage, and deploy security solutions like endpoint security solutions and firewalls to detect and prevent malware infections. This will help protect against known vulnerabilities and ensure a secure environment.

1.  New Linux Malware “Migo” Exploits Redis for Cryptojacking
2.  Free Download Manager Site Pushed Linux Password Stealer
3.  Malicious Ads Infiltrate Bing AI Chatbot in Malvertising Attack
4.  Hamas Hackers Hit Israelis with New BiBi-Linux Wiper Malware
5.  Mirai-based NoaBot Botnet Hits Linux Systems with Cryptominer

New Linux Malware Alert: ‘Spinning YARN’ Hits Docker, Other Key Apps

By Deeba Ahmed
Group-IB Report Warns of Evolving Cyber Threats Including AI and macOS Vulnerabilities and Ransomware Attacks.
This is a post from HackRead.com Read the original post: Report Uncovers Massive Sale of Compromised ChatGPT Credentials

Group-IB report unveils: compromised ChatGPT accounts sold on dark web, highlighting AI security risks, ransomware surge, macOS vulnerabilities. Take action to stay safe.

Group-IB’s Threat Intelligence has released a “Hi-Tech Crime Trends 23/24” report highlighting a dramatic surge in ransomware attacks, macOS system threats, and the growing use of AI by cyber criminals.

The report revealed Asia-Pacific being the primary target for advanced persistent threat groups in 2023, with 523 attacks worldwide. APAC organizations accounted for 34% of global attacks, with Europe and the Middle East ranking second and Africa third.

A 70% rise in public ads selling zero-day exploits was recorded during 2022-2023. Threats like the **CVE-2023-38831** zero-day vulnerability in ZIP file format remained popular among advanced cybercrime groups and nation-state actors for cyber-espionage activities. 

The report also warned of a growing interest in AI systems, **particularly ChatGPT** credentials, for reaching sensitive corporate data as public Large Language Models (LLMs) often do not protect accounts with multi-factor authentication.

AI systems can let attackers access confidential information, including internal source code, financial data, and trade secrets, and access communication history logs between employees and systems, allowing attackers access to sensitive data.

Over 225,000 infostealer logs containing compromised ChatGPT credentials were detected between January-October 2023. Four ChatGPT-style tools were developed since mid-2023 to facilitate such activities, including WolfGPT, DarkBARD, **FraudGPT, and WormGPT**. FraudGPT and WormGPT are popular for social engineering and phishing, while WolfGPT focuses on code or exploits.

Researchers detected around 130,000 compromised hosts with ChatGPT access between June and October 2023, marking a 36% increase from the previous year. The **LummaC2** information stealer breached most logs.

Researchers also detected 4,583 companies with their information, files, and data published on ransomware Distributed Leaks (DLSs), marking a 74% growth from the previous year, with North American companies being the biggest victims. 

Global threat actors, primarily APT groups, are targeting Apple platforms more, with underground sales of macOS information stealers increasing fivefold. Most concerning cyber risks for 2024 include zero-day exploits and malicious service use.

Cybersecurity firms have long been raising alarm over the continuous expansion in the global cyber threats spectrum. In June 2023, Group-IB researchers **discovered** a trend of over 100,000 devices infected with stolen ChatGPT credentials, with 26,802 compromised accounts recorded in May 2023. The Asia-Pacific region had the highest concentration of compromised credentials. ChatGPT’s default settings store user queries and AI responses, exposing confidential information.

In January 2024, Kaspersky Digital Footprint Intelligence **reported** threat actors exploiting AI technologies for illegal activities, sharing jailbreaks and exploiting legitimate tools for malicious purposes, particularly ChatGPT and LLMs, which can be used for malicious purposes, including malware development and illicit language model use.

The latest **report** highlights a significant rise in ransomware attacks targeting manufacturing, real estate, healthcare, government, and military sectors, the growing sophistication of **cybercriminals targeting macOS systems**, and the potential misuse of AI by cybercriminals to automate tasks, personalize attacks, and bypass security measures.

Businesses should invest in robust security solutions like firewalls, endpoint protection software, and intrusion detection systems, along with offering employee training on cyber threats to stay protected.

1.  **OpenAI’s ChatGPT Can Create Polymorphic Malware**
2.  **Malicious Abrax666 AI Chatbot Exposed as Potential Scam**
3.  **Malicious Ads Infiltrate Bing AI Chatbot in Malvertising Attack**
4.  **Following WormGPT, FraudGPT Emerges for AI-Driven Cyber Crime**
5.  **Researcher create polymorphic Blackmamba malware with ChatGPT**

Report Uncovers Massive Sale of Compromised ChatGPT Credentials

By Waqas
Logged out of your Meta Platform services?
This is a post from HackRead.com Read the original post: Meta Platforms Face Outage: Facebook, Instagram, Messenger, Threads Down

You are not alone, Facebook, Instagram, Messenger and Threads are down worldwide.

Users of Meta Platforms’ services, including Facebook, Instagram, Messenger, and Threads, are currently experiencing difficulties accessing their accounts. Reports indicate a widespread outage impacting individuals globally.

Starting around 4:30 PM GMT, a surge in user reports on Downdetector, a platform tracking online outages, signaled login issues across all four platforms. Users attempting to log in have encountered error messages, with some being logged out unexpectedly. The problem appears to be affecting users on both desktop and mobile applications.

Instagram error (screenshot: Hackread.com)

Meta Platforms has yet to acknowledge the outage on its official communication channels officially, but it’s expected that the company is actively investigating the cause of the issue.

The full extent of the outage remains unclear, but it’s evident that it’s not limited to just Facebook. Downdetector is currently swamped with user reports for all four affected platforms, suggesting a significant disruption to Meta’s services.

Here’s what we know so far:

*   **The outage began around 4:30 PM GMT.**
*   **Both desktop and mobile platforms seem to be affected.**
*   **Meta Platforms has not yet officially acknowledged the issue.**
*   **Users across the globe are facing problems accessing Facebook, Instagram, Messenger, and Threads.**

This is a developing story, and we will update this article as more information becomes available. We advise users to monitor Meta’s official channels for further updates and avoid attempting repeated logins to prevent potential account security issues.

1.  Video Chat Website Omegle Permanently Shuts Down
2.  ChatGPT Down? Anonymous Sudan Claims Responsibility
3.  ChatGPT Down? OpenAI Blames Outages on DDoS Attacks

Meta Platforms Face Outage: Facebook, Instagram, Messenger, Threads Down

By Waqas
Researchers have created computer worms with self-propagation capabilities that target GenAI applications.
This is a post from HackRead.com Read the original post: Researchers Test Zero-click Worms that Exploit Generative AI Apps

A new study dubbed ComPromptMized, warns of zero-click worms exploiting generative AI, spreading through systems sans user interaction, and posing data theft risks. Experts stress urgent AI security measures.

Researchers have recently unveiled findings indicating the creation of a computer worm capable of targeting generative AI-powered applications. This revelation comes amidst growing concerns over the **security of artificial intelligence systems**.

In a collaborative effort led by Stav Cohen from Technion – Israel Institute of Technology, Ron Bitton from Intuit, and Ben Nassi from Cornell Tech, the team developed and tested this novel worm against popular AI models, including Gemini Pro (previously **Bard AI**), **ChatGPT**, and LLaVA.

While the study highlights the potential malicious applications of such technology, it also echoes a warning **issued last year** by Europol regarding prompt engineering and jailbreaking of AI chatbots.

The research suggests that attackers could exploit this worm to manipulate AI models into replicating malicious inputs and engaging in harmful activities. One alarming demonstration involved the worm **attacking generative AI** email assistants, effectively stealing email data and distributing spam.

The mechanism behind the worm’s operation is intriguing yet concerning. By introducing specific text into an email, attackers could “poison” the databases of certain email application clients. This manipulation could then prompt models like ChatGPT and Gemini to replicate the malicious input and extract sensitive user data from the context.

In their **study** dubbed ComPromptMized, the researchers explored various scenarios, including both black-box and white-box accesses, and tested the worm’s effectiveness against different types of input data, such as text and images. The findings underscore the potential threats posed by such attacks on the burgeoning **GenAI ecosystems**.

The implications of this research extend beyond theoretical concerns. As more companies integrate generative AI capabilities into their applications, the risk of exploitation becomes increasingly tangible. The ability of malicious actors to leverage AI technology for nefarious purposes underscores the urgent need for robust security measures in AI development and deployment.

**Beth Linker**, Senior Director of AI & SAST at the Synopsys Software Integrity Group, emphasized the significance of this research, stating, “This attack highlights the vulnerability of GenAI-powered proactive agents as a potential target for exploitation. With the proliferation of new AI-driven tools promising to streamline our digital interactions, it is crucial for organizations to carefully consider the permissions granted to these tools and implement robust safety measures.”

While the research provides valuable insights into the vulnerabilities of generative AI systems, it also serves as a call to action for stakeholders across various industries. As we continue to embrace the benefits of AI innovation, it is imperative to remain alert against emerging threats and prioritize the development of strong security protocols.

1.  OpenAI’s ChatGPT Can Create Polymorphic Malware
2.  Malicious Abrax666 AI Chatbot Exposed as Potential Scam
3.  Malicious Ads Infiltrate Bing AI Chatbot in Malvertising Attack
4.  Following WormGPT, FraudGPT Emerges for AI-Driven Cyber Crime
5.  Researcher create polymorphic Blackmamba malware with ChatGPT

Researchers Test Zero-click Worms that Exploit Generative AI Apps

By Deeba Ahmed
The CHAVECLOAK banking Trojan employs PDFs, ZIP downloads, DLL sideloading, and deceptive pop-ups to target Brazil's unsuspecting banking users financial sector. 
This is a post from HackRead.com Read the original post: New CHAVECLOAK Banking Trojan Targets Brazilians via Malicious PDFs

Watch out for the new CHAVECLOAK banking Trojan as it spreads its infection through SMS phishing (SMishing), phishing emails, and compromised websites.

Cybersecurity researchers at FortiGuard Labs have discovered a high-severity Trojan, dubbed CHAVECLOAK, targeting Brazilian banking users. The malware targets Windows devices and accesses online banking platforms, stealing their banking credentials and financial information.

The CHAVECLOAK infection method is under investigation, but researchers suspect potential distribution channels include phishing emails, SMS phishing, and compromised websites.

According to the company’s blog post, the campaign involves malicious emails disguised as legitimate bank communications that could trick users into downloading malware. It then targets unsuspecting users utilising Portuguese language settings, DLL sideloading, and deceptive pop-ups. It actively monitors victims’ interactions with financial portals.

It is worth motioning that DLL sideloading poses a huge security risk because it allows the malware to exploit legitimate processes without raising suspicion or getting detected. 

The malware controls victims’ devices and collects sensitive financial information through a malicious PDF file, claiming to contain contract documents with Portuguese instructions. However, it has a malicious downloader link, which is processed via Goo.su and redirects to a ZIP file, resulting in the MSI file “NotafiscalGFGJKHKHGUURTURTF345.msi.”

When decompressed, the MSI installer revealed multiple TXT files, a legitimate execution file, and a malicious DLL named “Lightshot.dll.” The DLL file’s modified date is more recent than the other files. The installer executes the file “Lightshot.exe” and uses DLL sideloading techniques to execute the malicious DLL. This lets the legitimate executable run the malicious code discreetly, enabling unauthorized activities like data theft. 

Additionally, the malware uses the “GetVolumeInformationW” process to gather file system and volume information, generates a log file, and executes the “Lightshot.exe” program upon user login. It sends HTTP requests, logs data, and monitors the foreground window using the APIs “GetForegroundWindow” and “GetWindowTextW.”

The malware then communicates with its C2 server, facilitating actions to steal a victim’s credentials, blocking their screen, logging keystrokes, and displaying deceptive pop-up windows.

Further, it actively monitors access to financial portals, including Mercado Bitcoin, the largest digital currency exchange in Brazil and Latin America, which combines conventional and cryptocurrency platforms and traditional banks.

The emails with a Docu file containing a malicious PDF file (left) – Alert in Portuguese language stating “Verifying that your computer is secure to access your account.” (right) – Screenshots: FortiGuard Labs

The stolen information is uploaded to different paths. The malware configures account information and sends a POST request. The malware actively monitors victims’ interactions with financial portals, highlighting the sophistication of contemporary banking trojans.

To protect yourself from CHAVECLOAK and similar banking trojans, be cautious with emails and SMS, verify website legitimacy, enable two-factor authentication (2FA), use strong passwords, and regularly update your operating system, web browser, and security software to address known vulnerabilities. Avoid clicking on suspicious links or attachments, and double-check website URLs for typos or minor variations.

1.  TA544 threat actors hit Italian firms with Ursnif banking trojan
2.  New MaliBot Android Malware Found Stealing Personal, Banking Data
3.  European Banking Authority victim in Microsoft Exchange Server hack
4.  Android Banking Malware FjordPhantom Steals Funds Via Virtualization
5.  SpyNote Spyware Returns with SMS Phishing Against Banking Customers

New CHAVECLOAK Banking Trojan Targets Brazilians via Malicious PDFs

By Waqas
Another day, another third-party data breach!
This is a post from HackRead.com Read the original post: American Express Cardholders Impacted by Third-Party Vendor Data Breach

American Express cardholders are advised to be vigilant after a data breach at a third-party vendor potentially exposed some card information. While American Express systems remain secure, the breach may have compromised card numbers, names, expiration dates, and other details.

American Express notified card members today of a data breach impacting some customer information, emphasizing that its systems were not compromised. The breach originated from a third-party service provider used by numerous merchants, potentially exposing customer details including card numbers, names, and expiration dates.

****What Happened:****

American Express discovered unauthorized access to a system utilized by a third-party service provider engaged by various merchants. This incident may have compromised the account information of some American Express card members.

American Express has filed a data breach notification with the state of Massachusetts regarding potential impacts on cardholder information, which may include current or previously issued American Express card numbers, cardholder names, and card information such as expiration dates.

> _“At this time, we have been informed that your current or previously issued American Express Card account number, your name and other Card information such as the expiration date, may have been compromised. Please be aware that you may receive additional letters from us if more than one of your American Express Card accounts were involved.”_
> 
> American Express

In response to this situation, American Express has taken several measures to address the issue. The company has affirmed the security of its own systems and is actively monitoring accounts for any signs of fraudulent activity.

Additionally, cardholders are reassured that they are not liable for unauthorized charges. American Express has provided resources and information on fraud protection through its Security Center website.

For insights into this, we reached out to Piyush Pandey, CEO at Pathlock who stated, “Over the last few years, we’ve seen a significant uptick in third-party data breaches. In this example, there are multiple parties, or what we call “nth party” risk. This places a much greater emphasis on organizations to vet their third parties during onboarding to minimize access risk.”

Piyush also cautioned businesses about the importance of scrutinizing third parties before entering into business partnerships with them. “Organizations must also ensure that the third-party partners of the third parties they are doing business with are assessed for access risk. It should become part of standard third-party contracts to specify breach response responsibilities,” he explained. “Masking data to provide only what is needed by third parties to provide services must be a best practice.”

Nevertheless, American Express card members are advised to review their account statements for any suspicious activity, especially over the next 12-24 months. They are also encouraged to enable account notifications via the American Express Mobile app or through email/text messaging for added security.

Furthermore, updating contact information with American Express is recommended to ensure smooth communication if necessary.

****Rising Incidents of Third-Party Data Breaches****

The beginning of 2024 has witnessed a noticeable uptick in data breaches affecting diverse sectors, including corporate entities and governmental organizations. On February 23 2024, a threat actor using the alias IntelBroker leaked 2.4 million data belonging to private plane owners linked to the Los Angeles International Airport.

In August 2023, an IT contractor employed by the Metropolitan Police Force experienced a cyberattack that impacted over 50,000 MET police personnel.

In September 2023, a third-party contractor experienced a data breach that affected over 8,000 Greater Manchester Police Officers. In October 2023, another contractor inadvertently exposed their database, resulting in the leakage of sensitive details about 500,000 Irish Police vehicle seizure records.

1.  **23andMe blames its users for the massive data breach**
2.  **AnyDesk Urges Password Change Amid Security Breach**
3.  **Defunct Ambulance Service Data Breach Impacts 1 Million**
4.  **Cloudflare Hacked After State Actor Leverages Okta Breach**
5.  **RingGo Owner EasyPark Hit by Data Breach, User Data Stolen**
6.  **LockBit Ransomware Claims Data Breach at SpaceX Contractor**
7.  **CutOut.Pro AI Tool Data Breach: Hacker Leak 20 Million User Info**

American Express Cardholders Impacted by Third-Party Vendor Data Breach

By Deeba Ahmed
Leaked Military Audio Raises Stakes in Russia-Ukraine Conflict.
This is a post from HackRead.com Read the original post: Russian Operatives Expose German Military Webex Conversations

In the recording, four senior Bundeswehr (German Armed Forces) officers are discussing the hypothetical export of Taurus cruise missiles to Ukraine, and how to attack Russian infrastructure through them.

Russian spies leaked a 38-minute audio file of German military officials discussing Taurus cruise missile deliveries to Ukraine, raising questions about the military’s information security practices, as reported by Russian state broadcaster RT.

The German Defence Ministry has accused Russia of launching an “information war” following the publication of the recording of a meeting of senior German military officials, calling the incident an act of eavesdropping and a “hybrid disinformation attack” by Russia-backed spies.

Reportedly, the spies could record the conversation by joining a Webex conference. The conversation reveals plans for the shipment of advanced weaponry to pro-Russian separatists in eastern Ukraine and a possible military strike on Crimea, a Ukrainian peninsula currently under Russian control. 

It is worth noting that Kyiv wants Germany’s Taurus missiles, long-range missiles from France and Britain, and Ukrainian soldier training amid the ongoing war in Ukraine since the country is facing soldiers and ammunition shortages. The transcript of the conversation, which took place on 19 February, was published by RT on 1st March. 

In the recording, four senior Bundeswehr (German Armed Forces) officers are discussing the hypothetical export of Taurus cruise missiles to Ukraine, and how to attack Russian infrastructure through them.

German Chancellor Olaf Scholz refuses to send such long-range cruise missiles, causing splintering within the country’s governing coalition. The recording, shared on social media, revealed that the German Air Force’s chief, Lieutenant General Ingo Gerhartz **expressed** concern about direct connections with the Ukrainian armed forces. 

Russian officials also discussed potential targets for Taurus missiles donated to Ukraine, the training time for local personnel, and the possibility of using the missiles to destroy the Kerch bridge linking Crimea to Russia.

They also discussed preparations for a meeting with MP Boris Pistorius to send around 10-20 Taurus missiles from Germany’s 600-strong stockpile to counter Russia’s air defences and destroy the Kerch connection. They also discussed transporting data for Taurus programming from German airbases into Ukraine.

As per DW, the Defence Ministry has confirmed the recording’s authenticity and German Chancellor Olaf Scholz referred to it as a “very serious matter.” German Social Democrats MP Pistorius criticized the leaked audio, stating it was suspiciously published just before opposition leader Alexei Navalny’s funeral. 

Germany’s Military Counterintelligence Service is investigating the leaked audio, which comes just days after Scholz inferred that British and French staff are helping calibrate missile targets for Ukrainians.

1.  Microsoft Executives’ Emails Breached by Russia Hackers
2.  Russian Hackers Hit Mail Servers in Europe for Military Intel
3.  Russian APT29 Hacked US Biomedical Giant in TeamCity Breach
4.  Russian Hackers Target Ubiquiti Routers for Data, Botnet Creation
5.  Microsoft Outlook Flaw Exploited by Russian Forest Blizzard Group

Russian Operatives Expose German Military Webex Conversations

By Deeba Ahmed
It is unclear how much the hacker received as part of the Facebook bug bounty program.
This is a post from HackRead.com Read the original post: Nepali Hacker Tops Hall of Fame by Exposing Facebook’s Zero-Click Flaw

Samip Aryal, a cybersecurity researcher and an ethical hacker from Nepal, bypassed the system’s rate-limiting feature and subsequently checked possible combinations of 6-digit numbers (from 000000 to 999999) for two hours.

Samip Aryal, a Nepali bug bounty hunter, discovered a zero-click flaw in Facebook’s password reset system, potentially allowing hackers to compromise any targeted account. This exploit earned Aryal his highest bug bounty, making him top the Facebook Hall of Fame for White-Hat Hackers 2024 ranking, though the exact bounty amount remains unknown.\]

Samip Aryal tops Facebook Hall of Fame list

Aryal discovered a way to abuse Facebook’s password reset functionality without rate-limiting. The bug allowed attackers to hijack user accounts through “zero-click” attacks (without user interaction) by requesting a password reset and brute force the 6-digit security codes. 

The vulnerability was discovered in Facebook’s password reset functionality. It allowed hackers to bypass the system’s rate-limiting feature and subsequently check possible combinations of 6-digit numbers (from 000000 to 999999) for two hours.

In his blog, Aryal revealed finding a vulnerable endpoint on Android Studio while testing Facebook versions. He received a pop-up in the password reset flow offering users to send a security code through Facebook notification. The code remained active for two hours despite incorrect inputs.

“I didn’t see any sort of code invalidation after entering the correct code but with multiple previous invalid tries (unlike in the SMS reset functionality),” Aryal explained.

He used a brute-force attack methodology to cover the entire search space in an hour, revealing that some users had the nonce code displayed on the notification, a zero-click exploit. The code was displayed on another screen with a single click.

For your information, a cryptographic nonce is an arbitrary number that can only be used once in a cryptographic communication. He further noted that hackers could hijack Facebook user accounts by choosing any account, going to its password reset flow, selecting “Send code via Facebook notification,” trying any code to receive a server response, and brute forcing it in two hours. Facebook application users would receive notifications with a six-digit code or prompting them to tap to see the login code.

PoC GIF

Aryal responsibly disclosed the flaw to Facebook on January 30, 2024, and the issue was fixed on February 2. 

The vulnerability could lead to personal information theft, disinformation spread, and network attacks. Being aware of emerging security threats on Meta and other social networking platforms is also crucial to keep your accounts protected.

It is worth mentioning that Meta accounts have particularly been the target of scams lately. In March 2023, researchers at Guardio discovered an info-stealing campaign involving fake ChatGPT extensions claiming to integrate with Google search results but in reality attempting to steal Facebook accounts. 

WithSecure cybersecurity firm identified a connection between recent DarkGate malware attacks and Vietnam-based threat actors attempting to hijack Meta business accounts and steal sensitive data in October 2023.

To stay safe, users should enable two-factor authentication, use strong, unique passwords, be cautious with password reset requests, and stay updated on security threats. 

1.  **6 of the Best Crypto Bug Bounty Programs**
2.  **10 Famous Bug Bounty Hunters of All Time**
3.  **Bug bounty: Hack Tesla Model 3 to win your own Model 3**
4.  **OpenAI’s ChatGPT Bug Bounty Program – Earn $200 to $20k**
5.  **Bug Bounty: Earn $40K for hacking Facebook, Instagram, WhatsApp**

Nepali Hacker Tops Hall of Fame by Exposing Facebook’s Zero-Click Flaw

By Waqas
Bifrost RAT, also known as Bifrose, was originally identified two decades ago in 2004.
This is a post from HackRead.com Read the original post: New Bifrost RAT Variant Targets Linux Devices, Mimics VMware Domain

The latest version of Bifrost RAT employs sophisticated techniques including typosquatting, to avoid detection and complicate efforts to trace its origins.

Cybersecurity experts at Palo Alto Networks’ Unit 42 have uncovered a new cybersecurity threat: a new variant of the Bifrost RAT (also known as Bifrose) targeting Linux systems. This variant, utilizing a tricky domain named download.vmfare(.)com, is designed to evade detection and compromise targeted systems.

The malicious domain bears a not-so-easy-to-distinguish resemblance to a legitimate VMware domain, with the only difference being the substitution of the letter “F” for the “W” in the domain: VM**w**are becomes VM**f**are. For your information, VMware is a leading provider of virtualization and cloud computing software and services.

This type of attack is called a **typosquatting attack** in which malicious actors register domain names similar to popular ones, relying on users making typing errors to visit their sites, often for phishing or malware distribution purposes. For example, “**It’s Google.com, not ɢoogle.com**.”

VirusTotal score for the malicious domain (screenshot: Palo Alto Networks’ Unit 42)

Bifrost, a remote access Trojan (RAT) dating back to 2004, is notorious for its ability to hide within systems, inject malicious code into legitimate processes, and establish covert communication channels with external servers. This allows attackers to steal sensitive data with ease.

The latest version of Bifrost, as detailed by researchers in their technical **blog post**, employs sophisticated techniques to avoid detection and complicate efforts to trace its origins. By encrypting collected data using RC4 encryption, and the aforementioned domain with a deceptive name, the malware makes it challenging for security experts to thwart its activities.

Additionally, the malware’s recent deployment on a server hosting an ARM version hints at an expansion of its targets.

Analysis of the malware’s code reveals intricate manoeuvres to establish connections and gather data, showcasing its advanced capabilities in evading detection. Palo Alto Networks detected over 100 instances of Bifrost activity in recent months, signalling a critical need for enhanced security measures.

To safeguard against Bifrost attacks, Unit 42 researchers recommend a multi-faceted approach including regular system updates, strong access controls, deployment of endpoint security solutions, and vigilant monitoring of network activity.

1.  New Linux Malware “Migo” Exploits Redis for Cryptojacking
2.  Free Download Manager Site Pushed Linux Password Stealer
3.  Malicious Ads Infiltrate Bing AI Chatbot in Malvertising Attack
4.  Hamas Hackers Hit Israelis with New BiBi-Linux Wiper Malware
5.  Mirai-based NoaBot Botnet Hits Linux Systems with Cryptominer

New Bifrost RAT Variant Targets Linux Devices, Mimics VMware Domain

By Deeba Ahmed
Russia Tightens Grip on Internet Freedom: VPN Ban Sparks Concerns.
This is a post from HackRead.com Read the original post: Russia Clamps Down on VPNs, Furthering Restrictions on Internet Access

The ban is likely due to people using VPN technology to access banned content and bypass government surveillance measures.

Russian media regulator Roskomnadzor plans to ban VPN services in Russia and Ukraine, potentially affecting free speech and information access, according to a new report by vpnMentor.

The report, authored by Jeremiah Fowler, a cybersecurity researcher known for identifying misconfigured databases on the Internet, sheds light on Russia’s recent efforts to further restrict internet freedom within its borders. It highlights the country’s new ban on popular VPN (Virtual Private Network) services, a move experts believe will significantly undermine online privacy and increase online censorship in the country. The ban will come into effect on 1st March 2024. 

It is worth noting that restricting VPNs may limit Russian citizens’ access to the outside world and form broader perspectives. In 2022, 23% of the Russian population used VPN services, up from 9% in 2021.

This surge is linked to Russia’s invasion of Ukraine and the blockage of 138,000 websites. Russia’s Freedom on the Net ranking of 21 out of 100 in 2023 indicates a preference for anonymity and privacy, prompting the government to ban VPNs.

This ban will not just affect internet users but also those fighting for freedom of expression, limiting access to independent news sources and anonymity, and increasing risk to activists, dissidents, and whistleblowers who rely on VPNs for secure communication. That’s because VPNs act as secure tunnels, encrypting internet connections to protect online privacy. They are used for data protection, accessing geo-restricted content, and private internet browsing without tracking.

According to vpnMentor’s blog post, Russian authorities have even banned advertisements and websites offering methods to bypass blocked resources in Russia and Ukraine. Russian authorities have pressured social media companies to restrict content, establish local businesses, store data locally, and allow security services unrestricted access to user data. Western companies have refused to comply, even if it means leaving the Russian market.

This move is part of a larger campaign from Russia to regulate and curb internet access, isolate internet users, and increase surveillance. In 2018, Russia requested Telegram to provide encryption keys for government access to users’ messages, audio, and pictures.

Last year Russian government banned various Western messaging apps, including Snapchat, WhatsApp, Discord, Skype for Business, Microsoft Teams, and Telegram, as well as European encrypted apps Viber and Threema, and Chinese communication app WeChat.

1.  Mullvad VPN’s Office Raided By Police for User Data
2.  Russia Bans WhatsApp, Discord, Telegram, and Others
3.  Top 10 worst countries for Internet freedom, censorship
4.  Researchers develop AI tool to evade Internet censorship
5.  Russia blocks 50 VPNs, Anonymizers in Telegram crackdown
6.  Geneva tool lets you bypass censorship by merely doing nothing
7.  ExpressVPN Removes Servers in India Against Data Collection Law

Source

HackRead