Atlanta, Georgia, 30th October 2024, CyberNewsWire

**Atlanta, Georgia, October 30th, 2024, CyberNewsWire**

White House National Cyber Director, CEOs, Key Financial Services Companies, Congressional and Executive Branch Experts will discuss industry priorities for 2025 and beyond  

The American Transaction Processors Coalition (ATPC) Cyber Council will convene “The Tie that Binds: A 21st Century Cybersecurity Dialogue,” on October 31, 2024, at the Bank of America Financial Center Tower’s Convention Hall in Atlanta. This event will feature leading cyber experts from the financial services sector, Federal agencies, the White House, and Congress to focus on pressing cybersecurity issues and ways the financial services sector is addressing these issues. It will include discussions on evolving technologies that will influence the path forward, the role of AI, supply chain security needs, and more. 

> “Cybersecurity is the backbone of the payment processing industry,” said H. West Richards, ATPC executive director. “The work of the ATPC Cyber Council is a testament to our commitment to safeguarding our financial ecosystem and fostering a collaborative approach to tackling the cybersecurity challenges of tomorrow.” 

**Key Speakers and Highlights:** 

*   The Honorable Harry Coker, Jr., White House National Cyber Director, will deliver the luncheon keynote. 
*   The Honorable Rich McCormick (R-GA-06) will deliver a keynote address. 
*   Moira Bergin, Subcommittee on Cybersecurity Staff Director, House Committee on Homeland Security, will discuss legislative priorities and global cybersecurity risks. 
*   The Honorable Andre Dickens, Mayor of Atlanta, will provide a video address. 
*   Barry McCarthy, CEO of Deluxe and Chair of the ATPC Board of Directors, will also deliver a keynote. 
*   Bridgette Walsh, Executive Director of the Financial Services Sector Coordinating Council, and Josh Magri, Founder & CEO of Cyber Risk Institute, will participate in a fireside discussion on private sector best practices. 
*   A panel on AI in financial services will feature Clarissa Banks (Deluxe), David Excell (Featurespace), David King (Mastercard), and Donna Teevens (ACI Worldwide), moderated by Rick Van Luvender. 
*   A panel on cyber education will include Dr. Tony Coulson (CSUSB), Dr. Albena Asenova-Belal (Gwinnett Technical College), Dr. Humayun Zafar (Kennesaw State University), and Dr. Michael Nowatkowski (Augusta University). 
*   H. West Richards, ATPC Executive Director, will open the event with a welcome address. 
*   Rick Van Luvender, ATPC Cyber Council Chair & SVP, Head of Cybersecurity Client Trust & International Cybersecurity Service at Fiserv, will deliver the opening remarks. 
*   Norma Krayem, ATPC Cyber Council Director & Vice President, Chair of the Cybersecurity, Privacy & Digital Innovation Practice Group at Van Scoyoc Associates, will provide insights on future cybersecurity trends.

The forum will conclude with a fireside chat focused on “A Look to the Future: 2025: Top Cybersecurity and Critical Technology Priorities for the ATPC Cyber Council,” featuring Rick Van Luvender from Fiserv and Norma Krayem, the ATPC Cyber Council director, focusing on future cybersecurity and critical technology priorities. 

Conference details are available at https://atpcoalition.com/atpc-cyber-forum/.  

ATPC is a leading voice for America’s payments processors, consisting of the world’s largest, global payment processors, banks, credit card companies and financial services companies. ATPC member companies are uniquely positioned to ensure global payments move seamlessly across the world, while empowering broader and more diverse participation within the financial services system. In the race for a better tomorrow, technology solutions can advance faster than companies can keep up with cybersecurity risks. As a result, the ATPC is one of the few coalitions that created a standalone Cybersecurity Council to prioritize these key cybersecurity issues across its member companies. The ATPC Cyber Council is a unique group made up of only CISOs, CSOs, CIOs and CTOs who are on the front lines every day dealing with the operational impacts of cybersecurity. These U.S. based companies serve hundreds of millions of customer businesses across the globe daily and process hundreds of billions of transactions per year.  

**About the ATPC** 

The ATPC is a leading voice for America’s payments processors, driving awareness of the industry and its value to consumers, businesses, and the economy with legislators and regulators at federal, state, and international levels. The ATPC is rooted in Georgia’s Transaction Alley where electronic payments and the fintech industry began. Yet, our members enable payments in states across the nation and in every corner of the globe. The ATPC has a rich history of economic development, thought leadership, and engagement on legislative and regulatory topics like cybersecurity, privacy, financial inclusion, fraud, as well as emerging themes like open banking, AI, and stable coins. 

**About the ATPC Cyber Council** 

The American Transaction Processors Coalition (ATPC) established a dedicated Cyber Council to galvanize the efforts of the ATPC member companies in addressing cybersecurity risks. The Cyber Council’s mission is to identify best practices and areas of shared risk to help ATPC members address the evolving cyber threat across America’s payments processing system to strengthen industry’s ability to identify, protect, detect, respond to and recover from cyberattacks. 

**Contact**

**Alison Watson**  
**Golin**  
**\[email protected\]**

ATPC Cyber Forum to Focus on Next Generation Cybersecurity and Artificial Intelligence Issues

A new, more sophisticated variant of the FakeCall malware is targeting Android devices. Learn about the advanced features…

A new, more sophisticated variant of the FakeCall malware is targeting Android devices. Learn about the advanced features that make this malware a serious threat, including screen capturing and remote-control capabilities.

Cybersecurity researchers at Zimperium’s zLabs have identified a “Scary” new variant of the **FakeCall malware**. This malware tricks victims into calling fraudulent phone numbers, leading to identity theft and financial loss. FakeCall is a vishing (**voice phishing**) malware which, once installed, can take almost complete control of a targeted Android phone. 

The latest variant exhibits several new functionalities including the ability to identify, compress, and upload image thumbnails, selectively upload specific images, remotely control the screen, simulate user actions, capture and transmit live video feeds, and remotely unlock the device. These features can capture sensitive documents or personal photos. 

The FakeCall malware typically infiltrates a device through a malicious app downloaded from a compromised website or a phishing email. The app requests permission to become the default call handler. If granted, the malware gains extensive privileges. 

Attack flow (Zimperium)

According to Zimperium’s **blog post** shared with Hackread.com ahead of publishing on Wednesday, attackers are using a service called “The Phone Listener Service” in their attack. In fact, this service is a critical component of the malware, enabling it to manipulate the device’s calling capabilities allowing it to intercept and control all incoming and outgoing and grab sensitive information, such as one-time passwords (**OTP**) or account verification codes.

In addition, the malware can manipulate the device’s display to show fake call interfaces, tricking victims into providing sensitive information. Additionally, it can manipulate call logs to hide its malicious activity and control the duration of calls. These capabilities allow attackers to deceive victims into revealing sensitive information or transferring funds.

Screenshot of the actual fake call interface (Zimperium)

The malware also exploits the **Android Acces**sibility Service to capture screen content and manipulate the device’s display to create a deceptive user interface while mimicking the legitimate phone app. This trick allows attackers to steal sensitive information, conduct surveillance, and even remotely control the device. 

It monitors events from the stock dialer app and detects permission prompts from the system permission manager and system UI. Upon detecting specific events, it can grant permissions for the malware, bypassing user consent. The malware allows remote attackers to control the victim’s device UI, allowing them to simulate user interactions and manipulate the device with precision.

To protect against such malware, always download apps from trusted sources like Google Play Store, be cautious about permission requests, and use mobile security software with on-device detection capabilities.

1.  **Unicode QR Code Phishing Scam Bypasses Traditional Security**
2.  **Malware Attack Imitates VPN, Security Apps on Android Phones**
3.  **Antidot Android Malware Poses as Google Update to Steal Funds**
4.  **QR Code Scam: Fake Voicemails Hits Users, 1000 Attacks in 14 Days**
5.  **Advanced Vishing Attack Campaign “LetsCall” Targets Android Users**

New “Scary” FakeCall Malware Captures Photos and OTPs on Android

An international law enforcement operation, led by the United States, Europol, and the Netherlands, has successfully dismantled the…

An international law enforcement operation, led by the United States, Europol, and the Netherlands, has successfully dismantled the infrastructure behind the notorious RedLine and META infostealer malware. Discover how these cyberattacks steal sensitive information and the impact they have on individuals and businesses worldwide.

An international law enforcement operation has successfully dismantled the infrastructure behind two notorious infostealer malware strains: RedLine and Meta. The operation, codenamed “Operation Magnus,” was led by the Dutch National Police, the U.S. Department of Justice (DOJ) and supported by Europol.

The investigation involved law enforcement agencies from across the globe, including Belgium (Belgian Federal Police, Belgian Federal Prosecutor’s Office), Australia (the Australian Federal Police), Portugal (Polícia Judiciária), and the United Kingdom (National Crime Agency).

Other US agencies involved in this operation include the FBI, Naval Criminal Investigative Service, IRS Criminal Investigation, Defense Criminal Investigative Service, and Army Criminal Investigation Division. These agencies collaborated under a Joint Cybercrime Action Taskforce (“JCAT”) Operation Magnus. 

Watch the video released by authorities

This operation resulted in full access (PDF) to the servers hosting the malware’s infrastructure, including source code, license servers, user data, and seizing domains and Telegram accounts. Authorities have created a dedicated website to provide resources for victims and the public

For your information, Infostealers are a type of malware designed to steal sensitive information from victims’ devices, such as login credentials, passwords, and credit card details. These stolen credentials are often sold on underground markets, enabling further cyberattacks and fraudulent activities.

Screenshot from RedLine’s infrastructure

RedLine and META are designed to infiltrate victim computers and steal sensitive information. This stolen data, often referred to as “logs,” can include usernames, passwords, financial information, and even cryptocurrency wallet details. Criminals use these stolen credentials for a variety of nefarious purposes, including launching further attacks, committing fraud, or bypassing multi-factor authentication (MFA). 

Investigations revealed RedLine and META may have infected millions of computers worldwide. Estimates suggest RedLine alone might be one of the most prevalent malware variants globally. Law enforcement has identified millions of unique credentials stolen by the malware, including usernames, passwords, and financial data.

As part of Operation Magnus, authorities unsealed a criminal complaint (PDF) against Maxim Rudometov, believed to be a developer and administrator of RedLine. The complaint accuses Rudometov of managing RedLine’s infrastructure, receiving payments through cryptocurrency accounts, and possessing the malware itself. He faces charges including access device fraud, conspiracy to commit computer intrusion, and money laundering, and if convicted, he could face a maximum sentence of 10 years in prison.

Maxim Rudometov, the alleged developer and administrator of RedLine.

Operation Magnus serves as a powerful example of international cooperation in combating cybercrime. By dismantling the RedLine and META infrastructure, law enforcement has significantly disrupted the activities of cybercriminals who rely on stolen data for their illicit operations. However, the ever-evolving nature of cybercrime necessitates continued vigilance and cooperation between law enforcement and cybersecurity experts.

1.  **VirusTotal Reveals Apps Most Exploited To Spread Malware**
2.  **Konni RAT Exploiting Word Docs to Steal Data from Windows**
3.  **FBI Dismantles Chinese-Linked Botnet of 260,000 IoT Devices**
4.  **Police Dismantle Phishing-as-a-Service Platform BulletProftLink**
5.  **Arid Viper’s AridSpy Trojan Hits Android Users in Palestine, Egypt**

Operation Magnus: Police Dismantles RedLine and META Infostealer Infrastructure

Russian hackers launched a targeted malware campaign via Telegram, aimed at Ukrainian military recruits. Disguised as recruitment tools,…

Russian hackers launched a targeted malware campaign via Telegram, aimed at Ukrainian military recruits. Disguised as recruitment tools, the malware steals data and spreads disinformation, weakening Ukraine’s defence efforts.

A new report by Google’s Threat Intelligence Group (TAG) exposes a cyber campaign targeting Ukrainian men eligible for military service. The campaign, linked to Russian state-sponsored hackers, orchestrated by the UNC5812 group, utilizes a combination of malware and disinformation.

It is worth noting that at the beginning of October 2024, reports indicated that Russian cyber operations against Ukraine during the first half of the year shifted from broad-spectrum attacks to a more targeted approach, specifically focusing on Ukraine’s military and defence sectors.

For the latest campaign, the immediate objective is to compromise the devices of potential Ukrainian military recruits. Hackers are distributing malicious software to help Ukrainian military recruits locate recruitment centers. These programs are laced with malware that can steal sensitive information like browser data, keystrokes, and cryptocurrency wallet details. 

To achieve this, the attackers have established a deceptive online presence through a Telegram channel and website known as “Civil Defense.” Reportedly, the website was registered in April 2024, but the Telegram channel was created in September

These platforms entice users with promises of helpful information and tools related to military conscription. However, once victims download and install the offered software, they unwittingly expose their devices to various malware strains.

For Windows users, this typically involves the Pronsis Loader, which subsequently delivers the information-stealing PURESTEALER. Android users, on the other hand, are targeted with the CRAXSRAT backdoor, a versatile tool capable of data theft, surveillance, and remote control. 

To bypass security measures, the attackers have employed social engineering techniques, instructing victims to disable Google Play Protect and manually grant permissions to the malicious apps. The campaign also involves a concerted effort to spread disinformation and undermine public morale in Ukraine. 

The “Civil Defense” platform disseminates anti-mobilization narratives, promotes false information about the war, and encourages users to share videos of alleged unfair practices at recruitment centers. The website has a dedicated news section rife with fabricated stories depicting purported injustices surrounding mobilization. The content is posted on pro-Russian social media channels. 

The UNC5812 campaign is part of a broader pattern of Russian cyberattacks aimed at destabilizing Ukraine. By targeting potential recruits, the attackers seek to erode public support for the military and hinder Ukraine’s ability to defend itself. 

Researchers suspect that UNC5812 is purchasing promoted posts in Ukrainian-language channels to target potential victims. A channel with over 80,000 subscribers promoting the “Civil Defense” Telegram channel-website was observed on September 18th. An additional Ukrainian-language news channel promoting the posts as recently as October 8th suggests the campaign is actively seeking new Ukrainian-language communities for targeted engagement.

Civil Defense promoted in Ukrainian-language missile alert and news communities and Download page, translated from Ukrainian (Via Google)

Google has identified and blocked malicious websites and domains by adding them to Safe Browsing, actively scanning devices for harmful apps, and collaborating with Ukrainian authorities to block the campaign’s website within the country. Google Play Protect also actively scans devices for harmful apps, including those installed outside the Play Store.

Nevertheless, Google’s report sheds light on Russia’s multifaceted approach to weakening Ukraine’s war effort through cyber means. By staying informed and utilizing security measures provided by platforms like Google, users can help mitigate the impact of such campaigns.

1.  Russia Responsible for Widespread Power Outage in Ukraine?
2.  Ukraine Blocks Russian Industroyer 2 Attack on Energy Provider
3.  Hackers Claim Data Breach at Russian Cybersecurity Firm Dr.Web
4.  Russian APT29 Using NSO Group-Style Exploits in Attacks, Google
5.  Russian Midnight Blizzard Breached UK Home Office via Microsoft

Russian Malware Attack Targets Ukrainian Military Recruits via Telegram

Custom generative AI solutions have the potential to transform industries, equipping businesses to reach their goals with exceptional…

Custom generative AI solutions have the potential to transform industries, equipping businesses to reach their goals with exceptional efficiency and innovation. By leveraging generative AI (GenAI), organizations can boost productivity, streamline decision-making, and enhance operational efficiency. Additionally, generative AI software development plays a crucial role in expanding training datasets for machine learning models, thereby improving their precision and dependability.

****Key Advantages of Implementing Generative AI****

In machine learning, augmenting training datasets with Generative Adversarial Networks (GANs) or other generative models is a common approach. This technique is particularly beneficial when the existing dataset is limited or lacks adequate diversity.

****Expanding Data Diversity****

Generative AI assists in expanding the diversity of training datasets by creating new examples absent in the original data. This augmentation strengthens machine learning models by reducing overfitting and increasing their ability to adapt to different scenarios. Incorporating generative AI into training data allows businesses to develop more adaptable and robust models.

****Improving Data Quality****

Generative AI enhances the quality of training data by generating examples that better reflect real-world scenarios. This boost in quality contributes to the precision and dependability of machine learning models. By integrating generative AI in data preparation, organizations ensure their models are trained on data that mirrors real-world conditions.

****Streamlining Data Annotation****

Data annotation in machine learning is often a labor-intensive process. Generative AI software development simplifies this process by automating annotation, thereby saving time and reducing the resources needed for data preparation. This acceleration allows for faster deployment of machine learning models.

****Reducing Data Collection Costs****

Gathering and preparing extensive training data can be costly. By using generative AI to enhance training datasets, organizations can reduce the time and resources required for data collection and preparation. This cost efficiency makes it feasible for businesses of all sizes to build and maintain machine learning models.

****Generative AI for Dataset Enhancement****

Generative AI serves as a powerful tool for expanding and refining training datasets, significantly improving the performance of machine learning models. By diversifying and enhancing the quality of training data, businesses can build more accurate models equipped to tackle real-world challenges. The typical steps involved in dataset augmentation using generative AI include:

****Data Augmentation with GANs****

*   Training the GAN: Start by training a GAN on the existing dataset. A GAN consists of a generator that creates new samples and a discriminator that evaluates whether samples are real or synthetic.
*   Data Creation: Use the trained generator to produce additional synthetic samples with characteristics similar to the original data.

****Best Practices****

*   Validation Set: Ensure augmented data is excluded from the validation set to maintain an unbiased model evaluation.
*   Class Balance: Maintain class balance in classification tasks to avoid overrepresentation of any single class.
*   Domain Expertise: Generate synthetic samples that realistically reflect the data’s domain characteristics.

****Implementation****

*   Integrating Generative Models: Embed the generative model into the data pipeline for seamless data generation during training.
*   Using Libraries: Utilize popular machine learning libraries like TensorFlow or PyTorch that offer built-in functions for GANs and data augmentation.

****Evaluation****

*   Assessing Impact: Evaluate the effect of data augmentation by comparing model performance with and without the additional data.
*   Monitoring Performance: Regularly monitor the model’s training to detect any negative impacts from the augmented data.

In summary, custom generative AI tools are giving businesses new ways to work with data and improve machine learning. By helping expand and refine datasets, generative AI makes models more adaptable, reliable, and less costly to develop.

These tools make it easier for organizations to build high-quality models faster, making machine learning more accessible for businesses of all sizes. As companies use generative AI to enhance their data, they’re setting themselves up to solve real-world challenges more effectively.

1.  Fields of application of artificial intelligence
2.  Using AI in Business Security and Decision Making
3.  How Artificial intelligence (AI) Stops Cybercriminals
4.  12 Best AI-powered Customer Communication Platforms
5.  How Artificial Intelligence is Impacting Modern Healthcare

Augmenting Training Datasets Using Generative AI

Find the best VPN for streaming with essential features like high-speed servers, strong encryption, streaming optimization, and broad…

Find the best VPN for streaming with essential features like high-speed servers, strong encryption, streaming optimization, and broad device compatibility. Enjoy seamless access to geo-restricted content securely.

Some geo-restricted content can only be unlocked and streamed using a Virtual Private Network (VPN). A VPN for streaming services allows you to watch content seamlessly while protecting your online identity.

With so many VPNs available, not all perform equally, making it challenging to find the best VPNs without interruptions. In this article, we’ll break down essential features to consider when selecting the top VPNs for streaming.

**Server Locations and Coverage**

An important feature in a streaming VPN is server locations and coverage, which determine the content you can access. Choose a VPN with a wide range of high-speed servers to prevent connectivity issues. A strong network spread across multiple countries will allow access to geo-restricted content. Look for VPN providers that frequently update servers, as this indicates a commitment to maintaining quality.

**Speed and Bandwidth**

To support HD streaming, ensure your VPN offers speeds of at least 100 Mbps, with no bandwidth limits or throttling. A VPN optimized for streaming should minimize buffering and reduce latency for smoother content loading.

****Encryption and Security****

When choosing a VPN for streaming, prioritize strong encryption and security. Look for AES-256 encryption or higher, and support for OpenVPN, IKEv2, and WireGuard protocols. The VPN should also include DNS leak protection to keep your IP address secure. If the VPN connection drops, an automatic internet disconnect feature ensures data remains private. These protections ensure that your data will not be exposed to third parties.

****Streaming Optimization****

Streaming optimization is key. The VPN should be optimized for high-speed, low-latency streaming, with custom protocols tailored to this purpose. Look for features that automatically select the best server for streaming, reducing buffering and enhancing speed.

****Device Compatibility****

Your VPN should support all the devices you plan to connect, including Windows, macOS, iOS, Android, and Linux. Look for compatibility with smart TVs (such as Samsung TV, Android TV, and Apple TV) and gaming consoles (PlayStation, Xbox, Nintendo Switch). It should also work with popular streaming platforms like Roku, Chromecast, and Amazon Fire TV. Browser extensions for Chrome, Firefox, and Safari add versatility, making it easier to stream across multiple devices.

****Simultaneous Connections****

Choose a VPN that supports at least five simultaneous connections. This feature lets you connect multiple devices without altering individual settings, which is convenient for families or business use. Check the VPN documentation for setup guides and confirm compatibility with less common devices like Linux and Chromebook. Additionally, look for split tunneling to configure specific device connections.

****Customer Support****

Reliable customer support is essential when using a VPN for streaming. Quick access to assistance for any issues or questions is critical. Look for providers that offer guides, FAQs, and tutorials for self-help, and a prompt email response time (ideally within 3 hours). Social media support is a plus. Effective customer support indicates a provider’s commitment to user satisfaction and technical support.

****Pricing and Payment Options****

Consider affordability and payment flexibility. Some VPNs offer discounts for long-term plans, free trials, money-back guarantees, and even cryptocurrency options. Make sure you’re getting value for your investment and review refund policies carefully. Look out for hidden fees or sudden price hikes, and ensure pricing transparency before subscribing.

****Logging Policy****

Opt for a VPN with a strict no-logs policy. It should avoid storing IP addresses, tracking online activities, or saving connection metadata. This policy helps ensure your privacy, reduces data breach risks, and underscores the VPN’s commitment to protecting client data.

****Compatibility with Popular Streaming Services****

Ensure the VPN is compatible with major streaming platforms you want to access, such as Netflix, Disney+, Hulu, Amazon Prime Video, HBO Max, and BBC iPlayer. Compatibility with these services ensures a smooth streaming experience and value for your subscription.

****Conclusion****

When selecting a VPN for streaming, consider these key features to make an informed choice. Look for speed, encryption, extensive server locations, streaming optimization, and privacy protections. Ensure the VPN provider doesn’t store user data and that its pricing, support, and device compatibility meet your expectations. Taking these steps will give you the best streaming experience while maintaining your online privacy.

1.  **Everything you need to know about VPN tracking**
2.  **Almost Every Major Free VPN Service is a Glorified Data Farm**
3.  **Surfshark VPN Data Breach Awareness with See-Through Toilet**
4.  **ASUS and NordVPN Partner to Integrate VPN Service into Routers**
5.  **Google Launches Verification Badges for Security Tested VPN Apps**

Top VPN Features to Consider When Choosing the Right Streaming Service

Apple unveils ‘Apple Intelligence’ for iPhone, iPad, and Mac devices while offering a $1 million bug bounty for…

Apple unveils ‘Apple Intelligence’ for iPhone, iPad, and Mac devices while offering a $1 million bug bounty for cybersecurity experts to find flaws in its Private Cloud Compute servers, enhancing privacy and AI security on iOS and macOS.

Apple today unveiled its highly anticipated AI-powered service, Apple Intelligence for iPhone, iPad, and Mac. This service, set to arrive with iOS 18.1, iPadOS 18.1, and macOS Sequoia 15.1, combines on-device processing with powerful cloud-based computing to handle complex AI tasks.

A preview of writing tools powered by Apple Intelligence

To ensure the security of these cloud-based systems, Apple has introduced a comprehensive bug bounty program. The tech giant is offering a reward of up to $1 million to security researchers who can successfully identify and exploit vulnerabilities in its “Private Cloud Compute” servers.

These servers, specifically designed for Apple Intelligence, are responsible for processing intensive AI tasks that cannot be handled by individual devices. This initiative is designed to strengthen the security of the Private Cloud Compute (PCC) servers that will underpin this service. The PCC servers, which will handle certain AI-powered tasks, are a critical component of Apple Intelligence. 

“We believe Private Cloud Compute is the most advanced security architecture ever deployed for cloud AI compute at scale, and we look forward to working with the research community to build trust in the system and make it even more secure and private over time,” Apple stated in its official statement.

Apple has taken significant steps to prioritize user privacy and security. To further strengthen trust, Apple has also opened up a Virtual Research Environment (VRE) to researchers and security enthusiasts.

The VRE provides access to the PCC software, allowing individuals to scrutinize its code and identify potential vulnerabilities. This allows them to scrutinize the system’s security measures and identify potential weaknesses.

The iPhone maker has also published a comprehensive security guide, detailing the intricacies of PCC’s security architecture and how it protects user data. This guide, coupled with the VRE, provides a robust platform for security researchers to delve deep into the system and uncover potential weaknesses.

The program offers a range of rewards, including $50,000 for accidental or unexpected data disclosure, $100,000 for uncertified code execution, $150,000 for access to user request data or sensitive information outside the trust boundary, and $250,000.

Additionally, $1,000 for arbitrary code execution without user permission or knowledge. Apple also promises to consider awarding money for any security issue that significantly impacts PCC, even if it doesn’t match a published category. 

By offering a substantial reward for critical vulnerabilities, Apple is encouraging the global cybersecurity community to contribute to the security of its AI infrastructure. The company is particularly interested in vulnerabilities that could compromise user data, execute code without permission, or exploit system design flaws.

By inviting the security community to scrutinize its infrastructure, Apple is also showing a commitment to transparency and security. To learn more about Apple Bug Bounty Program visit this link.

1.  Google Launches $250,000 kvmCTF Bug Bounty Program
2.  OpenAI Launches $200 to $20k ChatGPT Bug Bounty Program
3.  When Ethical Hackers Saved Companies from Devastating Hacks
4.  Multichain hack: Hacker returns $1m, keeps $150k as bug bounty
5.  A 19-year-old ethical hacker is a millionaire now; thanks to his skills

Apple Launches ‘Apple Intelligence’ and Offers $1M Bug Bounty for Security

Cary, NC, 28th October 2024, CyberNewsWire

**Cary, NC, October 28th, 2024, CyberNewsWire**

As the year-end approaches, it’s common for enterprises to discover they still have funds that must be utilized. Often, these L&D dollars are “use or lose,” meaning they will be returned to the general fund if not invested. Recognizing this, INE Security is launching an initiative to guide organizations in investing in technical training before the year end. This approach not only ensures wise expenditure of remaining budgets but also significantly strengthens organizational security postures. 

****Addressing Training Budgets:****

*   **Year-End Budget Scenario:** It’s common for organizations to approach year-end with an unused budget designated for training. If not spent, these funds often return to general accounts or are lost altogether, missing an opportunity for strategic investment.
*   **Strategic Spending:** INE Security encourages using these funds to invest in team cybersecurity training, turning what could be wasted resources into a pivotal investment in security and professional development.
*   **Advantages of Utilizing Surplus Funds:** Proactively using surplus training budgets can help organizations make strategic decisions that align with long-term goals, improving security protocols and fostering a knowledgeable workforce. 

****How Organizations Can Utilize Available Training Budgets:****

*   **Skill Enhancement****:** Upgrade the team’s skills to defend against the latest networking, cloud, and cybersecurity threats.
*   **Employee Retentio****n:** Invest in employees’ growth to boost morale and retention – especially in a tight job market where your best employees may be lured to other companies. 
*   **Future-Proofing****:** Prepare teams for future challenges with forward-looking training programs.
*   **Compliance and Standards****:** Ensure compliance with industry standards and regulations through accredited courses and certifications – bolstering your team for contract awards and impending compliance requirements (CMMC).

> “In a time when digital threats are increasing in both complexity and frequency, proactive Networking, Cloud, and Cybersecurity training is more crucial than ever,” said Dara Warn, CEO of INE Security. “We recognize that many organizations end the year with a surplus in their training budgets. This is an excellent opportunity to invest in vital training, ensuring teams are not only prepared but are ahead of the curve.”

Organizations can benefit by engaging in INE Security’s expert-led courses and hands-on labs, which are designed to provide real-world experience and in-depth knowledge across Networking, Cloud, and Cybersecurity. In recognition of the often-underused training budgets available at year’s end, INE Security is offering significant discounts for team training on two-year deals. This initiative not only helps organizations optimize their unspent training funds but also boosts their long-term security strategies.

To learn more about INE’s comprehensive Networking, Cloud, and Cybersecurity training programs, users can visit www.ine.com or contact INE Security’s corporate training advisors directly. 

**About INE**

INE Security is the premier provider of online technical training for the IT/IS industry. Harnessing a powerful hands-on lab platform, cutting-edge technology, a global video distribution network, and world-class instructors, INE Security is the top training choice for Fortune 500 companies worldwide and for IT/IS professionals looking to advance their careers. INE’s suite of learning paths offers an incomparable depth of expertise across cybersecurity, cloud, networking, and data science. INE Security is committed to delivering advanced technical training while also lowering the barriers worldwide for those looking to enter and excel in a cybersecurity career. 

**Contact**

**Director of Global Strategic Communications and Events**  
**Kathryn Brown**  
**INE Security**  
**\[email protected\]**

INE Launches Initiative to Optimize Year-End Training Budgets with Enhanced Cybersecurity and Networking Programs

Four members of the notorious REvil ransomware group have been sentenced to prison terms in Russia. This development…

Four members of the notorious REvil ransomware group have been sentenced to prison terms in Russia. This development marks a major step in the global fight against cybercrime. Learn more about the REvil ransomware gang and the recent sentencing.

Four members of the notorious REvil ransomware gang (also known as Sodinokibi) have been sentenced to prison terms in Russia. This is a rare example of Russian authorities taking action against cybercriminals especially a ransomware group operating within their borders.

The St. Petersburg Garrison Military Court found Artem Zayets, Aleksey Malozemov, Daniil Puzyrevsky, and Ruslan Khansvyarov guilty of various cybercrimes, including illegal circulation of payment means and malware distribution.

The convicted individuals were part of a larger group of 14 people initially detained in connection with the REvil case. The REvil group, once a prolific threat actor, was dismantled following the arrest of several members by Russian authorities.

Revil ransomware gang aka Sodinokibi’s dark web leak site and ransomware note

“All defendants have been in custody since early 2022. They have not admitted their guilt. The arrests of the alleged REvil members, who are called pro-Russian cybercriminals in the Western press, took place in several regions of the Russian Federation in June 2021,” Russian news outlet Kommersant reported.

The investigation, initiated by a request from U.S. law enforcement, revealed the group’s involvement in high-profile cyberattacks targeting international technology companies, Spanish Telecom firm MasMovil, Kaseya, US nuclear weapons contractor, and many more.

The four individuals received prison sentences ranging from 4.5 to 6 years. This outcome is particularly noteworthy considering that Russia has often been perceived as a haven for cybercriminals.

The sentencing of these REvil members follows a wider crackdown on cybercrime in Russia. Earlier this year, Russian authorities also initiated investigations into the Cryptex and UAPS groups, known for providing money laundering services to cybercriminals.

In addition, it follows the sentencing of Yaroslav Vasinskyi, a 24-year-old Ukrainian national, to 13 years in prison in the U.S. for his involvement in over 2,500 REvil ransomware attacks.

It is important to note that the Russian government’s actions against REvil came amidst increased international pressure, particularly from the United States after 2021 when the gang targeted over 1,000 businesses worldwide.

1.  REvil ransomware gang goes dark after Tor sites hack
2.  REvil gang hits UK ITSPs with extortion-based DDoS attacks
3.  REvil ransomware is back after disappearing amid Kaseya attack
4.  Universal decryptor key for Sodinokibi, REvil ransomware released
5.  Cardiologist Charged for Developing Jigsaw v.2, Thanos Ransomware

Russian Court Jails Four REvil Ransomware Gang Members

This article details a new campaign by TeamTNT, a notorious hacking group, leveraging exposed Docker daemons to deploy…

This article details a new campaign by TeamTNT, a notorious hacking group, leveraging exposed Docker daemons to deploy malware, using compromised servers and Docker Hub to spread their attacks. They also use cryptomining to earn money from their victims’ computational power.

Cybersecurity researchers at Aqua Nautilus have discovered a new hacking campaign by Adept Libra (aka TeamTNT), targeting exposed Docker daemons to deploy Sliver malware, a cyber worm, and cryptominers. 

TeamTNT is a notorious hacking group known for aggressive and persistent attacks on cloud-native environments. The group is known for exploiting vulnerabilities in Docker daemons and Kubernetes clusters to deploy malware and hijack resources for cryptocurrency mining.

In a recent campaign, TeamTNT compromised a legitimate Docker Hub account (nmlm99) to host malicious software, uploading around 30 images divided into two categories: infrastructure and impact. The infrastructure images are used to spread malware, while the impact images focus on mining cryptocurrency or renting out computing power.

Attack flow and TeamTNT’s signature

TeamTNT is using Docker Gatling Gun, which scans a massive range of IP addresses (around 16.7 million) for vulnerabilities in Docker daemons running on specific ports (2375, 2376, 4243, and 4244). If a vulnerability is found, a container from a compromised TeamTNT Docker Hub account is deployed, running a minimal Alpine Linux operating system and executing a malicious script called “TDGGinit.sh”. This script likely sets the stage for further malicious activity on the compromised system.

“TeamTNT deploys among other a local search of keys and credentials, such as SSH, cloud metadata server calls etc. Once they gain access, they store and disseminate their malware through these accounts,” the report read.

To evade detection, TeamTNT employs the Sliver malware, a more advanced and stealthier tool compared to their previous tool, Tsunami. They also use familiar names like Chimaera and Bioset to blend in with legitimate processes. Additionally, they steal credentials and scan networks for further targets.

For command and control, TeamTNT relies on web servers, Docker Hub, and various communication protocols like DNS, mTLS, and potentially proxies. Ultimately, their goal is to hijack resources for cryptocurrency mining or sell access to the compromised systems.

To mine cryptocurrency, such as Monero, TeamTNT uses various mining software, including XMRig, T-Rex, CGMiner, BFGMiner, and SGMiner. They often optimize mining operations by targeting specific hardware and software configurations. 

This campaign shows TeamTNT’s ability to adapt and evolve, urging organizations to be alert and upgrade their cybersecurity. The group is highly skilled and motivated and is not afraid to take risks. To protect against TeamTNT risks, organizations must invest in strong security practices, including software updates and network infrastructure security.

1.  **Google Kubernetes Engine Flaws Could Allow Cluster Takeover**
2.  **OracleIV DDoS Botnet Malware Hits Docker Engine API Instances**
3.  **Malware Exploits 9Hits, Turns Docker Servers into Crypto Miners**
4.  **Linux Malware Alert: Spinning YARN Hits Docker, Other Key Apps**
5.  **Cryptomining, Malware Flourish on Exposed Kubernetes Clusters**

Source

HackRead