Menu

Blog

Archive for the ‘cybercrime/malcode’ category: Page 9

Jun 5, 2024

Russian Power Companies, IT Firms, and Govt Agencies Hit by Decoy Dog Trojan

Posted by in categories: cybercrime/malcode, energy

Russian organizations are at the receiving end of cyber attacks that have been found to deliver a Windows version of a malware called Decoy Dog.

Cybersecurity company Positive Technologies is tracking the activity cluster under the name Operation Lahat, attributing it to an advanced persistent threat (APT) group called HellHounds.

“The Hellhounds group compromises organizations they select and gain a foothold on their networks, remaining undetected for years,” security researchers Aleksandr Grigorian and Stanislav Pyzhov said. “In doing so, the group leverages primary compromise vectors, from vulnerable web services to trusted relationships.”

Jun 5, 2024

361 million stolen accounts leaked on Telegram added to HIBP

Posted by in category: cybercrime/malcode

A massive trove of 361 million email addresses from credentials stolen by password-stealing malware, in credential stuffing attacks, and from data breaches was added to the Have I Been Pwned data breach notification service, allowing anyone to check if their accounts have been compromised.

Cybersecurity researchers collected these credentials from numerous Telegram cybercrime channels, where the stolen data is commonly leaked to the channel’s users to build reputation and subscribers.

The stolen data is usually leaked as username and password combinations (usually stolen via credential stuffing attacks or data breaches), username and passwords along with a URL associated with them (stolen via password-stealing malware), and raw cookies (stolen via password-stealing malware).

Jun 5, 2024

A Safer Future for AI with Stronger Algorithms

Posted by in categories: cybercrime/malcode, information science, robotics/AI

This post is also available in: עברית (Hebrew)

AI technology is spreading quickly throughout many different industries, and its integration depends on users’ trust and safety concerns. This matter becomes complicated when the algorithms powering AI-based tools are vulnerable to cyberattacks that could have detrimental results.

Dr. David P. Woodruff from Carnegie Mellon University and Dr. Samson Zhou from Texas A&M University are working to strengthen the algorithms used by big data AI models against attacks.

Jun 4, 2024

Health records system restored after Ascension hospitals cyber attack in the Austin area

Posted by in categories: biotech/medical, cybercrime/malcode, health

Some systems are still down, but medical staff can now use the computer system for patient care after almost four weeks.

Jun 3, 2024

Hackers Targeting 1,500 Banks and Their Customers in Push To Drain Accounts Across 60 Countries: Report

Posted by in categories: cybercrime/malcode, finance, government

Black hat hackers have reportedly unleashed malicious software targeting over 1,500 banks and their customers worldwide.

Security researchers at IBM say a revamped version of the Grandoreiro banking trojan has just rolled out, enabling attackers to perform banking fraud in 60 countries.

The malware allows attackers to send email notices that appear to be urgent government requests for payments.

May 31, 2024

6 Finetuning for Classification

Posted by in categories: cybercrime/malcode, robotics/AI

V/ Sebastian Raschka.

For weekend reading:

Chapter 6 (Finetuning LLMs for Classification) of Build an LLM from Scratch book is now finally available on the Manning website:

Continue reading “6 Finetuning for Classification” »

May 30, 2024

CISA Alerts Federal Agencies to Patch Actively Exploited Linux Kernel Flaw

Posted by in category: cybercrime/malcode

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added a security flaw impacting the Linux kernel to the Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation.

Tracked as CVE-2024–1086 (CVSS score: 7.8), the high-severity issue relates to a use-after-free bug in the netfilter component that permits a local attacker to elevate privileges from a regular user to root and possibly execute arbitrary code.

“Linux kernel contains a use-after-free vulnerability in the netfilter: nf_tables component that allows an attacker to achieve local privilege escalation,” CISA said.

May 26, 2024

$1,800,000,000,000 Bank Says Customer and Employee Data Has Been Exposed and Accessed in Mysterious Breach

Posted by in categories: cybercrime/malcode, finance

One of the largest banks in the world says a data breach has exposed customer and employee information.

In a statement, Santander says it’s aware of “unauthorized access” to a third-party database containing information on an undisclosed number of customers and employees.

The bank, which has $1.8 trillion in total assets and operates in ten markets across Europe and the Americas, says customers of Santander Chile, Spain and Uruguay are affected.

May 24, 2024

Space Force selects companies to develop concepts for simulated space war training range

Posted by in categories: cybercrime/malcode, military, satellites

Join our newsletter to get the latest military space news every Tuesday by veteran defense journalist Sandra Erwin.

In a statement May 22, the Space Force said this specialized environment will be crucial for training service personnel, known as guardians, to defend critical satellites and other spacecraft from electronic attacks. Satellites rely on electromagnetic signals for communication, navigation, and data transmission, making them vulnerable to jamming and cyberattacks.

May 24, 2024

Hackers Created Rogue VMs to Evade Detection in Recent MITRE Cyber Attack

Posted by in category: cybercrime/malcode

The MITRE Corporation has revealed that the cyber attack targeting the not-for-profit company towards late December 2023 by exploiting zero-day flaws in Ivanti Connect Secure (ICS) involved the actor creating rogue virtual machines (VMs) within its VMware environment.

“The adversary created their own rogue VMs within the VMware environment, leveraging compromised vCenter Server access,” MITRE researchers Lex Crumpton and Charles Clancy said.

“They wrote and deployed a JSP web shell (BEEFLUSH) under the vCenter Server’s Tomcat server to execute a Python-based tunneling tool, facilitating SSH connections between adversary-created VMs and the ESXi hypervisor infrastructure.”

Page 9 of 213First678910111213Last