Breaking News

Security Affairs newsletter Round 436 by Pierluigi Paganini – International edition

A new round of the weekly SecurityAffairs newsletter arrived! Every week the best security articles from Security Affairs are free for you in your email box.

Enjoy a new round of the weekly SecurityAffairs newsletter, including the international press.

US CISA added critical Apache RocketMQ flaw to its Known Exploited Vulnerabilities catalog
Ragnar Locker gang leaks data stolen from the Israel’s Mayanei Hayeshua hospital
North Korea-linked threat actors target cybersecurity experts with a zero-day
Zero-day in Cisco ASA and FTD is actively exploited in ransomware attacks
Nation-state actors exploit Fortinet FortiOS SSL-VPN and Zoho ManageEngine ServiceDesk Plus, CISA warns
Zero-days fixed by Apple were used to deliver NSO Group’s Pegasus spyware
Apple discloses 2 new actively exploited zero-day flaws in iPhones, Macs
A malvertising campaign is delivering a new version of the macOS Atomic Stealer
Two flaws in Apache SuperSet allow to remotely hack servers
Chinese cyberspies obtained Microsoft signing key from Windows crash dump due to a mistake
Google addressed an actively exploited zero-day in Android
A zero-day in Atlas VPN Linux Client leaks users’ IP address
MITRE and CISA release Caldera for OT attack emulation
ASUS routers are affected by three critical remote code execution flaws
Hackers stole $41M worth of crypto assets from crypto gambling firm Stake
Freecycle data breach impacted 7 Million users
Meta disrupted two influence campaigns from China and Russia
A massive DDoS attack took down the site of the German financial agency BaFin
X will collect biometric data from its premium users
“Smishing Triad” Targeted USPS and US Citizens for Data Theft
Publicly available Evil_MinIO exploit used in attacks on MinIO Storage Systems
University of Sydney suffered a security breach caused by a third-party service provider
Cybercrime will cost Germany $224 billion in 2023
PoC exploit code released for CVE-2023-34039 bug in VMware Aria Operations for Networks
LockBit ransomware gang hit the Commission des services electriques de Montréal (CSEM)

Cybercrime

“Smishing Triad” Targeted USPS And US Citizens For Data Theft   

Crypto gambling site Stake sees $41M withdrawn in confirmed hack

Cisco warns of VPN zero-day exploited by ransomware gangs

Massive DDoS attack on U.S. financial company thwarted by cyber firm  

Experts Fear Crooks are Cracking Keys Stolen in LastPass Breach  

Russian infosec boss gets nine years for $100M insider-trading caper using stolen data

Pandora’s box is now open: the well-known Mirai trojan arrives in a new disguise to Android-based TV sets and TV boxes  

Malware

Mac users targeted in new malvertising campaign delivering Atomic Stealer  

NSO Group iPhone Zero-Click, Zero-Day Exploit Captured in the Wild   

CISA: Malware Analysis Report – Attack on Aeronautical Sector organization

Hacking

VMWARE Aria Operations for Networks  

New Attack Vector In The Cloud: Attackers caught exploiting Object Storage Services   

German financial agency site disrupted by DDoS attack since Friday

7 Million Users Possibly Impacted by Freecycle Data Breach        

From NTAuthCertificates to “Silver” Certificate   

Zero-Day Alert: Latest Android Patch Update Includes Fix for Newly Actively Exploited Flaw

Apache Superset Part II: RCE, Credential Harvesting and More  

Exposing RocketMQ CVE-2023-33246 Payloads  

Intelligence and Information Warfare

Raising Online Defenses Through Transparency and Collaboration  

Results of Major Technical Investigations for Storm-0558 Key Acquisition  

CNMF and Partners Illuminate Multiple Nation-State Exploitation Efforts  

Active North Korean campaign targeting security researchers  

Probe reveals DHS relies on fake social media accounts to investigate targets  

Potential New EvilNum Campaign  

The International Criminal Court Will Now Prosecute Cyberwar Crimes  

Cybersecurity

National Grid to set ‘honeypots’ to trap hackers – amid rising risk from digitisation  

Who’s Your Next Cyber Chief? Good Question  

ASUS routers vulnerable to critical remote code execution flaws

MITRE & CISA Release Open-Source MITRE Caldera™ Extension for Operational Technology   

How Quantum Computing Will Impact Cybersecurity

Apple discloses 2 new zero-days exploited to attack iPhones, Macs

A Brief History of the Internet’s Biggest BGP Incidents  

Make smart choices to protect your privacy. Search for products. Read expert reviews. Get tips and tricks  

Norway court rules against Facebook owner Meta in privacy case   

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, newsletter)

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.

Recent Posts

Vyacheslav Igorevich Penchukov was sentenced to prison for his role in Zeus and IcedID operations

Ukrainian national Vyacheslav Igorevich Penchukov was sentenced to prison for his role in Zeus and…

2 hours ago

Rite Aid disclosed data breach following RansomHub ransomware attack

The American drugstore chain Rite Aid Corporation disclosed a data breach following the cyber attack…

5 hours ago

New AT&T data breach exposed call logs of almost all customers

AT&T disclosed a new data breach that exposed phone call and text message records for…

1 day ago

Critical flaw in Exim MTA could allow to deliver malware to users’ inboxes

A critical vulnerability in Exim mail server allows attackers to deliver malicious executable attachments to…

1 day ago

Palo Alto Networks fixed a critical bug in the Expedition tool

Palo Alto Networks addressed five vulnerabilities impacting its products, including a critical authentication bypass issue. Palo…

1 day ago

Smishing Triad Is Targeting India To Steal Personal and Payment Data at Scale

Resecurity has identified a new campaign by the Smishing Triad that is targeting India to…

2 days ago

This website uses cookies.