The Hacker News | #1 Trusted Source for Cybersecurity News — Index Page

The China-linked advanced persistent threat (APT) group known as Mustang Panda has been observed weaponizing Visual Studio Code software as part of espionage operations targeting government entities in Southeast Asia. "This threat actor used Visual Studio Code's embedded reverse shell feature to gain a foothold in target networks," Palo Alto Networks Unit 42 researcher Tom Fakterman said in a report, describing it as a "relatively new technique" that was first demonstrated in September 2023 by Truvis Thornton. The campaign is assessed to be a continuation of a previously documented attack activity aimed at an unnamed Southeast Asian government entity in late September 2023. Mustang Panda , also known by the names BASIN, Bronze President, Camaro Dragon, Earth Preta, HoneyMyte, RedDelta, Red Lich, and Stately Taurus, has been operational since 2012, routinely conducting cyber espionage campaigns targeting government and religious entities across Europe an...

GenAI has become a table stakes tool for employees, due to the productivity gains and innovative capabilities it offers. Developers use it to write code, finance teams use it to analyze reports, and sales teams create customer emails and assets. Yet, these capabilities are exactly the ones that introduce serious security risks. Register to our upcoming webinar to learn how to prevent GenAI data leakage When employees input data into GenAI tools like ChatGPT, they often do not differentiate between sensitive and non-sensitive data. Research by LayerX indicates that one in three employees who use GenAI tools, also share sensitive information. This could include source code, internal financial numbers, business plans, IP, PII, customer data, and more. Security teams have been trying to address this data exfiltration risk ever since ChatGPT tumultuously entered our lives in November 2022. Yet, so far the common approach has been to either “allow all” or “block all”, i.e allow the use ...

Designed to be more than a one-time assessment— Wing Security’s SaaS Pulse provides organizations with actionable insights and continuous oversight into their SaaS security posture—and it’s free! Introducing SaaS Pulse: Free Continuous SaaS Risk Management  Just like waiting for a medical issue to become critical before seeing a doctor, organizations can’t afford to overlook the constantly evolving risks in their SaaS ecosystems. New SaaS apps, shifting permissions, and emerging threats mean risks are always in motion. SaaS Pulse makes it easy to treat SaaS risk management as an ongoing practice, not just an occasional check-up. Security teams instantly get a real-time security “health” score, prioritized risks, contextualized threat insights, and the organization’s app inventory—without setups or integrations. SaaS is a Moving Target SaaS stacks don’t stand still. Business critical apps can easily slip into a state of vulnerability (i.e. supply chain attacks, account takeo...

Progress Software has released security updates for a maximum-severity flaw in LoadMaster and Multi-Tenant (MT) hypervisor that could result in the execution of arbitrary operating system commands. Tracked as CVE-2024-7591 (CVSS score: 10.0), the vulnerability has been described as an improper input validation bug that results in OS command injection. "It is possible for unauthenticated, remote attackers who have access to the management interface of LoadMaster to issue a carefully crafted http request that will allow arbitrary system commands to be executed," the company said in an advisory last week. "This vulnerability has been closed by sanitizing request user input to mitigate arbitrary system commands execution." The flaw affects the following versions - LoadMaster (7.2.60.0 and all prior versions) Multi-Tenant Hypervisor (7.1.35.11 and all prior versions) Security researcher Florian Grunow has been credited with discovering and reporting the flaw...

Android device users in South Korea have emerged as a target of a new mobile malware campaign that delivers a new type of threat dubbed SpyAgent . The malware "targets mnemonic keys by scanning for images on your device that might contain them," McAfee Labs researcher SangRyol Ryu said in an analysis, adding the targeting footprint has broadened in scope to include the U.K. The campaign makes use of bogus Android apps that are disguised as seemingly legitimate banking, government facilities, streaming, and utility apps in an attempt to trick users into installing them. As many as 280 fake applications have been detected since the start of the year. It all starts with SMS messages bearing booby-trapped links that urge users to download the apps in question in the form of APK files hosted on deceptive sites. Once installed, they are designed to request intrusive permissions to collect data from the devices. This includes contacts, SMS messages, photos, and other device i...