The Hacker News | #1 Trusted Source for Cybersecurity News — Index Page

Cybersecurity researchers have disclosed details of a threat actor known as Sticky Werewolf that has been linked to cyber attacks targeting entities in Russia and Belarus. The phishing attacks were aimed at a pharmaceutical company, a Russian research institute dealing with microbiology and vaccine development, and the aviation sector, expanding beyond their initial focus of government organizations, Morphisec said in a report last week. "In previous campaigns, the infection chain began with phishing emails containing a link to download a malicious file from platforms like gofile.io," security researcher Arnold Osipov said. "This latest campaign used archive files containing LNK files pointing to a payload stored on WebDAV servers." Sticky Werewolf, one of the many threat actors targeting Russia and Belarus such as Cloud Werewolf (aka Inception and Cloud Atlas ), Quartz Wolf , Red Wolf (aka RedCurl ), and Scaly Wolf , was first documented by BI.ZONE in Octo...

Details have emerged about a new critical security flaw impacting PHP that could be exploited to achieve remote code execution under certain circumstances. The vulnerability, tracked as CVE-2024-4577 , has been described as a CGI argument injection vulnerability affecting all versions of PHP installed on the Windows operating system. According to DEVCORE security researchers, the shortcoming makes it possible to bypass protections put in place for another security flaw, CVE-2012-1823 . "While implementing PHP, the team did not notice the Best-Fit feature of encoding conversion within the Windows operating system," security researcher Orange Tsai said . "This oversight allows unauthenticated attackers to bypass the previous protection of CVE-2012-1823 by specific character sequences. Arbitrary code can be executed on remote PHP servers through the argument injection attack." Following responsible disclosure on May 7, 2024, a fix for the vulnerability has bee...

Microsoft on Friday said it will disable its much-criticized artificial intelligence (AI)-powered Recall feature by default and make it an opt-in. Recall , currently in preview and coming exclusively to Copilot+ PCs on June 18, 2024, functions as an "explorable visual timeline" by capturing screenshots of what appears on users' screens every five seconds, which are subsequently analyzed and parsed to surface relevant information. But the feature, meant to serve as some sort of an AI-enabled photographic memory, was met with instantaneous backlash from the security and privacy community, which excoriated the company for having not thought through enough and implementing adequate safeguards that could prevent malicious actors from easily gaining a window into a victim's digital life. The recorded information could include screenshots of documents, emails, or messages containing sensitive details that may have been deleted or shared temporarily using disappearing ...

2023 was a year of unprecedented cyberattacks. Ransomware crippled businesses, DDoS attacks disrupted critical services, and data breaches exposed millions of sensitive records. The cost of these attacks? Astronomical. The damage to reputations? Irreparable. But here's the shocking truth: many of these attacks could have been prevented with basic cyber hygiene . Are you ready to transform your cybersecurity strategy? Join us for an exclusive webinar, " Better Basics Win the Cybersecurity Threat War: Defend, Deter, and Save ," where we'll reveal how to optimize your cyber hygiene and compliance costs. What you'll learn: The latest trends shaping the cybersecurity landscape: Get ahead of the curve and understand the evolving tactics of cybercriminals. How the CIS Controls and CIS Benchmarks can simplify your security efforts: Discover the power of these proven security best practices and how they can fortify your defenses. How a CIS SecureSuite Membership...

Cybersecurity researchers have disclosed that the LightSpy spyware recently identified as targeting Apple iOS users is in fact a previously undocumented macOS variant of the implant. The findings come from both Huntress Labs and ThreatFabric , which separately analyzed the artifacts associated with the cross-platform malware framework that likely possesses capabilities to infect Android, iOS, Windows, macOS, Linux, and routers from NETGEAR, Linksys, and ASUS. "The Threat actor group used two publicly available exploits ( CVE-2018-4233 ,  CVE-2018-4404 ) to deliver implants for macOS," ThreatFabric said in a report published last week. "Part of the CVE-2018-4404 exploit is likely borrowed from the Metasploit framework. macOS version 10 was targeted using those exploits." LightSpy was first publicly reported in 2020, although subsequent reports from Lookout and the Dutch mobile security firm have revealed possible connections between the spyware and an Android s...

Traditional SCAs Are Broken: Did You Know You Are Missing Critical Pieces? Application Security professionals face enormous challenges securing their software supply chains, racing against time to beat the attacker to the mark.  Software Composition Analysis (SCA) tools have become a basic instrument in the application security arsenal in the last 7 years. Although essential, many platforms end up creating more mess and driving the key pain in the industry - alert fatigue, leaving your supply chain exposed to critical vulnerabilities and malicious code attacks. Fortunately, alongside the black hat hackers making their best efforts to find new attack vectors and surfaces, innovative security tools are breaking new ground, helping organizations stay secure despite emerging threats. Myrror Security ’s latest resource, "Your SCA is Broken Guide - The Missing Pieces In Your Software Composition Analysis Platform," offers application security professionals a view into the tra...