Attacks

24 Jan

Chinese Cybercrime Group Using Golang Code Interpreter to Evade Detection

Attacks, Malware

DragonSpark does not appear to have any notable ties to other Chinese based threat actors. Based on the attacks that the group is carrying out, especially in regards to the locations of the victims as well as the choice of tools primarily developed by Chinese authors, researchers are fairly certain that the group has ties to China. It highly recommended that companies that either have ties to Eastern Asia or do a lot of business…

Read More
24 Jan

CISA Releases Protecting Our Future: Partnering to Safeguard K–12 organizations from Cybersecurity Threats

Attacks, Insights, Malware

Original release date: January 24, 2023 Today, CISA released Protecting Our Future: Partnering to Safeguard K–12 organizations from Cybersecurity Threats. The report provides recommendations and resources to help K-12 schools and school districts address systemic cybersecurity risk. It also provides insight into the current threat landscape specific to the K-12 community and offers simple steps school leaders can take to strengthen their cybersecurity efforts. The report’s findings state that K-12 organizations need resources, simplicity and…

Read More
23 Jan

Ad Fraud Campaign Targeted Over 11 Million Devices

Attacks, Malware

“It doesn’t stop with the stacked ads, though. For as many of those as might be rendering on a user’s device at once, they keep loading new ads until the ad slot with the malicious ad code is closed. The actors behind the VASTFLUX scheme clearly have an intimate understanding of the digital advertising ecosystem,” stated the company. In order to mislead both the advertising companies and the applications that display adverts, the campaign also…

Read More
23 Jan

FanDuel Warns of Data Breach After Customer Info Stolen in Vendor Hack

Attacks, Malware

Individuals who have been compromised by this breach should change login information immediately. FanDuel allows for multi-factor authentication (MFA), which should be enabled on any active account. Phishing attacks are likely to occur after this type of information is stolen. FanDuel users that have been notified of a data breach should remain vigilant for future phishing attacks. Many account compromises are caused by using the same credentials across numerous sites. If one site is breached,…

Read More
23 Jan

Canadian Energy Provider Qulliq Suffers Data Breach

Attacks, Malware

With investigations still pending, Qulliq customers should remain vigilant. Regularly checking bank and credit card statements that may have been used on the company’s site is advised. Changing the password to QEC accounts, as well as anywhere else that login combination was used, is suggested as well. It is good news that QEC had an incident response plan in place, as many companies still do not. The investigation results will provide more information to the…

Read More
20 Jan

Drupal Releases Security Advisories to Address Multiple Vulnerabilities

Attacks, Insights, Malware

Original release date: January 20, 2023 Drupal has released security advisories to address vulnerabilities affecting multiple products. An attacker could exploit these vulnerabilities to access sensitive information. CISA encourages users and administrators to review Drupal’s security advisories SA-CORE-2023-001, SA-CONTRIB-2023-002, SA-CONTRIB-2023-003, and SA-CONTRIB-2023-004 and apply the necessary updates. This product is provided subject to this Notification and this Privacy & Use policy.

Read More
20 Jan

Cisco Releases Security Advisory for Unified CM and Unified CM SME

Attacks, Insights, Malware

Original release date: January 20, 2023 Cisco released a security advisory for a vulnerability affecting Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME). A remote attacker could exploit this vulnerability to cause a denial-of-service condition. For updates addressing lower severity vulnerabilities, see the Cisco Security Advisories page. CISA encourages users and administrators to review the advisories and apply the necessary updates. This product is provided subject to…

Read More
20 Jan

New ‘Hook’ Android Malware Lets Hackers Remotely Control Devices

Attacks, Malware

Android apps are constantly being used by threat actors because of the availability of third-party app stores and the lack of strict app guidelines for apps published within those stores. Android users should only download apps through the official Google Play Store and only from trusted developers. https://www.bleepingcomputer.com/news/security/new-hook-android-malware-lets-hackers-remotely-control-your-phone/

Read More
20 Jan

T-Mobile Reports Another Data breach

Attacks, Malware

Even though the data stolen in the breach did not include sensitive information, the stolen data could still be used to carry out attacks if used in conjunction with other publicly available data. The company has stated that the malicious activity has been contained at this point for this attack. Whenever a customer is notified by a company of a data breach, they should ensure they are taking the proper steps to protect themselves including…

Read More
20 Jan

New Boldmove Malware Used to Backdoor Fortinet Devices

Attacks, Malware

BOLDMOVE demonstrates the value of two key things – patching and a defense in depth strategy. As this malware spreads primarily through FortiOS devices, which contain minimal logging capabilities, it can go undetected for large periods of time. Patching, however, would mitigate the threat as the systems would not be vulnerable in the first place. With up to date patching, this malware cannot spread unchecked throughout the environment, making it the best defense against this…

Read More