CyberGuy

@Solana & @MultiversX Enthusiast 🚀 | #NFT Explorer 🎨 | #Blockchain Believer 🔗 | #DeFi Adventurer 💼 | #Crypto Futurist 🌐

[The Hacker News @TheHackersNews]

⚠️ Watch out for FAKE Adobe Acrobat Reader installers. They carry a nasty #malware called Byakugan that steals your data and even drops cryptominers.

https://t.co/JQgZ207idT

#hacking

[The Hacker News @TheHackersNews]

🔒 New research reveals critical security risks for AI-as-a-service providers like Hugging Face. Attackers could gain access to hijack models, escalate privileges, and infiltrate CI/CD pipelines.

Details: https://t.co/e74f60mkLF

#technews #artificalintelligence

[CyberGuy @CyberGuyRO]

The #Android banking #trojan known as Vultur has resurfaced with a suite of new features and improved anti-analysis and detection evasion techniques, enabling its operators to remotely interact with a mobile device and harvest sensitive data.

"Vultur has also started masquerading more of its #malicious activity by encrypting its C2 communication, using multiple #encrypted payloads that are decrypted on the fly, and using the guise of legitimate applications to carry out its malicious actions," NCC Group researcher Joshua Kamp said in a report published last week.

Vultur was first disclosed in early 2021, with the malware capable of leveraging Android's accessibility services APIs to execute its malicious actions.

The malware has been observed to be distributed via trojanized dropper apps on the #Google Play Store, masquerading as authenticator and productivity apps to trick unwitting users into installing them. These dropper apps are offered as part of a dropper-as-a-service (DaaS) operation called Brunhilda.

Other #attack chains, as observed by NCC Group, involve the droppers being spread using a combination of SMS messages and phone calls – a technique called telephone-oriented attack delivery (TOAD) – to ultimately serve an updated version of the #malware.

[CyberGuy @CyberGuyRO]

The #Indian government said it has rescued and repatriated about 250 citizens in Cambodia who were held captive and coerced into running #cyber scams.

The Indian nationals "were lured with employment opportunities to that country but were forced to undertake illegal #cyber work," the Ministry of External Affairs (#MEA) said in a statement, adding it had rescued 75 people in the past three months.

It also said it's working with "with Cambodian authorities and with agencies in #India to crack down on those responsible for these fraudulent schemes."

The development comes in the wake of a report from the Indian Express that said more than 5,000 Indians stuck in #Cambodia were forced into "#cyber slavery" by organized #crime rackets to #scam people in India and extort #money by masquerading as law enforcement authorities in some cases.

[CyberGuy @CyberGuyRO]

Business email compromise (or #BEC) is a form of #phishing attack where a criminal attempts to trick a senior executive (or budget holder) into transferring funds, or revealing sensitive #information.

The #criminals behind BEC send convincing-looking emails that might request unusual #payments, or contain links to 'dodgy' #websites.

Some emails may contain viruses disguised as harmless attachments, which are activated when opened.
Unlike standard phishing emails that are sent out indiscriminately to millions of people, #BEC attacks are crafted to appeal to specific individuals, and can be even harder to detect.

BEC is a threat to all organisations of all sizes and across all sectors, including non-profit organisations and #government.

If you think you've been a victim of a phishing attack, tell your #IT department as soon as you can. The earlier you tell then, the more likely they'll be able to help.

[CyberGuy @CyberGuyRO]

The #Golden Age of Automated #Penetration Testing is Here

#Network penetration testing plays a vital role in detecting vulnerabilities that can be #exploited. The current method of performing pen testing is pricey, leading many #companies to undertake it only when necessary, usually once a year for their compliance requirements.
This manual approach often misses opportunities to find and fix security issues early on, leaving businesses vulnerable to expensive #cyberattacks and potential breaches.

However, new technologies using automation and #AI have revolutionized the process, making regular network pentesting easy and affordable.

We're now in the golden era of pentesting, where every company can assess the #security of their networks without breaking the bank.

More details at : https://t.co/peDKf1HAem

[CyberGuy @CyberGuyRO]

Hackers Target #macOS Users with Malicious Ads Spreading Stealer #Malware

Malicious ads and bogus websites are acting as a conduit to deliver two different stealer malware, including Atomic Stealer, targeting #Apple macOS users.

The ongoing infostealer attacks targeting macOS users may have adopted different methods to compromise victims' Macs, but operate with the end goal of stealing sensitive data, Jamf Threat Labs said in a report published Friday.

One such attack chain targets users searching for Arc Browser on search engines like #Google to serve bogus ads that redirect users to look-alike sites ("airci[.]net") that serve the malware.

[CyberGuy @CyberGuyRO]

@dot9app Let’s go!!

erd16u8ghp7xjkn8uhhn2k9d8dw6ndtuy28v2des404cnwu9f3w4mdqq278rq2

[CyberGuy @CyberGuyRO]

@zrw @zrw dm me i have something to talk with you!

[CyberGuy @CyberGuyRO]

@zrw can you DM me, i have something to ask. thanks

[CyberGuy @CyberGuyRO]

TeamCity Flaw Leads to Surge in #Ransomware, #Cryptomining, and #RAT Attacks

Multiple threat actors are exploiting the recently disclosed security flaws in #JetBrains TeamCity software to deploy ransomware, #cryptocurrency miners, Cobalt Strike beacons, and a Golang-based remote access trojan called Spark RAT.

The #attacks entail the exploitation of CVE-2024-27198 (CVSS score: 9.8) that enables an adversary to bypass authentication measures and gain administrative control over affected servers.

"The #attackers are then able to install #malware that can reach out to its command-and-control (C&C) server and perform additional commands such as deploying Cobalt Strike beacons and remote access trojans (RATs)," Trend Micro said in a new report.

"#Ransomware can then be installed as a final payload to encrypt files and demand ransom #payments from victims."

Following public disclosure of the flaw earlier this month, it has been weaponized by threat actors associated with BianLian and Jasmin ransomware families, as well as to drop the XMRig cryptocurrency miner and Spark RAT.

Organizations relying on TeamCity for their CI/CD processes are recommended to update their #software as soon as possible to #safeguard against potential threats.

More on https://t.co/Kx3iwPlFDt

[CyberGuy @CyberGuyRO]

#Ukraine Arrests Trio for #Hijacking Over 100 Million #Email and #Instagram Accounts

The #Cyber Police of #Ukraine has arrested three individuals on suspicion of #hijacking more than 100 million emails and #Instagram accounts from users across the #world.

The suspects, aged between 20 and 40, are said to be part of an organized criminal group living in different parts of the country. If convicted, they face up to 15 years in prison.

The accounts, authorities said, were taken over by carrying out brute-force attacks, which employ trial-and-error methods to guess login credentials. The group operated under the direction of a leader, who distributed the #hacking tasks to other members.

The #cybercrime group subsequently monetized their ill-gotten credentials by putting them up for sale on #darkweb forums.

Other threat actors who purchased the information used the compromised accounts to conduct a variety of fraudulent schemes, including those in which scammers reach out to the victim's friends to urgently transfer #money to their #bank account.

"You can protect your account from this method of #hacking by setting up two-factor authentication and using strong #passwords," the #agency said.

As part of the operation, officials conducted seven searches in Kyiv, Odesa, Vinnytsia, Ivano-Frankivsk, Donetsk, and Kirovohrad, confiscating 70 computers, 14 phones, #bank cards, and #cash worth more than $3,000.

The development comes as a #US. national pleaded guilty to breaching over a dozen entities in the U.S., including a medical clinic in Griffin, and exfiltrating the personal information of more than 132,000 individuals. He is scheduled for sentencing on June 18, 2024.

Robert Purbeck (aka #Lifelock or #Studmaster) "aggravated his crimes by weaponizing sensitive data in an egregious attempt to extort his #victims," U.S. Attorney Ryan K. Buchanan said.

[CyberGuy @CyberGuyRO]

New 'Loop DoS' Attack Impacts Hundreds of Thousands of Systems

A novel denial-of-service (#DoS) #attack vector has been found to target application-layer protocols based on User Datagram Protocol (#UDP), putting hundreds of thousands of hosts likely at risk.

Called Loop DoS attacks, the approach pairs "servers of these protocols in such a way that they communicate with each other indefinitely," researchers from the #CISPA Helmholtz-Center for Information #Security said.

UDP, by design, is a connectionless protocol that does not validate source IP addresses, making it susceptible to IP spoofing.

Thus, when #attackers forge several UDP packets to include a victim IP address, the destination #server responds to the victim (as opposed to the threat actor), creating a reflected denial-of-service (DoS) attack.

The latest study found that certain implementations of the UDP protocol, such as #DNS, #NTP, #TFTP, Active Users, Daytime, Echo, Chargen, #QOTD, and Time, can be weaponized to create a self-perpetuating attack loop.

[CyberGuy @CyberGuyRO]

@_NasibX Stocks :)

[CyberGuy @CyberGuyRO]

From #Deepfakes to #Malware: #AI's Expanding Role in #cyberattacks

Large language models (LLMs) powering artificial intelligence (#AI ) tools today could be exploited to develop self-augmenting malware capable of bypassing YARA rules.

"Generative #AI can be used to evade string-based YARA rules by augmenting the source code of small malware variants, effectively lowering detection rates," Recorded Future said in a new report shared with The #Hacker #News.

The findings are part of a red teaming exercise designed to uncover malicious use cases for AI technologies, which are already being experimented with by threat actors to create malware code snippets, generate #phishing emails, and conduct reconnaissance on potential targets.

The #cybersecurity firm said it submitted to an LLM a known piece of malware called #STEELHOOK that's associated with the APT28 #hacking group, alongside its YARA rules, asking it to modify the source code to sidestep detection such the original functionality remained intact and the generated source code was syntactically free of errors.

[CyberGuy @CyberGuyRO]

Suspected #Russian Data-Wiping 'AcidPour' #Malware Targeting #Linux x86 Devices
A new variant of a data wiping malware called #AcidRain has been detected in the wild that's specifically designed for targeting #Linux x86 devices.

The malware, dubbed AcidPour, is compiled for Linux x86 devices, SentinelOne's Juan Andres Guerrero-Saade said in a series of posts on @X .

"The new variant [...] is an ELF binary compiled for x86 (not MIPS) and while it refers to similar devices/strings, it's a largely different codebase," Guerrero-Saade noted.

AcidRain first came to light in the early days of the #Russo-#Ukrainian war, with the malware deployed against KA-SAT modems from #USA . satellite company #Viasat.

An ELF binary compiled for MIPS architectures is capable of wiping the filesystem and different known storage device files by recursively iterating over common directories for most Linux distributions.

[CyberGuy @CyberGuyRO]

New #Phishing Attack Uses Clever #Microsoft Office Trick to Deploy NetSupport #RAT

A new phishing campaign is targeting #US organizations with the intent to deploy a remote access trojan called NetSupport RAT.

#Israeli #cybersecurity company Perception Point is tracking the activity under the moniker Operation PhantomBlu.

"The PhantomBlu operation introduces a nuanced exploitation method, diverging from NetSupport RAT's typical delivery mechanism by leveraging OLE (Object Linking and Embedding) template manipulation, exploiting #Microsoft Office document templates to execute malicious code while evading detection," security researcher Ariel Davidpur said.

NetSupport #RAT is a malicious offshoot of a legitimate remote desktop tool known as NetSupport Manager, allowing threat actors to conduct a spectrum of data gathering actions on a compromised endpoint.

[CyberGuy @CyberGuyRO]

@DegenerateNews @X 14K so far
https://t.co/y4YlHhu6RJ
We have to repost the NEWS FAST!

[DEGEN NEWS @DegenerateNews]

BREAKING: ton_blockchain @X ACCOUNT IS COMPROMISED - DO NOT SEND FUNDS TO FAKE PRESALE NOR CLICK LINKS