CYBERSECURITY / DEFENSE / INTELLIGENCE

  • The United States Justice Department has announced big rewards for information leading to the capture of four Iranian nationals.

    These individuals are accused of conducting a sophisticated multi-year cyber campaign against American companies.

    The announcement underscores the gravity of cyber threats and the U.S. government’s commitment to countering such illegal activities.

    The indictment, unsealed in a Manhattan federal court, names Hossein Harooni, Reza Kazemifar, Komeil Baradaran Salmani, and Alireza Shafie Nasab as the perpetrators behind a concerted effort to compromise the U.S. government and business networks.

    Is Your Network Under Attack? - Read CISO’s Guide to Avoiding the Next Breach - Download Free Guide

    This cyber campaign is believed to be part of a larger strategy by Iranian actors to exert influence and gain unauthorized access to critical information and systems.

    The Reward for Justice has recently tweeted about a lucrative opportunity for information related to Iranian hackers.

    The reward for such information has been set at a maximum of $10 million.

    Charges

    The charges laid out by the Justice Department are severe and reflect the serious nature of the offenses.

    The four individuals are accused of engaging in a cyber-enabled campaign that targeted U.S. infrastructure.

    While the specific charges have not been detailed in the press release, such indictments typically include counts of unauthorized access to computer systems, data theft, and potentially espionage-related activities.

    Impact

    The impact of these cyber-attacks is far-reaching.

    They represent a direct threat to the security of sensitive U.S. government and corporate information and undermine trust in digital infrastructure.

    The announcement of rewards, which can reach $10 million, clearly signals that the U.S. is taking a proactive stance in deterring such cyber threats and is willing to invest significant resources in bringing the perpetrators to justice.

    The Justice Department’s move also serves as a deterrent to other would-be cyber attackers, demonstrating that the U.S. will pursue and potentially prosecute individuals involved in cyber espionage and cybercrime, regardless of location.

    The unsealing of the indictment and the subsequent reward offer marks a critical step in the fight against international cybercrime.

    The U.S. government’s approach reflects an understanding that cyber threats require a robust and multi-faceted response, combining legal action, international cooperation, and public-private partnerships.

    As the digital landscape continues to evolve, such measures will be vital in safeguarding national interests and maintaining the integrity of global cyberinfrastructure.

    Free Webinar: Mastering Web Application and API Protection/WAF ROI Analysis -  Book Your Spot

    The post Rewards Up to $10 Million for Information on Iranian Hackers appeared first on GBHackers on Security | #1 Globally Trusted Cyber Security News Platform.

    Go to source

    ΒΆΒΆΒΆΒΆΒΆ

    ΒΆΒΆΒΆΒΆΒΆ

    ΒΆΒΆΒΆΒΆΒΆ

    ΒΆΒΆΒΆΒΆΒΆ

    ΒΆΒΆΒΆΒΆΒΆ

  • A new malware campaign has been exploiting the updating mechanism of the eScan antivirus software to distribute backdoors and cryptocurrency miners like XMRig through a long-standing threat codenamed GuptiMiner targeting large corporate networks. Cybersecurity firm Avast said the activity is the work of a threat actor with possible connections to a North Korean hacking group dubbed 

    Go to source

    ΒΆΒΆΒΆΒΆΒΆ

    ΒΆΒΆΒΆΒΆΒΆ

    ΒΆΒΆΒΆΒΆΒΆ

    ΒΆΒΆΒΆΒΆΒΆ

    ΒΆΒΆΒΆΒΆΒΆ

  • A new ongoing malware campaign has been observed distributing three different stealers, such as CryptBot, LummaC2, and Rhadamanthys hosted on Content Delivery Network (CDN) cache domains since at least February 2024. Cisco Talos has attributed the activity with moderate confidence to a threat actor tracked as CoralRaider, a suspected Vietnamese-origin

    Go to source

    ΒΆΒΆΒΆΒΆΒΆ

    ΒΆΒΆΒΆΒΆΒΆ

    ΒΆΒΆΒΆΒΆΒΆ

    ΒΆΒΆΒΆΒΆΒΆ

    ΒΆΒΆΒΆΒΆΒΆ

  • Launched in March, the effort is looking at poisoned datasets, adversarial attacks, Trojans, and more.

    Go to source

    ΒΆΒΆΒΆΒΆΒΆ

    ΒΆΒΆΒΆΒΆΒΆ

    ΒΆΒΆΒΆΒΆΒΆ

    ΒΆΒΆΒΆΒΆΒΆ

    ΒΆΒΆΒΆΒΆΒΆ

  • It’s a fraught question amid Russian gains, uncertain long-term U.S. support, and Kyiv’s eventual need to end the war.

    Go to source

    ΒΆΒΆΒΆΒΆΒΆ

    ΒΆΒΆΒΆΒΆΒΆ

    ΒΆΒΆΒΆΒΆΒΆ

    ΒΆΒΆΒΆΒΆΒΆ

    ΒΆΒΆΒΆΒΆΒΆ

  • COO: β€œWe’ve got some other strengths in some of the key components that go in the prime satellites and buses.”

    Go to source

    ΒΆΒΆΒΆΒΆΒΆ

    ΒΆΒΆΒΆΒΆΒΆ

    ΒΆΒΆΒΆΒΆΒΆ

    ΒΆΒΆΒΆΒΆΒΆ

    ΒΆΒΆΒΆΒΆΒΆ

  • Niger’s rejection of democratic ties coincides starkly with its embrace of Russian military assistance since the July 2023 military coup.

    Go to source

    ΒΆΒΆΒΆΒΆΒΆ

    ΒΆΒΆΒΆΒΆΒΆ

    ΒΆΒΆΒΆΒΆΒΆ

    ΒΆΒΆΒΆΒΆΒΆ

    ΒΆΒΆΒΆΒΆΒΆ

  • ΒΆΒΆΒΆΒΆΒΆ

    ΒΆΒΆΒΆΒΆΒΆ

    ΒΆΒΆΒΆΒΆΒΆ

    ΒΆΒΆΒΆΒΆΒΆ

    ΒΆΒΆΒΆΒΆΒΆ

  • Researchers have identified a dependency confusion vulnerability impacting an archived Apache project called Cordova App Harness. Dependency confusion attacks take place owing to the fact that package managers check the public repositories before private registries, thus allowing a threat actor to publish a malicious package with the same name to a public package repository. This&

    Go to source

    ΒΆΒΆΒΆΒΆΒΆ

    ΒΆΒΆΒΆΒΆΒΆ

    ΒΆΒΆΒΆΒΆΒΆ

    ΒΆΒΆΒΆΒΆΒΆ

    ΒΆΒΆΒΆΒΆΒΆ

  • Oracle Virtualbox was identified and reported as having a critical vulnerability associated with Privilege Escalation and Arbitrary File Move/Delete.

    This vulnerability was assigned with CVE-2024-21111, and the severity was 7.8 (High).Β 

    However, Oracle has acted swiftly upon the report and has patched the vulnerability accordingly. Following that, Oracle also released a security advisory to address the vulnerability.

    Recently Oracle Releases Security Update in 2024 – 372 Vulnerabilities Are Fixed

    Now, a publicly available exploit proof-of-concept has been published, providing detailed information on the vulnerability.

    Free Webinar | Mastering WAAP/WAF ROI Analysis | Book Your Spot

    PoC Exploit Released

    This vulnerability existed in Oracle Virtualbox versions prior to 7.0.16, which allows a threat actor to escalate privileges to that of NT AUTHORITY\SYSTEM via Symbolic Link, which will either perform an arbitrary file delete or an arbitrary file move.

    This is because Oracle Virtualbox allows every user to write to the installation folder C:\ProgramData\VirtualBox.

    Moreover, Virtualbox attempts to move log files from the location as NT AUTHORITY\SYSTEM for backup actions with a maximum of 10 logs. 

    In addition to this, Virtualbox also tries to delete the 11th log on the location as NT AUTHORITY\SYSTEM, which gives rise to these two bugs (File Delete and File Move) that can be utilized to attain privilege escalation.

    As per the Proof-of-concept video shared for File Delete, the researcher uses a EXE file under the name “VBoxEoP_del.exe” which attempts to create a new log file (VBoxSDS.log.11) under the C:\ProgramData\Virtualbox directory and again attempts to delete the log file.Β 

    This action combined together with an MSI file (Config.msi) provided the researcher with a new cmd terminal with the permissions of NT AUTHORITY\SYSTEM.

    The scenario is similar to Arbitrary file move also, in which the EXE file attempts to move the files from the C:\ProgramData\Virtualbox directory.

    It is recommended that Virtualbox users upgrade to the latest versions to prevent threat actors from exploiting this vulnerability.

    Looking to Safeguard Your Company from Advanced Cyber Threats? DeployΒ TrustNetΒ to Your Radar ASAP.

    The post PoC Exploit Released For Critical Oracle VirtualBox Vulnerability appeared first on GBHackers on Security | #1 Globally Trusted Cyber Security News Platform.

    Go to source

    ΒΆΒΆΒΆΒΆΒΆ

    ΒΆΒΆΒΆΒΆΒΆ

    ΒΆΒΆΒΆΒΆΒΆ

    ΒΆΒΆΒΆΒΆΒΆ