GBHackers on Security | #1 Globally Trusted Cyber Security News Platform

An investigation revealed an intrusion in Asia involving the BellaCiao .NET malware, as the initial sample (MD5 14f6c034af7322156e62a6c961106a8c) provided valuable insights into its version and development timeline.  A second suspicious sample on the same machine, while exhibiting similar functionality to BellaCiao, was a C++ reimplementation of an older version, suggesting a potential evolution in the […]

The post BellaCiao, A new .NET Malware With Advanced Sophisticated Techniques appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

A seemingly benign health app, “BMI CalculationVsn,” was found on the Amazon App Store, which secretly collected sensitive user data, including installed app package names and incoming SMS messages, posing a significant privacy threat. The BMI calculator app conceals malicious intent, as the app’s primary function is a smokescreen for a variety of harmful activities, […]

The post Malicious Apps On Amazon Appstore Records Screen And Interecpt OTP Verifications appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

The Lazarus Group has recently employed a sophisticated attack, dubbed “Operation DreamJob,” to target employees in critical sectors like nuclear energy, which involves distributing malicious archive files disguised as legitimate job offers.  Once executed, these files unleash a multi-stage infection chain, comprising a downloader, loader, and backdoor, allowing the threat actor to establish persistent access […]

The post Lazarus Hackers Using New VNC Based Malware To Attack Organizations Worldwide appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

NodeStealer, initially a JavaScript-based malware, has evolved into a more sophisticated Python-based threat that targets Facebook Ads Manager accounts, stealing sensitive financial and business data in addition to credit card details and browser information.  The malware is delivered through spear-phishing emails with malicious links, uses DLL sideloading and encoded PowerShell for stealthy execution, and exfiltrates […]

The post New Python NodeStealer Attacking Facebook Business To Steal Login Credentials appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

A new Mirai-based botnet, “Hail Cock Botnet,” has been exploiting vulnerable IoT devices, including DigiEver DVRs and TP-Link devices with CVE-2023-1389. The botnet, active since September 2024, leverages a variant of Mirai malware with enhanced encryption.  A recent uptick in attacks targeting the URI /cgi-bin/cgi_main.cgi, exploiting an RCE vulnerability in DigiEver DS-2105 Pro devices, aligns […]

The post DigiEver IoT Devices Exploited To Deliver Mirai-based Malware appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

A joint Cybersecurity Advisory (CSA) warns of ongoing exploitation attempts by Iranian Islamic Revolutionary Guard Corps (IRGC)-affiliated cyber actors using the online persona “CyberAv3ngers.”  These actors are targeting and compromising Unitronics Vision Series programmable logic controllers (PLCs), specifically those manufactured by the Israeli company Unitronics. Water and Wastewater Systems (WWS) are among the many critical […]

The post Hackers Exploiting PLC Controllers In US Water Management System To Gain Remote Access appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Cybersecurity threats are increasingly targeting vulnerabilities in publicly exposed assets like VPNs and firewalls, exploited by various actors, including APT groups and ransomware gangs.  While this focus is understandable, it’s crucial not to neglect traditional attack vectors like phishing emails, malicious websites, and social engineering, as they remain potent tools in the hands of attackers. […]

The post New Watering Hole Attack That Used Fake Adobe Flash Player Update To Deliver Malware appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

North Korean hackers are estimated to have stolen a staggering $2.2 billion in 2024, up 21% from 2023. With advanced tactics and increasing sophistication, the Democratic People’s Republic of Korea (DPRK) has positioned itself as a dominant force in crypto theft, targeting both decentralized finance (DeFi) platforms and centralized exchanges to fund its state-sponsored programs. […]

The post North Korean Hackers Stolen $2.2 Billion from Crypto Platforms in 2024 appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

A staggering 17 million patient records, containing sensitive personal and medical information, have been stolen in a devastating ransomware attack on PIH Health. The cyberattack, which began on December 1, has disrupted operations at three hospitals: PIH Health Downey Hospital, PIH Health Whittier Hospital, and PIH Health Good Samaritan Hospital, as well as affiliated urgent […]

The post 17M Patient Records Stolen in Ransomware Attack on Three California Hospitals appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

A new malware variant called Nunu Stealer is making headlines after being advertised on underground hacker forums and Telegram channels. Priced at $100 per month, this malicious tool is gaining attention for its extensive capabilities and potential to wreak havoc on individuals and organizations alike. According to a post shared by a ThreatMon on X, the malware […]

The post Threat Actors Selling Nunu Stealer On Hacker Forums appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

A critical vulnerability has been identified in Siemens’ User Management Component (UMC), which could allow unauthenticated remote attackers to execute arbitrary code. The flaw, designated CVE-2024-49775, is a heap-based buffer overflow vulnerability. Siemens has issued Security Advisory SSA-928984 and urges customers to implement recommended fixes or mitigations to minimize the risks. Details of the Vulnerability The […]

The post Siemens UMC Vulnerability Allows Arbitrary Remote Code Execution appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Foxit Software has issued critical security updates for its widely used PDF solutions, Foxit PDF Reader and Foxit PDF Editor. The updates—Foxit PDF Reader 2024.4 and Foxit PDF Editor 2024.4/13.1.5—were released on December 17, 2024, to counter vulnerabilities that could leave users exposed to remote code execution (RCE) attacks. Details of the Vulnerabilities The security flaws […]

The post Foxit PDF Editor Vulnerabilities Allows Remote Code Execution appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Microsoft has swiftly addressed a critical security vulnerability affecting Windows 11 (version 23H2), which could allow local attackers to escalate privileges to the SYSTEM level. Security researcher Alex Birnberg showcased the exploit during the renowned TyphoonPWN 2024 cybersecurity competition, securing third place for his demonstration of the flaw. TyphoonPWN, one of the premier cybersecurity competitions, […]

The post Windows 11 Privilege Escalation Vulnerability Lets Attackers Execute Code to Gain Access appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

A Romanian man has been sentenced to 20 years in prison for his involvement in the notorious NetWalker ransomware attacks. The sentencing, which took place in the Middle District of Florida, also included a forfeiture order of $21.5 million in illicit proceeds, as well as restitution payments totaling $14,991,580.01. Daniel Christian Hulea, 30, of Jucu […]

The post NetWalker Ransomware Operator Sentenced to 20 Years in Prison appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

 The Cybersecurity and Infrastructure Security Agency (CISA) has sounded the alarm over a critical vulnerability impacting BeyondTrust’s Privileged Remote Access (PRA) and Remote Support (RS) products. This newly uncovered flaw tracked as CVE-2024-12356, could allow attackers to execute malicious commands, posing a severe risk to global enterprises relying on these tools for secure remote access and […]

The post CISA Warns of BeyondTrust Privileged Remote Access Exploited in Wild appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

 The Cybersecurity and Infrastructure Security Agency (CISA) has issued eight detailed advisories on vulnerabilities affecting Industrial Control Systems (ICS). These vulnerabilities impact critical software and hardware across various industries, posing risks of service disruption, unauthorized access, and malicious code execution. The following are the key vulnerabilities, their associated Common Vulnerabilities and Exposures (CVEs), and mitigation […]

The post CISA Releases Eight New ICS Advisories to Defend Cyber Attacks appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

A new and advanced ransomware family, dubbed NotLockBit, has emerged as a significant threat in the cybersecurity landscape, closely mimicking the behavior and tactics of the notorious LockBit ransomware. NotLockBit notably distinguishes itself by being one of the first ransomware strains designed to effectively attack both macOS and Windows operating systems, showcasing powerful cross-platform capabilities. […]

The post NotLockBit – Previously Unknown Ransomware Attack Windows & macOS appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Through the use of XLoader and impersonating SharePoint notifications, researchers were able to identify a sophisticated malware delivery campaign.  A link that was disguised as a legitimate SharePoint notification was included in the emails that were sent out at the beginning of the attack.  The engine flagged the message as malicious based on several factors: […]

The post Beware Of Malicious SharePoint Notifications That Delivers Xloader Malware appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Researchers have identified a rise in malicious activity on the VSCode Marketplace, highlighting the vulnerability of the platform to supply chain attacks similar to those previously seen in the npm community. Malicious actors are increasingly exploiting npm packages to distribute malicious code, mirroring tactics previously used in VSCode extensions that involve the npm package etherscancontracthandler, […]

The post Malicious Supply Chain Attacking Moving From npm Community To VSCode Marketplace appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

TA397, also known as Bitter, targeted a Turkish defense organization with a spearphishing email containing a RAR archive, which included a decoy PDF, a malicious LNK file disguised as a PDF, and an ADS file with PowerShell code.  This technique, common for TA397, leverages NTFS ADS to establish persistence and deploy further malware like wmRAT […]

The post Hackers Weaponizing LNK Files To Create Scheduled Task And Deliver Malware Payload appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.