Almost 25,000 email addresses and passwords allegedly belonging to employees of leading health organisations such as the World Health Organisation (WHO) and the US National Institutes of Health (NIH) have been leaked online in what is being described as a "harassment campaign". The news comes as WHO reported that it has been forced to double its security resources due to a significant increase in cyber attacks on the organisation since mid-March. READ MORE...
Hackers have a new favorite topic of conversation on underground forums: How to obtain - and leverage - valuable credentials for Zoom, Skype, Webex and other web conferencing platforms increasingly used by remote workers. That's what Etay Maor, chief security officer at IntSights, has discovered over the past few weeks in his examinations of various underground forums. READ MORE...
With the U.S. Small Business Administration continuing to play a high-profile role in getting cash to companies that are struggling because of the coronavirus pandemic, cybercriminals are stepping up their efforts to steal money from those very firms. Research published Monday by IBM's incident response team shows that attackers are spoofing the SBA in emails to try to install a remote hacking tool capable of stealing passwords and accessing webcams. READ MORE...
Hackers have been exploiting a previously unknown vulnerability in Sophos XG devices to launch SQL injection attacks to steal usernames and hashed passwords of user accounts. The British security firm last week encountered an XG Firewall with a suspicious field value visible in the management interface before launching an immediate investigation that resulted in the discovery of an ongoing attack. READ MORE...
The developers behind the Shade ransomware on Monday announced that they ceased operations and publicly released decryption keys to let their victims recover files for free. Also referred to as Troldesh and Encoder.858, Shade has been present on the malware landscape since 2014. Updated with backdoor capabilities in 2016, the Trojan became one of the most prevalent threats last year, when it was observed targeting over 340 file extensions for encryption (using AES 256). READ MORE...
A threat actor focusing on Android systems has expanded their malware-as-a-service (MaaS) business with file-encrypting capabilities for ransomware operations. Named Lucy Gang by researchers, the actor is a Russian-speaking team that made itself known two years ago with the Black Rose Lucy service, offering botnet and malware dropping capabilities for Android devices. READ MORE...
The "Real-Time Find and Replace" WordPress plugin was updated recently to address a high severity vulnerability that could be exploited to inject code into a website. Designed to allow WordPress site admins to dynamically replace HTML content from themes and other plugins with content of their choosing before the page is served to users, the plugin is available as open source and has over 100,000 installations. READ MORE...