Government agencies in the US, Australia, and Canada are drawing attention to memory safety issues in open source software (OSS) code, warning that most projects vastly use code written in a memory-unsafe language. The use of such code introduces memory safety vulnerabilities that expose organizations and users to attacks, CISA, the FBI, Australia's Cyber Security Center (ACSC), and the Canadian Centre for Cybersecurity (CCCS) note in their joint guidance. READ MORE...
Healthcare revenue cycle management services provider Designed Receivable Solutions (DRS) has informed authorities that the number of individuals impacted by a recent data breach has increased to 585,000. The California-based company, which specializes in patient-centered and client-focused revenue cycle services, detected an intrusion in its network on January 22, 2024. An investigation revealed that hackers had accessed and stolen files from its systems. READ MORE...
Uncle Sam has put a $5 million bounty on any information leading to the arrest or conviction of self-titled "CryptoQueen" Ruja Ignatova, who is wanted in the US for apparently bilking victims out of more than $4 billion in what the Feds describe as the "one of the largest global fraud schemes in history." In 2014, Ignatova and Karl Sebastian Greenwood co-founded the "Bitcoin killer" OneCoin in Sofia, Bulgaria. READ MORE...
A federal grand jury in Maryland on Wednesday indicted a Russian who allegedly worked with his country's military intelligence to attack targets in Ukraine ahead of Russia's full-scale invasion in 2022. Amin Timovich Stigal, 22, participated in wiper attacks against Ukrainian military and civilian targets, federal prosecutors said, using malware disguised to look like ransomware that researchers later dubbed "WhisperGate." READ MORE...
On June 24, we observed a new campaign distributing a stealer targeting Mac users via malicious Google ads for the Arc browser. This is the second time in the past couple of months where we see Arc being used as a lure, certainly a sign of its popularity. It was previously used to drop a Windows RAT, also via Google ads. The macOS stealer being dropped in this latest campaign is actively being developed as an Atomic Stealer competitor. READ MORE...
A federal grand jury in Maryland returned an indictment charging a Russian citizen with conspiracy to hack into and destroy computer systems and data. If convicted, he faces a maximum penalty of five years in prison. The U.S. Department of State's Rewards for Justice program is offering a reward of up to $10 million for information on his location or his malicious cyberactivity. In advance of the full-scale Russian invasion of Ukraine, targets included Ukrainian Government systems. READ MORE...
Apple released its latest firmware update for its AirPods products to address a vulnerability that could give a threat actor unauthorized access. The vulnerability is tracked as CVE-2024-27867 and affects multiple AirPods models as well as Beats. "When your headphones are seeking a connection request to one of your previously paired devices, an attacker in Bluetooth range might be able to spoof the intended source device and gain access to your headphones," reported Apple in an advisory. READ MORE...
A critical vulnerability recently discovered in a widely used piece of software is putting huge swaths of the Internet at risk of devastating hacks, and attackers have already begun actively trying to exploit it in real-world attacks, researchers warn. The software, known as MOVEit and sold by Progress Software, allows enterprises to transfer and manage files using various specifications, including SFTP, SCP, and HTTP protocols and in ways that comply with regulations mandated under PCI and HIPAA. READ MORE...