"BianLian threat actors exploiting JetBrains TeamCity flaws with ransomware attacks."

Views expressed in this cybersecurity, cyber crime update are those of the reporters and correspondents.  Accessed on 11 March 2024, 1405 UTC.

Content and Source:   https://feedly.com/i/collection/content/user/f401222a-bca6-4c45-9cc1-183f239e8d86/category/7737d3c9-5fe2-4b34-8708-85e57085f895 ("Security News Bundle").

Please scroll down to read your selections.  Thanks for joining us today.

Russ Roberts (https://www.hawaiicybersecurityjournal.net).

Security News Bundle

137

MOST POPULAR

BianLian Threat Actors Exploiting JetBrains TeamCity Flaws in Ransomware Attacks

7 TTPs

•

50The Hacker News / 3h

The threat actors behind the BianLian ransomware have been observed exploiting security flaws in JetBrains TeamCity software to conduct their extortion-only attacks. According to a new report from GuidePoint Security, which responded to a recent intrusion, the incident "began with the exploitation of a TeamCity server which resulted in the deployment of a PowerShell implementation of

Experts released PoC exploit for critical Progress Software OpenEdge bug

Shared Modules (Enterprise T1129)

•

Security Affairs / 2h

•

CVE-2024-1403

Researchers released technical specifics and a PoC exploit for a recently disclosed flaw in Progress Software OpenEdge Authentication Gateway and AdminServer. Researchers from Horizon3.ai have published technical details and a proof-of-concept (PoC) exploit for the critical security flaw CVE-2024-1403 in Progress Software OpenEdge Authentication Gateway and AdminServer. “The Progress OpenEdge tea

British Library pushes the cloud button, says legacy IT estate cause of hefty rebuild

The Register – Security / 23min

Five months in and the mammoth post-ransomware recovery has barely begun The British Library says legacy IT is the overwhelming factor delaying efforts to recover from the Rhysida ransomware attack in late 2023.…

TODAY

Data Leakage Prevention in the Age of Cloud Computing: A New Approach

The Hacker News / 1h

As the shift of IT infrastructure to cloud-based solutions celebrates its 10-year anniversary, it becomes clear that traditional on-premises approaches to data security are becoming obsolete. Rather than protecting the endpoint, DLP solutions need to refocus their efforts to where corporate data resides - in the browser. A new guide by LayerX titled "On-Prem is Dead. Have You Adjusted Your Web

Magnet Goblin Delivers Linux Malware Using One-Day Vulnerabilities

5 TTPs

•

SecurityWeek / 1h

The financially motivated threat actor Magnet Goblin is targeting one-day vulnerabilities to deploy Nerbian malware on Linux systems. The post appeared first on SecurityWeek .

How do you lot feel about Pay or say OK to ads model, asks ICO

ICO seeks views on consent/pay models

•

The Register – Security / 2h

And does it count as consent? The UK's Information Commissioner's Office (ICO) has opened a consultation on "consent or pay" business models. We're sure readers of The Register will have a fair few things to say.…

Magnet Goblin group used a new Linux variant of NerbianRAT malware

IoC > 1 IP

•

Security Affairs / 3h

•

7 TTPs

The financially motivated hacking group Magnet Goblin uses various 1-day flaws to deploy custom malware on Windows and Linux systems. A financially motivated threat actor named Magnet Goblin made the headlines for rapidly adopting and exploiting 1-day vulnerabilities, CheckPoint warned. The group focuses on internet-facing services, in at least one instance the group exploited the vulnerability C

New Open Source Tool Hunts for APT Activity in the Cloud

CloudGrappler: Open-source tool for cloud threat

•

SecurityWeek / 3h

The CloudGrappler open source tool can detect the presence of known threat actors in cloud environments. The post appeared first on SecurityWeek .

YESTERDAY

Hackers exploited WordPress Popup Builder plugin flaw to compromise 3,300 sites

IoC > 2 domains and 1 URL

•

Security Affairs / 5h

•

Process Injection (Enterprise T1055)

Threat actors are hacking WordPress sites by exploiting a vulnerability, tracked as CVE-2023-6000, in old versions of the Popup Builder plugin. In January, Sucuri researchers reported that Balada Injector malware infected over 7100 WordPress sites using a vulnerable version of the Popup Builder WordPress plugin . Sucurity reported that on December 13th, the Balada Injector campaign started infect

Proof-of-Concept Exploit Released for Progress Software OpenEdge Vulnerability

42The Hacker News / 7h

Technical specifics and a proof-of-concept (PoC) exploit have been made available for a recently disclosed critical security flaw in Progress Software OpenEdge Authentication Gateway and AdminServer, which could be potentially exploited to bypass authentication protections. Tracked as CVE-2024-1403, the vulnerability has a maximum severity rating of 10.0 on the CVSS scoring system. It

Magnet Goblin Hacker Group Leveraging 1-Day Exploits to Deploy Nerbian RAT

Remote Access Software (Enterprise T1219)

•

56The Hacker News / 7h

A financially motivated threat actor called Magnet Goblin is swiftly adopting one-day security vulnerabilities into its arsenal in order to opportunistically breach edge devices and public-facing services and deploy malware on compromised hosts. “Threat actor group Magnet Goblin’s hallmark is its ability to swiftly leverage newly disclosed vulnerabilities, particularly targeting

Microsoft waited 6 months to patch actively exploited admin-to-kernel vulnerability

Rootkit (Enterprise T1014)

•

The Register – Security / 9h

PLUS: NSA shares cloud security tips; Infosec training for Jordanian women; Critical vulnerabilities Infosec in brief Cybersecurity researchers informed Microsoft that Notorious North Korean hackers Lazarus Group discovered the "holy grail" of rootkit vulnerabilities in Windows last year, but Redmond still took six months to patch the problem.…

Japan Blames North Korea for PyPI Supply Chain Cyberattack

Compromise Software Supply Chain (Enterprise T1195.002)

•

Dark Reading / 14h

Open source software ecosystem compromise leaves developers in Asia and around the globe at risk.

Lithuania security services warn of China’s espionage against the country

China escalates espionage against Lithuania

•

Security Affairs / 15h

A report published by Lithuanian security services warned that China has escalated its espionage operations against Lithuania. A report released by Lithuanian security services has cautioned that China has intensified espionage activities targeting Lithuania. Previously, the government of Beijing was interested in information about the ‘five poisons’ (Taiwan, Hong Kong, Tibet, Xinjiang, and Falun

YouTube stops recommending videos when signed out of Google

100+BleepingComputer / 15h

YouTube has changed how it works for people not signed into Google account or using incoginto mode, and it's not showing suggested videos anymore. This change, which is being tested with some random users, shows a very simple YouTube homepage without any videos or tips on what to watch. [...]

Hackers exploit WordPress plugin flaw to infect 3,300 sites with malware

IoC > 2 domains and 1 URL

•

100+BleepingComputer / 22h

•

2 TTPs

Hackers are breaching WordPress sites by exploiting a vulnerability in outdated versions of the Popup Builder plugin, infecting over 3,300 websites with malicious code. [...]

Magnet Goblin hackers use 1-day flaws to drop custom Linux malware

7 TTPs

•

90BleepingComputer / 22h

•

1-Day Goblin Magnet

A financially motivated hacking group named Magnet Goblin uses various 1-day vulnerabilities to breach public-facing servers and deploy custom malware on Windows and Linux systems. [...]