"China-linked APT Gelsemium uses a news Linux backdoor dubbed WolfsBane."

Views expressed in this cybersecurity, cyber crime update are those of the reporters and correspondents.  Accessed on 23 November 2024, 1447 UTC.

Content and Source:  Email subscripiton via http://feedly.com.   https://feedly.com/i/subscription/feed%2Fhttp%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2Ffeed

Please check link or scroll down to read your selections.  Thanks for joining us today.

Russ Roberts (https://www.hawaiicybersecurityjournal.net).

Security Affairs

68K followers23 articles per week#security#tech

8

Today

China-linked APT Gelsemium uses a new Linux backdoor dubbed WolfsBane

by Pierluigi Paganini / 1h

China-linked APT Gelsemium has been observed using a new Linux backdoor dubbed WolfsBane in attacks targeting East and Southeast Asia. China-linked APT Gelsemium has deployed a previously unknown Linux backdoor, WolfsBane, in attacks targeting East and Southeast Asia, according to ESET. Victims include entities in Taiwan, the Philippines, and Singapore, as seen in VirusTotal samples from March 20

Microsoft seized 240 sites used by the ONNX phishing service

9 TTPs

•

by Pierluigi Paganini / 3h

•

Microsoft seizes phishing websites

Microsoft disrupted the ONNX phishing service, seizing 240 sites and naming an Egyptian man as the operator behind the operation. Microsoft announced the disruption of the ONNX phishing service, another success against cybercrime which led to the seizure of 240 sites. The IT giant also identified and publicly disclosed the identity of an Egyptian man, Abanoub Nady (aka MRxC0DER), who allegedly ru

Yesterday

U.S. CISA adds Apple, Oracle Agile PLM bugs to its Known Exploited Vulnerabilities catalog

Execution (Enterprise TA0002)

•

by Pierluigi Paganini / 1d

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Apple, Oracle Agile PLM bugs to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the following vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog : CVE-2024-44308 Apple Multiple Products Code Execution Vulnerability CVE-2024-44309 Apple Multiple Pr

Nov 21, 2024

More than 2,000 Palo Alto Networks firewalls hacked exploiting recently patched zero-days

IoC > 1 IP

•

by Pierluigi Paganini / 1d

•

5 TTPs

Threat actors already hacked thousands of Palo Alto Networks firewalls exploiting recently patched zero-day vulnerabilities. Thousands of Palo Alto Networks firewalls have reportedly been compromised in attacks exploiting recently patched zero-day vulnerabilities ( CVE-2024-0012 and CVE-2024-9474 ) in PAN-OS. CVE-2024-0012 is a vulnerability in Palo Alto Networks PAN-OS that allows unauthenticate

Ransomhub ransomware gang claims the hack of Mexican government Legal Affairs Office

Mexico investigates ransomware hack

•

by Pierluigi Paganini / 1d

Mexico is investigating a ransomware attack targeting its legal affairs office, as confirmed by the president amidst growing cybersecurity concerns. Mexico’s president announced the government is investigating an alleged ransomware hack that targeted the administration’s legal affairs office. “Today they are going to send me a report on the supposed hacking.” President Claudia Sheinbaum said duri

US DoJ charges five alleged members of the Scattered Spider cybercrime gang

10 TTPs

•

by Pierluigi Paganini / 1d

•

Five charged in Scattered Spider scheme

The U.S. Justice Department charged five suspects linked to the Scattered Spider cybercrime gang with wire fraud conspiracy. The U.S. Justice Department charged five alleged members of the cybercrime gang Scattered Spider (also known as UNC3944 , 0ktapus ) with conspiracy to commit wire fraud. “Law enforcement today unsealed criminal charges against five defendants who allegedly targeted employee

Threat actor sells data of over 750,000 patients from a French hospital

French hospitals suffer major data breaches

•

by Pierluigi Paganini / 2d

A threat actor had access to electronic patient record system of an unnamed French hospital, and the health data of 750,000 patients was compromised. An unnamed French hospital suffered a data breach that impacted more than 758,000 patients, a threat actor had access to the electronic patient record system of the organization. The threat actor claims that exposed records include name, first name,

Nov 20, 2024

Decade-old local privilege escalation bugs impacts Ubuntu needrestart package

4 TTPs

•

by Pierluigi Paganini / 2d

Decade-old flaws in the needrestart package in Ubuntu Server could allow local attackers to gain root privileges without user interaction. The Qualys Threat Research Unit (TRU) discovered five Local Privilege Escalation (LPE) decade-old security vulnerabilities in the needrestart package that could allow a local attacker to gain root privileges without requiring user interaction. The needrestart

End of feed