Today's cybersecurity headlines reveal a critical warning for ShareFile users to shut down Storage Zone Controllers due to an active threat, alongside the discovery of multiple new vulnerabilities impacting various systems from bootloaders to cryptocurrency wallets. We also see reports of ongoing cybercriminal activity, including supply chain attacks targeting crypto developers and widespread WordPress site compromises.
ShareFile Users Urged to Shut Down Storage Zone Controllers Amid Credible ThreatVulnerability
Progress Software has issued an urgent directive to customers using its ShareFile platform, specifically those with on-premise Storage Zone Controllers, advising them to immediately power down these servers. This action is a response to a 'credible external security threat' targeting the software, prompting the company to temporarily restrict access to affected accounts as a precautionary measure while investigations are underway.
Why it matters: If your business uses ShareFile's on-premise Storage Zone Controllers, it's critical to follow Progress Software's instructions immediately to prevent potential data breaches or system compromise.
Read more at The Hacker News ↗
New U-Boot Flaws Enable Stealthy Firmware AttacksVulnerability
Six new security vulnerabilities have been identified in U-Boot, a widely used bootloader found in various embedded devices like routers and smart cameras. These flaws, four of which can crash devices, and two allowing malicious code execution during startup, could enable attackers to install persistent malware and bypass security protections, making attacks difficult to detect.
Why it matters: If your business relies on devices that use U-Boot, such as network equipment, ensure firmware is kept up-to-date and apply patches as they become available to guard against sophisticated boot-level compromises.
Read more at The Hacker News ↗
Supply Chain Attack on Injective Labs GitHub Targets Crypto WalletsThreat
Threat actors compromised the GitHub repository of Injective Labs' SDK project to distribute a malicious package via the npm registry. This tainted package, @injectivelabs/[email protected], was designed to steal cryptocurrency wallet private keys and mnemonic seed phrases through disguised telemetry functions.
Why it matters: Businesses developing or using software with open-source dependencies, especially in the crypto space, must implement rigorous supply chain security measures and vet all third-party components to prevent malicious code injection.
Read more at The Hacker News ↗
XRING Flaw Allows Remote Clients to Crash HTTP/3 ServersVulnerability
A recently disclosed vulnerability, dubbed XRING, exists in Alibaba's XQUIC library, which handles QUIC and HTTP/3 protocols. This flaw allows any remote client to crash a server with a small, legitimate burst of QPACK traffic, requiring no authentication or malformed packets. A patch is not yet available.
Why it matters: If your website or services utilize HTTP/3 with Alibaba's XQUIC library, be aware of this unpatched vulnerability that could lead to denial-of-service, and monitor for updates or mitigation strategies.
Read more at The Hacker News ↗
Thousands of WordPress Sites Backdoored by WP-SHELLSTORM CampaignThreat
An exposed server belonging to a cybercrime group has revealed details of a mass hacking operation named WP-SHELLSTORM, which has backdoored thousands of WordPress websites. The server's contents, left unsecured for weeks, provided researchers with insights into the tools, logs, and target lists of the operation, which aimed to compromise over 1.4 million sites.
Why it matters: If your business runs a WordPress site, ensure all themes and plugins are updated, strong security practices are in place, and conduct regular security audits to detect and remove any potential backdoors.
Read more at The Hacker News ↗
Ransomware Negotiator Sentenced for Aiding BlackCat AttacksRansomware
A former ransomware negotiator has received a 70-month prison sentence in the U.S. for conspiring with the BlackCat ransomware group. The individual was found to have assisted in extorting multiple victims and collaborated with other cybersecurity professionals to target additional victims.
Why it matters: This highlights the severe legal consequences for individuals who facilitate ransomware operations, even those seemingly acting as intermediaries. Businesses should always report ransomware incidents to law enforcement rather than engaging with unauthorized negotiators.
Read more at The Hacker News ↗
Ill Bloom Vulnerability Drains Over $5 Million from Crypto WalletsVulnerability
A new crypto wallet flaw, dubbed 'Ill Bloom' by Coinspect, exploits weak randomness in the generation of recovery phrases, allowing attackers to reconstruct these phrases and gain control over affected wallets. This vulnerability has already been actively exploited, leading to the theft of over $5 million from cryptocurrency wallets.
Why it matters: If your business uses cryptocurrency wallets, verify that the wallet software generates recovery phrases using robust cryptographic randomness and consider transferring assets to wallets confirmed to be immune from this flaw.
Read more at The Hacker News ↗
Fake Microsoft Entra Passkey Enrollment Used in Vishing AttacksThreat
A threat actor, O-UNC-066, is using voice-based phishing (vishing) attacks to trick Microsoft 365 users into enrolling fake Entra passkeys. These attacks aim to gain access to Microsoft 365 accounts and carry out data extortion, utilizing a sophisticated phishing kit that targets the passkey enrollment process.
Why it matters: Educate employees about vishing tactics and the dangers of enrolling passkeys or providing credentials via unexpected calls or links, reinforcing that legitimate services will not ask for sensitive information in this manner.
Read more at The Hacker News ↗
Critical Auth Bypass Exploited in Gitea Docker ImageVulnerability
Hackers are actively exploiting a critical authentication bypass vulnerability present in the official Docker image for Gitea, a self-hosted Git service. This flaw enables attackers to impersonate any user, including administrative accounts, leading to potential complete compromise of Git repositories and associated data.
Why it matters: If your business uses Gitea with its official Docker image, immediately apply the necessary patches or updates to prevent unauthorized access and potential data manipulation or theft of your code repositories.
Read more at BleepingComputer ↗
New MODBEACON RAT Used by China-Linked Silver Fox GroupThreat
The China-linked cybercrime group Silver Fox has been linked to MODBEACON, a new remote access trojan (RAT) built in Rust. This RAT uses gRPC streaming for encrypted command-and-control (C2) communication and is propagated through counterfeit installers, often leveraging SEO poisoning techniques.
Why it matters: Businesses should educate employees on identifying suspicious software installers, avoid downloading applications from unofficial sources, and use robust endpoint detection and response (EDR) solutions to detect advanced malware like MODBEACON.
Read more at The Hacker News ↗
This round-up is compiled and summarised in our own words from public reporting; follow the links above for full details at the original sources.