Today's cybersecurity landscape features critical warnings about actively exploited vulnerabilities and a notable data breach affecting e-commerce merchants. Additionally, new threat actor tactics, significant GDPR fines, and an unusual cyberattack against a ransomware group highlight the evolving challenges.
Fake LastPass Installers Distribute Advanced MalwareThreat
Threat actors are distributing a deceptive LastPass Authenticator installer, primarily via GitHub, which contains a sophisticated Windows kernel driver. This driver is signed with a legitimate Microsoft certificate, allowing it to bypass and disable antivirus and endpoint detection and response (EDR) software before deploying a password-stealing malware.
Why it matters: Always download software directly from official vendor websites to avoid malicious installers, as fake applications can severely compromise your systems and steal sensitive credentials.
Read more at The Hacker News ↗
CISA Warns of Actively Exploited Linux Kernel VulnerabilitiesVulnerability
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent alert regarding the active exploitation of three critical Linux kernel flaws. These vulnerabilities could lead to severe outcomes, including denial-of-service conditions, memory disclosure, or memory modification on affected systems.
Why it matters: Regularly update your Linux-based servers and devices to patch known kernel vulnerabilities, as unpatched systems are prime targets for active exploitation by malicious actors.
Read more at BleepingComputer ↗
BigCommerce Merchants Hit by Supply Chain Data BreachBreach
BigCommerce has notified its merchants about a data breach stemming from compromised credentials for third-party Ribon applications. Attackers exploited these compromised credentials to inject malicious scripts into various online stores hosted on the e-commerce platform.
Why it matters: If you operate an online store, regularly audit third-party integrations and ensure robust security practices for all connected applications to prevent supply chain attacks that can compromise your website and customer data.
Read more at BleepingComputer ↗
Google Fined €403 Million for GDPR Location Data ViolationsPolicy
Google has been hit with a significant fine of €403 million by Ireland's Data Protection Commission (DPC) for violations of the EU's General Data Protection Regulation (GDPR). The fine pertains to how Google handled users' location data across three of its features between May 2018 and February 2020, with the DPC ordering compliance within six months.
Why it matters: This highlights the stringent requirements of GDPR; small businesses collecting any user data, especially location information, must ensure transparent consent and adherence to data protection laws to avoid heavy penalties.
Read more at The Hacker News ↗
North Korean Threat Actors Compromise 30,000 Devices in Crypto Theft CampaignThreat
A joint cybersecurity advisory has revealed details of the 'Contagious Interview' campaign, led by North Korean threat actors, which has compromised at least 30,000 devices globally. This sophisticated operation has resulted in the theft of over $10.71 million in cryptocurrency and account credentials from more than 7,000 crypto wallets, primarily targeting web designers, engineers, and crypto specialists.
Why it matters: Be extremely cautious of unsolicited job offers or communications, especially those involving cryptocurrency, as threat actors frequently use social engineering to trick professionals into installing malware and stealing assets.
Read more at The Hacker News ↗
ShinyHunters Claims to Hack Cl0p Ransomware Group's Dark Web SiteOther
The cybercrime group ShinyHunters has reportedly hijacked the dark web leak site of the notorious Cl0p ransomware gang. ShinyHunters claims to have stolen data from Cl0p's systems, potentially exposing organizations that had previously paid ransoms to new extortion threats.
Why it matters: Even major ransomware groups are not immune to attacks, but this incident underscores the danger for victims whose data may now be exposed by multiple threat actors.
New TASK#STOMP PowerShell Backdoor Steals Sensitive DataThreat
Researchers have uncovered a new campaign named TASK#STOMP, which deploys a PowerShell backdoor specifically designed for extensive data exfiltration. This backdoor harvests business documents, monitors the filesystem for new files, steals Wi-Fi passwords and clipboard content, captures screenshots, and can execute arbitrary commands on compromised machines.
Why it matters: Implement strong endpoint protection and monitor PowerShell script execution on your systems, as backdoors like TASK#STOMP can silently steal critical business information and credentials.
Read more at The Hacker News ↗
WordPress 'Click2Shell' Vulnerability Allows Remote PHP ExecutionVulnerability
Technical details and a proof-of-concept exploit have been released for 'Click2Shell,' a new cross-site request forgery (CSRF) vulnerability affecting WordPress Core. This flaw could allow attackers to execute PHP code on the server, posing a significant risk to websites running the popular CMS.
Why it matters: Keep your WordPress installations, themes, and plugins updated immediately upon new releases to patch critical vulnerabilities like Click2Shell, which could lead to full server compromise.
Read more at BleepingComputer ↗
This round-up is compiled and summarised in our own words from public reporting; follow the links above for full details at the original sources.