Today's cybersecurity news highlights a critical vulnerability in Canonical's LXD and MicroCloud, alongside a significant cryptocurrency theft impacting Polymarket users. North Korean state-sponsored threat actors also made headlines for their alleged involvement in a record-breaking crypto heist.
Critical Vulnerability in Canonical LXD and MicroCloud Allows Client ImpersonationVulnerability
A severe security flaw (CVSS 10.0) in Canonical's LXD and MicroCloud software could enable attackers to pose as trusted clients. By accessing the HTTPS API over the network and possessing a trusted client's public certificate, an attacker could gain full control over the cluster and its virtual machines.
Why it matters: Organizations using LXD or MicroCloud should promptly apply any available patches to prevent unauthorized access and potential compromise of their virtualized environments.
Read more at The Hacker News ↗
Polymarket Traders Lose $2.7 Million in Supply Chain AttackBreach
Hackers infiltrated the prediction market platform Polymarket by injecting malicious code into a third-party script used for page speed optimization. This code manipulated signed-in traders' accounts, selling positions and transferring approximately $2.7 million in cryptocurrency to the attackers. Polymarket has pledged to refund all 726 affected users.
Why it matters: Website owners relying on third-party scripts should rigorously vet their providers and implement content security policies to mitigate risks from supply chain attacks, which can directly impact user funds or data.
Read more at The Hacker News ↗
FBI Attributes $6.3 Billion Binance Crypto Heist to North Korean Group TraderTraitorThreat
The FBI has formally linked the massive $6.3 billion cryptocurrency theft from Binance to the North Korea-backed hacking group known as TraderTraitor (also tracked as Jade Sleet, PUKCHONG, and UNC4899). This incident marks the largest cryptocurrency heist on record, highlighting the significant financial impact of state-sponsored cybercrime.
Why it matters: Businesses handling digital assets or operating in high-value sectors must remain vigilant against sophisticated state-sponsored threat actors, investing in advanced security measures and threat intelligence.
Read more at The Hacker News ↗
Alpine Linux Rebuilds GitLab After Attempted RCE AttackVulnerability
Alpine Linux, a prominent open-source project, took its GitLab server offline and reset all passwords following an attempted remote code execution (RCE) attack. The incident, which occurred in late October, involved hackers trying to exploit a critical GitLab vulnerability within Alpine's development infrastructure.
Why it matters: Regularly patching all software, especially critical development tools like GitLab, is essential for small businesses to prevent successful exploitation of known vulnerabilities and protect their infrastructure from compromise.
Read more at BleepingComputer ↗
NetamLoader Malware Targets Asian Government Windows 10 SystemsThreat
Cybersecurity researchers have uncovered a highly advanced infection chain deploying a novel .NET assembly-loading framework named NetamLoader. This sophisticated malware specifically targets custom Windows 10 builds utilized by government organizations across Asia, suggesting a focused and persistent threat actor.
Why it matters: Organizations, particularly those handling sensitive data, should employ advanced endpoint detection and response (EDR) solutions to identify and neutralize sophisticated malware that targets specific system configurations.
Read more at The Hacker News ↗
This round-up is compiled and summarised in our own words from public reporting; follow the links above for full details at the original sources.