Cyber Security Help

A recently identified Chinese government-backed hacker group, known as ‘Salt Typhoon,’ has reportedly infiltrated several US Internet service providers (ISPs) in an effort to steal sensitive information, according to a Wall Street Journal report.

South Korea's National Intelligence Service, the Prosecutors' Office, the National Police Agency, the Defense Security Command, and the Cyber Operations Command, have issued a joint cybersecurity advisory to warn about the increasing cyber threats posed by North Korean hacking groups targeting the country's construction and machinery sectors.

A North Korea-linked threat actor known as Moonstone Sleet has been detected pushing malicious npm packages to the JavaScript package registry. Moonstone Sleet first garnered attention in May, when Microsoft released a report detailing the group's dual focus on espionage and financial cyberattacks. Utilizing a diverse array of techniques, Moonstone Sleet targeted aerospace, education, and software organizations, as well as developers.

Singapore authorities have recovered over $40 million defrauded in a business email compromise (BEC) scam, Interpol revealed. On 23 July 2024, a Singapore-based commodity firm reported to the Singapore Police Force (SPF) that they had fallen victim to a BEC scam. In such scams, fraudsters gain access to or impersonate business email accounts to deceive employees into transferring money to their accounts.

In a coordinated international effort, the US Internal Revenue Service-Criminal Investigation (IRS-CI), the Department of Justice (DoJ), and the Federal Bureau of Investigation (FBI), along with Germany's Federal Criminal Police Office (BKA) and the Attorney General’s Office in Frankfurt, seized the domain of online crypto wallet Cryptonator. The platform was taken down for its failure to implement appropriate anti-money laundering controls and its role in facilitating illicit activities.

A recent investigation has uncovered that software essential to the operation of Britain's nuclear submarines was developed by engineers based in Russia and Belarus, according to a report by The Telegraph. The software, intended to be created by British IT staff with appropriate security clearances, was instead partially outsourced to developers in Siberia, Russia, and Minsk, Belarus.

The China-linked threat actor Evasive Panda, also known as StormBamboo, compromised an unnamed internet service provider (ISP) to push malicious software updates to target companies in mid-2023. Evasive Panda, aka Bronze Highland and Daggerfly, has been active since at least 2012. The group is notorious for using backdoors like MgBot (also known as POCOSTICK) and Nightdoor (aka NetMM and Suzafk) to extract sensitive information.

A new cyber espionage campaign by the the China-linked state-sponsored threat actor tracked as APT41 has been observed targeting an unnamed Taiwanese government-affiliated research institute with the ShadowPad malware and the Cobalt Strike tool.

Cybercriminals exploit recently patched VMware ESXi flaw to deploy ransomware A recently patched vulnerability in VMware ESXi hypervisors is being actively exploited by threat actors to gain access to target networks and deploy ransomware. The flaw (CVE-2024-37085) allows attackers to obtain full administrative permissions on domain-joined ESXi hypervisors. Attackers utilize specific commands to create a group named “ESX Admins” in the domain and add a user to it.

A Chinese nation-state threat actor has been observed leveraging the LODEINFO and NOOPDOOR malware families to steal sensitive information from Japanese organizations, Israely cybersecurity firm Cybereason said in a recent report. The threat actor, which the company tracks as ‘Cuckoo Spear,’ has been linked to a known Chinese state-backed hacker group APT10.