Microsoft Warns of New INC Ransomware Targeting U.S. Healthcare Sector

Microsoft has revealed that a financially motivated threat actor has been observed using a ransomware strain called INC for the first time to target the healthcare sector in the U.S.
The tech giant's threat intelligence team is tracking the activity under the name Vanilla Tempest (formerly DEV-0832).
"Vanilla Tempest receives hand-offs from GootLoader infections by the threat actor Storm-0494,


https://thehackernews.com/2024/09/microsoft-warns-of-new-inc-ransomware.html?utm_source=dlvr.it&utm_medium=blogger

SambaSpy Attacking Windows Users With Weaponized PDF Files

Threat actors often make use of weaponized PDF files as they enable them to deliver malware and execute attacks through phishing schemes.  These PDFs can contain embedded malicious code, links, and scripts that exploit vulnerabilities in PDF readers, making them a preferred method for evading traditional security measures. Kaspersky Lab researchers recently discovered that SambaSpy […]


The post SambaSpy Attacking Windows Users With Weaponized PDF Files appeared first on Cyber Security News.


https://cybersecuritynews.com/sambaspy-windows-users-weaponized-pdf/?utm_source=dlvr.it&utm_medium=blogger

Cyber Attack on Security Firm Dr.Web Forces Servers Disconnection

In a recent cyberattack, Russian cybersecurity firm Doctor Web (Dr.Web) was forced to disconnect all its servers to mitigate the threat and ensure the safety of its infrastructure. Cyber Attack on Security Firm Dr.Web Forces Servers Disconnection The attack, which began on Saturday, September 14, 2024, was swiftly identified and managed by the company’s security […]


The post Cyber Attack on Security Firm Dr.Web Forces Servers Disconnection appeared first on Cyber Security News.


https://cybersecuritynews.com/cyber-attack-dr-web-server/?utm_source=dlvr.it&utm_medium=blogger

New "Raptor Train" IoT Botnet Compromises Over 200,000 Devices Worldwide

Cybersecurity researchers have uncovered a never-before-seen botnet comprising an army of small office/home office (SOHO) and IoT devices that are likely operated by a Chinese nation-state threat actor called Flax Typhoon (aka Ethereal Panda or RedJuliett).
The sophisticated botnet, dubbed Raptor Train by Lumen's Black Lotus Labs, is believed to have been operational since at least May 2020,


https://thehackernews.com/2024/09/new-raptor-train-iot-botnet-compromises.html?utm_source=dlvr.it&utm_medium=blogger

Chinese Engineer Charged in U.S. for Years-Long Cyber Espionage Targeting NASA and Military

A Chinese national has been indicted in the U.S. on charges of conducting a "multi-year" spear-phishing campaign to obtain unauthorized access to computer software and source code created by the National Aeronautics and Space Administration (NASA), research universities, and private companies.
Song Wu, 39, has been charged with 14 counts of wire fraud and 14 counts of aggravated identity theft.


https://thehackernews.com/2024/09/chinese-engineer-charged-in-us-for.html?utm_source=dlvr.it&utm_medium=blogger

North Korean Hackers Target Energy and Aerospace Industries with New MISTPEN Malware

A North Korea-linked cyber-espionage group has been observed leveraging job-themed phishing lures to target prospective victims in energy and aerospace verticals and infect them with a previously undocumented backdoor dubbed MISTPEN.
The activity cluster is being tracked by Google-owned Mandiant under the moniker UNC2970, which it said overlaps with a threat group known as TEMP.Hermit, which is


https://thehackernews.com/2024/09/north-korean-hackers-target-energy-and.html?utm_source=dlvr.it&utm_medium=blogger

Patch Issued for Critical VMware vCenter Flaw Allowing Remote Code Execution

Broadcom on Tuesday released updates to address a critical security flaw impacting VMware vCenter Server that could pave the way for remote code execution.
The vulnerability, tracked as CVE-2024-38812 (CVSS score: 9.8), has been described as a heap-overflow vulnerability in the DCE/RPC protocol.
"A malicious actor with network access to vCenter Server may trigger this vulnerability by sending a


https://thehackernews.com/2024/09/patch-issued-for-critical-vmware.html?utm_source=dlvr.it&utm_medium=blogger

VMware vCenter Server Vulnerabilities Let Attackers Execute Remote Code

VMware has disclosed two critical security vulnerabilities affecting its vCenter Server and Cloud Foundation products that could allow attackers to execute remote code and escalate privileges. The company is urging customers to patch affected systems immediately. The more critical flaw, tracked as CVE-2024-38812, is a heap-overflow vulnerability in implementing the DCERPC protocol within vCenter Server. […]


The post VMware vCenter Server Vulnerabilities Let Attackers Execute Remote Code appeared first on Cyber Security News.


https://cybersecuritynews.com/vmware-vcenter-server-remote-code/?utm_source=dlvr.it&utm_medium=blogger

VMware patches over remote make-me-root holes in vCenter Server, Cloud Foundation

Bug reports made in China Broadcom has emitted a pair of patches for vulnerabilities in VMware vCenter Server that a miscreant with network access to the software could exploit to completely commandeer a system. This also affects Cloud Foundation.… This…

Read more →


https://www.itsecuritynews.info/vmware-patches-over-remote-make-me-root-holes-in-vcenter-server-cloud-foundation/?utm_source=dlvr.it&utm_medium=blogger

Apple iOS 18 Released with Fixes for 32 Security Vulnerabilities

Apple has released iOS 18, addressing a total of 32 security vulnerabilities across various components of its operating system. This comprehensive update is available for iPhone XS and later models, as well as iPad Pro 13-inch, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and […]


The post Apple iOS 18 Released with Fixes for 32 Security Vulnerabilities appeared first on Cyber Security News.


https://cybersecuritynews.com/ios-18-32-vulnerabilities/?utm_source=dlvr.it&utm_medium=blogger