SecurityWeek’s cybersecurity news roundup provides a concise compilation of noteworthy stories that might have slipped under the radar. We provide a valuable summary of stories that may not warrant an entire article, but are nonetheless important for a comprehensive understanding of the cybersecurity landscape. Each week, we curate and present a collection of noteworthy developments, […]
T-Mobile on Wednesday shared additional information on a cyberattack believed to have been conducted by the China-linked threat group Salt Typhoon, but the telecoms firm reiterated that the attack was blocked. It came to light earlier this month that T-Mobile has also been targeted by the Chinese threat group Salt Typhoon in a major cyberespionage […]
Microsoft informed customers on Tuesday that vulnerabilities affecting cloud, AI and other services have been patched, including a flaw that was exploited in attacks. The tech giant has patched vulnerabilities in Azure, Copilot Studio, and its Partner Network website — one security hole in each — but customers do not need to take any action. […]
Malware hunters at ESET on Wednesday documented the discovery of a prototype UEFI bootkit targeting specific Ubuntu Linux configurations, signaling a shift as hackers expand bootkit attacks beyond the Windows operating system. Named Bootkitty, ESET notes that the bootkit represents an initial proof-of-concept rather than an active threat but warns of a new reality: “UEFI […]
The cybercriminals behind Banshee Stealer have reportedly shut down their operation after someone leaked the macOS malware’s source code. Threat intelligence and research project Vx-Underground reported this week that the Banshee Stealer source code was leaked online. The project said the malware operation has been shut down as a result of the leak. It’s unclear […]
Threat actors are likely exploiting ProjectSend servers unpatched against a vulnerability that was publicly disclosed roughly a year and a half ago, VulnCheck warns. An open source application written in PHP, ProjectSend is designed for file sharing, enabling users to create client groups, assign user roles, and access statistics, detailed logs, notifications, and more. The […]
US senators Bill Cassidy (R-LA), Mark Warner (D-VA), John Cornyn (R-TX), and Maggie Hassan (D-NH) have introduced a bipartisan bill seeking stronger cybersecurity in the healthcare sector and the protection of health data. The Health Care Cybersecurity and Resiliency Act of 2024 (PDF) calls for updated Health Insurance Portability and Accountability Act (HIPAA) regulations and […]
Researchers at offensive cyber solutions provider AmberWolf have disclosed the details of a new attack method that can be leveraged against widely used corporate VPN clients. VPNs are often used by organizations for secure remote access, but the AmberWolf researchers showed that the attack surface they introduce should not be ignored. They also published an […]
A Russia-linked APT actor has been observed chaining two recent zero-day vulnerabilities in Firefox and Windows to deploy a backdoor on the victims’ machines, ESET reports. The hacking group, tracked as RomCom, Storm-0978, Tropical Scorpius, and UNC2596, has been conducting opportunistic and targeted campaigns against various sectors, as part of both espionage and cybercrime operations. […]
Interpol arrested 1,006 suspects in Africa during a massive two-month operation, clamping down on cybercrime that left tens of thousands of victims, including some who were trafficked, and produced millions in financial damages, the global police organization said Tuesday. Operation Serengeti, a joint operation with Afripol, the African Union’s police agency, ran from Sept. 2 […]