# Former 250cc World Champion Sito Pons Joins Forces with CryptoDATA RNF MotoGP Team

Barcelona, 31st August - The CryptoDATA RNF MotoGP Team is proud to announce the partnership with two-time 250cc World Champion, Sito Pons, which will start in the 2024 season. The decision announced by RNF particularly aims to harness Sito's four decades of MotoGP experience specifically leveraging on his expertise. This strategic alliance between two powerhouses represents an important progression within the team's strategic business plan, contributing towards achieving a part of the team's carefully designed future objectives.

Sito Pons, a name synonymous with triumph and tenacity, brings with him a legacy that speaks volumes. His illustrious journey, marked by winning the World Championship twice with Honda in 1988 and 1989, is a testament to his strong determination. 

Notably, Pons' achievements extend beyond the racetrack, earning him the prestigious Prince of Asturias Award for Sport in 1990. As the only motorcycle racer to hold this accolade, his contribution to the motorsport's legacy is undeniable. Furthermore, his role as President of the International Road Racing Teams Association for over a decade, along with his representation of World Championship Racers on the International Motorcycling Federation, highlights his commitment to elevating the sport as a whole.
 
In this significant transition, Sito Pons, the mastermind behind one of the leading teams in the intermediate Moto2 category, will begin a new chapter in MotoGP. His new role as Chief Revenue Officer with the CryptoDATA RNF MotoGP Team will leverage his experience of over 40 years in the MotoGP World Championship with a focus on growing the team's performance.

Razlan Razali, Founder & Team Principal of CryptoDATA RNF MotoGP Team
"We are thrilled to welcome Sito Pons to the RNF family. His extensive MotoGP experience, valuable insights and dedication align seamlessly with our vision of creating one of the best MotoGP teams. Together with Sito, our mission is to build a sustainable team and strive for strategic excellence with our partners." 

Sito Pons, Chief Revenue Officer of CryptoDATA RNF MotoGP Team
*"I'm excited to rejoin MotoGP, now as part of the CryptoDATA RNF MotoGP Team. In this new role, I'll bring over 40 years of my MotoGP experience to the table – a decade as a rider and over three decades as a team principal in both MotoGP and Moto2. Working alongside Razlan and his team, we aim to enhance our portfolio by focusing on growing the value of the team. I love challenges, and I’m very happy to be part of this new challenge." *

**Ovidiu Toma, Co-founder and CEO of CryptoDATA Tech**
*"Sito Pons' decision to join hands with CryptoDATA RNF MotoGP Team embodies our commitment to excellence and innovation. Together, we’ll find new ways to achieve great performance off-track."*
 
**Bogdan Mărunțiș, Co-founder and Head of Global Strategy of CryptoDATA Tech**
*"Sito Pons brings a wealth of experience and strategic prowess that aligns with our growth trajectory. This partnership marks a significant step towards our vision of pushing boundaries in MotoGP. There's much to achieve, and we look forward to the journey ahead. "*


large_WhatsApp Image 2023-08-31 at 19.41.30.jpeg

medium_WhatsApp Image 2023-08-31 at 19.41.30.jpeg

small_WhatsApp Image 2023-08-31 at 19.41.30.jpeg

thumbnail_WhatsApp Image 2023-08-31 at 19.41.30.jpeg

WhatsApp Image 2023-08-31 at 19.41.30.jpeg

 The CryptoDATA RNF MotoGP Team is proud to announce the partnership with two-time 250cc World Champion, Sito Pons, which will start in the 2024 season. 

 Former 250cc World Champion Sito Pons Joins Forces with CryptoDATA RNF MotoGP Team

![k.webp](/uploads/k_461c3c7241.webp)

___

A proof-of-concept (PoC) has been made available for a security flaw impacting the KeePass password manager that could be exploited to recover a victim's master password in cleartext under specific circumstances.

The issue, tracked as CVE-2023-32784, impacts KeePass versions 2.x for Windows, Linux, and macOS, and is expected to be patched in version 2.54, which is likely to be released early next month.

"Apart from the first password character, it is mostly able to recover the password in plaintext," security researcher "vdohney," who discovered the flaw and devised a PoC, said. "No code execution on the target system is required, just a memory dump."

"It doesn't matter where the memory comes from," the researcher added, stating, "it doesn't matter whether or not the workspace is locked. It is also possible to dump the password from RAM after KeePass is no longer running, although the chance of that working goes down with the time it's been since then."

It's worth noting that successful exploitation of the flaw banks on the condition that an attacker has already compromised a potential target's computer. It also requires that the password is typed on a keyboard, and not copied from the device's clipboard.

vdhoney said the vulnerability has to do with how a custom text box field used for entering the master password handles user input. Specifically, it has been found to leave traces of every character the user types in the program memory.

This leads to a scenario whereby an attacker could dump the program's memory and reassemble the password in plaintext with the exception of the first character. Users are advised to update to KeePass 2.54 once it becomes available.

The disclosure comes a few months after another medium-severity flaw (CVE-2023-24055) was uncovered in the open source password manager that could be potentially exploited to retrieve cleartext passwords from the password database by leveraging write access to the software's XML configuration file.

KeePass has maintained that the "password database is not intended to be secure against an attacker who has that level of access to the local PC."

It also follows findings from Google security research that detailed a flaw in password managers such as Bitwarden, Dashlane, and Safari, which can be abused to auto-fill saved credentials into untrusted web pages, leading to possible account takeovers.

Tech Trends

A proof-of-concept (PoC) has been made available for a security flaw impacting the KeePass password manager that could be exploited to recover a victim's master password in cleartext under specific circumstances.

small_k.webp

thumbnail_k.webp

k.webp

KeePass Exploit Allows Attackers to Recover Master Passwords from Memory

![cry.webp](/uploads/cry_096291869c.webp)

___

**In just a few weeks, phishing scam Inferno Drainer has made off with nearly $6 million in various cryptocurrences and NFTs.**

It’s likely targeting your favorite crypto projects on the largest blockchains. But what exactly is Inferno Drainer?

Scam Sniffer, a platform specializing in the identification of scams, announced on Friday that the malicious software provider is allegedly linked to thousands of scams resulting in the theft of several million dollars.

By analyzing off-chain and on-chain data on Ethereum, Arbitrum, BNB Chain, and other chains, the security firm identified 4,888 victims who collectively lost over $5.9 million in cryptocurrencies and NFTs.

Approximately 1,699 ETH is reported to have been stolen and distributed across five different addresses, each holding between 300 and 400 ETH.

The extent of these scams was revealed when a suspected Inferno Drainer member named “Mr Inferno” appeared in a Scam Sniffer's Telegram group.  

This led to the discovery of a website promoting the scammer's services. “We have a product that provides Web3 malicious website scanning service for platforms, so we identifiy a lot of malicious websites,” Scam Sniffer explained to Decrypt. “The Telegram channel helped us connect them together.”

The scammer reportedly charges 20% to 30% of the stolen assets in exchange for their malicious software, which is used to create fraudulent websites. 

In total, Inferno is reported to have created nearly 689 phishing websites since March 27. “This is the data we have based on the on-chain activity, but it could have started earlier,” Scam Sniffer told Decrypt. 

“It can be seen as a ‘malware-as-a-service' product,” they said. “They provide the software and the malicious site hosting, and they charge based on the stolen amount.”

The victim who has suffered the greatest losses is this wallet, which had nearly $400,000 worth of assets stolen. 

According to Scam Sniffer, the victim attempted to negotiate with the scammer, offering to let them retain 50% of the stolen goods.

Last month, a similar type of “Scam as a Service” called Venom Drainer was already identified by Scam Sniffer. It drained $27M from 15k victims, with the top 5 victims losing $14M in total. 530 phishing sites were created, targeting around 170 brands.

**Which projects have been targeted?**

The scammers targeted some of the most well-known brands in the crypto ecosystem, such as Pepe, Collab.Land, zkSync, MetaMask, and Nakamigos, among others. 

In total, about 220 brands are believed to have been used to deceive users.

Despite the bear market, crypto scams are still frequent. A recent study by Crystal Blockchain revealed that 2022 emerged as the worst year on record for crypto fraud, with 120 separate incidents reported. 

This number represents a 28% increase compared to 2021.

However, the total value lost across all incidents in 2022 was less than half of that in 2021 when the total funds lost in crypto scams reached $4.6 billion. This can likely be chalked up to the ongoing bear market which kicked off last May.

Decentralized finance (DeFi) breaches are now the most common type of crypto attack, according to the same study.


In just a few weeks, phishing scam Inferno Drainer has made off with nearly $6 million in various cryptocurrences and NFTs.

large_cry.webp

medium_cry.webp

small_cry.webp

thumbnail_cry.webp

cry.webp

What Is Inferno Drainer? New Phishing Scam Pilfering Crypto, NFTs

![biden.avif](/uploads/biden_2a1590fbbf.avif)

___

United States President Joe Biden has expressed opposition to a debt ceiling deal that he says would benefit “wealthy tax cheats and crypto traders” while putting food assistance programs at risk.

United States President Joe Biden expressed opposition to a debt ceiling agreement with Republican leaders that would allegedly benefit crypto traders. Attending the Group of Seven (G7) Summit in Hiroshima, Japan on May 21, Biden called the Republicans’ proposed terms “unacceptable” during a press conference.

**“I’m not going to agree to a deal that protects wealthy tax cheats and crypto traders while putting food assistance at risk for nearly a hundred — excuse me — nearly 1 million Americans.”**

The alleged protections for crypto traders refer to tax-loss harvesting. According to the Washington Post, there’s an ongoing discussion between the White House and Republican leaders about blocking that the mechanism for cryptocurrency transactions.

Crypto tax-loss harvesting is a strategy that investors use to reduce their overall tax liabilities. It involves selling a cryptocurrency at a loss to offset capital gains from crypto profit. To claim a loss, the assets must be sold, and the proceeds must be used to purchase a similar asset within 30 days before or after the sale. The mechanism is also available for stocks and other assets.

Along with ending tax-loss harvesting for crypto, the White House pitched Republicans a similar proposal that bars investors from deferring taxes on real estate swaps. Both the changes would add about $40 billion in tax revenue for the U.S. government.

Republicans reject the proposals, a source told the Post. House Speaker Kevin McCarthy claims the U.S. debt rise is a “spending problem, not a revenue problem," citing the Biden administration’s excessive spending during the pandemic. Meanwhile, the White House blames the debt issue on tax cuts from previous administrations, claiming revenue has been significantly affected by tax reductions.

Republicans want to close the deficit with $4.8 trillion in spending cuts, which would directly affect federal agencies’ budgets. If Congress fails to raise the debt ceiling, the U.S. could default as early as June 1. Biden will reportedly speak with McCarthy on the phone during his flight from Hiroshima to Washington, D.C.

In effect since 1917, the debt ceiling is the limit that Congress has set on how much money the federal government can borrow to pay i bills.



Regulation

United States President Joe Biden has expressed opposition to a debt ceiling deal that he says would benefit “wealthy tax cheats and crypto traders” while putting food assistance programs at risk.



biden.avif

Biden won’t accept debt deal protecting crypto traders

![cash.avif](/uploads/cash_8a24231a1a.avif)

___

The total control over Tornado Cash governance allows the attacker to withdraw all of the locked votes, drain all of the tokens in the governance contract and brick the router.

Adding to the existing roadblocks of the decentralized crypto mixer Tornado Cash, an attacker managed to gain full control of the governance through a malicious proposal. 

On May 20 at 3:25 ET, an attacker successfully granted 1.2 million votes to a malicious proposal. Given that the proposal received more than 700,000 legitimate votes, the attacker gained total control over Tornado Cash governance.

The information was shared by @samczsun of research-driven technology investment firm Paradigm, who revealed that, when sharing the malicious proposal, the attacker claimed that it used a logic similar to a proposal that had previously passed by the community. However, this time, the proposal had an additional function. 

As explained by @samczsun:

**“Once the proposal was passed by voters, the attacker simply used the emergencyStop function to update the proposal logic to grant themselves the fake votes.”**


The total control over Tornado Cash governance allows the attacker to withdraw all of the locked votes, drain all of the tokens in the governance contract and brick the router. At the time of writing, the attacker “simply withdrew 10,000 votes as TORN and sold it all,” said @samczsun.

The attack comes as a reminder to crypto investors to vet proposal descriptions and logic. An active community of Tornado Cash, who goes by the name Tornadosaurus-Hex or Mr. Tornadosaurus Hex, confirmed that all funds in Governance are potentially compromised and requested all members to withdraw all funds locked in governance.

As shown above, they also attempted deploying a contract that could potentially revert the changes while still suggesting the community to withdraw their funds. Cointelegraph also came across a distress call from one of Tornado Cash’s community developer who confirmed the above developments, stating:

**“There was an attack on the protocol this morning that you already know about. All day, another community developer and I thought about what to do, but the situation is close to hopeless - currently the attacker controls Governance.”**

The team is currently in search of Solidity developers that can help save the protocol from extinction. They additionally stated that “we need contact with Binance - this exchange has more tokens than the attacker.”

A former Tornado Cash developer is reportedly working on building a new crypto mixing service from scratch, which addresses the “critical flaw” existing in Tornado Cash.

The developer hopes the solution will empower “the community to defend against hackers abusing the anonymity sets of honest users without requiring blanket regulation or sacrificing on crypto ideals.”

The total control over Tornado Cash governance allows the attacker to withdraw all of the locked votes, drain all of the tokens in the governance contract and brick the router.

cash.avif

Attacker hijacks Tornado Cash governance via malicious proposal

![py.png](/uploads/py_9d845ec01f.png)

___

The maintainers of Python Package Index (PyPI), the official third-party software repository for the Python programming language, have temporarily disabled the ability for users to sign up and upload new packages until further notice.

"The volume of malicious users and malicious projects being created on the index in the past week has outpaced our ability to respond to it in a timely fashion, especially with multiple PyPI administrators on leave," the admins said in a notice published on May 20, 2023.

No additional details about the nature of the malware and the threat actors involved in publishing those rogue packages to PyPI were disclosed.

The decision to freeze new user and project registrations comes as software registries such as PyPI have proven time and time again to be a popular target for attackers looking to poison the software supply chain and compromise developer environments.

Earlier this week, Israeli cybersecurity startup Phylum uncovered an active malware campaign that leverages OpenAI ChatGPT-themed lures to bait developers into downloading a malicious Python module capable of stealing clipboard content in order to hijack cryptocurrency transactions.

ReversingLabs, in a similar discovery, identified multiple npm packages named nodejs-encrypt-agent and nodejs-cookie-proxy-agent in the npm repository that drops a trojan called TurkoRat.

The maintainers of Python Package Index (PyPI), the official third-party software repository for the Python programming language, have temporarily disabled the ability for users to sign up and upload new packages until further notice.

small_py.png

thumbnail_py.png

py.png

PyPI Repository Under Attack: User Sign-Ups and Package Uploads Temporarily Halted

![goo.webp](/uploads/goo_6d3a3852e7.webp)

___

Google has updated its policy for personal accounts across its services to allow a maximum period of inactivity of two years.

After that time has passed, the accounts "may" be deleted, along with all their contents, settings, preferences, and user-saved data. This includes all data stored on services such as Gmail, Docs, Drive, Meet, Calendar, Google Photos, and YouTube.

However, this new policy will not apply to Google accounts for organizations such as schools or businesses.

Google says the policy change aims to enhance online security, as inactive accounts often fall prey to account hijacking, typically due to old and weak passwords and no additional security measures.

"Starting later this year, if a Google Account has not been used or signed into for at least 2 years, we may delete the account and its contents," said Ruth Kricheli, Google's VP for Product Management.

"Our internal analysis shows abandoned accounts are at least 10x less likely than active accounts to have 2-step-verification set up.

"Meaning, these accounts are often vulnerable, and once an account is compromised, it can be used for anything from identity theft to a vector for unwanted or even malicious content, like spam."

The new policy will take effect immediately, and the first accounts to reach the new inactivity threshold will be deleted in December 2023.

However, this does not mean all users who haven't used their Google accounts for two years or longer will have their accounts deleted by the end of the year.

Google says it will start with accounts never used after their creation and will take careful, phased steps from then on.

Also, the impacted account holders will receive multiple notifications months before the account deletion happens on the provided recovery emails so that they can take action in time.

**How to avoid getting your account deleted**

Many people like to maintain a backup for cases when their primary Google account becomes inaccessible, or they need one for testing purposes.

Those accounts may be rarely used, but their owners may still need to retain them for their reasons. 

Google says taking any of the below actions using those accounts will reset the activity counter back to zero:

- Reading or sending an email

- Using Google Drive

- Watching a YouTube video

- Downloading an app on the Google Play Store

- Using Google Search

- Using Sign in with Google to sign in to a third-party app or service

Of course, the account holders must carry out one of the above actions every two years. Still, Google will continue sending warning notices in the future to minimize the likelihood of surprise deletions.

Also, owners of backup accounts that sit idle for lengthy periods should ensure they're using a strong password, enable two-factor authentication, and update their recovery information.

Finally, account owners can back up all their data using Google's Takeout system or the Inactive Account Manager tool to define what happens after 18 months of inactivity.

The belief that Google accounts would last indefinitely has led countless individuals to rely on them for professional or personal purposes. 

Many had naively assumed their Google accounts were invulnerable, treating them as seemingly everlasting repositories for their digital lives. 

However, as Google demonstrated with this policy update, years of emails, attachments, and personal files could vanish if users fail to heed the warning and log in before the deadline.

Google has updated its policy for personal accounts across its services to allow a maximum period of inactivity of two years.

large_goo.webp

medium_goo.webp

small_goo.webp

thumbnail_goo.webp

goo.webp

Google will delete accounts inactive for more than 2 years

![nf.avif](/uploads/nf_bdf7e15570.avif)

___

**1. A brief history of NFTs: From inception to global recognition**

What started with Bitcoin-based colored coins in 2012–2013 became a phenomenon in 2021 and is still thriving. The Ethereum blockchain had a pivotal role in popularizing NFTs.

Though 2021 turned out to be the year of Nonfungible tokens (NFTs), it wasn’t the year when the technology was invented. Kevin McCoy minted the first NFT, “Quantum,” on the Namecoin blockchain in 2014. Nonetheless, the inception of Bitcoin-based colored coins in 2012–2013 marked the beginning of the concept that led to the development of BRC-20 tokens. This idea stemmed from a paper authored by Meni Rosenfield in 2012, and it paved the way for the evolution of digital tokens on the Bitcoin blockchain.

The world, however, noticed NFTs in 2017. This was mainly due to the arrival of the Ethereum blockchain, which overcame the limitations in the blockchains prior to it when it came to hosting NFTs. Ethereum not only provided NFTs with a reliable solution for critical things such as token creation, storage, programming and trading but also lowered the entry barrier for launching NFT projects.

A brief history of NFTs can be segregated into a timeline:

**2. The evolution of NFTs: From colored coins to the emergence of Rare Pepes and Spells of Genesis**

As mentioned, the story took off with colored coins, which were created to represent and manage ownership of real-world assets on the blockchain. They were different from Bitcoin (BTC) because of the “nonfungible” element that provided them with a unique utility.

Demonstrating a humongous leap in Bitcoin’s capabilities, colored coins were composed of tiny fractions of a Bitcoin, which could be as minuscule as a satoshi. Use cases of colored coins, such as the representation of property, coupons, or usage as digital collectibles, subscriptions, shares and access tokens, helped people realize the potential of blockchains for issuing assets.

Bitcoin, however, was never intended to be used as a database for tokens, which meant that colored coins just remained at the concept level. However, the development did set off a series of experiments that culminated in NFTs. The first of the NFTs was “Quantum,” as mentioned before, an octagon-shaped animation. The arrival of Ethereum provided NFTs with the platform they required to flourish.

A major project of this period that enabled the development of digital assets was The Counterparty platform built on Bitcoin. A spectrum of “Rare Pepes” NFTs was released on The Counterparty, initiating the use case of NFT as artwork. “Spells of Genesis,” created on Ethereum, was another big NFT project after The Counterparty.

**3. The rise of NFTs in gaming and the metaverse: From CryptoPunks to Axie Infinity**

Ethereum introducing a set of token standards facilitated the steady movement of NFTs toward the blockchain. The token standard informs developers how to deploy new tokens.

The success of the Rare Pepes was followed by Larva Labs, a software development company that launched CryptoPunks, its own generative series of NFTs, created by John Watkinson and Matt Hall. Inspired by London punk culture, the project has 10,000 unique pieces, with no two characters resembling each other. CryptoPunks became a huge success and was the foundation of many other NFT projects, including the Bored Ape Yacht Club, one of the biggest NFT collections.

The next major launch was CryptoKitties, which came up during the ETHWaterloo hackathon, back in October 2017. The game enables players to buy, sell and create NFTs representing virtual cats with desirable traits on Ethereum. Post CryptoKitties, NFT gaming became increasingly popular.

NFT gaming combined with metaverse projects to formulate a new momentum. A major project of this era was Ethereum-based Decentraland, a virtual world that allows players to explore games and build and collect assets.

In October 2018, Axie Infinity, an NFT-based battle game, was released. It set the ball rolling for play-to-earn (P2E) games, which enabled gamers to earn in-game rewards while playing. It’s a pioneering video game on the Ethereum blockchain involving Axies, creatures that are rare NFTs with unique attributes. Gamers fight battles using Axies and build more attributes into them.

**4. Expanding beyond Ethereum: Non-Ethereum blockchains and the NFT ecosystem**

Certain factors propelled NFTs to a sharp surge in 2021. Various blockchains set up new standards specifically for NFTs.

NFTs in 2021 witnessed a spike in supply and demand. According to NFT data company NonFungible.com, NFT trading jumped around 21,000% to top $17 billion during the year.

The usage of NFTs in the art market was a major factor behind the surge. The emergence of digital art provided artists with another venue to showcase their creativity and store their work, which could be verified as well. Thanks to these advantages, digital art gained traction and helped propel the NFT boon.

This was the time when renowned auction houses such as Christie’s and Sotheby’s moved their auctions online. Moreover, these auctions included art that pushed the popularity of NFTs. It was at Christie’s where Beeple’s “Everydays: the First 5000 Days” NFT made a record-shattering sale of $69 million. A sale of that scale drew the attention of non-Ethereum blockchains and blockchain enthusiasts toward NFTs.

Buoyed by the NFT mania, blockchains such as Cardano, Solana, Flow and Tezos started work on their own platforms for NFTs. In September 2021, smart contracts became functional on Cardano, which facilitated the development of NFT applications on the platform. A few new standards were set up by various blockchains to establish the authenticity of nonfungible assets.

A key event of the year was Facebook rebranding itself as Meta and strolling into the metaverse space. NFTs were always an integral part of the metaverse, leading to the surge in demand for NFTs. 

**5. Revival and resurgence: NFT market rebounds and issuance of Bitcoin-native NFTs**

The sector took a plunge in 2022 but regained an upward trend in 2023, bringing the joy back to NFT aficionados.

For much of 2022, growth in the NFT sector plateaued. Macroeconomic factors brought down the enthusiasm in the NFT market. Even the metaverse had been a talking point before it fell off the radar. Mark Zuckerberg’s metaverse division lost $13.72 billion in 2022.

2023, however, brought smiles back to NFT enthusiasts. Ordinals launched in January 2023, exploiting the 2021 Bitcoin Taproot upgrade, which enabled on-chain Bitcoin-native NFTs. By February 2023, Yuga Labs, the premiere issuer of NFTs in the world, had announced the rollout of “TwelveFold,” a new NFT collection to be issued on the Bitcoin network. Ordinals, an advancement of the concept of colored coins, are serial numbers imprinted in a single, unique satoshi.

As per data from DappRadar, the NFT market clocked $2 billion in total trading volume in February, which was a 117% increase from the previous month. The impetus sustained into March, with data demonstrating only a slight dip to under $2 billion. BCC Research envisions a market value of the NFT sector of $125.60 billion by 2027, with a compound annual growth rate of 27.7% (2022–2027).

Accumulated data from DappRadar and Dune disclosed about 5.8 million total NFTs sold in March compared to approximately 6.5 million NFTs in February. Ethereum NFT trading in February ($1.81 billion) was almost identical in March ($1.82 billion).

Tokens

What started with Bitcoin-based colored coins in 2012–2013 became a phenomenon in 2021 and is still thriving. The Ethereum blockchain had a pivotal role in popularizing NFTs.

nf.avif

Who invented NFTs?: A brief history of nonfungible tokens

![sa.webp](/uploads/sa_d4d56edce0.webp)

___

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has warned of active exploitation of a medium-severity flaw affecting Samsung devices.

The issue, tracked as CVE-2023-21492 (CVSS score: 4.4), impacts select Samsung devices running Android versions 11, 12, and 13.

The South Korean electronics giant described the issue as an information disclosure flaw that could be exploited by a privileged attacker to bypass address space layout randomization (ASLR) protections.

ASLR is a security technique that's designed to thwart memory corruption and code execution flaws by obscuring the location of an executable in a device's memory.

Samsung, in an advisory released this month, said it was "notified that an exploit for this issue had existed in the wild," adding it was privately disclosed to the company on January 17, 2023.

Other details about how the flaw is being exploited are currently not known, but vulnerabilities in Samsung phones have been weaponized by commercial spyware vendors in the past to deploy malicious software.

Back in August 2020, Google Project Zero also demonstrated a remote zero-click MMS attack that leveraged two buffer overwrite flaws in the Quram qmg library (SVE-2020-16747 and SVE-2020-17675) to defeat ASLR and achieve code execution.

In light of active abuse, CISA has added the shortcoming to its Known Exploited Vulnerabilities (KEV) catalog, alongside two Cisco IOS flaws (CVE-2004-1464 and CVE-2016-6415), urging Federal Civilian Executive Branch (FCEB) agencies to apply patches by June 9, 2023.

Last week, CISA also added seven vulnerabilities to the KEV catalog, the oldest of which is a 13-year-old bug impacting Linux (CVE-2010-3904) that allows an unprivileged local attacker can escalate their privileges to root.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has warned of active exploitation of a medium-severity flaw affecting Samsung devices.

small_sa.webp

thumbnail_sa.webp

sa.webp

Warning: Samsung Devices Under Attack! New Security Flaw Exposed

![cc.webp](/uploads/cc_fa85e0f9b3.webp)

___

**Many of the most well-known crypto firms are not adhering to basic governance standards, the findings of a Bloomberg survey have shown. Only 31 out of the 60 polled firms “currently procure a full financial audit or reserve attestations from an independent auditor.” Industry participants have said many crypto firms are not audited because the “Big Four” accounting firms are not willing to have them as clients.**

**Many Crypto Firms Lack Independent Boards**

Some of the most influential cryptocurrency firms are not adhering to established corporate governance standards and many others are believed to be operating outside the norm, a Bloomberg study has found. The study also found that out of the 60 crypto industry firms that were polled, about 10 companies did not have a board with at least one non-executive director.

According to the study report, Tether, Huobi and Magic Eden are among those firms without independent company boards. In instances where a board actually exists, the report said these were either advisory in nature or mainly comprised of company executives, hence they cannot pass as independent boards. Binance, the largest cryptocurrency exchange by volume traded, is set to have a formal board in place by the end of the year, the report said.

Although many investors in crypto firms are said to be insisting on increased transparency and accountability following crypto exchange FTX’s collapse, the Bloomberg study found that just over half (31) of the firms “currently procure a full financial audit or reserve attestations from an independent auditor.” On the other hand, the findings showed that the audit status of some 22 out of the 60 companies is unknown. Only seven companies said they were not audited.

**Blockchain Technology’s Appeal Said to Be Undermined by Opaqueness of Crypto Firms** 

Meanwhile, Ruth Foxe Blader, a partner at venture capital firm Anthemis, is quoted in the report lamenting the crypto industry’s opaqueness which contradicts the blockchain technology’s promise of transparency and tamperproof record-keeping.

“It’s an industry of anonymity that’s masquerading as transparency,” Blader reportedly said.

Blader argued that crypto firms should be subjected to the same basic standards — such as audits and independent boards — as other firms, because that is what any investor would expect, particularly for a company operating in the financial services industry.

While the study findings paint a picture of an industry whose participants are unwilling to be audited, some have said the real issue is the so-called Big Four accounting firms’ reluctance to take on crypto firms as clients. This argument is seemingly backed by the France-based accounting group Mazars Group’s decision to stop vouching for reserves held by crypto exchanges. As reported by Bitcoin.com News, Mazars Group ended offering such services in Dec. 2022 after citing concerns about the public’s understanding of such reports.

Meanwhile, the experts quoted in the Bloomberg report have warned that without an extensive regulatory framework in place, the crypto industry participants will not be inclined to do more to appease investors and clients that are said to be demanding greater transparency.

Many of the most well-known crypto firms are not adhering to basic governance standards, the findings of a Bloomberg survey have shown. Only 31 out of the 60 polled firms “currently procure a full financial audit or reserve attestations from an independent auditor.” Industry participants have said many crypto firms are not audited because the “Big Four” accounting firms are not willing to have them as clients.

large_cc.webp

medium_cc.webp

small_cc.webp

thumbnail_cc.webp

cc.webp

Report: Well Known Crypto Firms Still Not Adhering to Basic Governance Standard

![bi.avif](/uploads/bi_e7823f1bbd.avif)

___

Cuscal, the company that handles the Australian dollar on- and off-ramping for the exchange, declined to comment specifically on why it decided to pull support for Binance Australia.

The third-party payments provider for Binance Australia, Cuscal, hinted at the impact of “scams and fraud” related to “account fraud, ID takeover and crypto activity” after being questioned why it offboarded the exchange.

Binance Australia on May 18 announced it would be suspending Australian dollar fiat services in Australia after a decision from a "third-party payment service provider" — this turned out to be a financial services company Cuscal. 

A spokesperson representing Cuscal declined to elaborate why it specifically pulled support for Binance Australia, and the official statement from the company does not mention Binance or crypto exchanges.

“Following recent media attention in relation to the impact of scams and fraud in Australia with particular focus on account fraud, ID takeover and crypto activity, Cuscal reiterates its commitment and important role in identifying and implementing detection services for our clients across the Australian payments system,” a statement from Cuscal wrote.

It added it “has, and will continue to, terminate any clients or their customers and/or merchants” that do not meet its onboarding and compliance requirements.

The spokesperson told Cointelegraph that it’s “focused on supporting the industry in protecting Australians from financial crimes and scams."

A Zepto spokesperson told Cointelegraph at the time that it “processes payments for Binance Australia” and “our partner, Cuscal, instructed us to offboard Binance.”

The Cuscal spokesperson did not elaborate on why it instructed its partner payments firm Zepto to “offboard” the exchange, saying it doesn’t “have a comment on any other parties at this point.”

**Related: Revolut launches business offering in Australia, seeks banking license**

On May 18, Binance Australia said its Australian dollar services were suspended “with immediate effect," citing a “decision made by our third party payment service provider.”

Binance Australia has been on the hunt for an alternative payments partner since. Binance said Zepto and Cuscal are continuing to support users wishing to withdraw Australian dollars.




Cuscal, the company that handles the Australian dollar on- and off-ramping for the exchange, declined to comment specifically on why it decided to pull support for Binance Australia.



bi.avif

Binance Australia partner hints at rising ‘scams’ after debanking exchange

![aia.png](/uploads/aia_dc38a3e57a.png)

___

Malicious Google Search ads for generative AI services like OpenAI ChatGPT and Midjourney are being used to direct users to sketchy websites as part of a BATLOADER campaign designed to deliver RedLine Stealer malware.

"Both AI services are extremely popular but lack first-party standalone apps (i.e., users interface with ChatGPT via their web interface while Midjourney uses Discord)," eSentire said in an analysis.

"This vacuum has been exploited by threat actors looking to drive AI app-seekers to imposter web pages promoting fake apps."

BATLOADER is a loader malware that's propagated via drive-by downloads where users searching for certain keywords on search engines are displayed bogus ads that, when clicked, redirect them to rogue landing pages hosting malware.

The installer file, per eSentire, is rigged with an executable file (ChatGPT.exe or midjourney.exe) and a PowerShell script (Chat.ps1 or Chat-Ready.ps1) that downloads and loads RedLine Stealer from a remote server.

Once the installation is complete, the binary makes use of Microsoft Edge WebView2 to load chat.openai[.]com or www.midjourney[.]com – the legitimate ChatGPT and Midjourney URLs – in a pop-up window so as to not raise any red flags.

The adversary's use of ChatGPT and Midjourney-themed lures to serve malicious ads and ultimately drop the RedLine Stealer malware was also highlighted last week by Trend Micro.

This is not the first time the operators behind BATLOADER have capitalized on the AI craze to distribute malware. In March 2023, eSentire detailed a similar set of attacks that leveraged ChatGPT lures to deploy Vidar Stealer and Ursnif.

The cybersecurity company further pointed out the abuse of Google Search ads has fallen off from their early 2023 peak, suggesting that the tech giant is taking active steps to curtail its exploitation.

The development aligns with a broader wave of phishing and scam campaigns, wherein threat actors are attempting to cash in on the surging use of these AI tools to distribute malware and other bogus apps.

Security vendor Sophos, in a related research, outlined a set of ChatGPT-related fleeceware apps in the Google Play and Apple App Store — collectively dubbed FleeceGPT – that coerce users into signing up for unwanted subscriptions.

"Because fleeceware applications are designed to stay on the edge of Apple and Google terms of service and do not access private information or attempt to circumvent platform security, they are rarely rejected during review and are allowed into the app stores," Sophos researchers Jagadeesh Chandraiah and Sean Gallagher said.

In recent weeks, Check Point, Meta, and Palo Alto Networks Unit 42 have warned of increasing fraudulent activity mimicking the ChatGPT service to harvest users' credit card details, perpetrate credit card fraud, and steal victims' Facebook account details via copycat chatbot web browser extensions.

Between November 2022 through early April 2023, Unit 42 said it detected a 910% increase in monthly registrations for domains related to ChatGPT.

The findings come weeks after Securonix uncovered a phishing campaign dubbed OCX#HARVESTER that targeted the cryptocurrency sector between December 2022 and March 2023 with More_eggs (aka Golden Chickens), a JavaScript downloader that's used to serve additional payloads.

eSentire, in January, traced the identity of one of the key operators of the malware-as-a-service (MaaS) to an individual located in Montreal, Canada. The second threat actor associated with the group has since been identified as a Romanian national who goes by the alias Jack.

Malicious Google Search ads for generative AI services like OpenAI ChatGPT and Midjourney are being used to direct users to sketchy websites as part of a BATLOADER campaign designed to deliver RedLine Stealer malware.

small_aia.png

thumbnail_aia.png

aia.png

Searching for AI Tools? Watch Out for Rogue Sites Distributing RedLine Malware

![ru.jpg](/uploads/ru_4df7b43b83.jpg)

___

**The governments of Russia and Iran are starting to phase out the usage of the U.S. dollar to conduct bilateral trade settlements. Russian Deputy Prime Minister Alexander Novak stated that 80% of Russia-Iran trade transactions are settled using national currencies and that they are considering also the usage of the Chinese yuan.**

**80% of Russia-Iran Trade Settlements Involve National Currencies**

Russian and Iran have started to phase out the usage of the U.S. dollar in their bilateral trade settlements. According to Russian Deputy Prime Minister Alexander Novak, the call to use national currencies, including the Russian ruble and the Iranian rial, has been effective, leaving only a small amount of these transactions still relying on the U.S. dollar.

After meeting with Iranian officials, Novak stated:

"We discussed these issues in great detail today, and both the Ministry of Finance and the Bank of Russia were present, as were our Iranian counterparts. I believe approximately 80% of our mutual settlements are in national currencies: rials and rubles."

Furthermore, Novak stated that the two countries were considering the usage of other third-party currencies to settle their bilateral transactions, including the Chinese yuan, a currency already widely used by the Russian Federation.

**A Push to Ditch the U.S. Dollar**

Novak also referred to the low utilization of traditional settlement currencies, including the U.S. dollar and the euro, stating that less than 20% of transactions involved settlements using them. “The work that was purposefully carried out in order to switch to national currencies has its results,” he stated.

Both Iran and Russia are currently facing economic sanctions enacted by the U.S. government that make difficult the use of the dollar for completing transactions using the traditional finance system. This has resulted in a complete change of the payment mechanics in international trade transactions, with the two countries seeking to adopt alternatives.

Recently, Iranian President Ebrahim Raisi ordered the Central Bank of Iran to lay the groundwork for ditching the U.S. dollar completely from its trade transactions and switching to the Iranian rial and national currencies. In the same way, Russia has supported the shift to using national currencies and the Chinese yuan for this same purpose.

In January, it was reported that both countries were discussing the possibility of the issuance of a gold-backed stablecoin to be used for international settlements, but Russian officials stated this discussion would have to be postponed until the approval of a clear cryptocurrency legal framework.

The governments of Russia and Iran are starting to phase out the usage of the U.S. dollar to conduct bilateral trade settlements. Russian Deputy Prime Minister Alexander Novak stated that 80% of Russia-Iran trade transactions are settled using national currencies and that they are considering also the usage of the Chinese yuan.

large_ru.jpg

medium_ru.jpg

small_ru.jpg

thumbnail_ru.jpg

ru.jpg

Russia and Iran Phasing Out US Dollar in Bilateral Trade Settlements

![fraud.jpg](/uploads/fraud_280217981f.jpg)

___

Preventing fraud has been a challenge for businesses for centuries. Old fraud tactics continue to be used today in addition to hundreds of other types of ways to commit fraud that have emerged as new ways to provide business services and products have been adopted. In recent years the opportunities to commit fraud have burgeoned as the COVID-19 pandemic thrust businesses suddenly into situations where workers worked remotely and consumers purchased more frequently remotely, online and through social media sites and new apps, usually assuming that all was secured. And to expand the fraud risk environment even more, many new and emerging types of technologies with insufficient-to-no security controls are being widely adopted by organizations of all types, bringing more fraud pathways.

Many of the new types and trends for committing business fraud included the expanded use of cryptocurrencies for business payments, and utilizing AI and similar tech to create synthetic identities to commit a wide range of frauds. There are many other tactics being used, but these are two areas of quickly increasing fraud. Businesses are in the midst of a perfect storm of digital fraud.

**Cryptocurrency fraud**

From the beginning of 2021 to mid-2022, more than $1 billion in cryptocurrency was lost to fraud scams; more than any other payment frauds. Cybercrooks are pretending to be established businesses to communicate with consumers, which harms the reputations of those businesses that are being impersonated. Another cryptocurrency fraud is when businesses accept cryptocurrency for payments, and then the cryptocurrency exchange experiences a hack or insider exploitation and the business’s money is subsequently stolen or otherwise lost.

A few ways in which businesses can mitigate the risks of cryptocurrencies:

- Make employees and customers aware of potential impersonators of their business that could be running cryptocurrency scams. Post information to the business website and provide an email and/or phone number for those who think they may be seeing such tactics that are coming from what appears to be your business.

- Use strong security and authentication practices for the business crypto accounts, including multi-factor authentication (MFA), never sharing login credentials, and strongly encrypting in storage and during transmission all data associated with cryptocurrencies.

- Follow Know Your Customer (KYC) and Anti-money Laundering (AML) practices.

- Use offline cold wallets for the majority of the business’s cryptocurrency value share. Keep the minimum required amount of liquidity online or with the business’s payment service provider.

- Use third-party trusted broker services that have been vetted by the cryptocurrency community. Look for one that has insurance for your fiat money, and ideally also for your crypto accounts, depending upon how much you are depending upon cryptocurrency in your business.

**Synthetic identity fraud**

Artificial intelligence (AI), machine learning (ML) and deep learning tech are being used to create fake identities using parts of real individuals’ identities mixed with fake parts, which quite simplistically explained is synthetic identity fraud. Synthetic identity fraud is being increasingly used to gain access to consumer business accounts.

Synthetic media tools, such as those used to modify or create video, images and audio representing real people, are readily available for anyone including fraudsters to use. The use of these new ways to create synthetic identities makes it harder for businesses to identify and stop such frauds.

Synthetic identity fraud caused $20 billion in losses for U.S. banks and financial institutions in 2020. Losses from synthetic identity fraud are projected to reach $2.48 billion by 2024. Businesses face huge challenges stopping synthetic identity fraud since it is not identified by most traditional fraud prevention models.

A few ways in which businesses can mitigate the risks of being a victim of synthetic identity fraud include:

- Use strong identity verification processes and procedures. Verification methods should include a variety of dependable information sources. Commonly used are passports, driver’s licenses and other government-issued identification documents. Increasingly more often used are biometric data, such as iris scans, fingerprints and other types of biometrics that typically are not publicly available.

- Monitoring suspicious activity is necessary to detect and prevent synthetic identity fraud. This is where AI tools can turn the table on synthetic identity fraud and use it to prevent that crime instead of enabling it.

- Human awareness is still necessary, though. Especially in businesses where customers are known by workers, especially in small to medium-sized businesses. Procedures should be followed that include scrutinizing customer behavior and transaction patterns to identify unusual or suspicious activity that may indicate fraud.

- Collaborating with other organizations, such as those in local anti-fraud and security associations, and those in national industry-specific associations can be very useful. Having a contact within law enforcement agencies is also valuable for preventing successful synthetic identity fraud attempts by staying aware of current fraud crimes. When businesses and other types of organizations share information about synthetic identity theft and other types of fraud activities, organizations will be much more likely to detect and prevent fraud before it occurs. And, it could also help to identify and apprehend synthetic identity fraud criminals.  

Businesses must remain vigilant and proactive in their efforts to prevent fraud by adopting strong security measures, staying up to date with emerging fraud activities and collaborating with other organizations to share information and prevent fraud before it happens.

Preventing fraud has been a challenge for businesses for centuries. Old fraud tactics continue to be used today in addition to hundreds of other types of ways to commit fraud that have emerged as new ways to provide business services and products have been adopted.

medium_fraud.jpg

small_fraud.jpg

thumbnail_fraud.jpg

fraud.jpg

How organizations can navigate an evolving fraud landscape

![toy.webp](/uploads/toy_4543e0cba4.webp)

___

Japanese auto giant Toyota Motor Corp. has confirmed a decade-long data leak via its big data and mobility affiliate, Toyota Connected Corp, affecting millions of customers.

Spanning from January 2012 to April 2023, the problem with Toyota’s cloud-based Connected service pertains only to vehicles in Japan, said spokesperson Hideaki Homma.

The company attributed the security lapse to a misconfigured database that allowed anyone to access the information without a password.

**A decade-long Toyota Connected service data leak affected 2.15 million car owners**

Toyota attributed the decade-long data breach to human error that left the cloud service publicly accessible without a password.

“It was found that some of the data that Toyota Motor Corporation entrusted to Toyota Connected Corporation (hereinafter referred to as “TC”) was publicly accessible due to a misconfiguration of the cloud environment,” reads the auto-translated statement.

Mark Stockley, a senior threat researcher at Malwarebytes, noted that the mass cloud migration was responsible for an avalanche of cloud misconfigurations.

“This is a prevalent and increasingly common issue,” Stockley said. “The wholesale move to The Cloud and “NoSQL” data storage has been accompanied by an avalanche of stories about leaky Amazon S3 buckets, Internet-exposed Elastic Search instances, and unsecured MongoDB databases.”

The Japanese automaker disclosed that the data leak affected customers who signed up on Toyota cloud platforms since 2012, including those using T-Connect, G-Link, G-Book, and Connected services.

T-Connect is a smart car service for voice assistance, car status monitoring, and customer service access.

The Toyota Connected service reminds owners to service their vehicles, links the car to entertainment services, and can assist during emergencies by calling for help and locating a car that’s been stolen.

**Toyota exposed vehicle identification numbers, location, and video footage**

The Toyota Connected service data leak exposed the vehicle identification number (VIN), location (and time), terminal ID, and video footage recorded by the vehicle.

Although hackers could not use the information to identify individual owners, they could track the vehicle locations using the VIN, while the video recording could jeopardize the owners’ privacy.

According to its statement, Toyota has no evidence that the information was leaked, copied, or misused. No car owner has reported any security incident from the Toyota Connected service data leak.

Nevertheless, Toyota regretted the “lack of active detection mechanism” that could have flagged the problem earlier.

“It’s no longer enough to just try and keep nefarious actors out, but you must be able to detect when they’re in or when something isn’t right,” said Camellia Chan, CEO and Founder at X-PHY.

Meanwhile, the company launched an investigation into all Toyota Connected cloud services and promised to educate its staff on data security practices.

The Prius hybrid and Lexus luxury automaker will also introduce a system to continuously monitor and audit its cloud configurations.

Toyota has also assured its customers that the problem was fixed, and owners could continue driving Connect-enabled vehicles without the need to bring them in for repairs.

Toyota promised to notify customers whose vehicle ID, chassis number, location information, or time was exposed.

**Another failure in automotive cybersecurity**

The data leak on the much-touted online service put the automaker’s cybersecurity practices on the spot when automakers worldwide are competing to integrate data for artificial intelligence-enhanced services.

The Toyota Connected service data leak also demonstrates how vulnerable automotive connectivity features could open a new attack surface for mass exploitation.

“In a world of interconnected devices operating on unknown vulnerability surfaces, it’s critical that businesses take a multi-layered, holistic cybersecurity approach that provides protection and detection at every level down to the hardware,” said Chan.

Early this year, researchers discovered software bugs in 16 car brands, including Mercedes-Benz, Porsche, Ford, and Toyota, that could allow hackers to control vehicles remotely and access personally identifiable information.

In October 2022, Toyota discovered it had mistakenly published T-Connect’s data server’s access keys on GitHub, potentially exposing 296,019 users’ personally identifiable information for five years.Dror Liwer, a co-founder at Coro, recommended anonymizing and encrypting user data: “While this is a misconfiguration which may not have been exploited, there is no reason to take chances with customer data,” Liwer said. “But beyond encryption and anonymization, when storing data, the main questions should be why, and for how long.”

According to Liwer, clear data retention guidelines limit the magnitude of an unfortunate data breach.

Technology

Japanese auto giant Toyota Motor Corp. has confirmed a decade-long data leak via its big data and mobility affiliate, Toyota Connected Corp, affecting millions of customers.

large_toy.webp

medium_toy.webp

small_toy.webp

thumbnail_toy.webp

toy.webp

Toyota Connected Service Decade-Long Data Leak Exposed 2.15 Million Customers

![sca.jpg](/uploads/sca_8533ad708f.jpg)

___

Hybrid distributor ScanScource announced that the company had suffered a ransomware attack. Upon discovering the incident on May 14, 2023, the company immediately launched an investigation and implemented its incident response plan.

ScanSource is managing the incident and is taking steps toward remediation. The company is working closely with forensic and cybersecurity experts to investigate the extent of the incident, minimize disruption and mitigate the situation. ScanSource has notified law enforcement authorities.

The company is working to bring affected systems back online, while also mitigating the impact on its business. 


Hybrid distributor ScanScource announced that the company had suffered a ransomware attack. Upon discovering the incident on May 14, 2023, the company immediately launched an investigation and implemented its incident response plan.

medium_sca.jpg

small_sca.jpg

thumbnail_sca.jpg

sca.jpg

ScanSource suffers ransomware attack

![mal.webp](/uploads/mal_927b7536af.webp)

___

A large cybercrime enterprise tracked as the "Lemon Group" has reportedly pre-installed malware known as 'Guerilla' on almost 9 million Android-based smartphones, watches, TVs, and TV boxes.

The threat actors use Guerilla to load additional payloads, intercept one-time passwords from SMS, set up a reverse proxy from the infected device, hijack WhatsApp sessions, and more.

According to a report by Trend Micro, whose analysts discovered the massive criminal enterprise and presented details about it at the recent BlackHat Asia conference, some of the attackers' infrastructure overlaps with the Triada trojan operation from 2016.

Triada was a banking trojan found pre-installed in 42 Android smartphone models from low-cost Chinese brands that sell their products globally.

Trend Micro says they first exposed the Lemon Group in February 2022, and soon after, the group allegedly rebranded under the name "Durian Cloud SMS." However, the attackers' infrastructure and tactics remained unchanged.

"While we identified a number of businesses that Lemon Group does for big data, marketing, and advertising companies, the main business involves the utilization of big data: Analyzing massive amounts of data and the corresponding characteristics of manufacturers' shipments, different advertising content obtained from different users at different times, and the hardware data with detailed software push," explains the Trend Micro report.

**Implanting the malware**

Trend Micro has not elaborated on how Lemon Group infects devices with the malicious firmware containing Guerilla but clarified that the devices its analysts examined had been re-flashed with new ROMs.

The analysts identified over 50 different ROMs infected with initial malware loaders, targeting various Android device vendors.

"The criminal group has infected millions of android devices, mainly mobile phones, but also smart watches, smart TVs and more," reads the description of Trend Micro's Black Hat talk.

"The infection turns these devices into mobile proxies, tools for stealing and selling SMS messages, social media and online messaging accounts and monetization via advertisements and click fraud."

Possible ways to achieve this compromise include supply chain attacks, compromised third-party software, a compromised firmware update process, or enlisting insiders on the product manufacturing or distribution chain.

Trend Micro says they initially purchased an Android phone and extracted its "ROM image" to discover the modified firmware implanted by the Lemon Group.

This device had a modification on the 'libandroid_runtime.so' system library to contain additional code that would decrypt and execute a DEX file.

The code of the DEX file is loaded into memory and executed by Android Runtime to activate the main plugin used by the attackers, called "Sloth," and also provide its configuration, which contains a Lemon Group domain to use for communications.

**The Guerrilla malware**

The main plugin for the Guerrilla malware loads additional plugins that are dedicated to carrying out specific functionality, including:

- **SMS Plugin**: Intercepts one-time passwords for WhatsApp, JingDong, and Facebook received via SMS.

- **Proxy Plugin**: Sets up a reverse proxy from the infected phone allowing the attackers to utilize the victim's network resources.

- **Cookie Plugin**: Dumps Facebook cookies from the app data directory and exfiltrates them to the C2 server. It also hijacks WhatsApp sessions to disseminate unwanted messages from the compromised device.

- **Splash Plugin**: Displays intrusive advertisements to the victims when they are using legitimate applications.

- **Silent Plugin**: Installs additional APKs received from the C2 server or uninstalls existing applications as instructed. The installation and app launch are "silent" in the sense that they take place in the background.

These functions allow the Lemon Group to establish a diverse monetization strategy that could include selling compromised accounts, hijacking network resources, offering app-installation services, generating fraudulent ad impressions, offering proxy services, and SMS Phone Verified Accounts (PVA) services.

**Worldwide impact**

Trend Micro reports that Lemon Group had previously claimed on its service-offering site to control nearly nine million devices spread across 180 countries. The countries most significantly impacted include the United States, Mexico, Indonesia, Thailand, and Russia.

"Further, through our telemetry data, we confirmed that there are millions of infected devices operated globally. The main cluster of these devices is in South-East Asia and Eastern Europe, however, this is a truly global problem," said Trend Micro.

Trend Micro suggests that the actual count of Android devices infected with Guerrilla could be higher. However, those devices have not yet communicated with the attackers' command and control servers because they are still awaiting purchase.

By monitoring the operation, the analysts detected over 490,000 mobile numbers used for generating one-time password requests for SMS PVA services from JingDong, WhatsApp, Facebook, QQ, Line, Tinder, and other platforms.

The identification of over half a million compromised devices tied to just a single service offered by this cybercrime syndicate signifies a substantial global reach of their malicious operations.

BleepingComputer has asked Trend Micro where they purchased the pre-infected phone, how it's being sold, and what brands are impacted, but a reply was not immediately available.





Applications

A large cybercrime enterprise tracked as the "Lemon Group" has reportedly pre-installed malware known as 'Guerilla' on almost 9 million Android-based smartphones, watches, TVs, and TV boxes.

large_mal.webp

medium_mal.webp

small_mal.webp

thumbnail_mal.webp

mal.webp

Cybercrime gang pre-infects millions of Android devices with malware

![c.webp](/uploads/c_7560e82391.webp)

___

Cisco has released updates to address a set of nine security flaws in its Small Business Series Switches that could be exploited by an unauthenticated, remote attacker to run arbitrary code or cause a denial-of-service (DoS) condition.

"These vulnerabilities are due to improper validation of requests that are sent to the web interface," Cisco said, crediting an unnamed external researcher for reporting the issues.

Four of the nine vulnerabilities are rated 9.8 out of 10 on the CVSS scoring system, making them critical in nature. The nine flaws affect the following product lines -

- 250 Series Smart Switches (Fixed in firmware version 2.5.9.16)

- 350 Series Managed Switches (Fixed in firmware version 2.5.9.16)

- 350X Series Stackable Managed Switches (Fixed in firmware version 2.5.9.16)

- 550X Series Stackable Managed Switches (Fixed in firmware version 2.5.9.16)

- Business 250 Series Smart Switches (Fixed in firmware version 3.3.0.16)

- Business 350 Series Managed Switches (Fixed in firmware version 3.3.0.16)

- Small Business 200 Series Smart Switches (Will not be patched)

- Small Business 300 Series Managed Switches (Will not be patched)

- Small Business 500 Series Stackable Managed Switches (Will not be patched)

A brief description of each of the flaws is as follows -

- **CVE-2023-20159** (CVSS score: 9.8): Cisco Small Business Series Switches Stack Buffer Overflow Vulnerability

- **CVE-2023-20160** (CVSS score: 9.8): Cisco Small Business Series Switches Unauthenticated BSS Buffer Overflow Vulnerability

- **CVE-2023-20161** (CVSS score: 9.8): Cisco Small Business Series Switches Unauthenticated Stack Buffer Overflow Vulnerability

- **CVE-2023-20189** (CVSS score: 9.8): Cisco Small Business Series Switches Unauthenticated Stack Buffer Overflow Vulnerability

- **CVE-2023-20024** (CVSS score: 8.6): Cisco Small Business Series Switches Unauthenticated Heap Buffer Overflow Vulnerability

- **CVE-2023-20156** (CVSS score: 8.6): Cisco Small Business Series Switches Unauthenticated Heap Buffer Overflow Vulnerability

- **CVE-2023-20157** (CVSS score: 8.6): Cisco Small Business Series Switches Unauthenticated Heap Buffer Overflow Vulnerability

- **CVE-2023-20158** (CVSS score: 8.6): Cisco Small Business Series Switches Unauthenticated Denial-of-Service Vulnerability

- **CVE-2023-20162** (CVSS score: 7.5): Cisco Small Business Series Switches Unauthenticated Configuration Reading Vulnerability

Successful exploitation of the aforementioned bugs could permit an unauthenticated, remote attacker to execute arbitrary code with root privileges on an affected device by sending a specially crafted request through the web-based user interface.

Alternatively, they could also be abused to trigger a DoS condition or read unauthorized information on vulnerable systems by means of a malicious request.

Cisco said it does not plan to release firmware updates for Small Business 200 Series Smart Switches, Small Business 300 Series Managed Switches, Small Business 500 Series Stackable Managed Switches as they have entered the end-of-life process.

The networking equipment major also said it's aware of the availability of a proof-of-concept (PoC) exploit code, but noted that it did not observe any evidence of malicious exploitation in the wild.

With Cisco devices becoming a lucrative attack vector for threat actors, users are recommended to move quickly to apply the patches to mitigate potential threats

Cisco has released updates to address a set of nine security flaws in its Small Business Series Switches that could be exploited by an unauthenticated, remote attacker to run arbitrary code or cause a denial-of-service (DoS) condition.

small_c.webp

thumbnail_c.webp

c.webp

Critical Flaws in Cisco Small Business Switches Could Allow Remote Attacks

![eu.jpg](/uploads/eu_329149bd73.jpg)

___

**The Council of the European Union has given its final approval to new regulations for crypto assets and markets in the EU. The decision completes a lengthy and complex legislative process for what’s considered to be the world’s first comprehensive legal framework for digital assets like bitcoin.**


**EU Finance Ministers Give Final Nod to Markets in Crypto Assets Law**

At a meeting on Tuesday, the EU Council, composed of the finance ministers of the member states, adopted the Markets in Crypto Assets (MiCA) legislation. The set of rules brings crypto assets, their issuers and crypto service providers under a Union-wide regulatory framework.

The formal adoption is the final step in the legislative process, the Council noted. It comes after a provisional agreement was reached in June 2022, following trilogue negotiations with the European Parliament and the Commission, and the EU lawmakers’ vote in April of this year.

“I am very pleased that today we are delivering on our promise to start regulating the crypto-assets sector,” stated Elisabeth Svantesson, the finance minister of Sweden. Quoted in a press release, she also emphasized:

"Recent events have confirmed the urgent need for imposing rules which will better protect Europeans who have invested in these assets, and prevent the misuse of crypto industry for the purposes of money laundering and financing of terrorism."

The legislation is designed to regulate the supervision, consumer protection and environmental safeguards of digital assets, including cryptocurrencies like bitcoin. The new rules also cover utility tokens, asset referenced tokens and stablecoins.

The law regulates trading platforms as well as digital wallets used to hold crypto assets. “This regulatory framework aims to protect investors, preserve financial stability, while allowing innovation and fostering the attractiveness of the crypto-asset sector,” the EU Council insisted, adding:

"It also introduces a harmonized regulatory framework in the European Union which, given the global nature of crypto markets, is an improvement compared to the current situation with national legislation in some member states only."

MiCA is part of a larger digital finance package, meant to develop a common European approach, which also contains a digital finance strategy, a Digital Operational Resilience Act, concerning crypto service providers, too, and a proposal on a distributed ledger technology pilot regime for wholesale uses.

The Council of the European Union has given its final approval to new regulations for crypto assets and markets in the EU. The decision completes a lengthy and complex legislative process for what’s considered to be the world’s first comprehensive legal framework for digital assets like bitcoin.

large_eu.jpg

medium_eu.jpg

small_eu.jpg

thumbnail_eu.jpg

eu.jpg

EU Council Adopts New Rules for Europe’s Crypto Markets

![7.jpg](/uploads/7_d4bb664913.jpg)

___

A report by Temecula and the Identity Theft Resource Center looked into identity theft trends. The report indicates identity thieves are getting better at using social engineering techniques to convince people to share personal, financial and important business information.

The report found 80% of identity compromises were due to a scam, a 3% increase from the previous year. Of those scams, a majority (61%) of people researched reported being the victims of a Google Voice scam.

Other trends found in the report involve:

- Of total crimes reported to the, 55% were due to compromised credentials, 40% were due to misused credentials, 3% requested prevention and 1% reported attempted misuse of credentials.

- Of the 7% of federal accounts that were misused 78% were due to IRS accounts.

- Misused social media accounts made up 72% of non-government and non-financial account abuse.

- For the misuse of stolen information, a majority reported account takeover (61%) versus new account creation (32%).

- An increase in reports of Social Security numbers being misused to gain employment and used by individuals committing crimes.

- An increase in identity thieves using driver’s license information to get fraudulent auto loans, open new bank accounts and cell phone accounts.

- A surge in the number of people requesting information on how to help prevent identity theft.

The report also lists the top five states for identity scams including:

- California

- Texas

- New York

- Florida

- Pennsylvania

A report by Temecula and the Identity Theft Resource Center looked into identity theft trends. The report indicates identity thieves are getting better at using social engineering techniques to convince people to share personal, financial and important business information.

medium_7.jpg

small_7.jpg

thumbnail_7.jpg

7.jpg

Social media was 72% of non-government or financial account abuse

![an.webp](/uploads/an_5020898611.webp)

___

Lemon Group's Guerrilla malware model an example of how threat actors are monetizing compromised Android devices, researchers say.

Millions of Android phone users around the world are contributing daily to the financial wellbeing of an outfit called the Lemon Group, merely by virtue of owning the devices.

Unbeknownst to those users, the operators of the Lemon Group have pre-infected their devices before they even bought them. Now, they're quietly using their phones as tools for stealing and selling SMS messages and one-time passwords (OTPs), serving up unwanted ads, setting up online messaging and social media accounts, and other purposes.

Lemon Group itself has claimed it has a base of nearly 9 million Guerrilla-infected Android devices that its customers can abuse in different ways. But Trend Micro believes the actual number may be even higher.

**Building a Business on Infected Devices**

Lemon Group is among several cybercriminal groups that have built profitable business models around pre-infected Android devices in recent years.

Researchers from Trend Micro first began unraveling the operation when doing forensic analysis on the ROM image of an Android device infected with malware dubbed "Guerrilla." Their investigation showed the group has infected devices belonging to Android users in 180 countries. More than 55% of the victims are in Asia, some 17% are in North America and nearly 10% in Africa. Trend Micro was able to identify more than 50 brands of — mostly inexpensive — mobile devices.

In a presentation at the just concluded Black Hat Asia 2023, and in a blog post this week, Trend Micro researchers Fyodor Yarochkin, Zhengyu Dong, and Paul Pajares shared their insights on the threat that outfits like Lemon Group pose to Android users. They described it as a continuously growing problem that has begun touching not just Android phone users but owners of Android Smart TVs, TV boxes, Android-based entertainment systems, and even Android-based children's watches.

"Following our timeline estimates, the threat actor has spread this malware over the last five years," the researchers said. "A compromise on any significant critical infrastructure with this infection can likely yield a significant profit for Lemon Group in the long run at the expense of legitimate users."

**An Old but Evolving Malware Infection Issue**

The issue of Android phones being shipped with malware pre-installed on them is certainly not new. Numerous security vendors — including Trend Micro, Kaspersky, and Google — have reported over the years on bad actors introducing potentially harmful applications at the firmware layer on Android devices.

In many instances, the tampering has happened when an Android OEM, looking to add additional features to a standard Android system image, outsourced the task to a third-party. In some instances, bad actors have also managed to sneak in potentially harmful applications and malware via firmware over-the-air (FOTA) updates. A few years ago, most of the malware found preinstalled on Android devices were information stealers and ad servers.

Typically, such tampering has involved inexpensive devices from mostly unknown and smaller brands. But on occasion, devices belonging to bigger vendors and OEMs have been impacted as well. Back in 2017 for instance, Check Point reported finding as many as 37 Android device models from a large multi-national telecommunication company, pre-installed with such malware. The threat actor behind the caper added six of the malware samples to the device ROM so the user couldn't remove them without re-flashing the devices.

**Pre-Installed Malware Gets More Dangerous**

In recent years, some of the malware found pre-installed on Android devices have become much more dangerous. The best example is Triada, a Trojan that modified the core Zygote process in the Android OSa. It also actively substituted system files and operated mostly in the system's RAM, making it very hard to detect. Threat actors behind the malware used it to, among other things, intercept incoming and outgoing SMS messages for transaction verification codes, display unwanted ads and manipulate search results.

Trend Micro's research in the Guerrilla malware campaign showed overlaps — in the command-and-control infrastructure and communications for instance — between Lemon Group's operations and that of Triada. For instance, Trend Micro found the Lemon Group implant tampering with the Zygote process and essentially becoming a part of every app on a compromised device. Also, the malware consists of a main plugin that loads multiple other plugins, each with a very specific purpose. Those include one designed to intercept SMS messages and read OTPs from platforms such as WhatsApp, Facebook, and a shopping app called JingDong.

**Plugins for Different Malicious Activities**

One plugin is a crucial component of a SMS phone verified account (SMS PVA) service that Lemon Group operates for its customers. SMS PVA services basically provides users with temporary or disposable phone numbers they can use for phone number verification when registering for an online service, for instance, and for receiving two-factor authentication and one-time passwords for authenticating to them later. While some use such services for privacy reasons, threat actors like Lemon Group use them to enable customers to bulk register spam accounts, create fake social media accounts, and other malicious activities.

Another Guerrilla plugin allows Lemon Group to essentially rent out an infected phone's resources from short periods to customers; a cookie plugin hooks to Facebook-related apps on the user's devices for ad-fraud related uses; and a WhatsApp plugin hijacks a user's WhatsApp sessions to send unwanted messages. Another plugin enables silent installation of apps that would require installation permission for specific activities.

"We identified some of these businesses used for different monetization techniques, such as heavy loading of advertisements using the silent plugins pushed to infected phones, smart TV ads, and Google play apps with hidden advertisements," according to Trend Micro's analysis. "We believe that the threat actor's operations can also be a case of stealing information from the infected device to be used for big data collection before selling it to other threat actors as another post-infection monetization scheme."

Lemon Group's Guerrilla malware model an example of how threat actors are monetizing compromised Android devices, researchers say.

small_an.webp

thumbnail_an.webp

an.webp

Lemon Group Uses Millions of Pre-Infected Android Phones to Enable Cybercrime Enterprise

![fbi.jpg](/uploads/fbi_1d5a04f562.jpg)

___

A joint advisory from the National Cyber Security Centre has detailed how the UK and its allies have cracked Snake, a Russian malware used by the FSB.


A joint advisory from the National Cyber Security Centre has detailed how the UK and its allies have cracked Snake, a Russian malware used by the FSB. Operating as Britain’s foremost intelligence agency, GCHQ worked with the FBI and similar agencies in Canada and Australia to foil one of Russia’s most effective espionage assets for the last two decades.

The joint report comes with a rundown of the technical details of Snake, how it works and how networks can fortify themselves against its attacks. NCSC Director of Operations Paul Chichester said: ‘The advisory lifts the lid on a highly sophisticated espionage tool used by Russian cyber actors.’

**Snake, BRICs and Fortuitous Timing**

The Snake malware was a favourite of Russia’s Centre 16, a component of the FSB, for over twenty years. It is believed to have been designed in-house by the FSB for long-term intelligence gathering.

While it has been a long time coming, the news dropped amidst chatter concerning the BRICs and their rising economic influence. If the BRICs bloc field a viable alternative, it could create a rival for the U.S. dollar and start a chain reaction of de-dollarisation in other emerging economies.

The power of the dollar relative to other currencies is tracked by the DXY chart, specifically the euro, yen and pound sterling. All three currencies have had a volatile relationship with the USD in the past few months.

Exposing the Snake malware is just a small bout in long and large-scale posturing between Russia and Western powers, with no telling the effect it will have. It does solidify the GCHQ’s reputation as one of the most effective cyber security watchdogs in the world, a necessity as the UK remains the largest growing tech economy in Europe.

**Snake’s Origins and Turla Group**

While the details aren’t certain, the earliest form of Snake appeared in 2003 under the name Uroboros – the word for imagery where a snake eats its own tail. While the malware network would become widely known as Snake, Uroboros is still used for related malware as is Turla, another name used by the espionage groups that used the malware and are suspected to be state actors or at least subsidised by the state. Turla has gone by many names.

Given Turla’s secrecy and their likely FSB connections, discovering their many names was half the battle. In the joint advisory, authorities identified what they called ‘the Turla family’ which included other malware like Carbon/Cobra and Chinch/ComRAT. Both were derived from Snake’s code base and believed to have been developed by the same conspirators – the FSB and Turla.

**Snake’s Targets and Perseus**

The Snake malware was evidently one of the FSB’s most effective tools. All devices infected by Snake formed a peer-to-peer network without the knowledge or consent of the device owners, compatible with all popular OS. The FBI has said that Snake targeted over 50 countries, including US journalists, education sectors and NATO members’ computer hardware.

As part of their retaliation efforts, the joint intelligence agencies created a tool dubbed Perseus. It tricked devices infected by Snake into overwriting itself partially, enough to render the malware inert. They stress that computers can still be re-infected. CISA has issued a joint advisory here, which details how the malware works and how networks can protect themselves.

While state security will certainly use this opportunity to protect themselves against Snake malware reinfections, it’s up to individuals to educate themselves on this cyber security breakthrough and shore up defences. Businesses should especially take note of the advisory report and make sure they are protected.


A joint advisory from the National Cyber Security Centre has detailed how the UK and its allies have cracked Snake, a Russian malware used by the FSB.

large_fbi.jpg

medium_fbi.jpg

small_fbi.jpg

thumbnail_fbi.jpg

fbi.jpg

FBI, GCHQ Unite To Foil Russian Malware Hacking Tool

![ai.avif](/uploads/ai_94a940f031.avif)

___

Italian officials are setting aside $33 million to enhance the development of digital skills for workers at risk of termination due to automation and AI.

Italy’s back and forth with the emergence of artificial intelligence (AI) continues after lawmakers in the country announced funds for those at risk of losing their jobs to automation. 

On May 15, Italian officials set aside 30 million euros ($33 million) toward the Fondo per la Repubblica Digitale (FRD) to enhance the capabilities of the unemployed and those whose jobs are at risk of automation and AI takeover.

The FRD was initially set up by the Italian government back in 2021 with the mission of boosting digital skills and “developing the country’s digital transition.” According to the foundation, 54% of Italians between the ages of 16 and 74 are without basic digital skills as opposed to the European Union average of 46%.

While two-thirds of the funds will go toward helping the unemployed develop digital skills to enter the job market in the first place, 10 million will go toward those already at risk of AI replacement.

The FRD singled out professional industries that are categorized as a high risk of AI replacement, including “transport and logistics, office and administrative support, production, services and the sales sector.”

This development comes after Italy became one of the first countries to briefly ban the usage of the AI chatbot ChatGPT. The initial ban followed a data breach on the AI system, which caused exposure to user data. 

Regulators in Italy demanded more transparency from OpenAI, the company behind ChatGPT, along with implementing strict guidelines prior to lifting the ban. The application reentered the country after meeting such standards on April 29, nearly a month after its ban.

Despite being banned for only one month, the move triggered officials in Europe and around the world to consider policy toward AI. German regulators followed and launched an inquiry into ChatGPT’s General Data Protection Regulation compliance.

Currently, parliament members in the European Union are voting on a brand new AI Act, which would be among the first set of regulations for emerging AI technology.

Italian officials are setting aside $33 million to enhance the development of digital skills for workers at risk of termination due to automation and AI.

ai.avif

Italy sets aside millions for workers at risk of AI replacement

![cO.jpg](/uploads/c_O_d07da5642d.jpg)

___

Scaling can be an intense and stressful experience. And with the addition of new business considerations, risks and responsibilities increase. Whether witnessing a growth in demand, meeting new clients and creating new business opportunities, or investing to conquer new markets, keeping track of everything that comes with scaling can be extremely tricky. 

For the first time, the 2023 World Economic Forum Global Risks Report included “Widespread cybercrime and cyber insecurity” as a new entrant to the top rankings of global threats. But with all the factors that come with expansion, such as new products and services, budgets, ROI, marketing, sales and more, it's easy to lose sight of the one element that a company has to secure its posture: cybersecurity. In this report, be inspired by three simple tactics to scale business and security side by side without compromising budgets. 

**If it isn’t broke, don't fix it: Pentest the expansion**
 
The 2023 Technology Spending Intentions Survey of ESG Global says that more than half (52%) of organizations are planning to increase their IT spending. 41% of organizations surveyed assure they have leveled up their ransomware preparedness. As a business scales, security leaders might feel the urge to follow the crowd and increase investments, bringing in a new flashy cybersecurity vendor. 

However, if the current security system has been working so far, there is no need to rock the boat. In fact, switching away from an architecture that is proven effective can be a waste of time and resources. Additionally, it will likely bring unexpected new risks. 

On the other hand, while security leaders can easily scale up cloud, edge and on-premises using the system they are already operating, it's paramount to focus on the security of the new digital assets. Most companies expanding will add new websites, new digital services, new apps, IoT devices or new workforce endpoints. These additions represent business-critical assets to the organization’s plan and are the most significant risk. An innovative and out-of-the-box approach to guarantee their safety is penetration testing. 

While penetration testing can be exhaustive, they are usually laser-focused, making them ideal for testing the strengths and weaknesses of the organization’s new apps, endpoints and assets. Pentests are the only way of running realistic simulations of attacks, which include phishing simulations that reveal how awake new workers are to fake email, SMS, voice and other black hat hacker tricks. 

Pentesters will employ the same techniques modern cybercriminals use. The most professional services will scan the new assets, test their code, ensure it complies with standards, and identify bugs, weaknesses, misconfigurations and errors before cybercriminals can exploit them. They will also present organizations with guidance to remediate the problems they discovered. 

When a company’s security team is operating at 100%, and doesn’t need to make drastic changes, penetration tests will give insight into new additions before adding them under the umbrella of the company’s cybersecurity framework. Remember, only move a new digital asset from testing to operational once it has been double-checked. 

**Vendor consolidation and the layered approach**
  
In contrast, if and organization is scaling and the cybersecurity posture leaves many unanswered questions regarding its performance, security leaders should consider vendor consolidation and the layered security approach.

Nothing can make a business expansion lose momentum as running out of budget. Economic uncertainty and inflation check all the right boxes and ensure 2023 will be a rough year to navigate. But how can security leaders make sure their cybersecurity investments stay within the new business targets? 

Vendor consolidation is reducing the number of solutions, technologies and companies which security leaders are in business with to consolidate their compliance, governance and security. Not only is vendor consolidation a refreshing simplification for security teams and a welcomed budget cut for the accounting department, but it also increases the ability to perform better. 

In September 2022, a Gartner survey revealed that 75% of organizations were pursuing security vendor consolidation, with more than half (65%) consolidating to improve risk posture. Only 29% of organizations surveyed said they consolidated to cut down spending on licenses. 

When a company’s digital footprint grows, it might go in new directions where its security systems have never operated. Therefore security leaders may need to bring in new security technologies, processes and people to cover new assets. The best way to keep performance up while safeguarding resources is to add security solutions tailored to business needs. From endpoint security to IoT risk management, or next-generation firewalls, when consolidating vendors, ensure to include new layers of protection that meet the expectations and demands of the business expansion plan. 

Finally, the new layers must not be siloed and work under the cybersecurity umbrella. The umbrella should be consolidated, layered and integrated, giving security leaders complete visibility of the whole system in real time. Additionally, neglecting to include compliance and governance in this approach can have devastating consequences, especially if out to conquer new markets, customers or partners. 

**There is no business without compliance and governance**
 
Just like sensor-to-edge-to-cloud autonomous solutions can help companies monitor and reduce carbon footprint — working the “E” in ESG — there are new compliance and governance technologies that companies can leverage. Cloud, hybrid and on-premises compliance and governance tools are fully automated, highly customizable, scalable and, more importantly, cost-efficient. 

If wondering whether the return on investment for these platforms will pencil out, consider the costs of wandering into new territories without proper compliance and governance frameworks. As Diligent explains, the cost of breaching, for example, a law like the GDPR, can cost up to $847 million, while violating the Health Insurance Portability and Accountability Act (HIPAA) carries a $1.5 million penalty per year for each violation. 

Additionally, executives who knowingly certify financial reports that don’t comply with SOX requirements face fines of up to $1 million, alongside 10 years imprisonment, and violating anti-money laundering regulations can translate into up to 20 years for each violation. Furthermore, data privacy and security laws that protect consumers have become a growing trend for court cases costing companies millions in fines and leading to business havoc and extensive reputation damages. 

Compliance and governance are all about data management. From where and whom organizations collect or generate data to what they do with it, the entire lifecycle of the data is essential. Additionally, scaling may imply attracting new customers, hiring talent, setting up new business relationships with new partners or expanding the supply chain. How a company manages compliance and governance will open or close doors and shape the brand perception. 

While it's no secret that the ever-evolving legal and ethical landscape is becoming more complex to navigate, moving into new markets and regions will sure have security leaders shoulder-to-shoulder with new regulations to comply. Fortunately, innovation is on their side. Compliance and governance tools are embedded into all top cloud vendors; they are easy to operate, automate most of the compliance checks, are efficient and cost-effective. 

How do they work? These automated technologies will depend on the type of workloads an organization hosts and the compliance rules the business needs to meet. Once they have identified the regulatory requirements and assets, they are defined as rules within the solutions. For example, a rule may be that all the data stored in the cloud is encrypted, or be more detailed and, for example, list as mandatory all the requirements set by regulations like the General Data Protection Regulation (GDPR).  

Once rules are defined, the technologies can perform automatic audits, identify errors and suggest solutions. Furthermore, the tech can go beyond once-and-done audits, integrate risk management programs, set priorities, eliminate redundancy and monitor and execute planning and remediation.

Scaling and growth are born from business leaders' visions. Despite the current state of the global cybersecurity landscape, the ambition can be guided to success. Test the new digital assets before they go live, consolidate vendors, layer security and keep compliance and governance in check to reach milestones. Keeping security efforts clear and straightforward while accelerating performance without compromising budget is an achievable reality.   



Scaling can be an intense and stressful experience. And with the addition of new business considerations, risks and responsibilities increase. Whether witnessing a growth in demand, meeting new clients and creating new business opportunities, or investing to conquer new markets, keeping track of everything that comes with scaling can be extremely tricky. 

medium_cO.jpg

small_cO.jpg

thumbnail_cO.jpg

cO.jpg

Managing cyber risks while company scales

![ram.jpg](/uploads/ram_e6e2e0ad6e.jpg)

___

The rise in ransomware attacks have forced security leaders to reconsider how to protect their organizations. The joint Ransomware Index Report has identified 12 vulnerabilities newly associated with ransomware in Q1 2023.

In Q1 2023, 12 new vulnerabilities have become associated with ransomware. Seventy-three percent of these vulnerabilities were trending on the internet and the deep and dark web in the past quarter. With this increase, 7,444 products and 121 vendors are now vulnerable to ransomware attacks, of which Microsoft leads the pack with 135 ransomware-associated vulnerabilities.

The complete MITRE ATT&CK kill chain is present in 59 vulnerabilities; two vulnerabilities are brand new. Vulnerabilities with a MITRE ATT&CK kill chain allow attackers to exploit them from end-to-end (initial access to exfiltration). Popular scanners do not detect 18 vulnerabilities associated with ransomware, exposing enterprises to significant risks.

Open-source vulnerabilities have increased, with 119 ransomware-associated vulnerabilities now present in multiple vendors and products. Two APT groups have newly begun using ransomware as a weapon of choice, including DEV-0569 and Karakurt, bringing the overall number of APT groups capitalizing on ransomware to 52.



The rise in ransomware attacks have forced security leaders to reconsider how to protect their organizations. The joint Ransomware Index Report has identified 12 vulnerabilities newly associated with ransomware in Q1 2023.

medium_ram.jpg

small_ram.jpg

thumbnail_ram.jpg

ram.jpg

12 new vulnerabilities have become associated with ransomware

![ccy.webp](/uploads/ccy_9b2d368adb.webp)

___

Cybercrime group that often uses smishing for initial access bypassed traditional OS targeting and evasion techniques to directly gain access to the cloud.

A threat actor known for targeting Microsoft cloud environments now is employing the serial console feature on Azure virtual machines (VMs) to hijack the VM to install third-party remote management software within clients' cloud environments.

Tracked as UNC3844 by researchers at Mandiant Intelligence, the threat group is leveraging this attack method to skirt traditional security detections employed within Azure with a living-off-the-land (LotL) attack ultimately aimed at stealing data that it can use for financial gain, Mandiant researchers revealed in a blog post this week.

Using one of its typical method of initial access — which involves compromising admin credentials or accessing other privileged accounts via malicious smishing campaigns — UNC3844 establishes persistence using SIM swapping and gains full access to the Azure tenant, the researchers said.

From there, the attacker has a number of options for malicious activity, including the exportation of information about the users in the tenant, collection of information about the Azure environment configuration and the various VMs, and creation or modification of accounts.

"Mandiant has observed this attacker using their access to a highly privileged Azure account to leverage Azure Extensions for reconnaissance purposes," the researchers wrote. "These extensions are executed inside of a VM and have a variety of legitimate uses."

**Hijacking the VM**

By leveraging in particular the serial console in Microsoft Azure, UNC3844 can connect to a running OS via serial port, giving the attacker an option besides the OS to access a cloud environment.

"As with other virtualization platforms, the serial connection permits remote management of systems via the Azure console," they wrote. "The novel use of the serial console by attackers is a reminder that these attacks are no longer limited to the operating system layer."

UNC3844 is a financially motivated threat group active since last May that typically targets Microsoft environments for ultimate financial gain. The group was previously seen in December leveraging Microsoft-signed drivers for post-exploitation activities.

However, once UNC3844 takes control of an Azure environment and uses LotL tactics to move within a customer's cloud, the consequences go beyond mere data exfiltration or financial gain, one security expert notes.

"By gaining control of an organization's Azure environment, the threat actor can plant deepfakes, modify data, and even control IoT/OT assets that are often managed within the cloud," Bud Broomhead, CEO at Viakoo, a provider of automated IoT cyber hygiene, said in a statement sent to Dark Reading.

**From the VM to the Environment**

Mandiant detailed in the post how the threat actor targets the VM and ultimately installs commercially available remote management and administration tools within the Azure cloud environment to maintain presence.

"The advantage of using these tools is that they’re legitimately signed applications and provide the attacker remote access without triggering alerts in many endpoint detection platforms," the researchers wrote.

Before pivoting to another system, the attacker set up a reverse SSH (Secure Shell Protocol) tunnel to its command-and-control (C2) server and deployed a reverse tunnel configured such that port forwarding any inbound connection to remote machine port 12345 would be forwarded to the localhost port 3389, they explained in the post. This allowed UNC3844 a direct connection to the Azure VM via Remote Desktop, from which they can facilitate a password reset of an admin account, the researchers said.

The attack demonstrates the evolution and growth in sophistication of both attackers' evasion tactics and targeting, the latter of which now goes beyond the network and the endpoint directly to mobile devices and the cloud, notes Kern Smith, vice president of Americas, sales engineering at mobile security firm Zimperium.

"Increasingly, these attacks are targeting users where organizations have no visibility using traditional security tooling — such as smishing — in order to gain the information needed to enable these types of attacks," he says.

**How to Defend Against this VM Attack**

To thwart this type of threat, organizations must first prevent targeted smishing campaigns "in a way that enables their workforce while not inhibiting productivity or impacting user privacy," Smith says.

Mandiant recommends restricting access to remote administration channels and disabling SMS as a multifactor authentication method wherever possible.

"Additionally, Mandiant recommends reviewing user account permissions for overly permissive users and implementing appropriate Conditional Access Authentication Strength policies," the researchers wrote.

They also directed organizations to the available authentication methods in Azure AD on the Microsoft website, recommending that least-privilege access to the serial console be configured according to Microsoft's guidance.

Cybercrime group that often uses smishing for initial access bypassed traditional OS targeting and evasion techniques to directly gain access to the cloud.

small_ccy.webp

thumbnail_ccy.webp

ccy.webp

Microsoft Azure VMs Hijacked in Cloud Cyberattack

![th.webp](/uploads/th_817ca8b79f.webp)

___

Risk from artificial intelligence vectors presents a growing concern among security professionals in 2023.

As CISOs work to future proof their cybersecurity strategy and infrastructure for tomorrow's emerging threats, artificial intelligence (AI) attacks are looming large in their thoughts. Even without the hype that's billowed around ChatGPT and generative AI's skyrocketing popularity, AI risk has started to unfold as a growing concern among security researchers and pundits in 2023.

Security advocates are warning CISOs that they're fighting a two-front war when it comes to AI risk and resilience. Not only do they need to be wary of the threat posed by adversarial AI attacks against enterprise deployments of AI and machine learning (ML) models, but they must also defend themselves from a greater volume of attacks fueled by the bad guys' use of AI in their offensive campaigns.

**1. AI Poisoning Attacks**

One of the attack types that should concern CISOs from a data and process integrity standpoint are poisoning attacks. The principle behind these attacks is that by manipulating the data which a deep learning model trains upon, an attacker can either corrupt the model (untargeted) or even manipulate its output to produce favorable results for the attacker (targeted). Model poisoning is just the tip of the iceberg in the corpus of data integrity issues that threaten AI integrity. Large language models (LLM) are under the microscope of risk and resiliency researchers as they explore how issues like feedback loops and AI bias can make AI output unreliable.

**2. Weaponized Models**

Being still very deeply rooted in academia, the field of data science and AI/ML research rests upon a high degree of collaborative and iterative development that relies on a lot of sharing — be it data sharing or sharing of models. This can introduce significant risk to the AI supply chain, much in the same way that appsec folks are dealing with software supply chain security issues.

Recent research shows a proof-of-concept of how attackers could potentially embed malicious code into pretrained machine learning models to carry out a ransomware attack against an organization utilizing ML models from public repositories. Attackers could do this by hijacking a legitimate model on a repo, maliciously crafting it and then reloading that model.

**3. Data Privacy Attacks**

Some of the biggest risks around AI are actually data security and data privacy threats. If AI models aren't built with sufficient privacy measures, it is possible for an attacker to compromise the confidentiality of the data used to train those models. Some attacks, like membership inference, can query models in such a way as to figure out whether a particular piece of data is used in a model — which could be very problematic in healthcare situations where it'd be possible to infer someone has a specific disease if the inference attack confirmed they're in an AI model that studies that analyzes some facet of that disease.

Meantime, training data extraction attacks like model inversion can actually reconstruct training data. This is a challenge because "an ML system that is trained up on confidential or sensitive data will have some aspects of those data built right into it through training," explains Gary McGraw, co-founder of Berryville Institute of Machine Learning.

**4. Model Theft**

It's not just data that can be stolen from AI/ML deployments. Attackers can also potentially steal the special sauce of how a particular AI/ML model works through various types of model theft attacks. Attackers are most likely to look for straightforward measure such as breaking into private source code repositories through phishing or password attacks to steal models outright.

But researchers have also explored how attackers could potentially employ model extraction attacks against models that they couldn't access quite so simply. These attacks are able to reconstruct how a model predicts something by systematically querying that model. This could be of concern for CISOs at organizations that make significant in-house investments to proprietary AI models that are tied tightly into a core product.

**5. Sponge Attacks**

A panel of experts took the stage at the 2023 RSA Conference to discuss the coming AI risk and resilience issues that CISOs are going to tackle in the coming couple of years. The discussion was broad and wide-ranging, but one of the specific emerging attack types that popped up in the discussion was what is called a sponge attack. In this attack type, adversaries can essentially conduct a denial of service attack against an AI model by specially crafting input to burn up the model's use of hardware consumption.

"It's essentially where you're taking the parameters of the model or the layers within the neural network and you're essentially trying to cause the neural network to use more compute to the point of potentially exceeding the compute available to the system and taking the system down," explained Neil Serebryany, CEO of CalypsoAI.

**6. Prompt Injection**

The old developer's maxim is to never trust user input. Doing so begets attacks like SQL injection and cross-site scripting. Injection attacks against regular applications are already prevalent enough — it still occupies the number three slot on the latest OWASP Top 10. Now with generative AI entering the mix, CISOs are going to also have to worry about prompt injection.

Prompt injection is the use of maliciously crafted prompts into generative AI to elicit incorrect, inaccurate, and even potentially offensive responses. This could be particularly mettlesome as developers fold ChatGPT and other Large Language Models (LLMs) into their applications so that a user's prompt is crunched by the AI and triggers some other action, such as posting content to a website or crafting automated emails that could potentially include incorrect or incendiary messages.

**7. Evasion Attacks**

Evasion attacks are some of the most well-known adversarial AI attacks out there because some of them can be so deviously simple that they're fun to talk about. These attacks are the ones that can evade detection or classification systems — things like facial recognition or autonomous vehicle vision systems — through some visual trickery. For example, the use of maliciously crafted stickers on a stop sign could get a self-driving car to fail to read it properly.

More recently, an attack highlighted at the Machine Learning Evasion Competition (MLSEC 2022) got an AI facial recognition system to slightly modify celebrity photos to have them be recognized as completely different people.

**8. AI-Generated Phishing and BEC Lures**

Most of the attacks detailed here so far have been attacks lobbed against enterprise use of AI. The bad guys will not only be probing the flaws in AI in their future endeavors, but they'll also likely be utilizing AI to bolster their attacks against all types of enterprise applications and systems.

One of the gimmes for the attackers is already ramping up, namely the use of generative AI like ChatGPT to automate the creation of phishing emails. Security researchers are already reporting a ramp-up in phishing volume and effectiveness since the ready availability of ChatGPT online. This is a huge concern and made it to the SANS Top 5 Most Dangerous Cyberattacks for 2023 list.

**9. Deepfake BECs and Other Scams**

ChatGPT has broken the deepfake attack threat completely out of the realm of the theoretical and into the world of practical attacks. CISOs should be working on awareness efforts to help their workers understand that AI-generated media like voice and video are getting easier to produce than ever, making it very easy to impersonate a CEO or other executive in order to convince workers to fall for business email compromise and other scams that involve the transfer of large sums of money. This is only going to serve to amplify the already growing threat of BECs.

**10. AI-Generated Malware and Vuln Discovery**

Security researchers expect attackers to increasingly lean on generative AI to help them craft malware and quickly discover vulnerabilities in targeted systems to speed up and scale their attacks even further than they've already been doing with other automated technology. This is another one on the SANS Top 5 Most Dangerous Cyberattacks for 2023 list.

At RSAC 2023, Steven Sims, offensive operations curriculum lead for SANS and a longtime vulnerability researcher and exploit developer, demonstrated how easy it will be for even the most nontechnical criminal to get ChatGPT to generate ransomware code and to discover a zero-day flaw in a specific piece of code.




Risk from artificial intelligence vectors presents a growing concern among security professionals in 2023.

small_th.webp

thumbnail_th.webp

th.webp

10 Types of AI Attacks CISOs Should Track

![tr.webp](/uploads/tr_e03357c422.webp)

___

Plug X and other information-stealing remote-access Trojans are among the malware targeting networking, manufacturing, and logistics companies in Taiwan.

Cyber espionage attacks against organizations in Taiwan have surged against the backdrop of recent political tensions, new research shows.

Trellix this week cited a fourfold rise in malicious phishing emails targeting Taiwanese companies between April 7 and 10 of this year. Networking/IT, manufacturing, and logistics, were hit the most.

The emails followed different archetypes — a fake shipment update from DHL, a fake order for bulk cement, or a fake payment overdue notification.

Some of the emails came fitted with malicious attachments, while others contained links to fake login pages designed to harvest credentials.

Following the jump in malicious emails, the researchers detected an even more significant rise in instances of PlugX — a decade-old remote access Trojan common among Chinese state-linked threat actors. PlugX is perhaps most notable for its stealthiness, using DLL sideloading as a means of circumventing Windows security measures and running arbitrary code on a target machine.

Other infostealer malware families spotted in attacks against Taiwan include Zmutzy — a Trojan written in .NET — and Formbook — a cheap infostealer-as-a-service with downloader capabilities.

Patrick Flynn, head of commercial threat intelligence at Trellix, says the majority of the attacks appear to be nation-state, with about 40% targeting Taiwan officials and agencies.

**Cyberattacks in the China-Taiwan Conflict**

Conflict between China and Taiwan dates back three quarters of a century, with the former claiming sovereignty over the autonomous latter. Tensions have ebbed and flowed ever since, with a recent flare-up precipitating from the parallel conflict in Ukraine, diplomatic meetings between American and Taiwanese officials, and Chinese military drills in the Taiwan Strait. The political and economic implications are severe.

As in Ukraine, cyberattacks have long played a role in the Taiwan conflict — a simpler, more cost-effective, and less politically dangerous weapon of war most often deployed by the more powerful side to target their adversary.

"Cyberwarfare is an attractive option for a number of nation states, as it lets them target their adversaries without escalating to a 'shooting war,'" says Mike Parkin, senior technical engineer at Vulcan Cyber.

In January 2023, for example, Trellix observed a 30-times increase in extortion emails sent to Taiwanese officials. "Though it's unclear if this activity is from China-backed threat actors, it speaks to a continued increase in attacks specifically targeting Taiwan," the researchers explained.

For now, there's no reason to believe that cyber campaigns against Taiwan and its economy will slow down any time soon, so the impetus will fall on organizations to defend themselves.

"In most cases, the things we do to counter common cybercriminals are the same things we should be doing to counter nation-state attacks: training users, up-to-date patches, secure configurations, etc.," Parkin says.

But "state-level threats are likely to have more resources and can deploy more sophisticated malware, more targeted phishing attacks, and they have the time and energy to stay persistent," he says. "Facing threats like that makes it even more important for us to have our security stack at least to baseline."



Plug X and other information-stealing remote-access Trojans are among the malware targeting networking, manufacturing, and logistics companies in Taiwan.

small_tr.webp

thumbnail_tr.webp

tr.webp

Trojan-Rigged Phishing Attacks Pepper China-Taiwan Conflict

![1.jpg](/uploads/1_278b3e3e0d.jpg)

___

A data breach on the U.S. healthcare software giant NextGen Healthcare Inc. has exposed over 1 million patient records.

According to a data breach notification filed with the Office of the Maine Attorney General, the breach occurred between March 29 and April 14.

NextGen informed its customers on April 28 that it discovered the intrusion on March 30, hired external cybersecurity experts, and notified law enforcement authorities.

Based in Atlanta, Georgia, NextGen Healthcare provides cloud-based healthcare technology solutions, including electronic health records (EHR) software and practice management solutions for healthcare professionals.

Leaked NextGen patient records excluded medical information
NextGen Healthcare estimated that the data breach exposed 1,049,375 patient records, although only a “limited set of electronically stored personal information” was accessed.

Patient records typically contain basic personal identification details, financial information, and medical and treatment history. However, the leaked patient records excluded medical information but included PII such as patient names, dates of birth, addresses, and social security numbers.

“Importantly, our investigation has revealed no evidence of any access or impact to any of your health or medical records or any health or medical data,” the company said.

Additionally, NextGen found no evidence that the threat actor had misused the exposed personal information.

Nevertheless, the electronic health systems provider said it had taken steps to protect the victims by notifying them, resetting passwords, and offering free fraud protection.

“The individuals known to be impacted by this incident were notified on April 28, 2023, and we have offered them 24 months of free fraud detection and identity theft protection,” the company said in a statement.

Additionally, NextGen Healthcare took unspecified measures to reinforce its cyber defense to prevent a similar attack in the future.

Although the leaked patient records contained no medical information, victims were still vulnerable to other online threats.

Chris Hauk, Consumer Privacy Advocate at Pixel Privacy, noted that “the data that was gleaned could be used to either trick the victims into providing additional information or could even be used by bad actors to extract more info about the victims from other companies.”

“This is a massive cybercrime which will result in widespread identity theft,” reiterated Tom Kellermann, SVP of Cyber Strategy at Contrast Security.

**NextGen Healthcare attributes the data breach to a compromised third party**

According to its ongoing investigation, NextGen Healthcare discovered that the threat actor used compromised security credentials acquired from other “sources or incidents unrelated to NextGen” to gain access.

However, Erfan Shadabi, a cybersecurity expert at Comforte AG, seemingly squarely blamed the primary organization for failing to protect patient records.

“While it appears that a third party might be culpable, this does not absolve a primary organization from ensuring that all sensitive data is fully protected at all times.”

He recommended data-centric security measures and a robust data backup strategy.

“The bare minimum of data security includes fortifying the perimeters around this type of data,” Shadabi said. “However, more effective data protection methods are readily available in the marketplace, including data-centric technologies such as tokenization and format-preserving encryption.”

The healthcare software provider has not disclosed whether any threat group has demanded a ransom.

This is the second time in less than six months that malicious actors have targeted NextGen Healthcare.

On January 17, 2023, ALPHAV/BlackCat ransomware group listed NextGen on its dark web data leak site. Back then, NextGen said it was investigating the incident but found no evidence that hackers had infiltrated its systems or exfiltrated client data.

When DataBreaches.net contacted ALPHAV/BlackCat ransomware, the group said it could only provide proof if the victim refused to pay. Shortly after, the group removed NextGen from the victim list, suggesting that either a ransom was paid or the alleged data breach was a hoax.

“Healthcare providers have long been preferred targets by Cybercriminals who specialize in identity theft due to two reasons: first, they have woeful inadequate cybersecurity, and second they store the most sensitive PII,” Kellerman added.

According to Check Point Research, the healthcare sector was a common target for cyber attacks, recording a 60% increase in 2022 and the cost of a healthcare data breach increasing by 42% in two years. Similarly, IBM’s Data Breach Report found that healthcare data breaches were the most expensive, averaging $10.10 million per attack.

“Once again, we have seen a healthcare company fall foul [to] one of the most common forms of bad cyber hygiene, and that is the re-using of passwords,” lamented Darren James, senior product manager at Specops Software.

James warned that “using the same password across multiple IT systems and services means that only one needs to be comprised” for all to be at risk.

A data breach on the U.S. healthcare software giant NextGen Healthcare Inc. has exposed over 1 million patient records.

large_1.jpg

medium_1.jpg

small_1.jpg

thumbnail_1.jpg

1.jpg

NextGen Healthcare Data Breach Leaks 1 Million Patient Records, including Social Security Numbers

![vs.webp](/uploads/vs_be5bb76a32.webp)

___

Cybercriminals are starting to target Microsoft's VSCode Marketplace, uploading three malicious Visual Studio extensions that Windows developers downloaded 46,600 times.

According to Check Point, whose analysts discovered the malicious extensions and reported them to Microsoft, the malware enabled the threat actors to steal credentials, system information, and establish a remote shell on the victim's machine.

The extensions were discovered and reported on May 4, 2023, and they were subsequently removed from the VSCode marketplace on May 14, 2023.

However, any software developers still using the malicious extensions must manually remove them from their systems and run a complete scan to detect any remnants of the infection.

**Malicious cases on the VSCode Marketplace**

Visual Studio Code (VSC) is a source-code editor published by Microsoft and used by a significant percentage of professional software developers worldwide.

Microsoft also operates an extensions market for the IDE called the VSCode Marketplace, which offers over 50,000 add-ons that extend the application's functionality and provide more customization options.

The malicious extensions discovered by Check Point researchers are the following:

**'Theme Darcula dark'** – Described as "an attempt to improve Dracula colors consistency on VS Code," this extension was used to steal basic information about the developer's system, including hostname, operating system, CPU platform, total memory, and information about the CPU.

While the extension did not contain other malicious activity, it is not typical behavior associated with a theme pack.

This extension had the most circulation by far, downloaded over 45,000 times.

**'python-vscode'** – This extension was downloaded 1,384 times despite its empty description and uploader name of 'testUseracc1111,' showcasing that having a good name is enough to garner some interest. 

Analysis of its code showed that it is a C# shell injector that can execute code or commands on the victim's machine.

**'prettiest java'** – Based on the extension's name and description, it was likely created to mimic the popular 'prettier-java' code formatting tool.

In reality, it stole saved credentials or authentication tokens from Discord and Discord Canary, Google Chrome, Opera, Brave Browser, and Yandex Browser, which were then sent to the attackers over a Discord webhook.

The extension has had 278 installations.

Check Point also found multiple suspicious extensions, which could not be characterized as malicious with certainty, but demonstrated unsafe behavior, such as fetching code from private repositories or downloading files.

**Software repositories come with risk**

Software repositories allowing user contributions, such as NPM and PyPi, have proven time and time again to be risky to use as they have become a popular target for threat actors.

While VSCode Marketplace is just starting to be targeted, AquaSec demonstrated in January that it was fairly easy to upload malicious extensions to the VSCode Marketplace and presented some highly suspicious cases. However, they were not able to find any malware.

The cases discovered by Check Point demonstrate that threat actors are now actively attempting to infect Windows developers with malicious submissions, precisely like they do in other software repositories such as the NPM and PyPI.

Users of the VSCode Marketplace, and all user-supported repositories, are advised to only install extensions from trusted publishers with many downloads and community ratings, read user reviews, and always inspect the extension's source code before installing it.




Cybercriminals are starting to target Microsoft's VSCode Marketplace, uploading three malicious Visual Studio extensions that Windows developers downloaded 46,600 times.

CryptoDATA

News

CryptoDATA's officials news feed,
bringing you real first-hand-information

No featured article yet

Latest news

No latest article yet

Press releases

Former 250cc World Champion Sito Pons Joins Forces with CryptoDATA RNF MotoGP ...

KeePass Exploit Allows Attackers to Recover Master Passwords from Memory

What Is Inferno Drainer? New Phishing Scam Pilfering Crypto, NFTs

Popular posts

Google will delete accounts inactive for more than 2 years

Toyota Connected Service Decade-Long Data Leak Exposed 2.15 Million Customers

Lemon Group Uses Millions of Pre-Infected Android Phon...

Facebook glitch sent unintended friend requests to use...

EvilExtractor malware activity spikes in Europe and th...

Top 10 Cybersecurity Trends for 2023: From Zero Trust ...

South Korean crypto exchange GDAC hacked for nearly $1...

Get your news delivered

CryptoDATA

News

CryptoDATA's officials news feed, bringing you real first-hand-information

No featured article yet

Latest news

No latest article yet

Press releases

Former 250cc World Champion Sito Pons Joins Forces with CryptoDATA RNF MotoGP ...

KeePass Exploit Allows Attackers to Recover Master Passwords from Memory

What Is Inferno Drainer? New Phishing Scam Pilfering Crypto, NFTs

Popular posts

Google will delete accounts inactive for more than 2 years

Toyota Connected Service Decade-Long Data Leak Exposed 2.15 Million Customers

Lemon Group Uses Millions of Pre-Infected Android Phon...

Facebook glitch sent unintended friend requests to use...

EvilExtractor malware activity spikes in Europe and th...

Top 10 Cybersecurity Trends for 2023: From Zero Trust ...

South Korean crypto exchange GDAC hacked for nearly $1...

Get your news delivered

CryptoDATA's officials news feed,
bringing you real first-hand-information