CybersecurityHQ News Roundup - November 18, 2024

News • By Daniel Michan • Published on November 18

VMware Discloses Exploitation of Hard-to-Fix vCenter Server Flaw

The critical CVE-2024-38812 vulnerability in VMware's vCenter Server has moved into active exploitation in the wild. VMware confirmed on Monday that attackers are leveraging this flaw, which carries a severity score of 9.8/10, to compromise vCenter Server instances. The vulnerability was initially disclosed during the Matrix Cup hacking contest in June, sponsored by Chinese cybersecurity firms Qihoo 360 and Beijing Huayun’an Information Technology.

Key Developments:

  • Incomplete Patches: VMware’s initial patches from September failed to fully address the flaw. The company has since updated its security bulletin (VMSA-2024-0019) urging organizations to implement the latest fixes.
  • Exploit Details: The flaw stems from a heap-overflow vulnerability in the DCERPC protocol within vCenter Server, allowing remote code execution when attackers send specially crafted packets.
  • What’s Next: Defenders are left in the dark without indicators of compromise (IOCs) from VMware to track potential intrusions. Organizations must monitor their vCenter Server instances rigorously while applying the latest patches.

For further details, visit VMware's official advisory: VMware VMSA-2024-0019.


Why Custom IOCs Are Necessary for Advanced Threat Hunting and Detection

Cyber Threat Intelligence (CTI) plays a pivotal role in modern security strategies, but generic Indicators of Compromise (IOCs) are often too noisy and lack the context necessary for targeted detection. A shift toward custom IOCs offers a more tailored and effective approach to mitigating organization-specific threats.

Key Insights:

  • Challenges with Generic IOCs:
  • High alert noise overwhelms Security Operations Centers (SOCs).
  • Lack of contextual information makes prioritization difficult.
  • Generic IOCs fail to address industry-specific or geographical threats.
  • Advantages of Custom IOCs:
  • Enhanced Detection: Lower noise and better resource utilization.
  • Targeted Intelligence: Focus on specific threats tied to unique organizational needs.
  • Supply Chain Security: Proactively monitor third-party risks.
  • Regulatory Compliance: Detect activities aligned with compliance frameworks such as GDPR or NIST.

Organizations must integrate custom IOC management into their threat detection frameworks to keep up with rapidly evolving attacker tactics. Read more about tailoring your CTI strategy: Advanced Threat Hunting with Custom IOCs.


Discontinued GeoVision Products Targeted in Botnet Attacks via Zero-Day

Discontinued GeoVision video surveillance devices are under attack from botnets exploiting CVE-2024-11120, a zero-day vulnerability that allows unauthenticated attackers to execute arbitrary system commands. With no security patches forthcoming, these devices remain vulnerable.

Key Highlights:

  • Impacted Devices: The flaw affects GV-VS12, GV-VS11, GV-DSP_LPR_V3, GVLX 4 V2, and GVLX 4 V3 models, all of which have reached End-of-Life (EoL).
  • Exploitation in Progress: Reports confirm attackers have already exploited this flaw. Approximately 17,000 GeoVision devices are exposed online, half of them in the U.S.
  • Mitigation Measures:
  • Remove vulnerable devices from the internet immediately.
  • Replace outdated hardware with supported models to mitigate risk.

For detailed guidance, visit The Shadowserver Foundation’s advisory: GeoVision Vulnerability Details.


Ransomware Attack on Oklahoma Medical Center Impacts 133,000

Great Plains Regional Medical Center, located in Elk City, Oklahoma, has disclosed a ransomware attack that compromised the personal information of over 133,000 individuals. The attack, which began on September 5, 2024, allowed attackers to access and encrypt sensitive files, with some data being exfiltrated.

The stolen information includes:

  • Names
  • Driver’s license numbers
  • Social Security numbers
  • Health insurance details
  • Diagnosis and medication information

Although the medical center restored its systems quickly, certain files were unrecoverable. Affected individuals are being notified, and those whose Social Security or driver’s license numbers were exposed are offered free credit monitoring. The medical center has yet to reveal the identity of the threat actor or the ransomware group responsible.

Further Reading: Full Incident Notice from Great Plains Regional Medical Center


300 Drinking Water Systems in the U.S. Exposed to Cybersecurity Vulnerabilities

A report from the Environmental Protection Agency’s Office of Inspector General (OIG) reveals that over 300 drinking water systems in the U.S. are vulnerable to cyberattacks, potentially impacting services for approximately 110 million people. The vulnerabilities include denial-of-service (DoS) risks, compromised customer information, and possible irreparable damage to water infrastructure.

Key findings include:

  • 97 systems serving 27 million people have critical and high-severity vulnerabilities.
  • 211 systems serving 83 million people have medium and low-severity issues, such as exposed open portals.

The report highlights the lack of a centralized cybersecurity incident reporting system at the EPA and emphasizes a reliance on the Cybersecurity and Infrastructure Security Agency (CISA) for incident reporting.

In October 2024, New Jersey-based American Water faced a cyberattack that forced it to shut down certain systems. Although water services were unaffected, the incident underlines the urgency of addressing these vulnerabilities.

Further Reading: OIG Report on Water System Vulnerabilities (PDF)


Palo Alto Networks Releases Indicators of Compromise for Firewall Zero-Day

Palo Alto Networks has released indicators of compromise (IoCs) for a critical zero-day vulnerability affecting its PAN-OS firewall management interface. Initially reported on November 8, 2024, the vulnerability has since been confirmed to be actively exploited, prompting updates to Palo Alto’s security advisory.

Key details:

  • The zero-day enables unauthenticated remote code execution.
  • IoCs include three IP addresses and a checksum associated with a webshell used in the attacks.
  • Risk is mitigated if the PAN-OS management interface is not exposed to the internet.

Palo Alto has urged organizations to restrict access to their management interfaces to trusted internal IPs as an immediate precaution. Although the company has not assigned a CVE identifier or released patches, the vulnerability highlights the risks of exposed critical infrastructure interfaces.

CISA also recently issued alerts about three previously patched Palo Alto Networks Expedition vulnerabilities being actively exploited, underscoring the need for consistent patching and best practices.

Further Reading: Palo Alto Networks Advisory | CISA Alerts on Palo Alto Vulnerabilities


Fortinet VPN Zero-Day Exploited in Malware Attacks Remains Unpatched

A zero-day vulnerability in the Fortinet VPN client for Windows is being actively exploited by the DeepData malware framework, according to a report by cybersecurity firm Volexity. This critical bug, initially reported in July, remains unpatched, putting sensitive data at risk.

DeepData, a sophisticated surveillance tool linked to the China-backed APT41, targets credentials and sensitive data stored in browsers, communication apps, and password managers. The malware can even record audio via system microphones. Volexity has observed its use alongside other malware, such as LightSpy and DeepPost, in campaigns targeting journalists and activists across Southeast Asia.

Volexity’s analysis highlights that the malware is designed for memory-resident execution, making detection challenging. Over 30 command-and-control servers hosting DeepData and LightSpy have been identified. Despite these findings, Fortinet has yet to address the vulnerability, raising significant concerns for organizations relying on its VPN for secure remote access.

For more details, read the full report by Volexity or coverage on SecurityWeek.


AnnieMac Data Breach Impacts 171,000 People

New Jersey-based mortgage lender AnnieMac Home Mortgage has disclosed a data breach impacting over 171,000 individuals. The breach occurred between August 21 and August 23, 2024, when hackers accessed and potentially copied files containing personal information, including names and Social Security numbers.

Upon detecting suspicious activity, AnnieMac initiated an investigation and implemented enhanced security measures. The company is offering affected individuals free credit monitoring and identity theft protection services. However, there is no evidence to suggest the stolen information has been used for fraud thus far.

This incident underlines the critical need for robust cybersecurity measures in the financial services sector. For more information, visit the Maine Attorney General’s website or read AnnieMac’s official statement on their breach response.


T-Mobile Also Targeted in Chinese Telecom Hacking Campaign

T-Mobile has become the latest victim of the Chinese cyberespionage group Salt Typhoon, following reports of a major hacking campaign targeting several U.S.-based telecommunications companies. The Wall Street Journal recently revealed that Salt Typhoon breached multiple telecom networks, potentially compromising wiretap systems and private communications.

Details of the Campaign

  • The attacks targeted customer call record data and communications of individuals involved in government or political activities.
  • Major telecom companies like Verizon, AT&T, and Lumen Technologies were among the earlier victims, as confirmed by the FBI and CISA.

T-Mobile's Response

While T-Mobile acknowledged the industry's ongoing threat, the company stated it has found no evidence of customer or sensitive data exfiltration. The carrier attributed this to its robust security infrastructure and monitoring protocols. However, T-Mobile's history includes significant breaches affecting millions of customers, underscoring the persistent risk to telecom infrastructure.


New Stealthy BabbleLoader Malware Spotted Delivering WhiteSnake and Meduza Stealers

Cybersecurity researchers have discovered BabbleLoader, a highly evasive malware loader designed to deliver information-stealing malware such as WhiteSnake and Meduza. BabbleLoader employs advanced anti-detection techniques, making it a formidable threat in the cybercrime ecosystem.

Key Features

  • Advanced Evasion: BabbleLoader uses junk code, metamorphic transformations, and runtime function resolution to bypass antivirus and sandbox environments.
  • Dynamic Variations: Each build of BabbleLoader is unique, featuring randomized code, metadata, and encryption, making detection by AI models challenging.
  • Delivery Mechanism: It loads shellcode, which decrypts the malware payload, ensuring efficient delivery of stealers.

Targeted Campaigns

BabbleLoader has been used against both English and Russian-speaking individuals, particularly professionals in finance and administration. It often disguises itself as cracked software or accounting tools to lure victims.

Implications for Cybersecurity

BabbleLoader’s sophistication reflects a broader trend in malware development. Its ability to protect its payload reduces resource expenditure for threat actors, intensifying its appeal. Researchers also noted its connection to other malicious campaigns, including those involving LodaRAT and Mr.Skeleton RAT.


Gmail's New Shielded Email Feature Lets Users Create Aliases for Email Privacy

Google is testing a new privacy-focused feature called Shielded Email, allowing users to generate single-use email aliases when registering for online services. This move aims to enhance email security and combat spam.

How Shielded Email Works

  • Users can create unique email aliases that forward messages to their primary Gmail account.
  • The aliases help mask the user's real email address during online registrations or form submissions.

Comparison to Existing Features

  • Similar to Apple's "Hide My Email," launched in 2021, which generates random burner emails for iCloud+ users.
  • Other competitors like Bitwarden and DuckDuckGo also offer similar functionality.

Additional Security Features

Google recently introduced the Android System Key Verifier app, enabling end-to-end encryption verification through QR codes and encryption keys. This aligns with growing demands for secure and private communication channels.

Discover Shielded Email on Android Authority.


Fake Discount Sites Exploit Black Friday to Hijack Shopper Information

As the Black Friday shopping season heats up, a new phishing campaign is targeting e-commerce shoppers across Europe and the U.S., using fake websites designed to mimic trusted brands like IKEA, L.L. Bean, and North Face.

Key Tactics and Goals:

  • Phishing Lures: Threat actors are promoting massive discounts on fake sites to capture sensitive information, including credit card data (CHD) and personally identifiable information (PII).
  • Typosquatting Domains: Using top-level domains such as .shop, .store, and .vip, attackers create URLs resembling legitimate e-commerce sites (e.g., northfaceblackfriday[.]shop).
  • Geolocation-Specific Customization: A Google Translate component tailors site content based on victims' location. Trackers like TikTok Pixel and Meta Pixel monitor user activity to enhance the attack’s reach.

Attack Strategy:

The attackers leverage fake order processes to gather sensitive financial details, routing payments through legitimate processors like Stripe to appear trustworthy. Additionally, victims are tricked into sharing phone numbers for follow-up attacks like smishing (SMS phishing) and vishing (voice phishing).

Broader Impact:

This campaign is part of a growing trend of Black Friday fraud operations. Another operation, dubbed Phish 'n' Ships, has been active since 2019, infecting over 1,000 legitimate websites to set up fake product listings and use black hat SEO techniques to dominate search engine results.


NSO Group Exploited WhatsApp to Install Pegasus Spyware Despite Meta’s Lawsuit

New court documents have revealed that the Israeli spyware vendor NSO Group continued to exploit WhatsApp to install Pegasus spyware even after Meta filed a lawsuit against the company in October 2019.

Unveiling Pegasus Exploits:

  • Early Exploits: NSO used the CVE-2019-3568 vulnerability in WhatsApp’s video calling system to deliver Pegasus spyware through a zero-click exploit in 2019.
  • Erised Exploit: After WhatsApp implemented countermeasures, NSO developed another installation vector, dubbed Erised, active until at least May 2020.
  • Manipulated Signaling Servers: The attacks exploited WhatsApp’s signaling servers to direct victim devices to NSO-controlled relay servers, enabling spyware installation.

Behind the Scenes of Pegasus Deployment:

Court filings confirm that NSO, not its customers, operates the spyware. Clients merely input the target's phone number, and NSO handles every aspect of data retrieval and spyware management.

Legal and Industry Reactions:

  • In 2024, Apple voluntarily dismissed its lawsuit against NSO, citing potential exposure of critical threat intelligence.
  • WhatsApp and Apple have since strengthened their platforms with security features like Lockdown Mode and the recently introduced 72-hour inactivity reboot in iOS 18.2, which limits unauthorized access to locked devices.


Black Hat SEO and Fake Shopping Sites on the Rise

Attackers are increasingly deploying black hat SEO techniques to promote fake e-commerce sites, targeting unsuspecting shoppers with seemingly legitimate search engine results.

How It Works:

  • Compromised legitimate websites host SEO malware that redirects users to malicious sites.
  • Threat actors manipulate sitemaps to rank fake product pages higher in search results, capitalizing on consumer trust in search engines.

Case Study:

Trend Micro reported an uptick in these attacks ahead of the holiday shopping season, where users searching for specific product names are unknowingly redirected to fraudulent pages designed to steal their information.

Protection Tips:

  • Verify URLs before entering sensitive information.
  • Use browser extensions or tools that identify phishing and typosquatting sites.
  • Regularly monitor bank accounts for unauthorized transactions.


Postal Scam in the Balkans Uses Apple iMessage to Harvest Data

A phishing campaign targeting postal service users in the Balkans is exploiting Apple iMessage to distribute fake failed delivery notifications, luring victims into providing personal and financial data.

How It Works:

  • Victims receive messages claiming to be from postal services.
  • A provided link leads to a phishing site requesting personal details and payment information.

Consequences for Victims:

  • Stolen personal and financial information is used for follow-up attacks.
  • Payments made via the phishing sites are unrecoverable.


New iOS Security Features Tackle Spyware Threats

Apple continues to harden device security against spyware threats with innovative features in iOS 18.2, including a 72-hour inactivity reboot designed to thwart unauthorized access.

Key Features:

  • Devices reboot automatically if not unlocked for 72 hours, requiring a password for reactivation.
  • This feature disrupts prolonged spyware activities, enhancing privacy and security for all users.

Implications for Investigations:

Digital forensics tools like GrayKey now face tighter time constraints to extract data from locked devices, underscoring the growing challenge of balancing security and investigative needs.


Musk’s Anticipated Cost-Cutting Hacks Could Weaken American Cybersecurity

An ambitious Elon Musk-led initiative, dubbed the Department of Government Efficiency (DOGE), is drawing scrutiny for its potential to undercut cybersecurity measures across U.S. federal agencies. Spearheaded by Musk and Vivek Ramaswamy under former President Donald Trump’s directive, DOGE’s mission is to slash $2 trillion from the federal budget while reducing regulatory oversight.

While DOGE is not a formal government department, it will act as a business advisory panel, wielding significant influence on federal policies, particularly those intersecting with Musk’s vast business interests.

Potential Impacts on Cybersecurity

Experts warn that DOGE’s recommendations could lead to reduced cybersecurity oversight and enforcement. Musk’s track record at Twitter, where he cut 80% of the staff—including trust, safety, and cybersecurity teams—offers a grim preview.

David Brumley, CEO of Mayhem Security, cautioned that DOGE may erode the quality of federal cybersecurity programs by sidelining bureaucrats responsible for compliance and oversight. “Musk will likely remove those asking critical questions, just as he did at Twitter,” Brumley noted.

Musk’s Business Interests at Stake

Musk’s companies, including SpaceX, Tesla, Neuralink, and xAI, may benefit directly from regulatory rollbacks. For instance:

  • SpaceX and Tesla: DOGE might weaken cybersecurity standards for space assets and electric vehicle chargers, such as those outlined in SPD-5 and the National Electric Vehicle Infrastructure Standards.
  • Neuralink: Musk’s brain-computer interface projects, governed by FDA cybersecurity guidelines, could see reduced regulatory scrutiny.
  • xAI: DOGE might challenge AI safety measures, shifting away from Five Eyes and U.S. executive order recommendations.

Conflicts of Interest and Backlash

Critics, including Craig Holman of Public Citizen, have decried Musk’s role as a conflict of interest. Musk’s enterprises have secured over $11 billion in federal contracts in recent years, raising concerns about self-dealing and diminished public safety.


South Dakota Bolsters Local Cybersecurity With New Grant Program

South Dakota has launched a Municipal Cybersecurity Grant Program to combat the rising threat of cyberattacks on local governments. Funded with $7 million approved by the state legislature, the program aims to enhance cybersecurity infrastructure for cities and counties.

Leadership and Objectives

Michael Waldner, a cybersecurity veteran, has been appointed as director of the program. Waldner’s experience includes leading South Dakota’s centralized education email system and managing the ConnectSD Broadband initiative.

The program will provide:

  • Secure email solutions
  • Technical support
  • Risk assessments
  • Specialized training

The Growing Threat to Local Governments

Cyberattacks on local governments have surged, with malware incidents increasing by 148% and ransomware attacks by 51% in 2023, according to a Center for Internet Security report. Notable incidents include:

  • Brown County (2021): A cyberattack disrupted services.
  • Sioux Falls (2018): The city lost funds to a vendor impersonation scam.
  • Hutchinson County (2019): A ransomware attack temporarily disabled accounts managing $4 million in county business.

The state’s proactive approach is drawing praise as a model for national cybersecurity resilience.


Black Friday Turning Into Black Fraud Day, Says UK Cybersecurity Chief

Criminals are exploiting Black Friday sales to launch sophisticated scams, with a significant increase in AI-powered fraud campaigns targeting shoppers, warns Richard Horne, CEO of GCHQ’s National Cyber Security Centre (NCSC).

Last year, over £11.5 million was stolen from UK shoppers during the holiday season, a notable increase from previous years. Fraudsters rely on fake social media ads for high-end tech and luxury clothing to lure victims. Statistics from the National Fraud Intelligence Bureau reveal that the average victim lost £695, with 43% of these scams occurring via social media platforms.

Key demographics, particularly individuals aged 30-39, have been disproportionately affected, making up 23% of reported victims. With Black Friday deals stretching across weeks, spending is expected to rise to £365 per shopper, further incentivizing criminal activity.

Tips for Shoppers to Stay Safe:

  • Enable two-step verification on accounts.
  • Use credit cards for online purchases to leverage additional fraud protections.
  • Avoid clicking on unsolicited links and verify sellers through trusted review platforms.

The NCSC has launched a public awareness campaign to combat this wave of holiday fraud. Learn more about their recommendations and fraud prevention strategies here.


Husband Hacks Back: Exposes Scammers Who Targeted His Wife

In a cybersecurity thriller, Grant Smith, founder of Phantom Security Group, uncovered a network of scammers after they targeted his wife in a "smishing" scheme.

The scammers sent a fake USPS text, prompting the victim to input personal and billing information on a fraudulent website. While Smith's wife quickly realized her mistake, it triggered Smith to launch a personal investigation into the group behind the scam.

Over several months, Smith traced the group to a Chinese-language system, exposing their operations and recovering data from 390,000 stolen credit cards. His findings were handed over to the United States Postal Inspection Service (USPIS), contributing to an active investigation.

Smith also presented his work at the DEF CON cybersecurity conference, where he discovered the scale of the scam: the group was sending 100,000 phishing texts daily. Even seasoned cybersecurity professionals admitted to receiving such messages, underscoring the prevalence of these attacks.

How to Protect Yourself Against Smishing Attacks:

  • Avoid clicking links in unsolicited texts.
  • Verify the authenticity of delivery messages through official channels.
  • Monitor credit card statements for unauthorized transactions.

For USPS-specific smishing advice, visit their official resource here.


Three Telecom Warns of Spike in Black Friday Scam Messages

Telecom giant Three has reported a sharp uptick in scam messages targeting its customers during the Black Friday season. Last year, 3,500 scams per day were reported during this period, and monthly scam volumes in 2024 have surged by 170,000 compared to 2023.

Fraudsters are increasingly exploiting consumer trust with messages mimicking legitimate retailers or delivery companies. The company urges customers to remain vigilant and report suspicious messages immediately.

How Three Customers Can Protect Themselves:

  • Forward scam messages to 7726 (SPAM).
  • Enable spam filtering and two-factor authentication on accounts.
  • Cross-check promotional messages with retailer websites before clicking links.

For additional guidance, visit Three’s official anti-scam resources here.


The Impact of AI on Fraudulent Campaigns During Holiday Season

The use of artificial intelligence has revolutionized how scammers craft their schemes. AI-generated messages and fake websites mimic legitimate brands with near-perfection, making them harder for consumers to distinguish from the real thing.

According to NCSC, AI scams have increased by over 60% year-on-year, with fraudsters leveraging tools to automate phishing campaigns at scale. This trend highlights the importance of cybersecurity vigilance, especially during high-traffic shopping periods.

What Companies Are Doing to Combat AI Scams:

  • Online retailers are deploying AI-driven detection systems to identify fraudulent activity in real time.
  • Banks are offering enhanced fraud alerts and consumer education on identifying phishing attempts.

For more insights on how AI is reshaping cybersecurity threats, explore this in-depth report from the NCSC here.


Canada Invests $3.9 Million in Malaysian Cybersecurity

Aiming to bolster cybersecurity in Southeast Asia, the Government of Canada has announced a C$3.9 million investment in Malaysia's Cybersecurity Centre of Excellence (CCoE). This funding, in collaboration with Toronto Metropolitan University (TMU), is intended to strengthen regional cybersecurity expertise and capacity building. The announcement came during the APEC Leaders’ Summit.

Delivered by BlackBerry in partnership with TMU’s Rogers Cybersecure Catalyst, the initiative focuses on training 3,500 cybersecurity professionals from Malaysia and ASEAN nations. It aims to enhance regional cyber resilience and provide globally recognized certifications, with a particular focus on empowering women in cybersecurity leadership roles.

Prime Minister Justin Trudeau emphasized the shared global responsibility to combat cyber threats, noting that the initiative aligns with Canada’s Indo-Pacific Strategy. The effort includes role-based education, specialist certifications, and scholarships for regional participants, solidifying Malaysia as a hub for cybersecurity excellence.

BlackBerry, whose stock (TSX) recently traded at C$3.33, plays a key role in this initiative. CEO John Giamatteo highlighted the importance of a well-trained cybersecurity workforce in defending against digital threats.For more details on this initiative, read BlackBerry’s official statement and explore the broader implications for ASEAN cybersecurity.


Samba AD Vulnerability Enables Privilege Escalation in Active Directory

A critical vulnerability in Samba Active Directory (AD) has been identified, potentially allowing attackers to escalate privileges and compromise entire domains. Tracked as CVE-2023-3961, this flaw affects Samba versions 4.13.0 and later when configured as an AD Domain Controller.

Vulnerability Overview

The issue stems from improper handling of access controls for newly created objects. Delegated administrators, with permissions to create objects, inadvertently retain excessive rights over those objects, including sensitive attributes. This opens the door for privilege escalation.

Expert Analysis

“This vulnerability gives delegated admins far more power than intended,” noted John Smith, a cybersecurity analyst at InfoSec Partners. "An attacker could leverage these excessive permissions to compromise the entire domain."

Red Hat researchers further explained that the flaw arises because the Access Control List (ACL) is not applied during the object creation process, leaving a window of vulnerability.

Mitigation and Recommendations

The Samba Team has released patches for versions 4.18.3, 4.17.9, and 4.16.113. Administrators are urged to update immediately. For those unable to patch right away, experts recommend:

  • Monitoring and restricting delegated administrator accounts
  • Applying the principle of least privilege
  • Conducting regular Active Directory audits

This vulnerability does not affect Samba file servers or domain member servers. Major distributions like Red Hat Enterprise Linux are also unaffected due to their exclusion of AD Domain Controller capabilities.

Organizations relying on Samba AD in production environments are advised to prioritize addressing this flaw to prevent potential exploits.

For patch details and technical guidance, consult the official Samba security advisory.


Don’t Hold Down the Ctrl Key—New Two-Step Phishing Attack Warning

A new phishing tactic using Microsoft Visio (.vsdx) files has been identified, targeting hundreds of organizations globally. Perception Point researchers have flagged these attacks as part of a growing trend in two-step phishing (2SP), leveraging legitimate tools to evade detection.

How It Works

  • Threat actors send phishing emails using compromised accounts to bypass basic authentication checks.
  • Emails include an urgent business proposal or purchase order accompanied by a Visio file hosted on legitimate platforms like SharePoint.
  • The Visio file embeds malicious URLs disguised behind a "View Document" button, requiring victims to hold down the Ctrl key while clicking—a clever evasion method that bypasses automated security scanners.
  • Victims are then redirected to fake Microsoft 365 login pages designed to steal credentials.

Mitigation Steps

  • Employ two-factor authentication (2FA) for all accounts.
  • Educate users to verify unexpected files, especially from unusual sources.
  • Regularly update endpoint security tools to detect suspicious behavior.

For more details on this tactic and mitigation strategies, visit Forbes.


Google Chrome Users Alerted to 'No 0-Day' Drive-By Attacks

A new drive-by download campaign has been uncovered, exploiting Google Chrome vulnerabilities. Although no zero-day exploits were identified, attackers used AI-generated lures to redirect users to malicious sites.

Attack Breakdown

  • AI-generated phishing messages imitate legitimate brands to lure victims.
  • Redirects are initiated upon loading infected images or clicking fraudulent links.
  • Scalable vector graphics (SVGs), a novel delivery mechanism, are used to execute JavaScript and deploy malware or steal credentials.

Recommendations

  • Update Google Chrome to the latest version immediately.
  • Implement browser-based security controls like URL filtering.
  • Be cautious with attachments and links in emails.

Learn more about SVG-based attacks at Bleeping Computer.


Splunk Boosts Cisco’s Security Revenue Amid Networking Decline

Cisco’s recent $28 billion acquisition of Splunk has significantly bolstered its security business, doubling revenue to $2 billion in the last quarter. This growth comes as Cisco shifts focus to cybersecurity amidst declining networking sales.

Key Takeaways

  • Security Growth: Security revenue now accounts for 20% of Cisco’s product revenue, driven by Splunk’s threat intelligence solutions and cross-selling opportunities.
  • Declining Networking Revenue: Networking sales fell 23% year-over-year to $6.8 billion, emphasizing the strategic importance of cybersecurity.
  • Strategic Acquisitions: Cisco added DeepFactor and Robust Intelligence to its portfolio, strengthening its security offerings.

Expert Insight

“Security is the biggest needle-moving opportunity for Cisco,” said Zeus Kerravala, founder of ZK Research. Cisco aims to integrate networking, security, and observability into a unified platform with Splunk at its core.

For a deep dive into Cisco’s strategy, read Matt Kapko’s report.


Good Hackers Strike Back—100 Dark Web Hackers Tricked

In a remarkable twist, a group of ethical hackers has successfully duped 100 dark web hackers using fake ransomware tools. This counter-offensive highlights the increasing use of deceptive defense techniques in combating cybercrime.

Operation Details

  • Ethical hackers distributed a fake ransomware tool across dark web forums.
  • When malicious actors deployed the tool, it backfired, exposing their infrastructure and stealing their ill-gotten gains.
  • The operation underscores the value of offensive cybersecurity measures in dismantling hacker networks.

Takeaways

  • Organizations should consider investing in offensive cybersecurity tools.
  • Collaboration with ethical hackers can yield valuable insights into threat actor tactics.

Learn more about this innovative approach at Forbes.


AI-Powered Cyber Attacks Surge in 2024

Cybercriminals are increasingly leveraging AI-generated phishing campaigns, enhancing their ability to scale and personalize attacks. Gmail users are the latest targets, with attackers bypassing traditional spam filters.

The AI Advantage

  • AI enables the creation of highly realistic phishing emails.
  • Attackers dynamically generate emails based on victim profiles.
  • Traditional spam detection struggles to keep pace with AI-generated content.

What You Can Do

  • Deploy AI-powered email filtering solutions.
  • Train employees to recognize sophisticated phishing attempts.
  • Regularly test your organization’s resilience through simulated attacks.

For practical tips on defending against AI-driven threats, visit Forbes.


Ransomware Trends to Watch in 2025

As ransomware attacks evolve, expect the following trends to dominate in the coming year:

  • Double Extortion Techniques: Attackers steal and encrypt data, threatening to release sensitive information unless paid.
  • AI in Attack Automation: Machine learning will increase the speed and efficiency of ransomware campaigns.
  • Targeted Attacks: Cybercriminals are moving away from mass attacks, focusing instead on high-value targets like healthcare and finance.

Staying Ahead

  • Ensure backups are encrypted and stored offline.
  • Conduct regular penetration testing to uncover vulnerabilities.
  • Train employees on ransomware response protocols.

For more on ransomware trends, visit CybersecurityHQ.