Cybersecurity Update: Insights from Cyber Briefing 2024.07.30
Written on
Introduction to Cyber Briefing
Welcome to the Cyber Briefing, your go-to source for the latest cybersecurity updates, alerts, and incidents every weekday. If this is your first time reading, consider subscribing for crucial alerts. 🚨
Latest Cybersecurity Alerts
Phishing Attack Targets OneDrive Users
A new phishing scheme has emerged, specifically targeting Microsoft OneDrive users. This campaign, known as "OneDrive Pastejacking," uses social engineering tactics to trick victims into running a harmful PowerShell script. Attackers send an email containing an HTML file that mimics a OneDrive error page, leading users to open a PowerShell terminal and execute a malicious command that downloads the harmful script.
Apple's Critical Security Updates Released
On July 30, 2024, Apple rolled out important security updates across its operating systems, including iOS, macOS, tvOS, visionOS, watchOS, and Safari. These updates address numerous vulnerabilities, with iOS 17.6 and iPadOS 17.6 fixing 35 security issues that could lead to serious risks such as authentication bypasses and denial-of-service attacks.
Severe VMware ESXi Vulnerability Discovered
Researchers from Microsoft have identified a significant flaw in VMware ESXi hypervisors that allows unauthorized users to gain full administrative access. This vulnerability, exploited by ransomware groups like Storm-0506, poses a serious threat as it enables attackers to encrypt the hypervisor's file system, jeopardizing hosted virtual machines and potentially leading to data breaches.
Proofpoint Email Routing Flaw Exposed
A major phishing campaign has taken advantage of a critical email routing flaw within Proofpoint’s security framework. This vulnerability enabled attackers to send spoofed emails from trusted companies, including Best Buy and IBM, effectively bypassing standard security checks like SPF and DKIM.
DigiCert Announces SSL/TLS Certificate Revocation
DigiCert, a leading certificate authority, has revealed plans to revoke thousands of SSL/TLS certificates due to a significant Domain Control Verification error. This issue affects around 0.4% of domain validations and stems from a mistake in DNS-based CNAME records, violating CA/Browser Forum verification requirements.
Video: Cyber Briefing 2024.07.30 - Overview of Recent Cyber Incidents
Cyber Incidents of Note
Zeus Group Exposes Data of Israeli Olympians
The hacker collective known as "Zeus" leaked sensitive information about Israeli athletes involved in the Paris Olympics, which included personal data such as blood test results. This breach, disclosed on Telegram, prompted France's Anti-Cybercrime Office to act quickly to remove the compromised information.
Northeast Rehabilitation Hospital Network Data Breach
The Northeast Rehabilitation Hospital Network (NRHN) reported unauthorized access to its network between May 13 and May 22, 2024, affecting the personal and medical information of some patients. While no evidence of identity theft has surfaced, NRHN is currently investigating the breach and has notified federal law enforcement.
Pro-Ukrainian Hackers Attack Russian Firm
A pro-Ukrainian group, Cyber Anarchy Squad, has claimed responsibility for a significant cyberattack on the Russian security firm Avanpost, encrypting over 400 virtual machines and leaking 390 gigabytes of sensitive data.
Ransomware Attack on Melchers
The Bremen-based retail company Melchers has fallen victim to a ransomware attack by RA World, with claims of 15 gigabytes of stolen data. Although the attackers have made their claims on the darknet, Melchers denies any data leakage and is working to restore its systems.
UAB's Postcard Incident Exposes Patient Information
The University of Alabama at Birmingham (UAB) School of Nursing reported a privacy breach where a recruitment postcard inadvertently disclosed personal patient information. UAB has since apologized and implemented measures to prevent future occurrences.
Cybersecurity News Highlights
ECB Completes Banking Cyber Stress Test
The European Central Bank (ECB) has finalized its first-ever cyber stress test for the European banking sector, revealing that while banks have solid response frameworks, there is significant room for improvement in recovery capabilities.
Justice Department Defends TikTok Ban
The U.S. Justice Department is actively defending the constitutionality of a law that could lead to a TikTok ban in the U.S., emphasizing national security risks posed by its ownership by the Chinese firm ByteDance.
ICO Critiques Electoral Commission's Security Measures
The Information Commissioner's Office (ICO) has criticized the UK Electoral Commission for serious security failures that allowed the personal details of 40 million British voters to be accessed by hackers.
India’s Rising Data Breach Costs
The Reserve Bank of India's cybersecurity report indicates that the average cost of a data breach in the country has risen to $2.18 million, with phishing being the predominant attack vector.
ZeroTier Secures $13.5 Million in Funding
ZeroTier, a provider of virtual networking solutions, has raised $13.5 million in Series A funding to enhance product development and expand its market reach.
Video: Cyber Briefing 2024.07.30 - Analysis of Cybersecurity Trends
Subscribe for more updates and insights into the cybersecurity landscape.
Copyright © 2024 CyberMaterial. All Rights Reserved.
Follow CyberMaterial on:
LinkedIn, Twitter, Reddit, Instagram, Facebook, YouTube, and Medium.