Parse notes
Sponsored
Flashpoint's Threat Intelligence Report [4] looks at +3.6 petabytes of data from the hardest-to-reach corners of the web — revealing 2.1B stolen credentials and 5,742 ransomware attacks in 2024, with five major RaaS groups responsible for nearly half.
The State Bar of Texas suffered a data breach perpetrated by the INC ransomware gang. The threat actors stole full names, case documents, and other redacted information. The State Bar of Texas is offering free credit monitoring to victims and recommends that victims consider placing credit freezes.
A hacker breached the GitLab repos of the Europcar car rental company and stole source code for the mobile apps and personal information belonging to up to 200K customers. The threat actor discovered 9,000 SQL files, which include customers' names and email addresses, and 269 .env files. Europcar has confirmed the breach but has not provided more information.
Outlaw infects systems through SSH brute-force attacks, establishes persistence via cron jobs and SSH key manipulation, and deploys a three-part payload consisting of XMRIG for cryptocurrency mining, STEALTH SHELLBOT for remote control, and BLITZ for further propagation. Despite its unsophisticated nature, Outlaw remains effective because it leverages stolen system resources for mining profit while simultaneously expanding its botnet through continuous SSH brute-forcing of nearby systems.
Techcrunch has identified a new stalkerware app that requires a password to uninstall it. The app works by requiring the person who installs it to enable a built-in Android feature that allows for overlaying content, which allows the app to display the password prompt, which requires a password set by the person who installs it to dismiss whenever the user tries to uninstall it. Users can uninstall the app without a password by booting into safe mode. The app masquerades in the installed app list as a default Android app and also installs a device admin profile.
The post dives into Mustang Panda, which is targeting various organizations worldwide. By analyzing indicators of compromise, potential overlaps between Red Delta, APT41, and Mustang Panda were identified. The investigation led to uncovering additional infrastructure and operational connections between the threat actors.
Sponsored
When you don't know what actually exists in your environment, you could easily be leaving critical gaps that leave you vulnerable. That's why better security starts with aggregating your asset inventory [11], so you can maximize the security tools you already
MORF is an advanced mobile security analysis tool that automatically discovers sensitive information within Android and iOS applications.
RamiGPT is an AI-powered offensive security agent designed to autonomously escalate privileges using OpenAI.
Wiz has launched a new site designed for security teams and cloud professionals to monitor significant vulnerabilities in cloud environments. It offers technology-based filtering options, features CISA KEV exploits, and includes high-profile CVEs with known exploits from the past 60 days.
Code to cloud promises to reduce the cognitive load of vulnerability management by providing the exact lines of code that need to change to remediate a finding. It can also aid security teams by helping them find the right person for a fix, understand how widespread a problem is, and aid in prioritization. Code to cloud can be achieved via customers manually linking source repos to container images, container tagging, or the provider ingesting all the data a customer provides and using data modeling to identify relationships.
SpyCloud's research shows that 66% of malware infections happen on devices with endpoint security. Although EDR tools have advanced, modern malware evades detection. SpyCloud integrates with EDR products to close the detection gap and defend against cyber threats.
Xanthorox AI is a new hacking tool circulating on the dark web that offers advanced capabilities for cyber operations. It uses custom-built language models and various modules for automated attacks. Experts recommend using AI-powered security solutions to detect and prevent such threats effectively.
Nine harmful VSCode extensions in Microsoft's marketplace secretly installed cryptominers, amassing over 300,000 installs and misleading users since April 4.
The US extradited fugitives from nine countries for crimes like running dark web markets and drug trafficking, including the Rydox marketplace brothers.
Noah Urban, a 20-year-old man, pleaded guilty to cybercrime charges for stealing cryptocurrency and personal information as part of the Scattered Spider group, which hacked organizations like Twilio and LastPass.