According to security researchers at Patchstack, hackers are exploiting a recently patched vulnerability in the Bricks Builder plugin for WordPress to hack websites and deploy malware.  The issue tracked as CVE-2024-25600 is described as a remote code execution (RCE) flaw that can be exploited without authentication to execute arbitrary PHP code on an affected WordPress website.  The researchers noted that an analysis of the process calls revealed that no proper permissions or role checks were applied when a function handling a REST API endpoint was involved.

Researchers warn that cloud attackers have launched a new cryptocurrency jacking campaign targeting exposed Redis deployments. Unlike previous attacks on the in-memory data store, the threat actors use specific system-weakening commands prior to installing their cryptocurrency mining malware. Cado Security researchers named the new miner Migo and noted that it is being deployed with a user mode rootkit. The malware also includes a persistence mechanism to ensure its survival through reboots. This article continues to discuss findings regarding the Redis attack campaign.

It has been confirmed that 28,500 Microsoft Exchange servers are vulnerable to Elevation of Privilege (EoP), putting affected organizations at risk because many users rely on Exchange for work. A cybercriminal can use the EoP bug to relay a leaked Net-NTLMv2 hash to a vulnerable Exchange server in order to authenticate as a user. Hackers could crack NTLM hashes or use an NTLM relay attack. This article continues to discuss the vulnerability of 28,500 Microsoft Exchange servers to an EoP issue.

MrAgent is a new ransomware tool that operates as a binary designed to run mainly on VMware ESXi hypervisors. Its purpose is to automate and track ransomware deployment across large environments with multiple hypervisors. The gang found to be behind the tool, the RansomHouse Group, is a Ransomware-as-a-Service (RaaS) operation that was discovered in late 2021 and has been actively deploying ransomware variants on corporate networks. According to researchers, the RansomHouse Group extorts its victims twice. This article continues to discuss the RansomHouse Group and its new MrAgent tool.

The Cactus ransomware group claims to have stolen 1.5TB of data from the energy management and industrial automation company Schneider Electric. The attack affected the company's Sustainability Business division, disrupting Schneider Electric's Resource Advisor cloud platform services. According to Kroll researchers, the Cactus ransomware operation has been active since March 2023 and relies on multiple legitimate tools to achieve remote access.

Hackers have demonstrated that the new PlayStation Portal, which is a limited device for streaming games remotely from a PS5 console, is capable of much more. Andy Nguyen, a cloud vulnerability researcher, together with two other engineers, hacked the PlayStation Portal to run PPSSPP, a PlayStation Portable (PSP) emulator. The PSP is a standalone handheld portable console that was released in 2004 and does not require a wired console to stream games from. Nguyen confirmed that the hack only required software modifications, not hardware changes.

The LockBit ransomware operation has recently been severely disrupted by an international law enforcement operation that involved the seizure of servers and several individuals getting arrested or charged.  LockBit domains currently display a seizure notice informing visitors that the site is controlled by law enforcement, specifically the UK’s National Crime Agency (NCA).

According to security researchers at ThreatFabric, the Android banking trojan named Anatsa has evolved, and its attacks are more targeted.  Anatsa has been active for about four years and can target more than 600 mobile banking applications worldwide, infecting devices via malicious droppers uploaded to Google Play.  In June last year, three identified droppers had amassed roughly 30,000 installs via the application store.

Wyze recently shared more details on a security incident that impacted thousands of users recently and said that at least 13,000 customers could get a peek into other users' homes.  The company blames a third-party caching client library recently added to its systems, which had problems dealing with a large number of cameras that came online all at once after a widespread outage that occurred on 2/16.  The company noted that multiple customers reported seeing other users' video feeds under the Events tab in the app since Friday.