According to security researchers at Sophos, over three-quarters of cyber incidents impacted small businesses in 2023, with ransomware having the biggest impact on these firms.  The researchers noted that the notorious LockBit group made up the highest number of small business ransomware incidents handled by Sophos Incident Response last year, at 27.59%.  LockBit infections were considerably higher than the next highest groups: Akira (15.52%), BlackCat (13.79%), and Play (10.34%).

According to Japanese cybersecurity officials, the North Korea-affiliated Lazarus Group recently launched a supply chain attack on the PyPI software repository for Python apps. The threat actors uploaded malicious packages named "pycryptoenv" and "pycryptoconf," which are similar to the legitimate "pycrypto" encryption toolkit for Python. Developers who have downloaded the malicious packages onto their Windows machines are infected with a Trojan called "Comebacker." The malicious Python packages had been downloaded between 300 and 1,200 times.

A new banking Trojan called "CHAVECLOAK" targets Brazilian users through phishing emails with PDF attachments. According to Cara Lin, a Fortinet FortiGuard Labs researcher, the attack involves the PDF downloading a ZIP file and then executing the final malware using DLL side-loading techniques. Contract-themed DocuSign lures are used to trick users into opening PDF files with a button to read and sign the documents. Clicking the button triggers the retrieval of an installer file from a shortened remote link.

Generative Artificial Intelligence (AI) is expected to help with secure code writing, code analysis, test creation, documentation, and various other DevSecOps functions. According to most industry surveys, many developers are already using generative AI. For example, a CoderPad survey of over 13,000 developers released found that 67 percent of technology professionals already use AI, with ChatGPT coming in first, followed by GitHub Copilot, and Bard.

To help ensure a safe and secure digital ecosystem for all Americans, the Biden-Harris Administration has approved a secure software development attestation form, taking a step in implementing its requirement that those who produce software used by the Federal Government attest to the adoption of secure development practices. The release of the secure software development attestation form reinforces the secure-by-design principles advocated by the US Cybersecurity and Infrastructure Security Agency (CISA), federal government partners, and international allies.

Security researchers at Check Point Security have uncovered a trend involving the exploitation of 1-day vulnerabilities, including two in Ivanti Connect Secure VPN.  The flaws, identified as CVE-2023-46805 and CVE-2023-21887, were quickly exploited by multiple threat actors, leading to various malicious activities.  Tracking these exploits, the researchers said it encountered a cluster of activities attributed to a threat actor dubbed Magnet Goblin.

Roku recently disclosed a data breach in which over 15,000 customer accounts were hacked to make fraudulent purchases of hardware and streaming subscriptions. According to researchers, threat actors are selling the compromised accounts for as little as $0.50 each. Those who purchase the accounts can use stored credit cards to make illegal purchases. Roku first disclosed the data breach, revealing that 15,363 customer accounts had been hacked in a credential stuffing attack where threat actors collect credentials from previous data breaches and use them to log in to other websites.

The BianLian ransomware group has exploited JetBrains TeamCity software vulnerabilities. While investigating a recent attack attributed to the BianLian ransomware group, GuidePoint Security researchers discovered that the threat actors' infiltration of the target involved exploiting vulnerabilities in a TeamCity server. Since its emergence in August 2022, the BianLian ransomware has been used in attacks against organizations in healthcare, manufacturing, and other industries.

According to security researchers at Defiant, a high-severity vulnerability in the Ultimate Member plugin can be exploited to inject malicious scripts into WordPress sites.  Tracked as CVE-2024-2123, the vulnerability is described as a stored cross-site scripting (XSS) issue via several parameters, allowing attackers to inject web scripts into a site’s pages to be executed whenever those pages are loaded. The researchers noted that the flaw exists because of insufficient input sanitization and output escaping.

According to security researchers at Sucuri, hackers are breaching WordPress sites by exploiting a vulnerability in outdated versions of the Popup Builder plugin, infecting over 3,300 websites with malicious code.  The researchers noted that the flaw leveraged in the attacks is tracked as CVE-2023-6000, a cross-site scripting (XSS) vulnerability impacting Popup Builder versions 4.2.3 and older, which was initially disclosed in November 2023.