According to The Guardian, cybercriminals have targeted Radioactive Waste Management (RWM) through a spear phishing campaign involving LinkedIn. Accounts for RWM filed at Companies House show that cybercriminals have targeted the organization through the use of popular social network platforms to trick employees and other methods. RWM, which is a part of Nuclear Waste Services (NWS), revealed a recent increase in attacks, thus raising concerns about hackers gaining access to highly sensitive materials.

The Belarusian Cyber-Partisans hacktivist group shut down the country's leading state-owned media outlet, the Belarusian Telegraph Agency (BelTA), claiming to have wiped the news organization's website servers and backups. The group said it infiltrated BeITA's internal network, wiping workstations, archives, and more. BelTA is the country's largest news organization, which was created nearly a decade ago by the authoritarian regime and contains content in Belarusian, Russian, English, German, Spanish, Polish, and Chinese languages.

According to Cequence Security, the months that lead up to the 2023 holidays revealed a shift in threat actors' tactics, techniques, and procedures (TTPs) against major retailers. Attackers demonstrated their sophistication, persistence, and careful planning. Gift card fraud increased by 110 percent in the second half of 2023 alone, while scraping, loyalty card fraud, and payment card fraud increased by a combined average of over 700 percent.

A ransomware attack on Fallon Ambulance Services, a now-defunct subsidiary of Transformative Healthcare, exposed nearly a million people. According to Transformative Healthcare's breach notification, the attackers were in the company's systems from late February 2023 to late April 2023. The ALPHV/BlackCat ransomware group claimed responsibility for the attack on the healthcare services provider. They claim to have exported a terabyte of data from the company, including medical reports, paramedics reports, patient details, and other sensitive information.

Attackers with access to a Kubernetes cluster could exploit two vulnerabilities in the Google Kubernetes Engine (GKE) to escalate their privileges. According to Palo Alto Networks' Unit 42 research team, attackers can use this access to steal data, deploy malicious pods, and disrupt cluster operations. The first flaw is the default configuration of GKE's logging agent, FluentBit, which runs on all Kubernetes clusters by default. The second flaw is the Anthos Service Mesh (ASM) default privileges.

Recently, CHI Memorial released new details about the scope of the breach that impacted them and how it could affect patients.  CHI Memorial says that some patient information may be at risk, including name, address, date of birth, some clinical information, patient ID number, and health insurance information.  An investigation revealed that the breach happened on May 30th of last year. 

Ruhr University Bochum security researchers discovered Terrapin, a vulnerability tracked as CVE-2023-48795 with a CVSS score of 5.9, in the Secure Shell (SSH) cryptographic network protocol. The exploitation of the flaw allows an attacker to downgrade the connection's security. Terrapin is a prefix truncation attack that compromises the integrity of SSH's secure channel.

According to researchers at Security Joes, there is a new variant of the Dynamic Link Library (DLL) search order hijacking technique that threat actors could use to evade security mechanisms and execute malicious code on Microsoft Windows 10 and Windows 11 systems. The approach involves executables commonly found in the trusted WinSxS folder and exploits them using the classic DLL search order hijacking technique. Through this method, malicious actors can avoid the need for elevated privileges when trying to run malicious code on a compromised machine.

Over $80m worth of cryptocurrency was recently stolen following a cyberattack on the cross-chain bridge project Orbit Chain.  The blockchain revealed the incident on January 1, 2024, informing users that an “unidentified access” to Orbit Bridge was confirmed on December 31, 2023.  The attackers stole 26,741.6 of Ether (ETH), which were transferred to five wallet addresses, and around 15,498,358 of DAI (a stablecoin on the Ethereum blockchain) transferred to three addresses.  This is worth a total of around $84.5 million at current prices.

Researchers have developed a decryptor that uses a flaw in the Black Basta ransomware and allows victims to recover their files for free. However, Bleeping Computer has discovered that the Black Basta developers fixed the bug in their encryption routine, thus preventing the decryptor technique from being used in newer attacks. Security Research Labs (SRLabs) developed the 'Black Basta Buster' decryptor after finding a flaw in the encryption algorithm applied for the gang's encryptors that enables the discovery of the ChaCha keystream used to XOR encrypt a file.