Printing solutions giant Xerox recently confirmed that its US-based subsidiary Xerox Business Solutions experienced a data breach.  The incident, the company says, was limited to Xerox Business Solutions US and was contained by its cybersecurity team.  The company noted that while the attack did not affect Xerox’s corporate systems and had no impact on the company’s operations or data, the investigation launched into the matter determined that personal information was compromised.

The US Cybersecurity and Infrastructure Security Agency (CISA) has added two vulnerabilities to the Known Exploited Vulnerabilities (KEV) catalog. The first is a recently patched flaw in Google Chrome, and the second bug affects Spreadsheet::ParseExcel, an open-source Perl library for reading information from Excel files. The agency has given federal agencies until January 23 to mitigate the two security flaws or to stop using the vulnerable products. The Remote Code Execution (RCE) flaw affects versions 0.65 and older of the Spreadsheet::ParseExcel library.

According to Zimperium, the rise in mobile banking is accompanied by a significant increase in financial fraud. Zimperium's research found that 29 malware families targeted 1,800 banking apps in 61 countries last year. In 2022, Zimperium discovered ten active malware families targeting 600 banking apps. Banking trojans continue to advance because of their persistence, security evasion, and avoidance of detection on mobile devices. US banking institutions are the most targeted by financially motivated threat actors. In 2023, 109 US banks were targeted by banking malware.

Malware that steals information is exploiting an undocumented Google OAuth endpoint called MultiLogin to hijack user sessions and enable continuous access to Google services even if a password is reset. According to researchers at CloudSEK, the critical exploit helps with session persistence and cookie generation, thus allowing threat actors to maintain unauthorized access to a valid session. PRISMA, a threat actor, first revealed the technique on their Telegram channel on October 20, 2023.

According to Uri Dorot, senior security solutions lead at Radware, a new breed of destructive Distributed Denial-of-Service (DDoS) attacks, called the Web DDoS Tsunami, is causing significant problems worldwide. These attacks are unsatisfied with intense bursts of simple pings or flooding ports at layer 3 or 4. Instead, they are increasing the volume and intensity. In order to further understand Web DDoS Tsunami attacks, it is important to consider four basic dimensions: attack volume, attack duration, botnet type, and the type of attack transactions.

According to The Guardian, cybercriminals have targeted Radioactive Waste Management (RWM) through a spear phishing campaign involving LinkedIn. Accounts for RWM filed at Companies House show that cybercriminals have targeted the organization through the use of popular social network platforms to trick employees and other methods. RWM, which is a part of Nuclear Waste Services (NWS), revealed a recent increase in attacks, thus raising concerns about hackers gaining access to highly sensitive materials.

The Belarusian Cyber-Partisans hacktivist group shut down the country's leading state-owned media outlet, the Belarusian Telegraph Agency (BelTA), claiming to have wiped the news organization's website servers and backups. The group said it infiltrated BeITA's internal network, wiping workstations, archives, and more. BelTA is the country's largest news organization, which was created nearly a decade ago by the authoritarian regime and contains content in Belarusian, Russian, English, German, Spanish, Polish, and Chinese languages.

According to Cequence Security, the months that lead up to the 2023 holidays revealed a shift in threat actors' tactics, techniques, and procedures (TTPs) against major retailers. Attackers demonstrated their sophistication, persistence, and careful planning. Gift card fraud increased by 110 percent in the second half of 2023 alone, while scraping, loyalty card fraud, and payment card fraud increased by a combined average of over 700 percent.

A ransomware attack on Fallon Ambulance Services, a now-defunct subsidiary of Transformative Healthcare, exposed nearly a million people. According to Transformative Healthcare's breach notification, the attackers were in the company's systems from late February 2023 to late April 2023. The ALPHV/BlackCat ransomware group claimed responsibility for the attack on the healthcare services provider. They claim to have exported a terabyte of data from the company, including medical reports, paramedics reports, patient details, and other sensitive information.

Attackers with access to a Kubernetes cluster could exploit two vulnerabilities in the Google Kubernetes Engine (GKE) to escalate their privileges. According to Palo Alto Networks' Unit 42 research team, attackers can use this access to steal data, deploy malicious pods, and disrupt cluster operations. The first flaw is the default configuration of GKE's logging agent, FluentBit, which runs on all Kubernetes clusters by default. The second flaw is the Anthos Service Mesh (ASM) default privileges.