Microsoft warns that a new direct prompt injection attack called "Skeleton Key" could bypass ethical and safety guardrails in generative Artificial Intelligence (GenAI) models such as ChatGPT. It allows users to access offensive, harmful, or illegal content by giving context to normally forbidden chatbot requests. For example, most commercial chatbots would initially decline if a user asked for instructions on developing dangerous wiper malware that could disrupt power plants. However, revising the prompt in a certain context would likely enable the AI to provide the malicious content.

The US Department of Justice (DOJ) announced announced charges against a Russian national for his alleged participation in the launch of disruptive cyberattacks against Ukraine before Russia's February 2022 invasion. The individual named Amin Timovich Stigal is believed to be a member of "Cadet Blizzard," a state-sponsored threat actor also known as "DEV-0586" and "Ruinous Ursa." Court documents allege that the 22-year-old conspired to distribute the "WhisperGate" Master Boot Record (MBR) wiper to the systems of Ukrainian government entities.

Research by Tanya Koohpayeh Araghi from the Interdisciplinary Internet Institute (IN3) of the Universitat Oberta de Catalunya (UOC) has developed a new tool to protect digital data securely and cost-effectively. When doctors use the Internet to transfer images or make diagnoses, the data is vulnerable to attacks. Therefore, images must be protected to ensure accuracy and confidentiality. The study focuses on medical images, providing advances in protection through a technique involving digital watermarking.

The North Korean state-backed hacker group "Kimsuky" has been linked to the use of a new malicious Google Chrome extension that steals sensitive information. Zscaler ThreatLabz has dubbed the extension "TRANSLATEXT," which could gather email addresses, usernames, passwords, cookies, and browser screenshots. This article continues to discuss the Kimsuky threat and findings regarding its use of a new malicious Google Chrome extension.

Fortra recently announced patches for a critical-severity SQL injection vulnerability in FileCatalyst Workflow that could allow attackers to create administrative user accounts.  The company said the vulnerability is tracked as CVE-2024-5276 (CVSS score of 9.8), affecting FileCatalyst Workflow version 5.1.6 Build 135 and earlier.  The company noted that the issue could also be exploited to modify application data.  The company noted that using this vulnerability, data exfiltration via SQL injection is impossible.

TeamViewer, a remote connectivity software provider, has detected a corporate network compromise, and some reports suggest that the Russian group "APT29," also known as "Cozy Bear" and "Midnight Blizzard," is responsible for the attack. APT29 is a Russian state-sponsored threat group known for high-impact attacks on major organizations. This article continues to discuss the TeamViewer corporate network hack and the group believed to be behind it.

Mobile devices are vulnerable to data theft and Denial-of-Service (DoS) attacks due to flaws in 5G technologies. A team of seven Penn State University researchers discovered how hackers can go beyond sniffing a user's Internet traffic by providing the user's Internet connection. The hackers could then conduct phishing, eavesdropping, and more. According to the team, the attack is quite accessible, involving commonly overlooked vulnerabilities and equipment that can be purchased online.

A threat actor called "Unfurling Hemlock" has infected target systems with up to ten pieces of malware. Outpost24's KrakenLabs, who discovered the operation, calls the infection method a "malware cluster bomb" because the threat actor uses one malware sample to spread more on the compromised machine. This method delivers information stealers, botnets, and backdoors. KrakenLabs found over 50,000 "cluster bomb" files that appear to be linked to the Unfurling Hemlock group. This article continues to discuss findings regarding Unfurling Hemlock's attack operation.

Healthcare revenue cycle management services provider Designed Receivable Solutions (DRS) has recently informed authorities that the number of individuals impacted by a recent data breach has increased to 585,000.  The company detected an intrusion in its network on January 22, 2024. An investigation revealed that hackers had accessed and stolen files from its systems, including protected health information and personally identifiable information.

Ann & Robert H. Lurie Children’s Hospital of Chicago recently started to inform hundreds of thousands of individuals that their personal and health information has been compromised due to a ransomware attack.  The children’s hospital took many of its systems offline in late January in response to a cyberattack.  The incident resulted in limited access to medical records, disruptions to a patient portal, and hampered communications.