Many threat actors are using malware to scan software vulnerabilities that they can exploit in future cyberattacks. According to security researchers at Palo Alto Networks' Unit 42, there was a large number of malware-initiated scans among the scanning attacks they detected in 2023. Vulnerability scanning is a common reconnaissance step for malicious actors planning to launch cyberattacks. Similar to port scanning and Operating System (OS) fingerprinting, vulnerability scanning initiates network requests to exploit the target hosts' potential vulnerabilities.

A new Vietnam-connected cybercrime group called "CoralRaider" has targeted individuals and organizations in Asia, stealing social media account information and user data. CoralRaider, which first emerged in late 2023, mainly uses social engineering techniques and legitimate services to exfiltrate data. The group creates custom tools for loading malware onto victim systems. However, according to a new analysis by researchers with Cisco's Talos threat intelligence group, the group has made some mistakes, such as inadvertently infecting their own systems and exposing their activities.

Network attached storage (NAS) vendor D-Link has recently urged users of end-of-life (EOL) products to retire and replace them, after news emerged of mass exploitation of legacy kit via a newly discovered vulnerability.  A security researcher who calls himself "netsecfish" published details of the vulnerability, which affects various D-Link NAS devices, on March 26.

Bitdefender has discovered four vulnerabilities affecting multiple versions of WebOS, the operating system used in LG smart TVs. The flaws enable unauthorized access and control over the impacted models. They allow authorization bypasses, privilege escalation, and command injection. Possible attacks are based on the ability to create arbitrary accounts on the device using a service that runs on ports 3000/3001.

"RUBYCARP," a threat group with suspected Romanian origins, has been observed operating a long-running botnet for cryptocurrency mining, Distributed Denial-of-Service (DDoS), and phishing attacks. According to Sysdig, the group has been active for at least ten years and uses the botnet for financial gain. Its main mode of operation is a botnet launched through various public exploits and brute-force attacks.

It has recently been revealed that one month after paying cybercriminals to prevent the public release of data stolen in a February 2024 ransomware attack, Change Healthcare is being extorted again by a different cybercrime group.  Change Healthcare, a subsidiary of health insurance and services company UnitedHealth Group processes billions of healthcare transactions each year, and the ransomware attack crippled the healthcare system throughout the US.

Economic analysis and litigation support firm Greylock McKinnon Associates, Inc. (GMA) recently started notifying over 340,000 individuals that their personal and medical information was compromised in a year-old data breach.  The incident was detected on May 30, 2023, but it took the firm roughly eight months to investigate and determine what type of information was compromised and to identify the impacted individuals.  The company noted that both personal and Medicare information was compromised in the data breach.

ETH Zurich researchers have presented a secure one-way cryptographic function that differs from current methods. Instead of processing data using arithmetic operations, it is stored as a sequence of nucleotides, the chemical building blocks of DNA. Some experts believe that Q-Day will arrive within the next ten years. When this day comes, quantum computers will be so powerful that they can crack today's passwords. Password checks are based on the use of cryptographic one-way functions that calculate an output value from an input value.

According to 1Password, disruptive technologies such as Artificial Intelligence (AI) have exacerbated the tension between organizational security and employee productivity. Information Technology (IT) and security teams are struggling to keep up, even as their organizations face new challenges in a landscape constantly reshaped by rising cyber threats and disruptive technologies.

Magecart attackers are stashing persistent backdoors within e-commerce websites that can automatically push malware. According to Sansec researchers, the threat actors are exploiting a critical command injection vulnerability, tracked as CVE-2024-20720 with a CVSS score of 9.1, in the Adobe Magento e-commerce platform. It enables arbitrary code execution without user interaction.