A representative of the Knight ransomware is selling the alleged source code for version 3.0 of the ransomware on a hacker forum. Knight ransomware, a rebrand of the Cyclops operation, was launched at the end of July 2023 and targets Windows, macOS, and Linux/ESXi systems. It gained popularity by providing infostealers and a 'lite' version of its encryptor to lower-tier affiliates targeting smaller organizations. This article continues to discuss the source code for the third iteration of the Knight ransomware being offered for sale to a single buyer on a hacker forum.

Researchers have found two malicious packages on the Python Package Index (PyPI) repository that used a technique known as DLL side-loading to avoid detection by security software and execute malicious code. The packages, NP6HelperHttptest and NP6HelperHttper, were downloaded 537 and 166 times before their takedown. According to ReversingLabs researcher Petar Kirhmajer, the latest discovery is an example of DLL side-loading carried out by an open-source package, suggesting that the scope of software supply chain threats is growing.

According to security researchers at Patchstack, hackers are exploiting a recently patched vulnerability in the Bricks Builder plugin for WordPress to hack websites and deploy malware.  The issue tracked as CVE-2024-25600 is described as a remote code execution (RCE) flaw that can be exploited without authentication to execute arbitrary PHP code on an affected WordPress website.  The researchers noted that an analysis of the process calls revealed that no proper permissions or role checks were applied when a function handling a REST API endpoint was involved.

Researchers warn that cloud attackers have launched a new cryptocurrency jacking campaign targeting exposed Redis deployments. Unlike previous attacks on the in-memory data store, the threat actors use specific system-weakening commands prior to installing their cryptocurrency mining malware. Cado Security researchers named the new miner Migo and noted that it is being deployed with a user mode rootkit. The malware also includes a persistence mechanism to ensure its survival through reboots. This article continues to discuss findings regarding the Redis attack campaign.

It has been confirmed that 28,500 Microsoft Exchange servers are vulnerable to Elevation of Privilege (EoP), putting affected organizations at risk because many users rely on Exchange for work. A cybercriminal can use the EoP bug to relay a leaked Net-NTLMv2 hash to a vulnerable Exchange server in order to authenticate as a user. Hackers could crack NTLM hashes or use an NTLM relay attack. This article continues to discuss the vulnerability of 28,500 Microsoft Exchange servers to an EoP issue.

MrAgent is a new ransomware tool that operates as a binary designed to run mainly on VMware ESXi hypervisors. Its purpose is to automate and track ransomware deployment across large environments with multiple hypervisors. The gang found to be behind the tool, the RansomHouse Group, is a Ransomware-as-a-Service (RaaS) operation that was discovered in late 2021 and has been actively deploying ransomware variants on corporate networks. According to researchers, the RansomHouse Group extorts its victims twice. This article continues to discuss the RansomHouse Group and its new MrAgent tool.

The Cactus ransomware group claims to have stolen 1.5TB of data from the energy management and industrial automation company Schneider Electric. The attack affected the company's Sustainability Business division, disrupting Schneider Electric's Resource Advisor cloud platform services. According to Kroll researchers, the Cactus ransomware operation has been active since March 2023 and relies on multiple legitimate tools to achieve remote access.

Hackers have demonstrated that the new PlayStation Portal, which is a limited device for streaming games remotely from a PS5 console, is capable of much more. Andy Nguyen, a cloud vulnerability researcher, together with two other engineers, hacked the PlayStation Portal to run PPSSPP, a PlayStation Portable (PSP) emulator. The PSP is a standalone handheld portable console that was released in 2004 and does not require a wired console to stream games from. Nguyen confirmed that the hack only required software modifications, not hardware changes.

The LockBit ransomware operation has recently been severely disrupted by an international law enforcement operation that involved the seizure of servers and several individuals getting arrested or charged.  LockBit domains currently display a seizure notice informing visitors that the site is controlled by law enforcement, specifically the UK’s National Crime Agency (NCA).