IRONSCALES' Eyal Benishti provides a guide to establishing a phishing simulation testing program. Employee phishing training has become critical in developing a security-conscious workforce, lowering the risk of successful phishing attacks, and cultivating a resilient organizational culture capable of effectively responding to evolving cybersecurity threats. Today's average enterprise receives hundreds of phishing emails daily, with hundreds of thousands of attempts yearly.

Threat actors are using a new malware loader, tracked under the name Win/TrojanDownloader.Rugmi, to deliver various information stealers such as Lumma Stealer, Vidar, RecordBreaker, and Rescoms. According to researchers at ESET, this malware is a loader composed of a downloader that downloads an encrypted payload, a loader that executes the payload from internal resources, and another loader that runs the payload from an external file on the disk. The company's telemetry data shows that detections for the Rugmi loader increased significantly in October and November 2023.

Security experts stress that the continued advancement of Artificial Intelligence (AI) calls for organizations and governing bodies to establish security standards, protocols, and other safeguards to prevent AI from outpacing them. Large Language Models (LLMs) exhibit exceptional language understanding and human-like conversational capabilities as sophisticated algorithms and massive data sets power them. Experts agree that the time has come for the industry to address the inherent security risks posed by their development and deployment.

Healthcare organizations are increasingly reliant on interconnected systems, electronic health records, and telemedicine, making them a prime target for malicious actors looking to exploit vulnerabilities. The consequences of a healthcare cybersecurity breach are measured in compromised data as well as in jeopardized patient safety and trust. Help Net Security has provided some excerpts from cybersecurity-focused surveys conducted in the healthcare sector that were covered in 2023. With this data, security teams will gain insights that could help improve future security strategies.

AhnLab Security Emergency Response Center (ASEC) researchers are warning about attacks on poorly managed Linux SSH servers in which Distributed Denial-of-Service (DDoS) bots and CoinMiners are installed. During the reconnaissance phase, threat actors scan IP addresses for servers with the SSH service or port 22 activated, then carry out a brute force or dictionary attack to get the ID and password. They can sell compromised IP addresses and account credentials on the dark web.

Albania’s Parliament recently announced that it had suffered a cyberattack with hackers trying to get into its data system, resulting in a temporary halt in its services.  A statement said Monday’s cyberattack had not “touched the data of the system,” adding that experts were working to discover what consequences the attack could have.  It said the system’s services would resume at a later time.

German hospital network Katholische Hospitalvereinigung Ostwestfalen (KHO) has recently confirmed that service disruptions at three hospitals were caused by a Lockbit ransomware attack.  The attack began in the early morning of December 24, 2023.  It severely impacted the systems that support the operations of three hospitals in Bielefeld, Rheda-Wiedenbrück, and Herford, Germany.

Panasonic Avionics Corporation, a leading supplier of in-flight communications and entertainment systems, recently disclosed a data breach affecting an undisclosed number of individuals after its corporate network was breached more than one year ago, in December 2022.  The company stated that on December 30, 2022, it identified evidence of an issue potentially impacting certain systems in its corporate network environment that occurred on or around December 14, 2022.

A "recruiter" approached a blockchain developer on LinkedIn for a web development job and asked him to download npm packages from a GitHub repository, which led to the developer's MetaMask wallet emptying. It is not uncommon for legitimate technology interviews to include some kind of take-home exercise or proof-of-concept (PoC) assignment involving writing code or debugging, thus making the lure convincing even to technically savvy individuals like developers.

The Ohio Lottery has recently confirmed that it was targeted in a cyberattack, and a ransomware group claims to have stolen a significant amount of information from the organization’s systems.  The Ohio State Lottery informed customers on its website that it had experienced a “cybersecurity event” but assured the public that its gaming system was fully operational.  However, it said it decided to shut down some critical systems to contain the incident.