Microsoft discovered ongoing malvertising attacks involving the use of the DanaBot Trojan to spread CACTUS ransomware. Microsoft linked the campaign to Storm-0216, also known as Twisted Spider and UNC2198. Storm-0216 previously used Qakbot malware for initial access, but after the Qakbot infrastructure was taken down, it switched to other malware. The current DanaBot campaign was discovered in November, when Microsoft researchers found that the threat actors were using a private version of the popular info-stealing malware rather than the Malware-as-a-Service (MaaS) offering.

It has recently been revealed that data on Blue Shield of California members may have been exposed due to a vulnerability in the MOVEit file transfer platform.  The insurer was notified on Sept. 1 by a vendor that indicated it was a victim of the data breach.  The vendor found on Aug. 23 that an unauthorized user had tapped into information in the MOVEit server and then took the server offline.  After an investigation, Blue Shield of California discovered that this third party extracted data from the server on May 28 and May 31.

According to Lasso Security researchers, while HuggingFace and GitHub developer platforms are important for developing Artificial Intelligence (AI) technologies, they also expose top-level organization accounts from Google, Meta, Microsoft, and VMware to threat actors. Lasso Security began its investigation in November, inspecting hundreds of Application Programming Interfaces (APIs) on the expertise-sharing platforms. Meta, the parent company of Facebook, was discovered to be especially vulnerable, with its Large Language Model Meta AI (LLaMA) exposed in many cases.

Around 60 credit unions are experiencing outages as a result of a ransomware attack on a popular technology provider. According to National Credit Union Administration (NCUA) spokesperson Joseph Adamoli, the ransomware attack targeted Ongoing Operations, a cloud services provider owned by the credit union technology company Trellance. The attack is having a larger impact on other credit union technology providers, such as FedComp, which provides data processing solutions to credit unions.

In a recent data breach, hackers accessed about 14,000 customer accounts with the genetic testing company 23andMe. According to a new filing with the US Securities and Exchange Commission (SEC), the company determined that hackers had accessed 0.1 percent of its customer base. 23andMe's latest annual earnings report revealed that the company has over 14 million customers, so 0.1 percent of the customer base is around 14,000.

The European Space Agency (ESA) is facing cyber threats, as the technology it operates has become more vulnerable to hackers. The current commercialization of European space introduces new challenges, including cybersecurity. Dr. Daniel Fischer, ESA's Head of Ground Segment System and Cybersecurity Engineering, recently announced at a conference in Tallinn that the ESA will expand its security measures. A strong defense-in-depth security strategy called the Ground Operation System Common Core - Multi-Mission Generation (EGOS-MG) will be implemented.

Security researcher MalwareHunterTeam has found a sample of the Qilin ransomware gang's VMware ESXi encryptor, and it could be one of the most advanced and customizable Linux encryptors seen to date.  The researcher noted that enterprises are increasingly moving to virtual machines to host their servers, as they allow for better usage of available CPU, memory, and storage resources.  Due to this adoption, almost all ransomware gangs have created dedicated VMware ESXi encryptors to target these servers.

Researchers have discovered a new variant of the botnet called P2PInfect that can target routers and Internet of Things (IoT) devices. According to Cado Security Labs, the latest version is compiled for Microprocessor without Interlocked Pipelined Stages (MIPS) architecture, thus increasing its capabilities and impact. P2PInfect, a Rust-based malware, was first reported in July 2023, targeting unpatched Redis instances and gaining initial access through a critical Lua sandbox escape vulnerability, tracked as CVE-2022-0543 with a CVSS score of 10.0.

There has been a significant increase in attacks involving malicious files in Microsoft Office document formats. In 2023, malicious Microsoft Office documents and other popular document formats, such as PDFs, were used in 53 percent more attacks. Windows remains the top target for cybercriminals, accounting for 88 percent of all malware detected daily.

AeroBlade, a previously unknown cyber espionage hacking group, was discovered targeting organizations in the US aerospace sector. BlackBerry found the campaign unfolding in two phases: a testing wave in September 2022 and a more advanced attack in July 2023. In order to gain initial access to corporate networks, the attacks use spear-phishing with weaponized documents. A reverse-shell payload capable of file listing and data theft is dropped. BlackBerry believes the goal of the attacks was commercial cyber espionage to gather valuable information.