The AlphV/BlackCat ransomware group claims to have infiltrated the systems of the accounting software vendor Tipalti and plans to "go direct" to the company's clients to extort them. BlackCat says it has exfiltrated over 265GB of "confidential" data belonging to the company, its employees, and its clients. Based on their apparent understanding that Tipalti's cyber insurance policy does not cover extortion and an evaluation of its internal discussions, the criminals believe their chances of receiving an extortion payment directly from Tipalti are low.

The popular GST Invoice Billing Inventory (previously known as Book Keeper) app with more than 1 million downloads has left a database open, exposing sensitive personal and corporate data. The app for small and midsize businesses (SMBs) is one of thousands of apps on Google Play that have sensitive data hard-coded into the client side. This means that threat actors can access Application Programming Interface (API) keys, Google Storage buckets, and unprotected databases. They can exploit that information by analyzing publicly available information about apps.

According to security researchers at Abnormal Security, brand impersonation in cyberattacks has reached new levels of sophistication.  Traditionally observed in financial institutions and social media sites, threat actors are now employing multi-stage attacks with a high degree of personalization.  The researchers published a study that revealed a case where attackers impersonated the popular streaming service Disney+ in an intricate scheme.

The Cybersecurity and Infrastructure Security Agency (CISA) released the Cybersecurity Performance Goals (CPGs) in October 2022 to help organizations of all sizes and levels of cyber maturity gain confidence in their cybersecurity posture and reduce business risk. CISA outlined four CPGs that organizations could implement earlier this summer as the first steps toward improved cybersecurity.

The Polish Cyber Command has warned that the Russian state-backed hacking group Forest Blizzard, also known as Fancy Bear and APT28, has been targeting public and private entities in Poland by exploiting a known Microsoft Outlook vulnerability, tracked as CVE-2023-23397. APT28 has a history of targeting government, non-governmental, energy, and transportation organizations in the US, Europe, and the Middle East. The Computer Security Incident Response Team of the Polish National Research Institute (CSIRT NASK) detected and reported new attacks linked to the group.

Malicious actors can use a new "post-exploitation tampering technique" to trick a target into thinking their Apple iPhone is in Lockdown Mode when it is not, allowing them to perform covert attacks. According to Jamf Threat Labs, if a hacker has already infiltrated a user's device, they can cause Lockdown Mode to be bypassed when the user activates it. The goal is to enable Fake Lockdown Mode on a device that an attacker has compromised through other means, such as unpatched security flaws.

Attackers are targeting WordPress users with a fake security alert about a Remote Code Execution (RCE) flaw. The alert offers a "patch" that actually spreads malicious code capable of hijacking a site. The email campaign, discovered by Wordfence and Patchstack researchers, impersonates WordPress and warns users of a vulnerability, urging them to click on a link to download a plugin in order to fix the flaw. Patchstack warns that this is not a legitimate email and that the plugin will infect the user's website with a backdoor and a malicious administrator account.

According to the US Goverment Acountability Office (GAO), although US federal agencies have made progress in preparing for and responding to cyber threats, too many have failed to meet the deadline to implement incident response capabilities required by law.  The GAO found that 20 US federal agencies have not yet reached the advanced level, tier three, for cyber event logging.

Over a dozen malicious loan apps, collectively known as SpyLoan, have been downloaded more than 12 million times from Google Play this year, but the total is much higher because they are also available on third-party stores and suspicious websites. SpyLoan Android apps steal personal data from a victim's device regarding accounts, device information, call logs, installed apps, calendar events, local Wi-Fi network details, and image metadata. According to researchers, the threat extends to contact lists, location data, and text messages.

Security researchers at industrial cybersecurity firm TXOne Networks have disclosed the details of 10 unpatched vulnerabilities discovered in building automation products made by Austrian company Loytec more than two years ago.  The vulnerabilities have been assigned to the identifiers CVE-2023-46380 through CVE-2023-46389, and their details were disclosed in three separate advisories published on the Full Disclosure mailing list in November.