Cybersecurity researchers at the Georgia Institute of Technology (Georgia Tech) seek to identify "abnormal" and "illogical" control system commands suggesting the presence of insider threats or malicious attackers. They are doing so by gaining further insight into what are considered "normal" operations within electric power systems. Understanding normal operations and detecting suspicious activities will rely on using Artificial Intelligence (AI) to understand what the complex grid systems usually do and to identify actions that logically should not happen.

Researchers at North Carolina State University are conducting a project to raise awareness among young students about the safety risks that come with being online, as well as prepare elementary school teachers to teach cybersecurity topics. The project, funded by a National Science Foundation (NSF) DRK-12 grant and conducted in collaboration with the University of Delaware, will develop and test a professional development program that will support teachers in integrating cybersecurity lessons into fourth and fifth-grade math and science instruction.

Researchers at watchTowr showed the ability to seize part of the Internet's infrastructure for just $20, bringing attention to the fragility of the trust and cybersecurity mechanisms that organizations and users depend on. While looking for Remote Code Execution (RCE) vulnerabilities in WHOIS clients, the researchers found that the WHOIS server for the .mobi Top Level Domain (TLD) (for mobile-optimized sites) had migrated years ago from "whois.dotmobiregistry.net" to "whois.nic.mobi".

Apple has patched its Vision Pro Mixed Reality (MR) headset after researchers showed that an attacker could track a user's eyes to infer what they are typing. Vision Pro users can type by using a virtual keyboard and looking at each of the keys they want to press. "GAZEploit," an attack method shown by a team of researchers from the University of Florida and Texas Tech University, can be used to guess what a Vision Pro user is typing by tracking their avatar's eye movement. This article continues to discuss Apple's patching of Vision Pro following researchers' GAZEploit demonstration.

Researchers at Cleafy found a new variant of the Android banking trojan called "TrickMo" that can evade analysis and display fake login screens to steal victims' banking credentials. According to Cleafy, the new capabilities involve using malformed ZIP files together with JSONPacker. The application is installed via a dropper app with the same anti-analysis mechanisms. This article continues to discuss findings regarding the new variant of TrickMo.

One of the most dangerous ransomware groups, "Scattered Spider," has been using its clever social engineering approach to launch targeted, sophisticated phishing attacks against financial and insurance companies to steal high-level cloud permissions and deliver ransomware. Scattered Spider has been conducting smishing and vishing attacks to target the accounts of Information Technology (IT) service desk administrators and other high-privileged accounts.

According to the Select Committee on the Chinese Communist Party (CCP) and House Committee on Homeland Security, US seaports are dangerously dependent on Chinese cranes, which could threaten US port infrastructure security. A new joint report by the two committees focuses on Shanghai Zhenhua Heavy Industries (ZPMC), a company owned and controlled by the People's Republic of China (PRC) that operates about 80 percent of US Ship-to-Shore (STS) port cranes.

A record $65 million settlement was reached for a Pennsylvania healthcare company's medical record hack, which affected hundreds of patients and employees. The case involved about 135,000 patients and employees of the Pennsylvania-based independent healthcare network Lehigh Valley Health Network (LVHN). LVHN's data breach exposed 600 patients' and employees' medical records and Personally Identifiable Information (PII). The exposed data included addresses, email addresses, birthdates, Social Security numbers, passport information, medical data, and nude patient photos.

Aqua Security's Nautilus research team warns that "Hadooken" Linux malware has been targeting Oracle WebLogic servers to launch additional malware and steal credentials for lateral movement. The malware is used in attacks that exploit weak passwords for initial access. After compromising a WebLogic server, the attackers downloaded shell and Python scripts to fetch and run the malware. This article continues to discuss findings regarding the Hadooken malware targeting Oracle WebLogic applications and its link to multiple ransomware families.

The "RansomHub" ransomware gang is threatening to leak data allegedly stolen from Kawasaki Motors Europe (KME). The company has announced it is recovering from the cyberattack that disrupted service. The company is investigating and cleaning any suspicious material on its systems after the attack on its EU headquarters. KME is a subsidiary of Kawasaki Heavy Industries, a global Japanese company that makes motorcycles, utility vehicles, and other motorized products.