The Russian threat actor "Fighting Ursa," also known as "APT28," "Fancy Bear," and "Sofacy," has used car ads as a lure to distribute the "HeadLace" backdoor malware. The scheme targets Eastern European diplomats in need of personal transportation, luring them with a supposed good deal on an Audi Q7 Quattro SUV. This article continues to discuss the history of the Fighting Ursa Advanced Persistent Threat (APT) and the group's use of car ads as a lure to distribute HeadLace backdoor malware.

Researchers at Elastic Security Labs have discovered design flaws in Microsoft's Windows Smart App Control and SmartScreen. The exploitation of these vulnerabilities could allow threat actors to gain initial access to target environments with minimal user interaction and no security warnings. This article continues to discuss findings regarding the design weaknesses uncovered in Microsoft's Windows Smart App Control and SmartScreen.

Eighty-six percent of firms say unknown organizational cyber risks are a top concern, according to the "Critical Start 2024 Cyber Risk Landscape Peer Report." The report found that 66 percent of businesses have limited insight into their cyber risk profiles. Sixty-five percent of executives are concerned about cybersecurity investments and organizational risk reduction priorities not aligning. Eighty-three percent of cybersecurity professionals reported facing a cyber breach that required attention despite implementing traditional threat-based detection and response measures.

According to researchers at Volexity, the Advanced Persistent Threat (APT) group "StormBamboo" compromised an Internet Service Provider (ISP) to poison Domain Name System (DNS) queries and deliver malware to organizations. The Chinese-speaking cyber espionage threat actor, also known as "Evasive Panda" and "StormCloud," typically compromises third parties to breach targets. This article continues to discuss StormBamboo's compromise of an ISP to deliver malicious software updates.

Researchers from the Graz University of Technology have published a paper on "SLUBStick," a new Linux kernel exploitation technique that makes heap vulnerabilities increasingly dangerous. The team pointed out that Linux kernel flaws have increased in recent years, but many have limited impact. The researchers showed that the new SLUBStick technique can elevate a limited heap vulnerability to an arbitrary memory read/write primitive, enabling privilege escalation and container escapes even with the implementation of modern defenses.

According to a team of researchers from the University of Tokyo and NTT Security, attackers can conceal their malicious injection activity by inserting commands into the machine code stored in memory by the software interpreters that many programming languages use. Interpreters translate each line of human-readable software code into bytecode. The researchers successfully inserted malicious instructions into the bytecode stored in memory before execution. Since most security software does not scan bytecode, their changes went undetected.

According to Proofpoint, threat actors have been using Cloudflare Tunnels to deliver different Remote Access Trojan (RAT) families. Since February 2024, attackers have abused the TryCloudflare feature to create one-time tunnels without an account in order to distribute "AsyncRAT," "GuLoader," and other RATs. This article continues to discuss threat actors' abuse of Cloudflare's TryCloudflare feature to create one-time tunnels for the distribution of RATs.

The SANS Internet Storm Center reported that new Mirai botnet variants are targeting the open source Enterprise Resource Planning (ERP) framework OFBiz. The Apache Foundation supports OFBiz, a Java-based framework for creating ERP applications. OFBiz seems less prevalent than commercial alternatives, but like any other ERP system, organizations use it for sensitive business data, making security crucial. This article continues to discuss the targeting of the ERP framework OFBiz by the Mirai botnet.

Attackers have been pushing fake ads to lure users into downloading the popular Google Authenticator Multi-Factor Authentication (MFA) app, which actually leads to downloading malware on GitHub. According to Malwarebytes researchers, hosting the malware file on GitHub enables the threat actor to use a trusted cloud resource that is unlikely to get blocked through traditional means. This article continues to discuss attackers luring users to download malware on GitHub through fake Google Authenticator ads.

According to Checkmarx researchers, threat actors uploaded malicious Python packages to the PyPI repository and promoted them on the online question-and-answer platform StackExchange. The packages download scripts that steal sensitive data from messaging apps, cryptocurrency wallets, and more. The information-stealing malware can also exfiltrate files containing specific keywords, take screenshots, and send all of the data to a Telegram channel. This article continues to discuss hackers' distribution of malicious Python packages through StackExchange.