News – April 2024


  • The Fall of LabHost: Law Enforcement Shuts Down Phishing Service Provider

    April 18, 2024

    In late 2021, LabHost (AKA LabRat) emerged as a new PhaaS platform, growing over time to eventually offer dozens of phishing pages targeting banks, high-profile organizations, and other service providers located around the world, but most notably in Canada, the US, and the UK. The popularity of the platform meant that at the time of the ...

  • DuneQuixote campaign targets Middle Eastern entities with “CR4T” malware

    April 18, 2024

    In February 2024, Kaspersky researchers discovered a new malware campaign targeting government entities in the Middle East. They dubbed it “DuneQuixote”; and their investigation uncovered over 30 DuneQuixote dropper samples actively employed in the campaign. These droppers, which exist in two versions – regular droppers and tampered installer files for a legitimate tool named “Total Commander”, ...

  • #StopRansomware: Akira Ransomware summary

    April 18, 2024

    Since March 2023, Akira ransomware has impacted a wide range of businesses and critical infrastructure entities in North America, Europe, and Australia. In April 2023, following an initial focus on Windows systems, Akira threat actors deployed a Linux variant targeting VMware ESXi virtual machines. As of January 1, 2024, the ransomware group has impacted over 250 ...

  • Digitalisation, Efficiency, Innovation: AUTOMA 2024 Tackles Key Challenges in Oil & Gas

    April 18, 2024

    The Oil and Gas Automation and Digitalisation Congress (AUTOMA 2024) is held in Düsseldorf, Germany on 14-15 October 2024. The Congress assembles leading companies from the oil and gas industry to explore the latest trends in automating and digitising processes, shaping the future of the whole value chain. The Oil and Gas Automation and Digitalisation Congress ...

  • How secret rise of zero-day brokers is causing worldwide security risks

    April 18, 2024

    Zero-day hackers exploit security vulnerabilities in software that the developers of that software are often completely oblivious about. Imagine scrolling through your social media feed when a notification pops up, seemingly from a trusted friend. It contains a funny meme or a scandalous news story, but the link takes you to a different website. Clicking it ...

  • Police bust global cyber gang accused of industrial-scale fraud

    April 18, 2024

    Police have taken down a gang accused of using a technology service that helped criminals use fraudulent text messages to steal from victims. They have arrested 37 people worldwide and are contacting victims. Officers say younger people who grew up with the internet were the most likely to fall for the “phishing” scam. The technology allowed ...

  • US 911 emergency call line outage resolved in some areas

    April 18, 2024

    Emergency services on the 911 telephone call line were restored late on Wednesday in parts of the United States, officials said, following a widespread outage across all of South Dakota and in parts of Nebraska, Nevada and Texas. Officials in South Dakota, Nevada and Las Vegas said 911 services had been restored, but without identifying the ...

  • SoumniBot: the new Android banker’s unique techniques

    April 17, 2024

    The creators of widespread malware programs often employ various tools that hinder code detection and analysis, and Android malware is no exception. As an example of this, droppers, such as Badpack and Hqwar, designed for stealthily delivering Trojan bankers or spyware to smartphones, are very popular among malicious actors who attack mobile devices. That said, we ...

  • Attackers exploiting new critical OpenMetadata vulnerabilities on Kubernetes clusters

    April 17, 2024

    Attackers are constantly seeking new vulnerabilities to compromise Kubernetes environments. Microsoft recently uncovered an attack that exploits new critical vulnerabilities in OpenMetadata to gain access to Kubernetes workloads and leverage them for cryptomining activity. OpenMetadata is an open-source platform designed to manage metadata across various data sources. It serves as a central repository for metadata lineage, ...

  • CVE-2024-3400: Critical Command Injection Vulnerability in Palo Alto Networks Firewalls

    April 17, 2024

    On Friday, April 12, Palo Alto Networks published an advisory on CVE-2024-3400, a CVSS 10 zero-day vulnerability in several versions of PAN-OS, the operating system that runs on the company’s firewalls. According to the vendor advisory, if conditions for exploitability are met, the vulnerability may enable an unauthenticated attacker to execute arbitrary code with root privileges ...