InfoSecBulletin Cybersecurity for mankind
An unsecured database belonging to RateForce ended up exposing 93.93 GB of personal information of users. This is a reminder to secure your cloud buckets. We also have two more victims of the MOVEit ransomware attack. This time, it is the largest public pension fund in the U.S. and an insurance firm. In other news, there is an update on the Dole ransomware attack that took place in February this year. The corporation disclosed the number of impacted individuals. Read on to know more.
RateForce Data Leak
Over 145,000 ICS Across 175 Countries Found Exposed Online
World to see AI powered “human washing machines”
Hacker compromised over 2000 Palo Alto Networks Firewalls
“Forces Penpals” exposed US and UK Military Social Network’s 1 Million Records
CVE-2024-51503
Trend Micro released updates for Deep Security Agent RCE
Apple Releases Patch for two Actively Exploited Zero-Day
Maxar Space Data Leak, Company admit, Investigation ongoing!
GitHub CLI Vulnerability Could Allow RCE
“Sarcoma” ransomware group
Hacker to disclose “Popular Life Insurance” 36 GB of stolen data
BugHunt 2024: A Milestone Cyber security Competition held at Dhaka
An unsecured database belonging to the U.S. auto insurance price comparison site RateForce leaked 255,756 records (93.93 GB) containing scans and images of vehicle registrations, driver’s licenses, state Medicaid health coverage cards, and others.
MOVEit Ransomware Attacks
The MOVEit ransomware attack has claimed two more victims: the largest public pension fund in the U.S. and an insurance firm. The attack on the pension fund compromised the personal data of 2.5 million Genworth Financial policyholders, while the attack on the insurance firm compromised the personal information, including Social Security numbers, of 769,000 retired California state employees.
GitHub RepoJacking
Aqua Nautilus has warned that millions of GitHub repositories are potentially vulnerable to RepoJacking, a type of attack that steals sensitive data from repositories. Some vulnerable repositories belong to Google, Lyft, and other anonymous firms.
New JS Dropper Variant
Deep Instinct has spotted a new variant of JS dropper, named PindOS, that is deploying next-stage payloads such as IcedID and Bumblebee. These malware, in turn, serve as loaders for other malware, including ransomware.
Dole Ransomware Attack Update
Dole has confirmed that the February ransomware attack compromised the names, addresses, driver’s license numbers, passport numbers, dates of birth, phone numbers, and other employment information of 3,885 employees.
Chinese APT Groups Exploit Microsoft Office Vulnerability
SentinelOne has revealed that Chinese APT groups exploited a 17-year-old Microsoft Office vulnerability to launch malware attacks against foreign government officials who attended a G7 summit in Hiroshima, Japan.
NIST Creates First-Ever Cybersecurity Framework for Water Infrastructure
The National Institute of Standards and Technology (NIST) is creating the first-ever cybersecurity framework for water infrastructure to address unique cyber challenges impacting America’s complex water systems.
Microsoft Discovers Cryptomining Campaign
Microsoft has discovered a cryptomining campaign targeting IoT devices and internet-facing Linux systems. The attackers are using a backdoor that deploys a broad range of tools and an IRC bot to steal device resources for mining.
NSA Issues Guidance on Defending Against BlackLotus UEFI Bootkit Malware
The National Security Agency (NSA) has issued guidance on defending against BlackLotus UEFI bootkit malware attacks. The guidance recommends that system administrators apply the latest security updates, update recovery media, and customize UEFI Secure Boot to block older signed Windows boot loaders.
Unit 42 Researchers Observe Mirai Botnet Variant
Unit 42 researchers have observed a variant of the Mirai botnet that is targeting multiple vulnerabilities in popular IoT devices, with a focus on D-Link, Zyxel, and Netgear devices. The variant has been identified in two ongoing campaigns that started on March 14 and spiked in April and June.
