Daily News - Janeiro (19/01 - 25/01) - 04 Semana de 2025

Information Security, Cyber Security, Privacy and Hacking News --- Daily Updates !! Weekly Resume...

23/01

10 top XDR tools and how to evaluate them

Account Credentials for Security Vendors Found on Dark Web

AIDS vaccine non-profit suffers hacker attack

Allegheny Health Network reports a data breach involving IT vendor

Apple will enable its AI automatically, but users have seen enough

Beware: Fake CAPTCHA Campaign Spreads Lumma Stealer in Multi-Industry Attacks

ChatGPT Down – A Massive Outage Cause Inaccessible To Millions of Users

ChatGPT fica instável nesta quinta (22); falha pode ter sido causada por ataque hacker

Chinese threat actors used two advanced exploit chains to hack Ivanti CSA

CISA: Hackers still exploiting older Ivanti bugs to breach networks

Cisco addresses a critical privilege escalation bug in Meeting Management

Cisco fixes ClamAV vulnerability with available PoC and critical Meeting Management flaw

Cisco Fixes Critical Privilege Escalation Flaw in Meeting Management (CVSS 9.9)

Cisco Fixes Critical Vulnerability in Meeting Management

Cisco Meeting Management Vulnerability Let Attackers Elevate Privileges to Administrator

Cisco Warns of Critical Privilege Escalation Vulnerability in Meeting Management Platform

CISOs are juggling security, responsibility, and burnout

CISOs Dramatically Increase Boardroom Influence but Still Lack Soft Skills

ClamAV File Decryption Vulnerability Let Remote Attackers Trigger DoS Attack

Co-founder of major crypto company Ledger reportedly kidnapped in France

Critical Palo Alto Firewall Vulnerabilities Let Hackers Bypass Secure Boot & Exploit Firmware

Critical SonicWall Vulnerability Exploited In Attacks Execute Arbitrary OS Commands

Custom Backdoor Exploiting Magic Packet Vulnerability in Juniper Routers

Cyberattack suspected in Conduent service outage affecting multiple US states

Defense strategies to counter escalating hybrid attacks

Entire Georgian country population exposed in a massive data leak

Experts Find Shared Codebase Linking Morpheus and HellCat Ransomware Payloads

Fake Microsoft Teams Page Drops Malware On Windows By Exploiting Bing Ads

Four Critical Ivanti CSA Vulnerabilities Exploited—CISA and FBI Urge Mitigation

Funding soars in a milestone year for Israeli cybersecurity

GhostGPT – New AI Black Hat Tool Used by Hackers to Generative Malware & Exploits

Hewlett Packard investigating a significant data theft by the IntelBroker hacker group

How to Eliminate Identity-Based Threats

ICICI Bank Data Breach – BASHE Ransomware Group Allegedly Leak Bank Customers Data

Murdoc Botnet Exploiting AVTECH Cameras & Huawei Routers To Gain Complete Control

Nasdaq é alvo de ataque hacker para promover golpe com criptomoeda falsa

Nasdaq's Official X Account Hacked to Promote Fraudulent Memecoin

Network security firm SonicWall warns about critical vulnerability affecting its gateways

New Android Identity Check locks settings outside trusted locations

New Cookie Sandwich Technique Let Attackers Bypass HttpOnly Flag On Servers

New GhostGPT AI Chatbot Facilitates Malware Creation and Phishing

New Research: The State of Web Exposure 2025

New Supply Chain Attack Targeting Chrome Extensions To Inject Malicious Code

Next.js Framework Vulnerability Exposes Websites To Cache Poisoning & XSS Attacks

Nnice Ransomware Attacking Windows Systems With Advanced Encryption Techniques

Open-Source ClamAV Releases Critical Security Patch Updates – What’s Inside!

Palo Alto Firewalls Found Vulnerable to Secure Boot Bypass and Firmware Exploits

PayPal fined $2M for exposing New Yorker’s social security numbers

PoC Exploit Released for 7-Zip Mark-of-the-Web Bypass Vulnerability

Python administrator moves to improve software security

QakBot-Linked BC Malware Adds Enhanced Remote Access and Data Gathering Features

Rails Apps File Write Vulnerability Let Attackers Execute Code Remotely

Researcher Jailbreaks an AI’s System Prompt to Leak Its Core System Function

Scammers really like to impersonate Microsoft

SonicWall SMA appliances exploited in zero-day attacks (CVE-2025-23006)

SonicWall Urges Immediate Patch for Critical CVE-2025-23006 Flaw Amid Likely Exploitation

SonicWall warns of SMA1000 RCE flaw exploited in zero-day attacks

Stealthy Chinese hackers target VPN users via infected installer

Stealthy 'Magic Packet' malware targets Juniper VPN gateways

Subaru Car Vulnerability Lets Hackers Control Millions of Cars Remotely Using Starlink

Tesla EV charger hacked twice on second day of Pwn2Own Tokyo

Toronto school district says vendor data breach impacted student data dating back 40 years

TRIPLESTRENGTH Hits Cloud for Cryptojacking, On-Premises Systems for Ransomware

Trump demite membros do Conselho de Segurança Cibernética em meio a investigação sobre ataque hacker

Trump Pardons Silk Road Founder Ulbricht

Trump Terminates DHS Advisory Committee Memberships, Disrupting Cybersecurity Review

Tycoon 2FA Phishing Kit Using Specially Crafted Code To Evade Detection

U.S. President Donald Trump granted a “full and unconditional pardon” to Ross Ulbricht, Silk Road creator

Zero Day: Robert De Niro Tackles a Devastating Cyberattack in Netflix’s Thrilling New Series

Web Cache Vulnerability Scanner: Open-source tool for detecting web cache poisoning

What Makes Bulletproof Hosting Providers a Growing Danger in Australia

Why AWS S3 Buckets Are the New Target for Ransomware Campaigns

WordPress Real-Estate Plugin Vulnerability Exposes 32k+ Websites To Cyberattack

22/01

0-Click Deanonymization Attack Exploits Telegram, Signal, Discord And Other Apps

3 extensions to use for anonymous browsing - and what that even means

73% of UK Education Sector Hit by Cyber-Attacks in Past Five Years

318 Vulnerabilities Patched in January 2025 Oracle Critical Security Update

1,000+ Malicious Domains Mimic Reddit & WeTransfer To Deliver Malware

48,000+ internet-facing Fortinet firewalls still open to attack

50,000 Fortinet Firewalls Remain Vulnerable to Critical Zero-Day Exploit

A 7-Zip bug allows to bypass the Mark of the Web (MotW) feature

Account Compromise and Phishing Top Healthcare Security Incidents

Acronis CISO on why backup strategies fail and how to make them resilient

AI Cyber Security Predictions 2025

AI Risks and cyber resilience: global experts sound the alarm at Davos

American Standard is allegedly breached by RansomHub

Attackers Exploit IBM i Access Client Solutions on Windows 11 To Steal Passwords

AWS Releases Best Security Practices To Mitigate Ransomware Attacks

Blacon High School cancels classes indefinitely to recover from a cyber attack

BreachForums Admin Conor Fitzpatrick (Pompompurin) to Be Resentenced

Canadian e-commerce giant North Pole Company faces alleged data breach affecting over 500,000 customers

China-aligned PlushDaemon APT compromises supply chain of Korean VPN

China Hackers Compromised VPN Service Provider in Supply-Chain Attack

Cisco warns of denial of service flaw with PoC exploit code

Cloudflare blocked a record-breaking 5.6 Tbps DDoS attack

Cloudflare CDN flaw leaks user location data, even through secure chat apps

Cloudflare Mitigates Record-Breaking 5.6Tbps DDoS Attack

Conduent confirms cybersecurity incident behind recent outage

Criminal IP and OnTheHub Partner to Deliver Advanced Cybersecurity Solutions for Education

Critical infrastructure in crosshairs as ransomware attacks soar

Critical zero-days impact premium WordPress real estate plugins

Cyberattack Hits PowerSchool, Exposing Personal Data of Students and Staff

Cybersecurity books on ransomware you shouldn’t miss

Cybersecurity is tough: 4 steps leaders can take now to reduce team burnout

Data breach in Texas exposes personal information of over 61,000 residents

Default Teams configurations exploited in ransomware attacks

Discover Hidden Browsing Threats: Free Risk Assessment for GenAI, Identity, Web, and SaaS Risks

Distrustful employees sabotaging AI adoption by manipulating data, study claims

Email attacks surge in APAC, phishing up by 30% in 2024

Ex-CIA Analyst Pleads Guilty To Leaking National Defense Information

Hackers exploit 16 zero-days on first day of Pwn2Own Automotive 2025

Hackers Exploit Zero-Day in cnPilot Routers to Deploy AIRASHI DDoS Botnet

Hackers Exploited 16 0-days & Earned $382,750 – Pwn2Own Automotive 2025

Helldown Ransomware Exploiting Zyxel Devices Using Zero-Day Vulnerability

InvisibleFerret Malware Attacking Windows Users Through Fake Job Interview Tactics

IPany VPN breached in supply-chain attack to push custom malware

Is classic Outlook crashing when you start or reply to an email? A fix is on the way

Largest DDoS attacks now torture servers with up to 5.6 Tbps

Major Cybersecurity Vendors' Credentials Found on Dark Web

Malicious VS Code Mimic As Zoom App Steals Cookies From Chrome

Microsoft Extends Multi-Billion Dollar AI Partnership With OpenAI Till 2030

Microsoft services exploited in separate ransomware campaigns

Mirai botnet behind the largest DDoS attack to date

Mirai Botnet Launches Record 5.6 Tbps DDoS Attack with 13,000+ IoT Devices

Newly emergent Nnice ransomware examined

Opioid Misuse treatment centre confirms a major cyber attack on its systems

Oracle Releases January 2025 Patch to Address 318 Flaws Across Major Products

PlushDaemon APT Targeted South Korean VPN Software

PlushDaemon APT Targets South Korean VPN Provider in Supply Chain Attack

PowerSchool hacker claims they stole data of 62 million students

Preparing for evolving ransomware threats in 2025

President Trump Pardons Silk Road Creator Ross Ulbricht After 11 Years in Prison

Privacy professionals feel more stressed than ever

Pwn2Own Automotive 2025 Day 1: organizers awarded $382,750 for 16 zero-days

Ransomware Attacks Surge to Record High in December 2024

Record-breaking 5.6 Tbps DDoS Attack From 13,000 Mirai Hacked Devices

Restaurant booking platforms overrun with bots trying to steal data, researchers warn

Rostelecom, Russia telecom giant, investigates leak of company data

Security chiefs whose companies operate in the EU should be exploring DORA now

Stratoshark: Wireshark for the cloud – now available!

Telegram captcha tricks you into running malicious PowerShell scripts

Threat Actors Delivering Ransomware Via Microsoft Teams Using Voice Calls

Trump Terminates DHS Advisory Committee Memberships, Disrupting Cybersecurity Review

Tycoon 2FA Phishing Kit Upgraded to Bypass Security Measures

Two ransomware groups abuse Microsoft’s Office 365 platform to gain access to target organizations

US Department Of Homeland Security Terminates Entire Advisory Committees

Use this AI chatbot prompt to create a password-exclusion list

What PowerSchool isn’t saying about its ‘massive’ student data breach

Windows File Explorer Elevation Of Privilege Vulnerability(CVE-2024-38100) Exploited

21/01

7 top cybersecurity projects for 2025

7-Zip fixes bug that bypasses Windows MoTW security warnings, patch now

7-Zip Vulnerability Let Remote Attackers Bypass Protections & Execute Arbitrary Code

126 Linux kernel Vulnerabilities Lets Attackers Exploit 78 Linux Sub-Systems

13,000 MikroTik Routers Hijacked by Botnet for Malspam and Cyberattacks

Addressing the intersection of cyber and physical security threats

Almost 10% of GenAI Prompts Include Sensitive Data: Study

Apache CXF Vulnerability Let Attackers Push Systems to Trigger DoS Condition

AT&T data breach exposes FBI call logs, raising concerns over informant safety

Aussie manufacturer Clutch Industries confirms cyber incident

Beware! Fake SBI Reward APK Attacking Users To Deliver Android Malware

Beware Of Fake AnyDesk Requests That Gives Remote Access To Hackers

Blood Donation Service Confirms July 2024 Ransomware Attack Resulted in Personal Data Breach

Brave Browser Vulnerability Let Malicious Website Mimic as Legitimate One

CERT-UA warned of scammers impersonating the agency using fake AnyDesk requests

CERT-UA Warns of Cyber Scams Using Fake AnyDesk Requests for Fraudulent Security Audits

Chinese National Arrested by Philippine Authorities on Military Espionage Charges

CISO Top 10 Priorities for Q1 2025: Key Findings and Evolving Focus

Criminal IP Teams Up with OnTheHub for Digital Education Cybersecurity

Critical Injection Vulnerability in SUSE Linux Distro Let Attackers Exploits “go-git” Library

Critical Mozilla Vulnerabilities Prompt Urgent Updates for Firefox and Thunderbird Users

Cyber security a key concern ahead of Australia’s 2025 federal election

Dangerous new Nnice ransomware laughs at victims by replacing file extensions with ‘.xdddd’

Debian 11 Tryton-Server Vulnerability Let Attackers Launch Zip Bomb Attacks

Debian LDAP Server Vulnerabilities Allow Attackers Authenticate as Users

December 2024 Healthcare Data Breach Report

eCommerce data breach exposes details on half a million users

EU to take aim at healthcare cyber threat

Ex-CIA Analyst Pleads Guilty to Sharing Top-Secret Data with Unauthorized Parties

Experts found multiple flaws in Mercedes-Benz infotainment system

Fleet: Open-source platform for IT and security teams

Forescout Report Detail Hunters International Ransomware Gang Tactics

Gateshead Council investigating a major ransomware attack on its systems

Gootloader Malware Employs Blackhat SEO Techniques To Attack Victims

Hackers are abusing Zendesk to run brand impersonation scams

Hackers impersonate Ukraine’s Computer Emergency Response Team (CERT) to trick people into allowing computer access

HackGATE: Setting New Standards for Visibility and Control in Penetration Testing Projects

High Severity Vulnerability Discovered in CP Plus Router: Immediate Attention Needed

HPE launches investigation into latest IntelBroker breach claims

IntelBroker claims responsibility for breach of Hewlett Packard Enterprise, selling sensitive data online

Labels manufacturer Avery says ransomware attack impacted over 60,000 customers

Lessons from PowerSchool: A Wake-Up Call for the Education Sector

Linux PoDoFo Library Vulnerabilities Lets Attackers Trick User To Open PDF To Launch DOS Attacks

Medusa Ransomware: What You Need To Know

Mercedes-Benz MBUX Infotainment System’s Vulnerabilities Are Now Patched

Mercedes-Benz User Experience Systems Exploited to Gain Remote Access

Microsoft Enables New Administrator Protection Feature in Windows Security Settings

Microsoft Teams abused in Russian email bombing ransomware campaign

Mirai Variant Murdoc_Botnet Exploits AVTECH IP Cameras and Huawei Routers

Most European Privacy Teams Are Understaffed and Underfunded

New Contacto Ransomware Evades AV Detection & Uses Windows Console For Execution

New Cyber Threat Exposed: Advanced Techniques Used to Target German Systems

New Mirai Malware Variant Targets AVTECH Cameras, Huawei Routers

New Mirai Variant Murdoc_Botnet Launches DDoS Attacks via IoT Exploits

New Russian campaign abuses Microsoft Teams to exfil data

OpenVPN Easy-RSA Vulnerability Enables Bruteforce of Private CA Key

Oracle To Address 320 Vulnerabilities in January Patch Update

Outgoing FCC head says Salt Typhoon hacking a clarion call to address security issues

OWASP Top 10 2025 – Most Critical Weaknesses Exploited/Discovered

PARSIQ's Reactive Network Provides Solution for DeFi Exchange Vulnerabilities

PNGPlug Loader Delivers ValleyRAT Malware Through Fake Software Installers

Police algorithm labeling innocent kids as future crooks – media

Ransomware Attack Forces UK Balcom High School to Close Doors for Students

Ransomware attackers are “vishing” organizations via Microsoft Teams

Redline, Vidar and Raccoon Malware Stole 1 Billion Passwords in 2024

Russian Ransomware Hackers Impersonate IT Support on Microsoft Teams

Russian Ransomware Groups Deploy Email Bombing and Teams Vishing

Scam Yourself attacks: How social engineering is evolving

Teen hacks oil tankers for fun, Italy doesn’t get the joke

TP-Link Router Buffer Overflow Vulnerability Exploited to Execute Code

Trump revokes AI risk regulation in day one executive order

Tunneling Flaws Put VPNs, CDNs and Routers at Risk Globally

Ukraine’s state register restored after Russian cyber attack

Vim Command Line Text Editor Vulnerability Tiggers Potential Crash

Windows BitLocker bug exposes AES-XTS encryption

Windows BitLocker Vulnerability(CVE-2025-21210) Exploited in Randomization Attack

20/01

50 Million Potentially Compromised In PowerSchool Data Breach

Achieving rapid threat analysis and response

AI-driven insights transform security preparedness and recovery

Allegheny Health Network Files Official Notice of Data Breach Following Cybersecurity Incident at Vendor

Anne Neuberger Steps Down as White House Cybersecurity Advisor: What’s Next for U.S. Cyber Defense?

Apple Confirms TikTok No Longer Available In Stores For US Users

Best identity theft protection for families of 2025

Beware Of Your LinkedIn Contacts, They May Targeting Your Organization Assets

BianLian Hacker Group Claims ‘MassDevelopment’ Breach, Exfiltrating 4TB of Sensitive Data

Budget 2025 on the Horizon: Will India Take the Leap in Enhancing Cybersecurity and Data Privacy?

Canada’s Privacy Watchdog Raises Concerns Over PowerSchool Data Breach

CERT-UA warns against “security audit” requests via AnyDesk

ChatGPT Crawler Vulnerability Let Attackers Trigger DDoS Attack On Any Websites

Chester high school forced to shut after cyber attack

Chinese cybersecurity firm sanctioned by US Treasury over alleged links to Salt Typhoon hackers

Cisco wants to utilize AI to keep your new applications and data safe

Cyber attack cost Synnovis estimated £32.7m in 2024

Cyber attack on New York law firm impacted close to 3.5 million individuals

Data on Half a Million Hotel Guests Exposed After Otelier Breach

Decentralization is happening everywhere, so why are crypto wallets “walled gardens”?

Details of over 15,000 FortiGate devices leaked online, so be on your guard

DoNot Team Linked to New Tanzeem Android Malware Targeting Intelligence Collection

Elon Musk Offers to Fix U.S. Government IT Systems, Calls It Harder Than Space Missions

Enzo Biochem to pay $7.5 million to settle data breach class action lawsuit

FBI and CISA alert software vendors: stop hardcoding secrets, use secure cryptography

Fintech Bill Pay Platform “Willow Pays” Exposes Over 240,000 Records

Former CIA Analyst Pleads Guilty to Sharing Top Secret Files

FTC mandates security overhaul for GoDaddy following years of cybersecurity failures

FunkSec Ransomware Dominating Ransomware Attacks, Compromised 85 Victims In December

Government consultation considers measures to disrupt ransomware payments

GuidePoint warns of Python backdoor used in ransomware

Hackers Allegedly Claiming Breach Of Hewlett Packard Enterprise

Hackers Deploy Malicious npm Packages to Steal Solana Wallet Keys via Gmail SMTP

Hackers Weaponize MSI Packages & PNG Files To Deliver Multi-Stage Malware

Hackers Weaponize npm Packages To Steal Solana Private Keys Via Gmail

High school forced to close after cyber attack

Houses of Parliament blocks more than 46 million email attacks over three years

How organizations can secure their AI code

HPE Aruba Network Vulnerabilities Let Attackers Execute Arbitrary Code Remotely

HPE (Hewlett Packard Enterprise) Launches Investigation After Hacker Claims Data Breach

Iannuzzi Manetta & Co. Notified Current and Former Customers of Recent Data Breach

Indian APT Group DONOT Misuses App for Intelligence Gathering

iOS19 leaked: significant design changes, but nothing we haven’t seen before

JPMorgan's CISO on Overcoming Surging Threats and Regulatory Hurdles in Finance

Law firm counts cost of cyber attack

Linux Kernal 6.13 Released – What’s New!

Malicious npm and PyPI target Solana Private keys to steal funds from victims’ wallets

Massive data breach hits Otelier, exposing millions of hotel guests' personal information

Massive National Bureau of Investigation (NBI) Data Breach Exposes Millions of Users Records Online

Microsoft Configuration Manager Vulnerability Allows Remote Code Execution – PoC Released

Microsoft shares temp fix for Outlook crashing when writing emails

Microsoft's new expanded logging capabilities could mean big changes for US government devices

Midsize firms universally behind in slog toward DORA compliance

Millions of hotel guest reservations leaked in Otelier data breach

Money Message ransomware gang lists Queensland medical clinic

Morrison Community Hospital Agrees to $675K Settlement to Resolve Ransomware Lawsuit

Multiple Azure DevOps Vulnerabilities Let Inject CRLF Queries & Rebind DNS

NDR's role in a modern cybersecurity stack

New Android Malware Mimics Chat App to Steal Sensitive Data

New IoT Botnet Launching Large-Scale DDoS Attacks Hijacking IoT Devices

New MintsLoader Employs Domain Generation Algorithm & Anti-VM Techniques for Sophistication

New UEFI Secure Boot flaw exposes systems to bootkits

Novel Adversary-in-the-Middle (AiTM) Phishing Kit Sets Sights on Microsoft 365 Accounts

One in ten GenAI prompts puts sensitive data at risk

Otelier data breach exposes sensitive hotel guest information across major brands

Phishing Attacks Are the Most Common Smartphone Security Issue for Consumers

Phishing Campaign Attempts to Bypass iOS Protections

Planet WGS-804HPT Industrial Switch flaws could be chained to achieve remote code execution

PoC Exploit Released For QNAP Remote Code Execution Vulnerability

PowerSchool Faces 23 Lawsuits Over Schools' Mega Data Breach

Ransomware attack forces Brit high school to shut doors

Researchers Detailed the Ghostwriter APT Infrastructure Used to Launch Cyber Attacks

Researchers Identify Principles to Reduce Noise in Network Intrusion Detection Systems in SOC

Russian Hackers Employ QR Code Phishing Campaign

Sliver Implant Attacking German Entities With Weaponized LNK Files

Smishing Scams Impersonating Toll Roads Rising Due to Enhanced Phishing Kits Sold by Hackers

Sterling Bank Loses N1.2 Billion In Major Cyber Attack On Its System

Telegram-Based “Sneaky 2FA” Phishing Kit Targets Microsoft 365 Accounts

The critical state of identity security

The danger of new AI-powered ransomware

The impact of the cyber insurance industry in resilience against ransomware

Ukraine's State Registers Restored Following Cyber-Attack

Unsecured Tunneling Protocols Expose 4.2 Million Hosts, Including VPNs and Routers

U.S. Sanctions Chinese Cyber Actors Behind Treasury Breach and Salt Typhoon Attacks

US Sanctions Chinese Hackers for Treasury, Telecom Breaches

US Treasury sanctions Chinese cybersecurity firm and hacker behind US network breaches

Windows 11 BitLocker-Encrypted Files Accessed Without Disassembling Laptops

Windows Common Log File System Zero-day Vulnerability (CVE-2024-49138) Exploited

Wolf Haldenstein data breach impacts about 3M individuals

Yubico Warns of 2FA Security Flaw in pam-u2f for Linux and macOS Users

19/01

Researchers Proposed Quantum Diffie-Hellman Key Exchange for Future Quantum Cryptography

Star Blizzard hackers abuse WhatsApp to target high-value diplomats

TikTok Goes Dark in the U.S. as Federal Ban Takes Effect January 19, 2025

TikTok shuts down in the US as Trump throws the company a lifeline

TikTok Stopped Working for US Users, Removed from Apple & Google stores

Daily News - Janeiro (12/01 - 18/01) - 03 Semana de 2025