Security. In focus.

Salt Typhoon Targeting Old Cisco Vulnerabilities in Fresh Telecom Hacks - SecurityWeek

Salt Typhoon, a Chinese state-sponsored APT, has been targeting telecommunications providers and universities, exploiting vulnerabilities in Cisco devices. The group, known for previous attacks on US telecommunications companies, aims to gain persistent access and exfiltrate data. Organizations are advised to prioritize remediating exposed devices and implementing strict access controls.

whoAMI name confusion attacks can expose AWS accounts to malicious code execution | CSO Online

A cloud image name confusion attack, “whoAMI,” can expose thousands of active AWS accounts to malicious code execution. The attack exploits misconfigured software retrieving Amazon Machine Images (AMIs) to create EC2 instances, potentially allowing attackers to execute code within vulnerable AWS accounts. AWS has addressed the issue by introducing Allowed AMIs, a feature that lets users define a trusted allow list for AMI selection.

Microsoft Study Finds Relying on AI Kills Your Critical Thinking Skills

A Microsoft study found that over-reliance on AI tools for task completion can lead to a decrease in critical thinking skills among users. The study, which surveyed knowledge workers, revealed a correlation between increased confidence in AI capabilities and decreased critical thinking, particularly for lower-stakes tasks. While AI can improve efficiency, the study warns that uncritical reliance may result in diminished independent problem-solving and a lack of diverse outcomes.

Unpatched Cisco Devices Still Getting Popped by Salt Typhoon

A Chinese cyber espionage group, Salt Typhoon, continues to target unpatched Cisco devices, particularly in telecommunications and universities, to establish remote control and potentially steal sensitive information. The group, known for its involvement in mass hacking of telecommunications networks, exploits vulnerabilities to create virtual tunneling and gain privileged access to devices. Organizations are advised to review logs, patch devices, and monitor for unexpected network traffic to mitigate potential compromise.

Lawyers Caught Citing AI-Hallucinated Cases Call It a ‘Cautionary Tale’

Attorneys admitted to citing AI-generated, non-existent cases in a lawsuit against Walmart and Jetson Electronic Bikes. The judge demanded an explanation for the error, highlighting the risks of using AI in legal drafting. This incident follows previous cases where lawyers faced consequences for using AI-generated citations, underscoring the need for caution in this new era of AI integration.

Unusual attack linked to Chinese APT group combines espionage and ransomware | CSO Online

A recent attack combined cyberespionage and ransomware tactics, a rare occurrence for Chinese APT groups. The attacker used a variant of the PlugX cyberespionage toolset, previously linked to Chinese APT groups, alongside the RA World ransomware. The attacker demanded a $2 million ransom, claiming to have exploited a vulnerability in Palo Alto’s PAN-OS firewall software and stolen data from the victim’s S3 buckets.

North Korean hackers spotted using ClickFix tactic to deliver malware - Help Net Security

North Korean hackers are using the “ClickFix” tactic to deliver malware to South Korean targets. The tactic involves tricking users into executing malicious PowerShell scripts, often disguised as necessary fixes or registrations, to compromise their systems and exfiltrate data. Organizations should enhance security measures to protect against such attacks.

China-linked APTs' tool employed in RA World Ransomware attack

A November 2024 RA World ransomware attack on an Asian software firm used tools linked to China-linked APT groups, suggesting a possible connection between espionage and ransomware activities. The attacker’s use of a Toshiba executable to sideload PlugX malware and demand a ransom indicates a potential shift from espionage to cybercrime. However, the attacker’s prior involvement with ransomware groups like Bronze Starlight raises questions about their motives and the possibility of a cover-up.

DeepSeek Exposes Major Cybersecurity Blind Spot - SecurityWeek

DeepSeek, a new Chinese AI company, highlights a major cybersecurity blind spot: users’ lack of caution when sharing personal information on social media and internet apps. Attackers exploit this data to launch sophisticated cyberattacks, targeting businesses and individuals alike. To minimize risk, users should study privacy policies, strengthen account security, protect personal information, and be cautious of phishing and scams.

CVE-2025-1094: PostgreSQL psql SQL injection (FIXED) | Rapid7 Blog

Rapid7 discovered a high-severity SQL injection vulnerability, CVE-2025-1094, in PostgreSQL’s interactive tool psql. The vulnerability, which allows arbitrary code execution, was exploited in conjunction with CVE-2024-12356, an unauthenticated RCE vulnerability in BeyondTrust products. PostgreSQL users should upgrade to version 17.3, 16.7, 15.11, 14.16, or 13.19 to remediate the issue.

Astaroth Phishing Kit Bypasses 2FA to Hijack Gmail and Microsoft Accounts

A new phishing kit, Astaroth, bypasses two-factor authentication (2FA) by using a reverse proxy and real-time credential capture. Astaroth captures login credentials, authentication tokens, and session cookies, allowing attackers to hijack accounts even with 2FA enabled. The kit is sold on Telegram and promoted on cybercrime forums and marketplaces, highlighting its sophistication and effectiveness.

North Korean APT43 Uses PowerShell and Dropbox in Targeted South Korea Cyberattacks

A North Korean threat actor, Kimsuky, is targeting South Korean businesses, government, and cryptocurrency sectors using phishing emails with Korean-language decoy documents. The attack chain relies heavily on PowerShell scripts for payload delivery, reconnaissance, and execution, utilizing Dropbox for payload distribution and data exfiltration. The campaign, active since September 2022, demonstrates sophisticated techniques to evade detection and complicate incident response.

Dark Web Profile: Fog Ransomware - SOCRadar® Cyber Intelligence Inc.

Fog Ransomware, first detected in May 2024, primarily targets US-based educational institutions, utilizing a multi-pronged extortion campaign involving data encryption and exfiltration. The ransomware group, classified as a variant rather than a unified entity, employs a double extortion strategy, threatening to leak stolen data if ransom demands are not met. Organizations can defend against Fog Ransomware by implementing multi-factor authentication, regular system updates, employee training, and robust backup strategies.

Hackers are targeting your password manager app | Mashable

Cyberattacks on password managers and credential storage services have tripled, with 25% of malware variants targeting these services. Hackers are employing multi-stage attacks, dubbed “SneakThief,” to steal credentials from password stores, making it crucial to use password managers with multi-factor authentication and unique passwords.

Watergate Hotel hit with data breach - WTOP News

The Watergate Hotel in Washington, D.C., experienced a data breach last spring, potentially exposing sensitive information of guests and employees. The breach, discovered in April 2024, included personal details and financial information.

Samoa warns of APT40 hackers targeting organizations in Blue Pacific region, urges immediate action - Industrial Cyber

Samoa’s National Computer Emergency Response Team (SamCERT) issued an advisory warning of APT40, a state-sponsored cyber group targeting Pacific Island nations. APT40, known for its sophisticated malware and stealthy techniques, seeks to compromise sensitive networks and exfiltrate data. Organizations are urged to conduct threat hunting, review patching status, and update incident response plans to mitigate the risk posed by APT40.

Ransomware gangs shifting tactics to evade enterprise defenses | Cybersecurity Dive

Ransomware gangs are adapting to stronger enterprise defenses by employing more sophisticated tactics, such as data theft and extortion attacks, and “living off the land” techniques. This shift is driven by the competitive nature of the ransomware ecosystem and the increasing effectiveness of threat detection and law enforcement actions. While EDR and ransomware protection services have improved, data loss prevention services have lagged, leaving organizations vulnerable to data exfiltration.

Michigan casino chain forced to shut down after ransomware attack

Kewadin Casinos in Michigan’s Upper Peninsula are shut down following a ransomware attack that impacted multiple computer and phone systems. The Sault Ste. Marie Tribe of Chippewa Indians, which owns the casinos, is working to resolve the issue and expects a resolution within a week.

Scams targeting lovers or the lovelorn www.kaspersky.com/blog/tech…

If you’re still under the illusion that scammers only target illiterate simpletons and would never be interested in you, think again. Fraud is a subtle art, and even the most tech-savvy person could fall for a well-crafted scheme. In 2025, scammers are leveraging artificial intelligence, chatbots, and the global trend toward automation.

With Valentine’s Day coming up, we reveal how scammers exploit the feelings of both those in love and those seeking it.

No matter how sophisticated a scam is, you can almost always protect yourself — especially when it comes to romance-related schemes.

Hacker who hijacked SEC’s X account pleads guilty, faces maximum five-year sentence therecord.media/hacker-hi…

The hacker responsible for breaking into the X account of the U.S. Securities and Exchange Commission (SEC) and posting false information is facing a maximum prison sentence of five years after pleading guilty on Monday.

Eric Council Jr., a 25-year-old native of Athens, Alabama, pleaded guilty to conspiracy to commit aggravated identity theft and access device fraud. His sentencing hearing is scheduled for May 16.

The SEC’s X account was taken over and used to share false information about plans to approve exchange-traded funds (ETFs) that contain cryptocurrency like bitcoin.

At the time of the incident, X confirmed that an investigation revealed that the account compromise “was not due to any breach of X’s systems, but rather due to an unidentified individual obtaining control over a phone number associated with the @SECGov account through a third party.”

The X statement, which came from the site’s safety team, claimed the account did not have two-factor authentication enabled, something disputed in the indictment.

Google fixes flaw that could unmask YouTube users' email addresses www.bleepingcomputer.com/news/secu…

Google has fixed two vulnerabilities that, when chained together, could expose the email addresses of YouTube accounts, causing a massive privacy breach for those using the site anonymously.

The flaws were discovered by security researchers Brutecat (brutecat.com) and Nathan (schizo.org), who found that YouTube and Pixel Recorder APIs could be used to obtain user’s Google Gaia IDs and convert them into their email addresses.

The ability to convert a YouTube channel into an owner’s email address is a significant privacy risk to content creators, whistleblowers, and activists relying on being anonymous online.

Google has confirmed to BleepingComputer that mitigations for the bugs are now completed and that there are no signs that any attacker actively exploited the flaws.

Researchers Find New Exploit Bypassing Patched NVIDIA Container Toolkit Vulnerability thehackernews.com/2025/02/r…

Cybersecurity researchers have discovered a bypass for a now-patched security vulnerability in the NVIDIA Container Toolkit that could be exploited to break out of a container’s isolation protections and gain complete access to the underlying host.

The new vulnerability is being tracked as CVE-2025-23359 (CVSS score: 8.3). It affects the following versions -

NVIDIA Container Toolkit (All versions up to and including 1.17.3) - Fixed in version 1.17.4 NVIDIA GPU Operator (All versions up to and including 24.9.1) - Fixed in version 24.9.2

Cloud security firm Wiz, which shared additional technical specifics of the flaw, said it’s a bypass for another vulnerability (CVE-2024-0132, CVSS score: 9.0) that was addressed by NVIDIA in September 2024.

In a nutshell, the vulnerability enables bad actors to mount the host’s root file system into a container, granting them unfettered access to all files. Furthermore, the access can be leveraged to launch privileged containers and achieve full host compromise via the runtime Unix socket.

DPRK hackers dupe targets into typing PowerShell commands as admin www.bleepingcomputer.com/news/secu…

North Korean state actor ‘Kimsuky’ (aka ‘Emerald Sleet’ or ‘Velvet Chollima’) has been observed using a new tactic inspired from the now widespread ClickFix campaigns.

ClickFix is a social engineering tactic that has gained traction in the cybercrime community, especially for distributing infostealer malware.

It involves deceptive error messages or prompts that direct victims to execute malicious code themselves, often via PowerShell commands. These actions typically lead to malware infections.

Microsoft says it observed this tactic in limited-scope attacks starting January 2025, targeting individuals that work in international affairs organizations, NGOs, government agencies, and media companies across North America, South America, Europe, and East Asia.

Ransomware isn’t always about the money: Government spies have objectives, too www.theregister.com/2025/02/1…

Feature Ransomware gangsters and state-sponsored online spies fall on opposite ends of the cyber-crime spectrum.

The former move fast, make a lot of noise, and then intentionally draw attention to say “Hi, we’ve broken into your network,” usually sending the victim some encrypted files and a ransom note.

The latter often play the long game, moving stealthily and making seemingly innocuous moves to maintain a silent presence on your network, allowing them to snoop for as long as possible.

Over the summer the FBI and CISA warned that Iran’s Pioneer Kitten had been breaking into buggy VPNs and firewall devices to steal data and drop ransomware. But, according to the feds, this government-backed group’s recent attacks were financially motivated — not state-sanctioned.

Cybercrime: A Multifaceted National Security Threat cloud.google.com/blog/topi…

Cybercrime makes up a majority of the malicious activity online and occupies the majority of defenders' resources. In 2024, Mandiant Consulting responded to almost four times more intrusions conducted by financially motivated actors than state-backed intrusions. Despite this overwhelming volume, cybercrime receives much less attention from national security practitioners than the threat from state-backed groups. While the threat from state-backed hacking is rightly understood to be severe, it should not be evaluated in isolation from financially motivated intrusions.