Today’s roundup
Zero-Day Exploit Found in Popular Collaboration Software 'TeamChat'
Critical RCE Vulnerability Discovered in Popular Enterprise Linux Distribution
Cyberattack Disrupts Major Shipping Company, Global Logistics Impacted
Major Data Breach Impacts Global Retailer, Affecting Millions of Customers
New Ransomware Group Targets Healthcare Sector with Double Extortion Tactics
Ransomware Attack on Healthcare Provider Leads to Data Exposure and Service Disruption
Financial Services Sector Targeted by Advanced Persistent Threat (APT) Group
New 'GhostRAT' Malware Variant Emerges with Evasion Capabilities
Phishing Campaign Targets Microsoft 365 Users with Sophisticated Credential Harvesters
Government Agencies Warn of Increased Supply Chain Attacks
Summary
A zero-day vulnerability (CVE-2024-YYYYY) in 'TeamChat', a popular collaboration platform, is actively exploited via specially crafted messages allowing arbitrary code execution. Researchers identified the unpatched exploit; users should disable message previews.
'CyberGuard Labs' found a critical RCE (CVE-2024-XXXXX) in 'EnterpriseLinuxOS 9's systemd-networkd component. The flaw permits unauthenticated root access via DHCP client handling. Patches are available; immediate updates are advised.
Major global shipping company 'Oceanic Logistics' suffered a significant cyberattack, likely ransomware, disrupting IT systems and port operations globally. The incident has caused widespread cargo shipment delays.
Global retailer 'MegaMart' confirmed a data breach impacting 50 million customer records (names, addresses, phone numbers, partial credit cards) on May 15, 2024. 'SecureCo' attributed it to a misconfigured cloud storage bucket.
A new ransomware group, 'MedusaLocker 2.0', targets healthcare organizations globally using double extortion. It exfiltrates patient data before encrypting systems, exploiting unpatched VPN/RDP. Increased activity was noted over three weeks.
Regional healthcare provider 'MediCare Systems' was hit by a LockBit variant ransomware attack, causing service disruption and potential patient data exposure. Emergency services were diverted, and appointments canceled.
APT group 'FIN7' is actively targeting financial services in North America and Europe with custom malware and social engineering to exfiltrate financial data and intellectual property. Recent activity shows increased focus on investment firms.
'Palo Alto Networks Unit 42' detailed 'SpecterRAT', a new 'GhostRAT' variant. It features advanced anti-analysis and evasion via polymorphic code and legitimate Windows utilities, distributed via spear-phishing with malicious attachments.
A widespread, sophisticated phishing campaign targets Microsoft 365 users with convincing fake login pages and personalized email lures. It has compromised corporate accounts in finance and legal sectors.
CISA and NCSC issued a joint advisory on increased supply chain attacks, highlighting compromised software updates and poisoned open-source libraries. Recommendations include enhanced vendor risk management and SBOM adoption.
Want to dig deeper?
Cyber Groups
| FIN7 | GOLD NIAGARA, ITG14, Carbon Spider, ELBRUS, Sangria Tempest |
Malware Families