<?xml version="1.0" encoding="UTF-8" standalone="no"?><rss xmlns:atom="http://www.w3.org/2005/Atom" xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:itunes="http://www.itunes.com/dtds/podcast-1.0.dtd" xmlns:media="http://search.yahoo.com/mrss/" xmlns:slash="http://purl.org/rss/1.0/modules/slash/" xmlns:sy="http://purl.org/rss/1.0/modules/syndication/" xmlns:wfw="http://wellformedweb.org/CommentAPI/" version="2.0"><channel><title>The Hacker News</title><link>https://thehackernews.com</link><description>Most trusted, widely-read independent cybersecurity news source for everyone; supported by hackers and IT professionals — Send TIPs to admin@thehackernews.com</description><language>en-us</language><lastBuildDate>Thu, 08 Feb 2024 22:23:05 +0530</lastBuildDate><sy:updatePeriod>hourly</sy:updatePeriod><sy:updateFrequency>1</sy:updateFrequency><atom:link href="https://feeds.feedburner.com/TheHackersNews" rel="self" type="application/rss+xml"/><item><title>Chinese Hackers Operate Undetected in U.S. Critical Infrastructure for Half a Decade</title><description><![CDATA[The U.S. government on Wednesday said the Chinese state-sponsored hacking group known as&nbsp;Volt Typhoon&nbsp;had been embedded into some critical infrastructure networks in the country for at least five years.
Targets of the threat actor include communications, energy, transportation, and water and wastewater systems sectors in the U.S. and Guam.
"Volt Typhoon's choice of targets and pattern]]></description><link>https://thehackernews.com/2024/02/chinese-hackers-operate-undetected-in.html</link><guid isPermaLink="false">https://thehackernews.com/2024/02/chinese-hackers-operate-undetected-in.html</guid><pubDate>Thu, 08 Feb 2024 18:35:00 +0530</pubDate><author>info@thehackernews.com (The Hacker News)</author><enclosure length="12216320" type="image/jpeg" url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi8FKfzSfddYQOjRjuXe9S7Ll3AxDEr42oYx9ZL9HK_IrqTtbaRvWGk1N3QisM_lRJNsDJpQTwko8WScLB-BQdp_UoY9Iv8fBBgvoXnNEgRCVcs7IRrYjJZQwzcqFOhuHLBhDIMYXlnA25g_7MSz_9iDf0GMybhJGfSplvgFGRMokYxNfc9KLJISAW-Hr9h/s1600/cisa.jpg"/></item><item><title>Unified Identity – look for the meaning behind the hype! </title><description><![CDATA[If you've listened to software vendors in the identity space lately, you will have noticed that “unified” has quickly become the buzzword that everyone is adopting to describe their portfolio. And this is great! Unified identity has some amazing benefits!&nbsp;
However (there is always a however, right?) not every “unified” “identity” “security” “platform” is made equal. Some vendors call the]]></description><link>https://thehackernews.com/2024/02/unified-identity-look-for-meaning.html</link><guid isPermaLink="false">https://thehackernews.com/2024/02/unified-identity-look-for-meaning.html</guid><pubDate>Thu, 08 Feb 2024 16:09:00 +0530</pubDate><author>info@thehackernews.com (The Hacker News)</author><enclosure length="12216320" type="image/jpeg" url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgRsJ2A4vQItI-dlUOITUD4i6AdqziFQ174S0WEJbcHfMUYUMv_9eGfSj_ccf5jA_C38Gkdo_nRK94-R2M4E8_iem0UcbrrLu_wKFB64go0Q4JXILVPWBhdM55mMtcqG1_b1i8Q-Ad-Ax-lqUl56b96lhuRpxZwCXqB4Is0_ej-_0lboDq-T2MZOHtWeL4/s1600/blog.jpg"/></item><item><title>HijackLoader Evolves: Researchers Decode the Latest Evasion Methods</title><description><![CDATA[The threat actors behind a loader malware called&nbsp;HijackLoader&nbsp;have added new techniques for defense evasion, as the malware continues to be increasingly used by other threat actors to deliver additional payloads and tooling.
"The malware developer used a standard process hollowing technique coupled with an additional trigger that was activated by the parent process writing to a pipe,"]]></description><link>https://thehackernews.com/2024/02/hijackloader-evolves-researchers-decode.html</link><guid isPermaLink="false">https://thehackernews.com/2024/02/hijackloader-evolves-researchers-decode.html</guid><pubDate>Thu, 08 Feb 2024 15:58:00 +0530</pubDate><author>info@thehackernews.com (The Hacker News)</author><enclosure length="12216320" type="image/jpeg" url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiEM4tm_r9jLZ2WObJGCzKhUTJGe_W1C9aFroX2mncGBIH4-TK5SD4bfsREz1uChkLi0ddTWhe3pGPUM6SCWVZ5MG1txyaMHbHnUxTAylkvF1rwe9Jv4ehS6NMrNB3Rz4nLbwjeJGHdcOL2FKx4RkKZOEqj2djFLeY1jr3m9HuNRivpdu-hMHZMbGu6xLJF/s1600/malware.jpg"/></item><item><title>Google Starts Blocking Sideloading of Potentially Dangerous Android Apps in Singapore</title><description><![CDATA[Google has unveiled a new pilot program in Singapore that aims to prevent users from sideloading certain apps that abuse Android app permissions to read one-time passwords and gather sensitive data.
"This enhanced fraud protection will analyze and automatically block the installation of apps that may use sensitive runtime permissions frequently abused for financial fraud when the user attempts]]></description><link>https://thehackernews.com/2024/02/google-starts-blocking-sideloading-of.html</link><guid isPermaLink="false">https://thehackernews.com/2024/02/google-starts-blocking-sideloading-of.html</guid><pubDate>Thu, 08 Feb 2024 15:47:00 +0530</pubDate><author>info@thehackernews.com (The Hacker News)</author><enclosure length="12216320" type="image/jpeg" url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEivlSU44YcsCJIOu5qx2JsH9hnMtM6RQv7yQ2oltYCUxAn4YPkQwrKZj2sTgvkU9lt-aKfIRz94_CaSpou5u_rMFjfqhayFbaoggBrHlWhd8AA6HaLSPwyamUwyLnRq-GXN759NirhfzzxjidcFou2KP0kkEuo9l1UP0cEGdL0LkImW9kvYjqfR7iQdMPAu/s1600/app.jpg"/></item><item><title>Kimsuky's New Golang Stealer 'Troll' and 'GoBear' Backdoor Target South Korea</title><description><![CDATA[The North Korea-linked nation-state actor known as Kimsuky is suspected of using a previously undocumented Golang-based information stealer called&nbsp;Troll Stealer.
The malware steals "SSH, FileZilla, C drive files/directories, browsers, system information, [and] screen captures" from infected systems, South Korean cybersecurity company S2W&nbsp;said&nbsp;in a new technical report.
Troll]]></description><link>https://thehackernews.com/2024/02/kimsukys-new-golang-stealer-troll-and.html</link><guid isPermaLink="false">https://thehackernews.com/2024/02/kimsukys-new-golang-stealer-troll-and.html</guid><pubDate>Thu, 08 Feb 2024 12:23:00 +0530</pubDate><author>info@thehackernews.com (The Hacker News)</author><enclosure length="12216320" type="image/jpeg" url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi-jYuzTU3NOkKStwMpIM3Ui91S5eyuH7eYsbCh2JWLfIjB91LXpP2VNUVJEx0z9k7vyDFIYurHLa0_0Q0n1x802k16OP1mEonUPa2gUBdj5Sl84C0dSf2oG4uWwrwYgss8pGsaIgdM4P9Qim4AbyEP4YPxIPQzb8KXLkrjdiw_EKj0LFBgYWebSrtmw6To/s1600/hacker.jpg"/></item><item><title>Critical Patches Released for New Flaws in Cisco, Fortinet, VMware Products</title><description><![CDATA[Cisco, Fortinet, and VMware have released security fixes for multiple security vulnerabilities, including critical weaknesses that could be exploited to perform arbitrary actions on affected devices.
The first set from Cisco consists of three flaws – CVE-2024-20252 and CVE-2024-20254 (CVSS score: 9.6) and CVE-2024-20255 (CVSS score: 8.2) – impacting Cisco Expressway Series that could allow an]]></description><link>https://thehackernews.com/2024/02/critical-patches-released-for-new-flaws.html</link><guid isPermaLink="false">https://thehackernews.com/2024/02/critical-patches-released-for-new-flaws.html</guid><pubDate>Thu, 08 Feb 2024 10:40:00 +0530</pubDate><author>info@thehackernews.com (The Hacker News)</author><enclosure length="12216320" type="image/jpeg" url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEigD56PdvPC532R3jz9sjOnLllJDpXD4ykm43O-oUj0-iVdD8X35N6l9oOEUlUfxWajkFAf5Am5H41mbTlx1-XGo1s0SCbIIFE3Zu1IXGjtohbK3nD3S3qEQXoUg35O9XtL7y-F93unoivrrJLyVdLraPaFVgud-1FRv8eq1A8QLB5rHSUxucfxNSgXpcp-/s1600/patch.jpg"/></item><item><title>After FBI Takedown, KV-Botnet Operators Shift Tactics in Attempt to Bounce Back</title><description><![CDATA[The threat actors behind the&nbsp;KV-botnet&nbsp;made "behavioral changes" to the malicious network as U.S. law enforcement began issuing commands to neutralize the activity.
KV-botnet is the name given to a network of compromised small office and home office (SOHO) routers and firewall devices across the world, with one specific cluster acting as a covert data transfer system for other Chinese]]></description><link>https://thehackernews.com/2024/02/after-fbi-takedown-kv-botnet-operators.html</link><guid isPermaLink="false">https://thehackernews.com/2024/02/after-fbi-takedown-kv-botnet-operators.html</guid><pubDate>Wed, 07 Feb 2024 20:41:00 +0530</pubDate><author>info@thehackernews.com (The Hacker News)</author><enclosure length="12216320" type="image/jpeg" url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjB6z-7go-RSBA5tn3BCR6AQBr4cahflcMxGgBFJ5QSROJ84mRuOSCw8x3G1HG6Sk5ht4yrtvq69VuMenAz9fCo5pv7b5S_aBGafsovnkEPKj1KQLJRTkadhh79MAIbOrH4fF8vQvbuGWOjko4XqYp0BHdfn_K626DHfRGbYAMmT6DCLOY5ThtijN3nsplQ/s1600/botnet.jpg"/></item><item><title>Critical Boot Loader Vulnerability in Shim Impacts Nearly All Linux Distros</title><description><![CDATA[The maintainers of shim have released&nbsp;version 15.8&nbsp;to address six security flaws, including a critical bug that could pave the way for remote code execution under specific circumstances.
Tracked as&nbsp;CVE-2023-40547&nbsp;(CVSS score: 9.8), the vulnerability could be exploited to achieve a Secure Boot bypass. Bill Demirkapi of the Microsoft Security Response Center (MSRC) has been&]]></description><link>https://thehackernews.com/2024/02/critical-bootloader-vulnerability-in.html</link><guid isPermaLink="false">https://thehackernews.com/2024/02/critical-bootloader-vulnerability-in.html</guid><pubDate>Wed, 07 Feb 2024 19:03:00 +0530</pubDate><author>info@thehackernews.com (The Hacker News)</author><enclosure length="12216320" type="image/jpeg" url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjA4_JEtw-vnRjzTLLZ0j3s_yPZE2onBmIuhDx1tRNMTHOChuiGkHnkkSMMgyNnDDjtrBbkj0G3we65tSACB3xwLhymWIZWv3BWuwx9OykGLJkhnqJPmbLIu_c807H_4hGvIUyKFFaaJvOF81X8MaZSy18MxFj-bdCD3-ZIe3ndwum0eILItaPrJCQyxIDM/s1600/linux.jpg"/></item><item><title>New Webinar: 5 Steps to vCISO Success for MSPs and MSSPs</title><description><![CDATA[2024 will be the year of the vCISO. An incredible 45% of MSPs and MSSPs are&nbsp;planning to start offering&nbsp;vCISO services in 2024. As an MSP/MSSP providing vCISO services, you own the organization’s cybersecurity infrastructure and strategy. But you also need to position yourself as a reliable decision-maker, navigating professional responsibilities, business needs and leadership]]></description><link>https://thehackernews.com/2024/02/new-webinar-5-steps-to-vciso-success.html</link><guid isPermaLink="false">https://thehackernews.com/2024/02/new-webinar-5-steps-to-vciso-success.html</guid><pubDate>Wed, 07 Feb 2024 16:08:00 +0530</pubDate><author>info@thehackernews.com (The Hacker News)</author><enclosure length="12216320" type="image/jpeg" url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhiRQtPj5m3gcGOA64LxPN8UssmlU5hBuiUHEHXimDD5my40XAgN1fNYU5s1LxM5Fhhu0EWe_OCit3RT76-bbRp1l0hPjWCMt7L5zMvgLI1kwCm16Fj8zgA-Qxs_h0HeBhRWnTQCZLZ9GbjrV5od-HRTdvd44e9wW8RQnhunwl6AJw82nmuaxrp0toL2YM/s1600/vciso.jpg"/></item><item><title>Global Coalition and Tech Giants Unite Against Commercial Spyware Abuse</title><description><![CDATA[A coalition of dozens of countries, including France, the U.K., and the U.S., along with tech companies such as Google, MDSec, Meta, and Microsoft, have signed a joint agreement to curb the abuse of commercial spyware to commit human rights abuses.
The initiative, dubbed the&nbsp;Pall Mall Process, aims to tackle the proliferation and irresponsible use of commercial cyber intrusion tools by]]></description><link>https://thehackernews.com/2024/02/global-coalition-and-tech-giants-unite.html</link><guid isPermaLink="false">https://thehackernews.com/2024/02/global-coalition-and-tech-giants-unite.html</guid><pubDate>Wed, 07 Feb 2024 15:15:00 +0530</pubDate><author>info@thehackernews.com (The Hacker News)</author><enclosure length="12216320" type="image/jpeg" url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhfBuU-9-yh7kKy_yPLzsUSX0JRlPPLIw0C5I0egmfv2dU64CqzzMx6hP7r-cimJ9UXrnQpB_sk53O7Of5JFSG4DbUjxVwaO9221IbNWxsJOenvlin_31CvvU_P5qcoWUMRqrpCJjJDx5ytZmCxj5Iptmuom7_yHAQODGLCnsCwyV8m7s1J9cqVrJUEUj9P/s1600/spyware.jpg"/></item><item><title>Chinese Hackers Exploited FortiGate Flaw to Breach Dutch Military Network</title><description><![CDATA[Chinese state-backed hackers broke into a computer network that's used by the Dutch armed forces by targeting Fortinet FortiGate devices.
"This [computer network] was used for unclassified research and development (R&amp;D)," the Dutch Military Intelligence and Security Service (MIVD)&nbsp;said&nbsp;in a statement. "Because this system was self-contained, it did not lead to any damage to the]]></description><link>https://thehackernews.com/2024/02/chinese-hackers-exploited-fortigate.html</link><guid isPermaLink="false">https://thehackernews.com/2024/02/chinese-hackers-exploited-fortigate.html</guid><pubDate>Wed, 07 Feb 2024 11:59:00 +0530</pubDate><author>info@thehackernews.com (The Hacker News)</author><enclosure length="12216320" type="image/jpeg" url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi4y15sfKep4P_b9FpOWRGjmh8hiVnHZwLD-1BrGuaKL8v7_all-LKAKmhkBd5C01w-hH8k1FGYAW7uKWAndErAMDmhOvzAS0AbOyjsOAKf1WQ2GGTkgFKT3NcHXdHC32KFwQ5gMPB2VhScW_5fe0bXlzpBp1Z0dln4Ooa5tARoaM5zgy0CUYVCcj2Lt3nl/s1600/cyber.jpg"/></item><item><title>Critical JetBrains TeamCity On-Premises Flaw Exposes Servers to Takeover - Patch Now</title><description><![CDATA[JetBrains is alerting customers of a critical security flaw in its TeamCity On-Premises continuous integration and continuous deployment (CI/CD) software that could be exploited by threat actors to take over susceptible instances.
The vulnerability, tracked as&nbsp;CVE-2024-23917, carries a CVSS rating of 9.8 out of 10, indicative of its severity.
"The vulnerability may enable an unauthenticated]]></description><link>https://thehackernews.com/2024/02/critical-jetbrains-teamcity-on-premises.html</link><guid isPermaLink="false">https://thehackernews.com/2024/02/critical-jetbrains-teamcity-on-premises.html</guid><pubDate>Wed, 07 Feb 2024 10:35:00 +0530</pubDate><author>info@thehackernews.com (The Hacker News)</author><enclosure length="12216320" type="image/jpeg" url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgDMQ-b_IQ97I0qLK5nOsypl7zgPUmjiTjEHUTmwNLC5thPi5i-b73LGhFSvPDzRAItnb2NN5mfEoiD2nmgiR3NQIfqa-ErY3yije6jSu0hxOXRnZXD0b-Gi8ulVNkBX30WekFgzp8mhQvfY37URxhRIGw8279Ic5YCARa5so_PPT2vgSjV8uCL9UcTLyku/s1600/tc.jpg"/></item><item><title>Beware: Fake Facebook Job Ads Spreading 'Ov3r_Stealer' to Steal Crypto and Credentials</title><description><![CDATA[Threat actors are leveraging bogus Facebook job advertisements as a lure to trick prospective targets into installing a new Windows-based stealer malware codenamed&nbsp;Ov3r_Stealer.
"This malware is designed to steal credentials and crypto wallets and send those to a Telegram channel that the threat actor monitors," Trustwave SpiderLabs said in a report shared with The Hacker News.
Ov3r_Stealer]]></description><link>https://thehackernews.com/2024/02/beware-fake-facebook-job-ads-spreading.html</link><guid isPermaLink="false">https://thehackernews.com/2024/02/beware-fake-facebook-job-ads-spreading.html</guid><pubDate>Tue, 06 Feb 2024 19:39:00 +0530</pubDate><author>info@thehackernews.com (The Hacker News)</author><enclosure length="12216320" type="image/jpeg" url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgadxLa3hdliqOEcy-MNpSHhAA8rr0xcYjsy7knyOvbuDhSn9mWWOnnM3eAnJ7b250Qt19sCP7upZ9Bjcz2Eb1YOEH6coGpNjXPJdBFzAmFJfjxWsv3gV5RmWT-Yr8H33n427f5Z1nbhMWD0_JA8vztwU19fdzy_KiDPJ9F_OPFMc1T0uWlKv8eVV6v_kdd/s1600/hacker.jpg"/></item><item><title>Experts Detail New Flaws in Azure HDInsight Spark, Kafka, and Hadoop Services</title><description><![CDATA[Three new security vulnerabilities have been discovered in Azure HDInsight's Apache&nbsp;Hadoop,&nbsp;Kafka, and&nbsp;Spark&nbsp;services that could be exploited to achieve privilege escalation and a regular expression denial-of-service (ReDoS) condition.
"The new vulnerabilities affect any authenticated user of Azure HDInsight services such as Apache Ambari and Apache Oozie," Orca security]]></description><link>https://thehackernews.com/2024/02/high-severity-flaws-found-in-azure.html</link><guid isPermaLink="false">https://thehackernews.com/2024/02/high-severity-flaws-found-in-azure.html</guid><pubDate>Tue, 06 Feb 2024 19:32:00 +0530</pubDate><author>info@thehackernews.com (The Hacker News)</author><enclosure length="12216320" type="image/jpeg" url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg7UpJj4RRDmHSfQzbGIpYCWuZ6FRnJvwUL3G9A6zcxOdMDJdpsg4oVnky4N43rRuB2syS7LAFlS3UYVBfwIouy5BHNLj0UtL-3nQXVRW-4PvsBGqCbqBqvHMIotadY_7X5AgAKfWDk8vhpvYi6-QBoIxVDI7wb4gs7D5HdLE1aSRlxD27_vSZlVKwrt1Ub/s1600/cloud.jpg"/></item><item><title>How a $10B Enterprise Customer Drastically Increased their SaaS Security Posture with 201% ROI by Using SSPM</title><description><![CDATA[SaaS applications are the darlings of the software world. They enable work from anywhere, facilitate collaboration, and offer a cost-effective alternative to owning the software outright. At the same time, the very features that make SaaS apps so embraced – access from anywhere and collaboration – can also be exploited by threat actors.
Recently, Adaptive Shield commissioned a Total Economic]]></description><link>https://thehackernews.com/2024/02/how-10b-enterprise-customer-drastically.html</link><guid isPermaLink="false">https://thehackernews.com/2024/02/how-10b-enterprise-customer-drastically.html</guid><pubDate>Tue, 06 Feb 2024 16:23:00 +0530</pubDate><author>info@thehackernews.com (The Hacker News)</author><enclosure length="12216320" type="image/jpeg" url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi6tLCrT1SgJZwkMIUpyJEu5k5YNNVuq4KNitz12Ngg0xPQ1hWW0Nvt4JLWghjCqz0wybYUmyYJSvWR3HWDnBgRQpvi6KtpDCcgjJB17ht1Pt8uO5-5Olqk33iHdURz0-22vY4Hgq4Dn5c8Tb8sE0efLtNN79sFGlfuQXtoG2CDJJwsYoH-hwZqFCD80Rk/s1600/as.jpg"/></item><item><title>Hackers Exploit Job Boards, Stealing Millions of Resumes and Personal Data</title><description><![CDATA[Employment agencies and retail companies chiefly located in the Asia-Pacific (APAC) region have been targeted by a previously undocumented threat actor known as&nbsp;ResumeLooters&nbsp;since early 2023 with the goal of stealing sensitive data.
Singapore-headquartered Group-IB said the hacking crew's activities are geared towards job search platforms and the theft of resumes, with as many as 65]]></description><link>https://thehackernews.com/2024/02/hackers-exploit-job-boards-in-apac.html</link><guid isPermaLink="false">https://thehackernews.com/2024/02/hackers-exploit-job-boards-in-apac.html</guid><pubDate>Tue, 06 Feb 2024 15:44:00 +0530</pubDate><author>info@thehackernews.com (The Hacker News)</author><enclosure length="12216320" type="image/jpeg" url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi8KvfL2k4ylNL_dMnNHOPfB5ZUwTUVtuLUSIrWRaRiLboah9STBvKVwKYhc6XKuQLXyK1krVr-kuXVNjEYCLQk2kILqshUvwZMBeYizNVhKmD7kY9Ana4ZPi3ZlXWvDj_FHSMbmpPc7M686Ju06duWIfG5Cp_GZK07TMb3hWxsgX_mQ1iT8zuccj1Y1EaY/s1600/hacking.jpg"/></item><item><title>Recent SSRF Flaw in Ivanti VPN Products Undergoes Mass Exploitation</title><description><![CDATA[A recently disclosed server-side request forgery (SSRF) vulnerability impacting Ivanti Connect Secure and Policy Secure products has come under mass exploitation.
The Shadowserver Foundation&nbsp;said&nbsp;it observed exploitation attempts originating from more than 170 unique IP addresses that aim to establish a reverse shell, among others.
The attacks exploit&nbsp;CVE-2024-21893&nbsp;(CVSS]]></description><link>https://thehackernews.com/2024/02/recently-disclosed-ssrf-flaw-in-ivanti.html</link><guid isPermaLink="false">https://thehackernews.com/2024/02/recently-disclosed-ssrf-flaw-in-ivanti.html</guid><pubDate>Tue, 06 Feb 2024 12:28:00 +0530</pubDate><author>info@thehackernews.com (The Hacker News)</author><enclosure length="12216320" type="image/jpeg" url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgraNohdN4U1PcWdmQxmLb8RwVWHndGdf7wvL0CbP0NdPXeN1oLuq-MHmHzkliX2zHzHofzBbno3NHBJWVe2zbvvwZI4FGGTZ5UWaCLNfvVV9CltXs5OHyxbvoDUVQKEDqWjLk6cl24zJTFqhY-JWE4DeapkEK_iA8Tii-xSUWwy1tzYwetOqGR67SE55LT/s1600/lock.jpg"/></item><item><title>U.S. Imposes Visa Restrictions on those Involved in Illegal Spyware Surveillance</title><description><![CDATA[The U.S. State Department said it's implementing a new policy that imposes visa restrictions on individuals who are linked to the illegal use of commercial spyware to surveil civil society members.
"The&nbsp;misuse of commercial spyware&nbsp;threatens privacy and freedoms of expression, peaceful assembly, and association," Secretary of State Antony Blinken&nbsp;said. "Such targeting has been]]></description><link>https://thehackernews.com/2024/02/us-imposes-visa-restrictions-on-those.html</link><guid isPermaLink="false">https://thehackernews.com/2024/02/us-imposes-visa-restrictions-on-those.html</guid><pubDate>Tue, 06 Feb 2024 10:30:00 +0530</pubDate><author>info@thehackernews.com (The Hacker News)</author><enclosure length="12216320" type="image/jpeg" url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhCKjD8ZzJMCNKcRW3Hgr_i0ck7GejIKH0B8l4eFtiyT3HmVPeoxjJD2XAfIrTsUiS9NhUfS6wCjcexQEqloalCDMHrr8N4-aNctrQ_Q3dGwWJw8KjEc_u2PZIpqdHh4D5_cWxznlPO9qXxGkKuWvJ4pZDH6-Bc7efsiWOrxd2owZ-Ue_jsKzPOOK19FTsX/s1600/spyware.jpg"/></item><item><title>Belarusian National Linked to BTC-e Faces 25 Years for $4 Billion Crypto Money Laundering</title><description><![CDATA[A 42-year-old Belarusian and Cypriot national with alleged connections to the now-defunct cryptocurrency exchange BTC-e is facing charges related to money laundering and operating an unlicensed money services business.
Aliaksandr Klimenka, who was arrested in Latvia on December 21, 2023, was extradited to the U.S. and is currently being held in custody. If convicted, he faces a maximum penalty]]></description><link>https://thehackernews.com/2024/02/belarusian-national-linked-to-btc-e.html</link><guid isPermaLink="false">https://thehackernews.com/2024/02/belarusian-national-linked-to-btc-e.html</guid><pubDate>Mon, 05 Feb 2024 22:06:00 +0530</pubDate><author>info@thehackernews.com (The Hacker News)</author><enclosure length="12216320" type="image/jpeg" url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgGqtPf3YwZtQVkArELl9eMI8LpNchmvH8kGo-gwqO25xKW9fgqNdYVV3TqDAqOtlBp07ibySFvkyhs6qjJdvi0Xo12jwGMXlIIwATdMc2KWzg4N9Qlwk5na750CiXH-tE7i1O2wlK1z5uhCORlZT6RXB0LPTeit6nRO8QtDVEnL3blcjmnUN4g1RspcdPF/s1600/btc-e.jpg"/></item><item><title>Combined Security Practices Changing the Game for Risk Management</title><description><![CDATA[A significant challenge within cyber security at present is that there are a lot of risk management platforms available in the market, but only some deal with cyber risks in a very good way. The majority will shout alerts at the customer as and when they become apparent and cause great stress in the process. The issue being that by using a reactive, rather than proactive approach, many risks]]></description><link>https://thehackernews.com/2024/02/combined-security-practices-changing.html</link><guid isPermaLink="false">https://thehackernews.com/2024/02/combined-security-practices-changing.html</guid><pubDate>Mon, 05 Feb 2024 18:49:00 +0530</pubDate><author>info@thehackernews.com (The Hacker News)</author><enclosure length="12216320" type="image/jpeg" url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgoYdBULuJ7a52D4Jz5jvKjTOvqK2p3omwyhyphenhyphenqrms8if6-VtgCB1mNqR6GYjuMkSV44Kz-5hCmF1gk2-p0eqLnwDuLzTYaSaQhrFtzfSY6pIHrD7lXbq0T0eRhu742MP0mCvUNSyPlvZdz0yA_0Aa0NDW9nXRFAAbsChII2Yqckz__YjgVD9wgrQF3Oesk/s1600/shq.jpg"/></item><item><title>Patchwork Using Romance Scam Lures to Infect Android Devices with VajraSpy Malware</title><description><![CDATA[The threat actor known as Patchwork likely used romance scam lures to trap victims in Pakistan and India, and infect their Android devices with a remote access trojan called&nbsp;VajraSpy.
Slovak cybersecurity firm ESET said it uncovered 12 espionage apps, six of which were available for download from the official Google Play Store and were collectively downloaded more than 1,400 times between]]></description><link>https://thehackernews.com/2024/02/patchwork-using-romance-scam-lures-to.html</link><guid isPermaLink="false">https://thehackernews.com/2024/02/patchwork-using-romance-scam-lures-to.html</guid><pubDate>Mon, 05 Feb 2024 18:48:00 +0530</pubDate><author>info@thehackernews.com (The Hacker News)</author><enclosure length="12216320" type="image/jpeg" url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjtio1q-CLJas94ATMozGjvVW6-Y9RrvUZxF0d-qv1vB87eCUuz0HfhcyZHRlHPw7PGaSHO-U5Vrzv-Yq9jjAvTZKh6xqOWWfWRpAVFtNp9PTF8AuCM_22fMVos5Peb3c4uhkLnO8JWCb6hGmw8whGhv0UREA0k3dHkGO_MxCvJGMMJ0xqb_mi-PCn5ym3v/s1600/app.jpg"/></item><item><title>Hands-On Review: SASE-based XDR from Cato Networks</title><description><![CDATA[Companies are engaged in a seemingly endless cat-and-mouse game when it comes to cybersecurity and cyber threats. As organizations put up one defensive block after another, malicious actors kick their game up a notch to get around those blocks. Part of the challenge is to coordinate the defensive abilities of disparate security tools, even as organizations have limited resources and a dearth of]]></description><link>https://thehackernews.com/2024/02/hands-on-review-sase-based-xdr-from.html</link><guid isPermaLink="false">https://thehackernews.com/2024/02/hands-on-review-sase-based-xdr-from.html</guid><pubDate>Mon, 05 Feb 2024 16:42:00 +0530</pubDate><author>info@thehackernews.com (The Hacker News)</author><enclosure length="12216320" type="image/jpeg" url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg_t434xOc076hRhbvGCvAM8ncS3FhQFect76bc8dd5mNxn6mgnT4Gl-yTtWfCRJ25avAPyKxLIWCZsL4nPVDRp_jnfNV8eNBVpRxEbOY53skD2dpp5-7pjgJ4ABCKU60t0aNq781bhIcDfRD2i2qfbd2lQEcBj_ZRrKKNJsaZ3GZXDjkgn8_UXMgZaiVI/s1600/xdr.jpg"/></item><item><title>Pegasus Spyware Targeted iPhones of Journalists and Activists in Jordan</title><description><![CDATA[The iPhones belonging to nearly three dozen journalists, activists, human rights lawyers, and civil society members in Jordan have been targeted with NSO Group's Pegasus spyware, according to joint findings from Access Now and the Citizen Lab.
Nine of the 35 individuals have been&nbsp;publicly confirmed&nbsp;as&nbsp;targeted, out of whom six had their devices compromised with the mercenary]]></description><link>https://thehackernews.com/2024/02/pegasus-spyware-targeted-iphones-of.html</link><guid isPermaLink="false">https://thehackernews.com/2024/02/pegasus-spyware-targeted-iphones-of.html</guid><pubDate>Mon, 05 Feb 2024 13:07:00 +0530</pubDate><author>info@thehackernews.com (The Hacker News)</author><enclosure length="12216320" type="image/jpeg" url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgVQbUkPVd24ktiaDDrIwwVOgcfzzxWLkumQnJIL5OxgFaEQRGi8qmsot4n3ymqrbmjp32fvqFBmRxBsUC-Dzzy0VpKE5alIinBFQhhotAzwzV7leNdu_J2OfOiA2tv44CIXiwVP_tY7u1RcJBPhGLQx6rdM9N8-ZljdY-TAPzsPouCX9so6VHRek7g2ZYy/s1600/spyware.jpg"/></item><item><title>New Mispadu Banking Trojan Exploiting Windows SmartScreen Flaw</title><description><![CDATA[The threat actors behind the Mispadu banking Trojan have become the latest to exploit a now-patched Windows SmartScreen security bypass flaw to compromise users in Mexico.
The attacks entail a new variant of the malware that was first observed in 2019, Palo Alto Networks Unit 42 said in a report published last week.
Propagated via phishing mails, Mispadu is a Delphi-based information stealer]]></description><link>https://thehackernews.com/2024/02/new-mispadu-banking-trojan-exploiting.html</link><guid isPermaLink="false">https://thehackernews.com/2024/02/new-mispadu-banking-trojan-exploiting.html</guid><pubDate>Mon, 05 Feb 2024 09:15:00 +0530</pubDate><author>info@thehackernews.com (The Hacker News)</author><enclosure length="12216320" type="image/jpeg" url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhXSXjMhAgy508SEuJJTyP5xBulZxtzjUwcIbPctHBge1EbXQZqaQDSbqFGnmJaP0qio5HMFMxrarOAu2p7OjcMc39LV7xNGUSB1P5aTA6eYOPfaxsl8_AQNqQ5-0NHE2e7lq7gs0m21NvXH5CSceR1jY98qeXI94ukURZxiVnvOXg6d5SGr44dX2seo6f8/s1600/banking.jpg"/></item><item><title>U.S. Sanctions 6 Iranian Officials for Critical Infrastructure Cyber Attacks</title><description><![CDATA[The U.S. Treasury Department's Office of Foreign Assets Control (OFAC) announced sanctions against six officials associated with the Iranian intelligence agency for attacking critical infrastructure entities in the U.S. and other countries.
The&nbsp;officials&nbsp;include Hamid Reza Lashgarian, Mahdi Lashgarian, Hamid Homayunfal, Milad Mansuri, Mohammad Bagher Shirinkar, and Reza Mohammad Amin]]></description><link>https://thehackernews.com/2024/02/us-sanctions-6-iranian-officials-for.html</link><guid isPermaLink="false">https://thehackernews.com/2024/02/us-sanctions-6-iranian-officials-for.html</guid><pubDate>Sat, 03 Feb 2024 13:03:00 +0530</pubDate><author>info@thehackernews.com (The Hacker News)</author><enclosure length="12216320" type="image/jpeg" url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh6oLVWbaiMc4E45pKEGpXyNtyjE9ykR4s794BaRjYrUqvtZEDDbiYTNNZWHWvG39RJcbzkLov8-BsNnCMjrzyatdTJyqZWcH0h-WNaIoALweoO8Pbg0xrOBBtlbCtQQWiCyEe5w1qdwN0R-994Pwvymd1L556tniJB33uDKca3vKjgMvYVZSFunBFiqA7d/s1600/cyberattack.jpg"/></item><item><title>Mastodon Vulnerability Allows Hackers to Hijack Any Decentralized Account</title><description><![CDATA[The decentralized social network Mastodon has disclosed a critical security flaw that enables malicious actors to impersonate and take over any account.
"Due to insufficient origin validation in all Mastodon, attackers can impersonate and take over any remote account," the maintainers said in a terse advisory.
The vulnerability, tracked as&nbsp;CVE-2024-23832, has a severity rating of 9.4 out of]]></description><link>https://thehackernews.com/2024/02/mastodon-vulnerability-allows-hackers.html</link><guid isPermaLink="false">https://thehackernews.com/2024/02/mastodon-vulnerability-allows-hackers.html</guid><pubDate>Sat, 03 Feb 2024 12:21:00 +0530</pubDate><author>info@thehackernews.com (The Hacker News)</author><enclosure length="12216320" type="image/jpeg" url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg28r9uXfwuvVprDCNFUhSS42d1e0quf3e3gmcsQyVwXu8G1hmZHE7185AKkIufK4r_2KeG3EDKEJjggkMkc2mRTflbKVEAvYUjSchMTs9eQFB38wpcFS6SqcaL1b_q1BD-CWodTFhpnxiFnFlkTIlKG-QCI99Yyd9T3wvENckuQgYF6GsCL0Xb1ipBs_9C/s1600/social.jpg"/></item><item><title>AnyDesk Hacked: Popular Remote Desktop Software Mandates Password Reset</title><description><![CDATA[Remote desktop software maker AnyDesk disclosed on Friday that it suffered a cyber attack that led to a compromise of its production systems.
The German company said the incident, which it discovered following a security audit, is not a ransomware attack and that it has notified relevant authorities.
"We have revoked all security-related certificates and systems have been remediated or replaced]]></description><link>https://thehackernews.com/2024/02/anydesk-hacked-popular-remote-desktop.html</link><guid isPermaLink="false">https://thehackernews.com/2024/02/anydesk-hacked-popular-remote-desktop.html</guid><pubDate>Sat, 03 Feb 2024 08:25:00 +0530</pubDate><author>info@thehackernews.com (The Hacker News)</author><enclosure length="12216320" type="image/jpeg" url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhSP_cC8pTNgXXmy-qgjs-DLkhxgJ7PwkU9SJOWosxi-Cl7nlWCnnKST2fIGZTL1mPm3EXVC-ERu6xCrOTKgVe9S2mhxxjQkX4_zPFZBmh8aTAZt8iZ1IegsJ9kRl7yOEelVkYciFS_unyRONoypr7c_SwnxXtIdZG6v0J3VykPysfDSlI5rISG0_WfLQKO/s1600/anydesk.jpg"/></item><item><title>Russian APT28 Hackers Targeting High-Value Orgs with NTLM Relay Attacks</title><description><![CDATA[Russian state-sponsored actors have staged NT LAN Manager (NTLM) v2 hash relay attacks through various methods from April 2022 to November 2023, targeting high-value targets worldwide.
The attacks, attributed to an "aggressive" hacking crew called&nbsp;APT28, have set their eyes on organizations dealing with foreign affairs, energy, defense, and transportation, as well as those involved with]]></description><link>https://thehackernews.com/2024/02/russian-apt28-hackers-targeting-high.html</link><guid isPermaLink="false">https://thehackernews.com/2024/02/russian-apt28-hackers-targeting-high.html</guid><pubDate>Fri, 02 Feb 2024 20:19:00 +0530</pubDate><author>info@thehackernews.com (The Hacker News)</author><enclosure length="12216320" type="image/jpeg" url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhxA0Md3JY1x-UqA2Ne5Q-ZXcKu4EaQQ-ebhU7N8jmHz7SDZkpCb9GQs_cpcXf-oFXH3g5xoPHWlbFlYehSeByU-OyLkVVP9UGuTHmb8G6ltZDVKOFoHmfhhIvK5E9HqVSftVuPlc6ILjXVU_L6_bEfdKjbI1IJtyCkB4qXVIWfDTY9b2XQsRertitbi3hm/s1600/russian-hacker.jpg"/></item><item><title>DirtyMoe Malware Infects 2,000+ Ukrainian Computers for DDoS and Cryptojacking</title><description><![CDATA[The Computer Emergency Response Team of Ukraine (CERT-UA) has warned that more than 2,000 computers in the country have been infected by a strain of malware called DirtyMoe.
The agency&nbsp;attributed&nbsp;the campaign to a threat actor it calls&nbsp;UAC-0027.
DirtyMoe, active since at least 2016, is capable of carrying out cryptojacking and distributed denial-of-service (DDoS) attacks. In March]]></description><link>https://thehackernews.com/2024/02/dirtymoe-malware-infects-2000-ukrainian.html</link><guid isPermaLink="false">https://thehackernews.com/2024/02/dirtymoe-malware-infects-2000-ukrainian.html</guid><pubDate>Fri, 02 Feb 2024 18:47:00 +0530</pubDate><author>info@thehackernews.com (The Hacker News)</author><enclosure length="12216320" type="image/jpeg" url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg-19sEoZNiyWA3M0I-Rq4SmOKi6Y01UkceC8fN-fodP5XSqAJQ1y07ihd1Re0bA8MJ4xTG3jKkk1NxcYCd7gyWKgOlF6pVFyVwgfP9-C2OFyAiesQy_1qpbvTCR4RB775ciI_HbRzC15GVTOeGQkfzQb6r5sGEzapfei7SwG6x6YTiE95WKCO76Y5rXIaf/s1600/ua.jpg"/></item><item><title>Former CIA Engineer Sentenced to 40 Years for Leaking Classified Documents</title><description><![CDATA[A former software engineer with the U.S. Central Intelligence Agency (CIA) has been sentenced to 40 years in prison by the Southern District of New York (SDNY) for transmitting classified documents to WikiLeaks and for possessing child pornographic material.
Joshua Adam Schulte, 35, was originally charged in June 2018. He was&nbsp;found guilty&nbsp;in July 2022. On September 13, 2023, he was&]]></description><link>https://thehackernews.com/2024/02/former-cia-engineer-sentenced-to-40.html</link><guid isPermaLink="false">https://thehackernews.com/2024/02/former-cia-engineer-sentenced-to-40.html</guid><pubDate>Fri, 02 Feb 2024 16:10:00 +0530</pubDate><author>info@thehackernews.com (The Hacker News)</author><enclosure length="12216320" type="image/jpeg" url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjOwxGYvge0fDTfFHdY1V6LmuNEqoAF1KNJjDSY4oWYfk36S3qeZHbZXJfJoccrHhItwj7n8L7KsRQe0qw-wD-0oM_KuPdom5i7GegbDK82sCbs_fLjtSEHrLWTYPYdqtGeDD1o34gBhC_6m1o0jDGkCr1se10Z0hyphenhyphenrfI5gjk1svwVYqm0E_GUm41wXxPzr/s1600/cia.jpg"/></item><item><title>Cloudzy Elevates Cybersecurity: Integrating Insights from Recorded Future to Revolutionize Cloud Security</title><description><![CDATA[Cloudzy, a prominent cloud infrastructure provider, proudly announces a significant enhancement in its cybersecurity landscape. This breakthrough has been achieved through a recent consultation with Recorded Future, a leader in providing real-time threat intelligence and cybersecurity analytics. This initiative, coupled with an overhaul of Cloudzy's cybersecurity strategies, represents a major]]></description><link>https://thehackernews.com/2024/02/cloudzy-elevates-cybersecurity.html</link><guid isPermaLink="false">https://thehackernews.com/2024/02/cloudzy-elevates-cybersecurity.html</guid><pubDate>Fri, 02 Feb 2024 16:00:00 +0530</pubDate><author>info@thehackernews.com (The Hacker News)</author><enclosure length="12216320" type="image/jpeg" url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjYsdETOzl2Y8WkYJB5_kVl6IAsdEoTZ2zGHDOGVJ0L281MU-Pbv9BxH1zPbYU6ZcMLP8K54G1klylWxZ2i1r18jBXPBTX6nT0nBiBrjPDpoUA9-gLVIxaCRACvApqxB6pa7NBt1WzNFmGKHQaQEpSfzK3UCeGcLUo8IJ0n8RKFx00weFAZ6oIXW58uj1M/s1600/rf.jpg"/></item><item><title>INTERPOL Arrests 31 in Global Operation, Identifies 1,900+ Ransomware-Linked IPs</title><description><![CDATA[An INTERPOL-led collaborative operation targeting phishing, banking malware, and ransomware attacks has led to the identification of 1,300 suspicious IP addresses and URLs.
The&nbsp;law enforcement effort, codenamed&nbsp;Synergia, took place between September and November 2023 in an attempt to blunt the "growth, escalation and professionalization of transnational cybercrime."
Involving 60 law]]></description><link>https://thehackernews.com/2024/02/interpol-arrests-31-in-global-operation.html</link><guid isPermaLink="false">https://thehackernews.com/2024/02/interpol-arrests-31-in-global-operation.html</guid><pubDate>Fri, 02 Feb 2024 15:53:00 +0530</pubDate><author>info@thehackernews.com (The Hacker News)</author><enclosure length="12216320" type="image/jpeg" url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgMPIHwY0MA8BLaJhkijkiQiF4PpLrCL5nSoosgN09E77t8Qmh7a_FJ5Rcx1cvXRJOOrFPI1iNUncIIzb3xbNqX2-uTLc0OHyWY_XQ7cjusUh6Yc7tGHmtXHiPE2lgI1nZwrlysz2nIG-v69Xbamtv3WbwmYJmuPlLWHb_DKkpsuv1s8vskjkRRLXOh3zpj/s1600/cybercrime.jpg"/></item><item><title>Cloudflare Breach: Nation-State Hackers Access Source Code and Internal Docs</title><description><![CDATA[Cloudflare has revealed that it was the target of a likely nation-state attack in which the threat actor leveraged stolen credentials to gain unauthorized access to its Atlassian server and ultimately access some documentation and a limited amount of source code.
The intrusion, which took place between November 14 and 24, 2023, and detected on November 23, was carried out "with the goal of]]></description><link>https://thehackernews.com/2024/02/cloudflare-breach-nation-state-hackers.html</link><guid isPermaLink="false">https://thehackernews.com/2024/02/cloudflare-breach-nation-state-hackers.html</guid><pubDate>Fri, 02 Feb 2024 11:51:00 +0530</pubDate><author>info@thehackernews.com (The Hacker News)</author><enclosure length="12216320" type="image/jpeg" url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhqy5-MRRGyoCTA2O0QQiy0RvBbfjBfb0TVNvwZ8sVIfPIVrxSOeCcLsSM_NBkPZfM330CiN_kBdyFiVb-0t6GdhMPJ5M7cKxnbBtuWBEXnBzYsL4A5Awwk7vaxQ0fBjTXj96t4GrGxC6S_aje7KAEftuALuA-W708DVfaH8S2VTlqdHJfq21gu7Mupj5n4/s1600/cloudflare.jpg"/></item><item><title>FritzFrog Returns with Log4Shell and PwnKit, Spreading Malware Inside Your Network</title><description><![CDATA[The threat actor behind a peer-to-peer (P2P) botnet known as&nbsp;FritzFrog&nbsp;has made a return with a new variant that leverages the&nbsp;Log4Shell vulnerability&nbsp;to propagate internally within an already compromised network.
"The vulnerability is exploited in a brute-force manner that attempts to target as many vulnerable Java applications as possible," web infrastructure and security]]></description><link>https://thehackernews.com/2024/02/fritzfrog-returns-with-log4shell-and.html</link><guid isPermaLink="false">https://thehackernews.com/2024/02/fritzfrog-returns-with-log4shell-and.html</guid><pubDate>Thu, 01 Feb 2024 21:14:00 +0530</pubDate><author>info@thehackernews.com (The Hacker News)</author><enclosure length="12216320" type="image/jpeg" url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgJPr81DASLMYFC5az8KlOL0TnT171kAV2s_Cfve7t5W3bb9FzzB9MDTru7ykbpM3uelGLtlCKkkhdR1oNiYpNRK-g-YpN7OLKZ_z5bOijTHda9do0YT7U80AOhC3bbqgCT_yFmi88-qIE4_LulCP0m7x2aW4OWl0LTipYEkbsupnKSjA8cLcIiQjZNbrvI/s1600/botnet.jpg"/></item><item><title>Exposed Docker APIs Under Attack in 'Commando Cat' Cryptojacking Campaign</title><description><![CDATA[Exposed Docker API endpoints over the internet are under assault from a sophisticated cryptojacking campaign called&nbsp;Commando Cat.
"The campaign deploys a benign container generated using the&nbsp;Commando project," Cado security researchers Nate Bill and Matt Muir&nbsp;said&nbsp;in a new report published today. "The attacker&nbsp;escapes this container&nbsp;and runs multiple payloads on the]]></description><link>https://thehackernews.com/2024/02/exposed-docker-apis-under-attack-in.html</link><guid isPermaLink="false">https://thehackernews.com/2024/02/exposed-docker-apis-under-attack-in.html</guid><pubDate>Thu, 01 Feb 2024 19:06:00 +0530</pubDate><author>info@thehackernews.com (The Hacker News)</author><enclosure length="12216320" type="image/jpeg" url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhAMeDU9hu9OLJy1xCAoiOEJWkJT4Oq7i2_xbPc_l3HEsi5n9WdOuKY6Z-JctqXTkM9XcE7m_UH6zUQpYS2jnBbzpfbxmQPbcZOwzsDWrgU-vgZOLpRiHZFnqeCeTw96YHFIaqWxqTROO7fTFCRDVT_AB1lGAbCOEyfftYCsg3H6YTXcF7Q8VFfB12PCLuV/s1600/cat.jpg"/></item><item><title>Why the Right Metrics Matter When it Comes to Vulnerability Management</title><description><![CDATA[How’s your vulnerability management program doing? Is it effective? A success? Let’s be honest, without the right metrics or analytics, how can you tell how well you’re doing, progressing, or if you’re getting ROI? If you’re not measuring, how do you know it’s working? 
And even if you are measuring, faulty reporting or focusing on the wrong metrics can create blind spots and make it harder to]]></description><link>https://thehackernews.com/2024/02/why-right-metrics-matter-when-it-comes.html</link><guid isPermaLink="false">https://thehackernews.com/2024/02/why-right-metrics-matter-when-it-comes.html</guid><pubDate>Thu, 01 Feb 2024 17:10:00 +0530</pubDate><author>info@thehackernews.com (The Hacker News)</author><enclosure length="12216320" type="image/jpeg" url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi_G8rgBO3mGT_7FFrQf0IW9bO6XOmFWJ5ZRm-0hdrNXx-KnKhkJzqOPVqxfwrnoxqiub0n1unTbgB2HLyYbdPV7wtivdouBW06nxcOwDHYPAESl5iB97KrlVagI4FyjWKbMVpE0vdbpQ8Wi0Q7lnt1PPRTMphsoy939c4Zw9mjoyHWu3vUYDa-9e-DJNM/s1600/Intruder-Reporting.jpg"/></item><item><title>U.S. Feds Shut Down China-Linked "KV-Botnet" Targeting SOHO Routers</title><description><![CDATA[The U.S. government on Wednesday said it took steps to neutralize a botnet comprising hundreds of U.S.-based small office and home office (SOHO) routers hijacked by a China-linked state-sponsored threat actor called Volt Typhoon and blunt the impact posed by the hacking campaign.
The existence of the botnet, dubbed&nbsp;KV-botnet, was&nbsp;first disclosed&nbsp;by the Black Lotus Labs team at]]></description><link>https://thehackernews.com/2024/02/us-feds-shut-down-china-linked-kv.html</link><guid isPermaLink="false">https://thehackernews.com/2024/02/us-feds-shut-down-china-linked-kv.html</guid><pubDate>Thu, 01 Feb 2024 17:07:00 +0530</pubDate><author>info@thehackernews.com (The Hacker News)</author><enclosure length="12216320" type="image/jpeg" url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgLJIYnx7rPlbaWvV4TUVsQC1dzIgNPS2Te0mUaNqsJrhbmqnS6xXp2nT_xH36GDIO4vTT2L9Ty3bgRIcPU1MVqYkBaJXZ2y7GclqFrKXq-fqtvIAjyv8eMWrJtawKv4O8Ab1L-JkddZ1YTnZq-0OoX50MOF7MuUGqSDXpob4KL4A84ok7WtApnVPfARl5o/s1600/botnet.jpg"/></item><item><title>HeadCrab 2.0 Goes Fileless, Targeting Redis Servers for Crypto Mining</title><description><![CDATA[Cybersecurity researchers have detailed an updated version of the malware&nbsp;HeadCrab&nbsp;that's known to target Redis database servers across the world since early September 2021.
The development, which comes exactly a year after the malware was first&nbsp;publicly disclosed&nbsp;by Aqua, is a sign that the financially-motivated threat actor behind the campaign is actively adapting and]]></description><link>https://thehackernews.com/2024/02/headcrab-20-goes-fileless-targeting.html</link><guid isPermaLink="false">https://thehackernews.com/2024/02/headcrab-20-goes-fileless-targeting.html</guid><pubDate>Thu, 01 Feb 2024 16:52:00 +0530</pubDate><author>info@thehackernews.com (The Hacker News)</author><enclosure length="12216320" type="image/jpeg" url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhX9GbwqjDI5ZHX2j9lm2Xr5CgUyVZko1iMoPIVROeVA1Hc2yktaoaqfiSvz8PaJDny0IbW0qbeAVx5A_7shsNZSDEi49FD3_-PaAnrKK4IReOLgG6xAug9YljAFwnj7w8e6mDMeR06BQLNicQflCQa9yoM93_uncynrbjU9Rt8h2PKUoxjfDhCxsAmt11y/s1600/redis.jpg"/></item><item><title>Warning: New Malware Emerges in Attacks Exploiting Ivanti VPN Vulnerabilities</title><description><![CDATA[Google-owned Mandiant said it identified new malware employed by a China-nexus espionage threat actor known as UNC5221 and other threat groups during post-exploitation activity targeting Ivanti Connect Secure VPN and Policy Secure devices.
This includes custom web shells such as BUSHWALK, CHAINLINE, FRAMESTING, and a variant of&nbsp;LIGHTWIRE.
"CHAINLINE is a Python web shell backdoor that is]]></description><link>https://thehackernews.com/2024/02/warning-new-malware-emerges-in-attacks.html</link><guid isPermaLink="false">https://thehackernews.com/2024/02/warning-new-malware-emerges-in-attacks.html</guid><pubDate>Thu, 01 Feb 2024 13:13:00 +0530</pubDate><author>info@thehackernews.com (The Hacker News)</author><enclosure length="12216320" type="image/jpeg" url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi3nrJbRs2yw5uK7rbvIOCEVk4D5JJlXr3nyA4nOVPGuibJqWzHnAG3zplhYpU896J5vbWkNkI_t_0x9zbRbaskQgAL05npMW8mpY7m5oWzjyKK966DSWjVsybc0ECoU4x9CfEqAlUHiHIXOmVW7zfk-_eT9w1sKEsISeBkqkVsLx7nhBPa-76w6Q6LJuGH/s1600/malware.jpg"/></item><item><title>CISA Warns of Active Exploitation Apple iOS and macOS Vulnerability</title><description><![CDATA[The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday&nbsp;added&nbsp;a high-severity flaw impacting iOS, iPadOS, macOS, tvOS, and watchOS to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation.
The vulnerability, tracked as&nbsp;CVE-2022-48618&nbsp;(CVSS score: 7.8), concerns a bug in the kernel component.
"An attacker with]]></description><link>https://thehackernews.com/2024/02/cisa-warns-of-active-exploitation-of.html</link><guid isPermaLink="false">https://thehackernews.com/2024/02/cisa-warns-of-active-exploitation-of.html</guid><pubDate>Thu, 01 Feb 2024 10:32:00 +0530</pubDate><author>info@thehackernews.com (The Hacker News)</author><enclosure length="12216320" type="image/jpeg" url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj7NNaZN87IDYB7MQZS40FteKIFQ6VCWdVn9gRhiReCEV1kY0PTR_RwO39i8k8K-6sk19rrq7HQp6qCRpnZStl8C3EP8gIFGQNX3WIT2vsGF5u7GocvQOPuYKevGoPjon3Gz1UW2LWnCeRz7l9H7Ge3hqRLaD3e8ZxxTOYNXtjVFO0aBCpb1UVCFTQL9cak/s1600/apple.jpg"/></item><item><title>RunC Flaws Enable Container Escapes, Granting Attackers Host Access</title><description><![CDATA[Multiple security vulnerabilities have been disclosed in the runC command line tool that could be exploited by threat actors to escape the bounds of the container and stage follow-on attacks.
The vulnerabilities, tracked as CVE-2024-21626, CVE-2024-23651, CVE-2024-23652, and CVE-2024-23653, have been collectively dubbed&nbsp;Leaky Vessels&nbsp;by cybersecurity vendor Snyk.
"These container]]></description><link>https://thehackernews.com/2024/02/runc-flaws-enable-container-escapes.html</link><guid isPermaLink="false">https://thehackernews.com/2024/02/runc-flaws-enable-container-escapes.html</guid><pubDate>Thu, 01 Feb 2024 01:30:00 +0530</pubDate><author>info@thehackernews.com (The Hacker News)</author><enclosure length="12216320" type="image/jpeg" url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjOhJyCjSdWpD8HPjQ3c8aq914mXWulPoKo4mgfJldIz3ZkPLUAPkAq2TyZmXkI-2V4SOIe1Sq8Nu9GaYSYYDZtPDH2LidITzVKNE3hN9FEqX2u-G-gBDzATlj9j7yjJC6CxwRG-URMO_8Ygu-L0YSlVhSDMTzBYi7g9uKBcRe1oXTLB0wi5g7ZF7TJlXNu/s1600/Linux.jpg"/></item><item><title>Alert: Ivanti Discloses 2 New Zero-Day Flaws, One Under Active Exploitation</title><description><![CDATA[Ivanti is alerting of two new high-severity flaws in its Connect Secure and Policy Secure products, one of which is said to have come under targeted exploitation in the wild.
The list of vulnerabilities is as follows -

CVE-2024-21888&nbsp;(CVSS score: 8.8) - A privilege escalation vulnerability in the web component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows]]></description><link>https://thehackernews.com/2024/01/alert-ivanti-discloses-2-new-zero-day.html</link><guid isPermaLink="false">https://thehackernews.com/2024/01/alert-ivanti-discloses-2-new-zero-day.html</guid><pubDate>Wed, 31 Jan 2024 19:08:00 +0530</pubDate><author>info@thehackernews.com (The Hacker News)</author><enclosure length="12216320" type="image/jpeg" url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiA5k61PTbkidOoduanUyYKdtvRQSXaU-1R7UsnykkP5zb61Xyy_XMH_1JSaOKoZ_raGCcLJ9NQq3EwUXQlHk63-E-qvzPBlWOvhlMnL362lRhs2mo065hL5kRzYXOltmToecrdqf4xrtqXzG9cogVzy_JEi1o-UluYFCbg_tg2t-YoJMqz3lGumXUc9c5g/s1600/ivanti.jpg"/></item><item><title>Telegram Marketplaces Fuel Phishing Attacks with Easy-to-Use Kits and Malware</title><description><![CDATA[Cybersecurity researchers are calling attention to the "democratization" of the phishing ecosystem owing to the emergence of Telegram as an epicenter for cybercrime, enabling threat actors to mount a mass attack for as little as $230.
"This messaging app has transformed into a bustling hub where seasoned cybercriminals and newcomers alike exchange illicit tools and insights creating a dark and]]></description><link>https://thehackernews.com/2024/01/telegram-marketplaces-fuel-phishing.html</link><guid isPermaLink="false">https://thehackernews.com/2024/01/telegram-marketplaces-fuel-phishing.html</guid><pubDate>Wed, 31 Jan 2024 17:51:00 +0530</pubDate><author>info@thehackernews.com (The Hacker News)</author><enclosure length="12216320" type="image/jpeg" url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiPbSKmEBJOUPyMcThgOQF-T4tvpDc0i5-2DKcgDhSKQi3cuC_sLfsYsFsTcP2y65GoTCYDzEzsPaJ7GPIxsoOdcojwjvoORis8auFe2MY9vCC9xKhQDOEBMZn4ojDLR-V8mXDIdF7OPJXQB-87g9OWV1CC0aZGLi1HVdjyHafFFGhn8X7gZXlOaBci4SwF/s1600/telegram.jpg"/></item><item><title>The SEC Won't Let CISOs Be: Understanding New SaaS Cybersecurity Rules</title><description><![CDATA[The SEC isn’t giving SaaS a free pass. Applicable public companies, known as “registrants,” are now subject to cyber incident disclosure and cybersecurity readiness requirements for data stored in SaaS systems, along with the 3rd and 4th party apps connected to them.&nbsp;
The new cybersecurity mandates&nbsp;make no distinction between data exposed in a breach that was stored on-premise, in the]]></description><link>https://thehackernews.com/2024/01/the-sec-wont-let-cisos-be-understanding.html</link><guid isPermaLink="false">https://thehackernews.com/2024/01/the-sec-wont-let-cisos-be-understanding.html</guid><pubDate>Wed, 31 Jan 2024 16:32:00 +0530</pubDate><author>info@thehackernews.com (The Hacker News)</author><enclosure length="12216320" type="image/jpeg" url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh8Hl-OCnCJaHUR5FUnuA21h-wkKQWZGHuOE1Zz4toCAO4zEmr_nI-ut26GJOkJxbCHxEiShGmFjwsrWENUuHZJxmsPRj93fDjJ4kcBo2tysLeWUMsJZClrF5NBvyOJXjL8nd48kSmRhzcRyf5q5ebUTlLo1OoECgqF98MESi3FsevN4TqVTXUlWbfu6YI/s1600/cyber.jpg"/></item><item><title>Italian Businesses Hit by Weaponized USBs Spreading Cryptojacking Malware</title><description><![CDATA[A financially motivated threat actor known as&nbsp;UNC4990&nbsp;is leveraging weaponized USB devices as an initial infection vector to target organizations in Italy.
Google-owned Mandiant said the attacks single out multiple industries, including health, transportation, construction, and logistics.
"UNC4990 operations generally involve widespread USB infection followed by the deployment of the]]></description><link>https://thehackernews.com/2024/01/italian-businesses-hit-by-weaponized.html</link><guid isPermaLink="false">https://thehackernews.com/2024/01/italian-businesses-hit-by-weaponized.html</guid><pubDate>Wed, 31 Jan 2024 16:30:00 +0530</pubDate><author>info@thehackernews.com (The Hacker News)</author><enclosure length="12216320" type="image/jpeg" url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhZD2BegIs2gbK2hWTT3DWSXCLBjiqnUldewf4q3IQxBHIZJFVMwa6jxFE3fKkgK54MF9WeeOgpOXb2B2gnpc0j6v-Shads1Xk0jQtv23gmxdaIhzlbC11srzZEwHRJEAx0uP1YW8KuVFihCLOrisC2bZVKXnWZ1J0hnxEgYWqxncfHP_h00DyXWlQ3auSy/s1600/usd.jpg"/></item><item><title>Hackers Exploiting Ivanti VPN Flaws to Deploy KrustyLoader Malware</title><description><![CDATA[A pair of recently disclosed zero-day flaws in Ivanti Connect Secure (ICS) virtual private network (VPN) devices have been exploited to deliver a Rust-based payload called&nbsp;KrustyLoader&nbsp;that's used to drop the open-source Sliver adversary simulation tool.
The&nbsp;security vulnerabilities, tracked as CVE-2023-46805 (CVSS score: 8.2) and CVE-2024-21887 (CVSS score: 9.1), could be abused]]></description><link>https://thehackernews.com/2024/01/chinese-hackers-exploiting-critical-vpn.html</link><guid isPermaLink="false">https://thehackernews.com/2024/01/chinese-hackers-exploiting-critical-vpn.html</guid><pubDate>Wed, 31 Jan 2024 12:53:00 +0530</pubDate><author>info@thehackernews.com (The Hacker News)</author><enclosure length="12216320" type="image/jpeg" url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiCp6bv4zkK7TBndxQro0WJo4EUmgBaOhWcS_o6wG4Z1DRTNTVzWQuIVngOhwkjq0931XKL27PS1cxuP4l2kJrgtXlaV14w9RdE3Ba0KjaY1fseR6UDS-hR4aXxZ8UNobo3t_MWxLOUdzzH4rJwIcV3PkSxjEUXvhuvYMT4qUDyMo1CBILjgNZphx1bKJbh/s1600/chinese-hackers.jpg"/></item><item><title>New Glibc Flaw Grants Attackers Root Access on Major Linux Distros</title><description><![CDATA[Malicious local attackers can obtain full root access on Linux machines by taking advantage of a newly disclosed security flaw in the GNU C library (aka glibc).
Tracked as CVE-2023-6246 (CVSS score: 7.8), the heap-based buffer overflow vulnerability is rooted in glibc's __vsyslog_internal() function, which is used by&nbsp;syslog() and vsyslog()&nbsp;for system logging purposes. It's said to have]]></description><link>https://thehackernews.com/2024/01/new-glibc-flaw-grants-attackers-root.html</link><guid isPermaLink="false">https://thehackernews.com/2024/01/new-glibc-flaw-grants-attackers-root.html</guid><pubDate>Wed, 31 Jan 2024 11:14:00 +0530</pubDate><author>info@thehackernews.com (The Hacker News)</author><enclosure length="12216320" type="image/jpeg" url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhPndGyYFB6MIt0TLMf4_ftQZ1ew2cshnUsTPif9GN9zq9yxGCMg21VWEeoHuyD2k5IxDdB6n1msUeLVT3JJLMWPGTVr_osaobBK83UGqKO5ooqVmkVp3eEL04Ebax-HtulunBZkdR7y8nFFHYDW7t2v4QpZpScfHkHQtsnQyibOcCUv9d2Us_Mf4hyphenhyphengFIy/s1600/Linux.jpg"/></item><item><title>Brazilian Feds Dismantle Grandoreiro Banking Trojan, Arresting Top Operatives</title><description><![CDATA[A Brazilian law enforcement operation has led to the arrest of several Brazilian operators in charge of the&nbsp;Grandoreiro&nbsp;malware.
The Federal Police of Brazil&nbsp;said&nbsp;it served five temporary arrest warrants and 13 search and seizure warrants in the states of São Paulo, Santa Catarina, Pará, Goiás, and Mato Grosso.
Slovak cybersecurity firm ESET, which provided additional]]></description><link>https://thehackernews.com/2024/01/brazilian-feds-dismantle-grandoreiro.html</link><guid isPermaLink="false">https://thehackernews.com/2024/01/brazilian-feds-dismantle-grandoreiro.html</guid><pubDate>Tue, 30 Jan 2024 22:13:00 +0530</pubDate><author>info@thehackernews.com (The Hacker News)</author><enclosure length="12216320" type="image/jpeg" url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi1dHYGhmkRf1ylIsGmlmUDYt71mx6IqQjXxQihICcFMIhiXkaFgXXxs1i5k-xuQlJAWrJFe6n9F3kReUKeuQ8VQUEmVUOhBXWAkxUZ3gMuev6d2QEyptNs6K14780z5x3meZ61tvAL83mUUNfeVQq3J0xgi5RjJqbwRhityWntneRzlf39eRnlkMxefyhd/s1600/brazil.jpg"/></item><item><title>URGENT: Upgrade GitLab - Critical Workspace Creation Flaw Allows File Overwrite</title><description><![CDATA[GitLab once again released fixes to address a critical security flaw in its Community Edition (CE) and Enterprise Edition (EE) that could be exploited to write arbitrary files while creating a&nbsp;workspace.
Tracked as&nbsp;CVE-2024-0402, the vulnerability has a CVSS score of 9.9 out of a maximum of 10.
"An issue has been discovered in GitLab CE/EE affecting all versions from 16.0 prior to]]></description><link>https://thehackernews.com/2024/01/urgent-upgrade-gitlab-critical.html</link><guid isPermaLink="false">https://thehackernews.com/2024/01/urgent-upgrade-gitlab-critical.html</guid><pubDate>Tue, 30 Jan 2024 21:48:00 +0530</pubDate><author>info@thehackernews.com (The Hacker News)</author><enclosure length="12216320" type="image/jpeg" url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhtNJeC5Q5QEq9d5OIQ01Nx0ppKnenB3G29jeTvP9yglAnz9nNlki47ZuBgzBJHufEgrqfm1rY3YuCBHCJh9Ck27M4Auj_4UZKtNKdflcP1PKiAO1dpO9SWATwo9_K2BmDDb8qFtsFxljT2pe2ZyicVmlBEus0nggHdvhbh_pevG9TNhvuysaaQ4egKftg0/s1600/gitlab.jpg"/></item><item><title>China-Linked Hackers Target Myanmar's Top Ministries with Backdoor Blitz</title><description><![CDATA[The China-based threat actor known as&nbsp;Mustang Panda&nbsp;is suspected to have targeted Myanmar's Ministry of Defence and Foreign Affairs as part of twin campaigns designed to deploy backdoors and remote access trojans.
The findings come from CSIRT-CTI, which said the activities took place in November 2023 and January 2024 after artifacts in connection with the attacks were uploaded to the]]></description><link>https://thehackernews.com/2024/01/china-linked-hackers-target-myanmars.html</link><guid isPermaLink="false">https://thehackernews.com/2024/01/china-linked-hackers-target-myanmars.html</guid><pubDate>Tue, 30 Jan 2024 19:15:00 +0530</pubDate><author>info@thehackernews.com (The Hacker News)</author><enclosure length="12216320" type="image/jpeg" url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjk-F8L49O-FqoT8x-Bl1anNkIKYo6hiw12xNH1hWZjzjSaM3WO6wH4L5slBsyyKx5EUXQBRh6yzPiplfR7_YpkEXFo-uwMHNVPJcTN_9jOIJwDhjjRJ1mNXd2FYnHmu2HjEVsChncEh1uFDAXt19F0Ao9KHJ4PwnAarqSDa4X0GU6ToTLoEXz83b4DLS1O/s1600/chinese.jpg"/></item></channel></rss>