A recent National Crime Agency (NCA) investigation led to the arrest of a teenager in Walsall, England, linked…

A recent National Crime Agency (NCA) investigation led to the arrest of a teenager in Walsall, England, linked to a cyberattack on Transport for London (TfL). While the attack caused some disruptions, core services were largely unaffected.

National Crime Agency (NCA) has apprehended a teenager in Walsall, England, in connection with a cyber security incident that impacted Transport for London (TfL). The arrest is part of an ongoing investigation into the attack, that caused some disruptions, though the impact on core public transport services was minimal.

> Transport for London (@TfL) is addressing an ongoing cybersecurity incident. No customer data has been compromised, and services are unaffected. They're working with government agencies and will provide updates. Stay informed via the TfL website. #CyberSecurity #London pic.twitter.com/ozUDOs18uw
> 
> — Hackread.com (@HackRead) September 2, 2024

The teenager, whose identity has not been released due to their age, was arrested by NCA officers in Walsall. The arrest follows 2 weeks of investigation into the cyber attack. Charges have not yet been formally filed, but it is anticipated that they will be related to the incident.

The arrest and the age of the alleged hacker align with the **NCA’s February 2024 findings**, which revealed that 1 in 5 youths in the United Kingdom engage in cybercrime. The agency disclosed that one in five children aged 10-16 in the UK have participated in online activities that violate the Computer Misuse Act.

Jake Moore, Global Cybersecurity Advisor at ESET, provided insights into the potential motivations behind the attack and the importance of educating young people about the consequences of cybercrime.

Moore suggested that if a single individual was responsible for the TfL attack, it might have been a “cyber trial” rather than an organized attack. He explained that many young people experiment with their hacking skills without fully understanding the potential consequences of their actions.

“Hopefully, this can be a lesson to all those with similar skills to make sure they use them legally and for good,” Moore said. “When personal and financial details such as bank account numbers and sort codes are compromised, it no longer becomes a game of who can go the furthest and instantly becomes serious.”

> A teenager has been arrested by the NCA, as part of the investigation into a cyber security incident affecting Transport for London (TfL).
> 
> FULL STORY ➡️ https://t.co/TFbZdJ3FDO
> 
> — National Crime Agency (NCA) (@NCA\_UK) September 12, 2024

The involvement of teenagers in cybercrime is quite a serious issue. Unlike older individuals, who may be motivated by financial gain or organized crime, teens often view these activities as a game, without fully understanding the legal and ethical consequences.

Moreover, early involvement in cybercrime could set them on a dangerous path, limiting their potential for positive career opportunities while contributing to an increase in sophisticated online threats. As cyber criminals get younger, the challenges for law enforcement and cybersecurity professionals grow more difficult, demanding targeted interventions to prevent a generation from falling into cybercrime.

Nevertheless, as the investigation into the TfL cyber attack is underway, it is expected that more information will emerge regarding the teenager’s involvement and the extent of the damage caused.

1.  Aussie Arrested for “Evil Twin” Wi-Fi Scam Targeting Travelers
2.  MIT Graduate Brothers Arrested for $25 Million Ethereum Heist
3.  4 Arrested as Operation Endgame Disrupts Ransomware Botnets
4.  23-Year-Old Arrested for Running 100M Incognito Dark Web Market
5.  Teen among suspects arrested in Android banking malware scheme

NCA Arrests Teenager in Walsall Over TfL Cyber Attack

Silver Spring, United States, 12th September 2024, CyberNewsWire

**Silver Spring, United States, September 12th, 2024, CyberNewsWire**

The investment will drive the company’s advancement of scalable workload access management for enterprises

Aembit, the leading non-human identity and access management (IAM) company, has secured $25 million in Series A funding, bringing its total capital raised to nearly $45 million. Acrew Capital led the round, with participation from existing investors Ballistic Ventures, Ten Eleven Ventures, Okta Ventures, and CrowdStrike Falcon Fund.

Aembit’s funding comes in the wake of continued high-profile non-human identity attacks on organizations such as Cloudflare, The New York Times, and Microsoft. Non-human identity (NHI) refers to the applications, scripts, and bots that businesses use to automate their operations, as well as the credentials used by NHIs to communicate to sensitive databases, applications, and infrastructure. 

These incidents exposed secrets such as API keys, access tokens, and other non-human access credentials, which were used to penetrate enterprise environments. In a newly published survey of security professionals, Aembit found that most organizations still struggle with managing NHI credentials securely: Over 30% still storing credentials in code, and 23% using email and chat to share credentials. Over 60% of respondents are looking for a comprehensive solution across their entire organization.

Security professionals are recognizing the need for an access-focused approach that automates identity-driven, secretless, centrally enforced, and auditable access between distributed applications and SaaS services to sensitive resources in the cloud and on-premises. 

Aembit has led the market in solving this emerging challenge by pioneering non-human IAM. It enables policy-based access management between workloads and the sensitive resources they access, moving beyond reactive visibility and governance to proactively shrink the attack surface of rapidly growing and highly distributed non-human identities. Aembit was recently lauded as a Top 2 finalist in the prestigious 2024 RSA Innovation Sandbox competition and is a finalist for Best Identity Management Solution at the 2024 SC Awards. Aembit continues to advance access management with capabilities such as MFA-strength conditional access, policy automation via infrastructure-as-code, and robust auditing for NHI access. 

> “Aembit is tackling one of the most pressing challenges in modern enterprise security,” said Mark Kraynak, founding partner at Acrew Capital. “The shift to cloud and SaaS, and AI has driven an order-of-magnitude expansion in non-human identities. With the proliferation of microservices and APIs across diverse environments, IAM has become the critical first line of defense for protecting sensitive data. Legacy access management approaches weren’t designed with this level of scale and automation in mind. We are thrilled to be partnering with Aembit to bring a new approach to the market.”

Co-Founders David Goldschlag and Kevin Sapp have spent their careers innovating across the identity landscape, most recently creating New Edge Labs (acquired by Netskope), one of the first user zero trust products on the market.

> “Kevin and I founded Aembit with a vision to help enterprises secure access between non-human workloads, applications, and software resources with the same principles used today to secure human access,” said David Goldschlag, co-founder and CEO of Aembit. “Talking to hundreds of enterprises, and working closely with design partners, our approach centers on proactively securing access between non-human identities, while eliminating friction for developers and security teams.”

> “By solving non-human IAM, Aembit is tackling an essential security challenge,” said Brad Jones, CISO at Snowflake and an Aembit customer. “Not only is their approach to non-human access innovative, but Aembit is a provider we can rely on.”

The Aembit Workload IAM Platform enforces secure access between non-human workloads and the services that authorize access to sensitive data and infrastructure. Aembit’s policy engine grants secretless access, just-in-time, based on the workload’s identity and posture. 

Leveraging native identities and sophisticated automation, organizations use Aembit to eliminate storage of sensitive secrets within applications or vaults by moving to short-lived access tokens with a no-code auth approach. With Aembit, businesses proactively secure non-human access while eliminating the manual and fragmented work required today by security, engineering, and DevSecOps teams.

**About Aembit**

Aembit is the non-human identity and access management platform that secures access between workloads across clouds, SaaS, and data centers. With Aembit’s identity control plane, DevSecOps can fully automate secretless, policy-based, and Zero Trust workload access with MFA-strength capabilities. For more information, users can visit https://aembit.io/ and follow us on LinkedIn.

**Contact**

**CMO**  
**Apurva Davé**  
**Aembit**  
**\[email protected\]**

Aembit Raises $25 Million in Series A Funding for Non-Human Identity and Access Management

Cybercriminals are increasingly targeting retail affiliate programs with sophisticated cryptocurrency scams. Retailers and customers must stay alert against…

Cybercriminals are increasingly targeting retail affiliate programs with sophisticated cryptocurrency scams. Retailers and customers must stay alert against domain fraud, brand impersonation, and online Ponzi schemes to prevent losses.

Cybercriminals and nation-state hackers are increasingly targeting retail affiliate programs to conduct cryptocurrency scams, according to the latest research by cybersecurity firm DomainTools.

With its vast economic footprint and consumer brand loyalty, the retail sector has become a prime target for these malicious actors, exploiting online platforms and brand reputations to deceive consumers and reap financial rewards.

**Leveraging Brand Loyalty for Fraud**

The global retail industry—valued at over $30 trillion annually and with the top 50 retailers contributing more than $1.13 trillion in revenue in 2023—has always been a lucrative target for scammers and fraudsters. However, the transition toward e-commerce has opened up new opportunities for cybercriminals to exploit.

The DomainTools detailed technical report, shared with Hackread.com ahead of publishing, dives deep into how threat actors use domain fraud, brand impersonation, and multi-level Ponzi schemes to deceive consumers and steal cryptocurrency.

Cybercriminals are not just after financial gains; they are also damaging brand reputations. By closely imitating well-known consumer brands, these actors aim to exploit the trust and loyalty consumers have for these companies. This multi-layered fraud not only affects individual consumers but also threatens the credibility of the brands themselves.

**Online Storefronts: A Hotspot for Fraud**

One noteworthy trend underlined in the report is the rise of **e-commerce domain fraud**. As physical stores closed during the global pandemic, the retail sector’s move to online platforms created another ground for cybercriminals.

One group of threat actors, for instance, set up hundreds of fraudulent websites to impersonate well-known global retailers. These sites often promised huge discounts through fake “store closing” sales, luring unsuspecting consumers into the trap.

DomainTools traced thousands of such fraudulent domains, some of which impersonated luxury brands like Rolex and Cartier. The scammers created these fake websites using templates, automated processes, and even legitimate e-commerce platforms to generate convincing landing pages. The scale of the operation is staggering, with over 2,300 fraudulent domains tied to just one SSL certificate alone.

**Ponzi Schemes Disguised as Affiliate Programs**

The report also uncovers a disturbing trend: the use of brand impersonation to conduct financial fraud. Cybercriminals are preying on individuals looking for side-income opportunities by promising commissions for completing simple tasks, such as boosting online sales for well-known brands like Amazon and Target. Victims are led to believe they are joining legitimate affiliate programs when, in reality, they are being lured into Ponzi schemes.

These scams often require victims to invest in cryptocurrency, such as USDT (Tether), with the promise of high returns. The fraudsters then push victims to recruit others, creating a multi-level marketing front.

In one case, a fraudulent website using the domain “amazon-9000com” mimicked Amazon’s platform to convince users to invest in these fake opportunities. This particular scheme was linked to over 200 other fraudulent domains impersonating major brands, including Lazada, Walmart, and TikTok.

Example of malicious domains impersonating top brands (Screenshot: DomainTools)

**Copycat Scams Spread Quickly**

The third major finding in the report is the proliferation of **copycat schemes**. Once a scam proves successful, it is quickly replicated by other cyber criminals. For example, a domain called “targetpk8top” appeared in late 2023, impersonating Target in much the same way as earlier scams targeted Amazon. The same templates, naming conventions, and SSL certificates were used, showing how quickly these tactics spread across the cybercriminal ecosystem.

These copycat scams often follow a familiar playbook: they use fake investment schemes, promise high cryptocurrency returns, and rely on social media platforms to find new victims. By the time consumers realize they’ve been duped, the scammers have often disappeared, leaving little chance of recovering lost funds.

**What’s Next for Retailers?**

The report urges the retail sector to remain vigilant. These scams have been ongoing since at least 2020, and the perpetrators show no signs of slowing down. Retailers must monitor their online presence closely, especially regarding domain registrations and brand impersonations.

Additionally, collaboration is key. Organizations like the **Retail and Hospitality Information Sharing and Analysis Center (RH-ISAC)** and the **National Cyber-Forensics and Training Alliance (NCFTA)** are instrumental in sharing threat intelligence across the industry, helping retailers stay one step ahead of evolving cyber threats.

Although such scams are not new, their increased sophistication is only making it worse for unsuspecting customers and retailers. Therefore, both parties should recognize the threat posed by domain fraud and brand impersonation. Businesses should train their employees, and customers should learn how to identify scams or malicious websites.

1.  How to Increase Your Business’s Online Brand Awareness
2.  Memcyco Introduces Real-Time Solution to Combat Brandjacking
3.  Check Point Research: Microsoft the Most Phished Brand in Q2 2023
4.  Domain Squatting, rand Hijacking: A Silent Threat to Digital Enterprises
5.  42,000 phishing domains discovered masquerading as popular brands

From Amazon to Target: Hackers Mimic Top Brands in Global Crypto Scam

Kransom ransomware hides within the StarRail game using DLL side-loading and a legitimate certificate from COGNOSPHERE PTE. LTD.…

Kransom ransomware hides within the StarRail game using DLL side-loading and a legitimate certificate from COGNOSPHERE PTE. LTD. Bypassing detection, this malware delivers an encrypted payload. Analyze it in ANY.RUN’s interactive sandbox.

Researchers at ANY.RUN have discovered that the Kransom ransomware is being disguised as a game to evade detection. This malware employs DLL side-loading to execute its payload, using a legitimate certificate from COGNOSPHERE PTE. LTD. The latter adds an extra layer of deception to its attack. 

****Overview of Kransom Ransomware****

The ransomware execution flow

Kransom ransomware is cleverly disguised within the game StarRail, a legitimate software used as a front to trick users. The malware relies on a DLL file stored in the same directory as the game, which contains its encrypted ransomware code. 

This is a classic case of DLL side-loading, where a legitimate executable file loads a malicious DLL, allowing the ransomware to hijack the execution flow.

****Legitimate Certificate with Malicious Intent****

One of the most deceptive elements of Kransom is its use of a legitimate certificate from COGNOSPHERE PTE. LTD. By using a trusted certificate, the malware is able to bypass many traditional security measures, as the system recognizes the software as harmless. 

The valid certificate is displayed in ANY.RUN

However, malicious actions take place once the StarRailBase.dll is loaded by the executable, initiating the ransomware attack.

****How Kransom Ransomware Works****

To observe how Kransom ransomware works, a sample of this malware can be uploaded to a malware sandbox like ANY.RUN. The sandbox allows anyone to carry out a full analysis of the malware’s execution process, from its initial stages to the completion of its payload.

The legitimate **StarRail** game serves as a mask for the ransomware, which won’t function without the presence of the malicious **StarRailBase.dll** file. This DLL contains the ransomware’s encrypted payload, which is then executed by the game’s EXE file.

Malicious activity executed by DLL file in ANY.RUN

It should be noted that the game **StarRail**, developed by **HoYoverse**, is completely safe when used in its original form. However, Kransom takes advantage of the game’s structure to embed its malicious code in the same folder, making it difficult for users to notice anything unusual.

The ransomware code within the DLL is encrypted using XOR, making it harder to detect. Tools like ANY.RUN can help security analysts uncover what’s been XORed, providing crucial insight into the malicious content.

XOR-URL displayed in ANY.RUN sandbox

Once the ransomware is activated, users are met with a message: _“I believe you’ve encountered some problems. Email to hoyoverse for solutions.”_

Ransom note analyzed inside ANY.RUN’s sandbox

You can have a more comprehensive analysis of this malware by searching for additional samples in ANY.RUN’s TI Lookup tool.

Samples in ANY.RUN’s TI Lookup

****Try ANY.RUN Sandbox for Free****

To analyze your own malware and phishing samples in a fully interactive Windows 10 x64 or Linux VM environment, create a free ANY.RUN account using your email.

ANY.RUN’s cloud sandbox allows you to interact with files, URLs, and the system as if you were using a standard computer. You can download attachments, solve CAPTCHAs, and even reboot the entire system during analysis.

For advanced features like private mode and collaboration tools, you can request a 14-day free trial directly from ANY.RUN’s official website.

1.  **Analysis of Top Infostealers: Redline, Vidar and Formbook**
2.  **New ransomware locks files & asks victims to play PUBG game**
3.  **This Ransomware tells users to play a Japanese game – That’s all**
4.  **PythonAnywhere Cloud Platform Abused for Hosting Ransomware**
5.  **New Ransomware Asks User to Play a Game while Encrypting Data**

Ransomware Disguised as a Game: Kransom’s Attack Through DLL Side-Loading

Torrance, United States / California, 12th September 2024, CyberNewsWire

**Torrance, United States / California, September 11th, 2024, CyberNewsWire**

Criminal IP, a distinguished leader in Cyber Threat Intelligence (CTI) search engine developed by AI SPERA, announced that it has successfully integrated its IP address-related risk detection data with IPLocation.io, one of the most visited IP analysis and lookup tools on the internet.

Through the integration, IPLocation.io, a prominent IP address geolocation tracker platform with a substantial user base, now offers more detailed insights on IP addresses from Criminal IP’s accurate and up-to-date threat intelligence database.

**Innovative Data Ecosystem Driven by Search Engine and AI Expertise**

This is a groundbreaking advancement because Criminal IP’s database, built on a search engine framework, is more than a collection of information; it’s a refined machine learning ecosystem honed through extensive scanning and detection of malicious IP addresses. The system continuously enhances its accuracy by transforming self-collected threat data, particularly behavioral patterns for IP address evasion, into actionable intelligence using AI and machine learning techniques.

**Tracking Down Threat History with Snort and Scanner Information**

Unlike traditional IP tracking methods, which only provide the geographic location of IP addresses, Criminal IP data in IPLocation.io now delivers information from ‘Snort’, a network intrusion detection system, and vulnerability scanners on open ports. This, along with newly provided inbound and outbound scores of IP addresses, enables the comprehensive identification of threat information related to IP addresses. Users can now compile the information themselves to assess the risk of an IP address, supported by a variety of fact-based evidence.

Threat data from Criminal IP accessible on IPLocation.io website

Among IP Location Lookup data sources, Criminal IP provides the most comprehensive data, offering 25 distinct data points for a single IP address.

**Evasion-Focused Dynamic Pattern Analysis Unveils Potential Attack Scenarios**

Users can also detect IP address obfuscation and protect their assets with new VPN, Proxy, and Tor data in IP Location. The aforementioned data helps identify discrepancies between actual and reported locations of an IP address, as well as traffic routed through multiple servers, thus revealing potential threats. The system goes beyond a mere review of past records; it offers predictive insights into future risks by analyzing behavioral patterns and potential attack scenarios. This underscores the CTI database’s distinctive capability to continuously learn and analyze attack patterns executed online.

**About AI SPERA**

AI SPERA equips cybersecurity professionals with advanced tools and insights to protect digital assets. Its flagship products include Criminal IP, renowned for its AI-based search engine, as well as attack surface management and fraud detection for enterprise solutions. The firm’s established presence in major marketplaces like AWS and Snowflake further underscores its credibility and the trust placed in its services by leading industry players. Recently, AI SPERA achieved Level 1 certification under PCI DSS v4.0, overseen by the six leading global card issuers, showcasing its commitment to top-tier data security.

**Contact**

**Michael Sena**  
**AI SPERA**  
**\[email protected\]**

Criminal IP Teams Up with IPLocation.io to Deliver Unmatched IP Solutions to Global Audiences

DragonRank, a Chinese-speaking hacking group, has compromised 30+ Windows servers globally. They exploit IIS vulnerabilities to manipulate SEO…

DragonRank, a Chinese-speaking hacking group, has compromised 30+ Windows servers globally. They exploit IIS vulnerabilities to manipulate SEO rankings, distribute scam websites, and spread malware like PlugX and BadIIS.

A Chinese-speaking hacking group, known as “DragonRank,” has been discovered compromising over 30 Windows servers across the globe, including in Thailand, India, Korea, Belgium, Netherlands, and China.

The group’s primary goal is to manipulate search engine crawlers and disrupt the Search Engine Optimization (SEO) of affected sites, ultimately distributing scam websites to unsuspecting users.

One of the DragonRank’s advertisement websites on Google is plagued with malware

****How the Attack Works****

The DragonRank hacking group gains initial access to Windows Internet Information Services (IIS) servers by exploiting vulnerabilities in web application services, such as phpMyAdmin, WordPress, or similar web applications. Once they obtain the ability to execute remote code or upload files on the targeted site, they deploy a web shell like ASPXspy, granting them control over the compromised server.

According to Cisco Talos’ long and technical report shared with Hackread.com ahead of publishing on Tuesday, the group then utilizes the web shell to collect system information and launch malware, including PlugX and BadIIS, as well as credential-harvesting utilities like Mimikatz, PrintNotifyPotato, BadPotato, and GodPotato. They also breach additional Windows IIS servers in the target’s network, either through web shell deployment or by exploiting remote desktop logins using acquired credentials.

For your information, PlugX is a well-known RAT (remote access tool) equipped with modular plugins and property configurations, deployed by various Chinese-speaking cyber threat actors for over ten years. The PlugX configuration in this campaign contains all necessary values and information to properly run the executable.

On the other hand, BadIIS is a malware used to manipulate search engine crawlers and hyperlink jumps. The version of BadIIS detected in this campaign shares similar traits with the one mentioned (PDF) at Black Hat USA 2021, including configuration as an IIS proxy and capabilities for SEO fraud.

Interestingly, researchers also noted that DragonRank operates much like a business, with a commercial website offering their services in both Chinese and English. They engage with clients through platforms like Telegram and QQ, providing tailored SEO fraud services. Their business model includes a cautionary note about transaction confirmations, suggesting they operate with a level of professionalism uncommon in typical cybercrime groups.

Nevertheless, the DragonRank hacking group’s activities are a threat to online security, as they can drive traffic to malicious sites, increase the visibility of fraudulent content, or disrupt competitors by artificially inflating or deflating rankings.

These attacks can harm a company’s online presence, lead to financial losses, and damage its reputation by associating the brand with deceptive or harmful practices. Therefore, businesses and IT departments must:

*   **Use Advanced Threat Detection:** Implement solutions that can detect and respond to sophisticated malware like PlugX.
*   **Regularly Update Security Measures:** Ensure all systems, especially web servers, are patched against known vulnerabilities.
*   **Monitor Network Traffic:** Look for unusual outbound connections or changes in server behavior that might indicate malware like BadIIS.
*   **Educate Staff:** Awareness training on cyber threats can help in early detection of phishing or other social engineering attempts.

1.  **Chinese SMS Phishing Group Hits iPhone Users in India Post Scam**
2.  **ValleyRAT Malware Targets Chinese Windows Users in New Attack**
3.  **Chinese Velvet Ant APT Target F5 Devices in Years-Long Espionage**
4.  **“Unfading Sea Haze” Hackers Hit Military Targets in South China Sea**
5.  **Chinese Blackwood APT Deploys NSPX30 Backdoor in Cyberespionage**

Chinese DragonRank Hackers Exploit Global Windows Servers in SEO Fraud

Cybercriminals target Trump’s digital trading cards using phishing sites, fake domains, and social engineering tactics to steal sensitive…

Cybercriminals target Trump’s digital trading cards using phishing sites, fake domains, and social engineering tactics to steal sensitive data. Scammers create fake URLs mimicking the official site to deceive collectors.

Cybercriminals are now aiming at your digital collectable cards, with former President Donald Trump‘s new digital trading cards being the latest target. Since launching, Trump’s digital trading cards, which offer exclusive digital assets and real-life experiences, have generated substantial attention among collectors and supporters.

According to cybersecurity firm Veriti, malicious actors are using phishing sites, fake domains and various social engineering tactics to trick users into revealing sensitive information or installing malware.

One example of a fake domain is trumpdigitaltradingcards/.xyz, which mimics the official URL (collecttrumpcards/.com) but with subtle differences. Another instance is a fake site from the Democratic Party, which surfaced under the domain collecttrunpcards/.com in which the domain uses an “N” replacing the “M” in “Trump”).

Fake websites (Screenshot: Veriti)

****But how do these scams work?****

Attackers are using traditional phishing tactics, including email phishing and domain typosquatting, to lure in victims. Email phishing involves sending emails that appear to be from legitimate sources, and promoting limited-time offers on Trump’s digital cards, which often contain malicious links that lead to phishing websites.

“Attackers are leveraging the popularity of these trading cards to exploit users’ curiosity and desire to acquire them,” explained Veriti in its report shared with Hackread.com ahead of publishing on Tuesday. “The scams range from fake websites that look almost identical to the official site to more traditional phishing emails promising limited-time offers.”

****Not The First Time****

Trump has been used as bait for cybercrime before, and his supporters have been targeted in financial scams multiple times. In July of this year, scammers stole donations from his supporters by setting up fake and malicious websites.

In another scam, hackers used a fake Trump assassination story to steal cryptocurrency from his supporters. In January 2021, a phishing video link tied to Trump’s election campaign was found spreading the QNode RAT malware.

Nevertheless, if digital collectable cards are your passion, it’s essential to be aware of the associated risks. By staying alert and taking necessary precautions, you can protect yourself from phishing scams and your personal information from scammers. Follow these simple tips to stay secure:

*   Use common sense; it’s the best defence against any kind of attack.
*   Look for HTTPS, which adds a layer of security to your browsing experience.
*   Double-check URLs before entering any personal information, as phishing sites often use slight variations in spelling to fool users.
*   Be cautious of unsolicited emails, and instead of clicking directly on the link, navigate to the official website by typing in the URL manually.
*   Follow Hackread.com for the latest news on cybersecurity and online scams.

1.  **Trump campaign website defaced with “site seizure” notice**
2.  **Fake Trump’s scandal video campaign spreading QNode RAT**
3.  **Researcher logs into Trump’s Twitter with password MAGA2020**
4.  **Federal Agency that maintains secure COMM for Trump HACKED**
5.  **2 arrested for Hacking DC Security Cams Before Trump Inauguration**

Hackers Use Fake Domains to Trick Trump Supporters in Trading Card Scam

Palo Alto, USA/California, 11th September 2024, CyberNewsWire

Opus’ innovative engine integrates AI-driven intelligence, contextual data and automated decision-making to drive precise, efficient vulnerability remediation.

Opus Security, the leader in unified cloud-native remediation, today announced the launch of its **Advanced Multi-Layered Prioritization Engine**, designed to revolutionize how organizations manage, prioritize and remediate security vulnerabilities. Leveraging AI-driven intelligence, deep contextual data and automated decision-making capabilities, this innovative engine helps organizations prioritize the most critical vulnerabilities, enhancing both security posture and operational efficiency.

**A Breakthrough in Vulnerability Remediation**

Security teams are overwhelmed by the need to rapidly prioritize alerts from multiple tools across various attack surfaces. These may include redundant alerts or negligible findings and teams must decide which to address first without adequate information, context and ability to do so. Security teams struggle to identify and address the most critical issues, and developers have limited time and scope to devote to security fixes—especially when it isn’t clear what is important and what is negligible. Developers are often bombarded with alerts that are duplicates or irrelevant due to inefficient prioritization—wasting time and increasing friction and frustration.

Opus Security’s Advanced Multi-Layered Prioritization Engine is a transformative approach to vulnerability management. By integrating multiple layers of intelligence, contextual analysis and risk mitigation, the engine ensures that security teams can effectively prioritize and address the most critical vulnerabilities, reducing risk, enhancing operational efficiency and supporting overall business goals. The engine integrates traditional vulnerability severity scoring with dynamic exploitability analysis, detailed environmental context and an automated decision-making process to provide a robust method for ranking vulnerabilities.

A key component of this engine is the **AI-Based Vulnerability Intelligence Layer**, which goes beyond traditional severity scoring. This layer leverages over 700 real-time threat intelligence feeds to build a deep and nuanced understanding of each vulnerability’s risk. By incorporating intelligence from sources such as dark web forums, social media, open-source tools, exploit databases and active threat campaigns, the engine can flag high-risk issues with unparalleled accuracy. This intelligence-driven approach ensures that organizations are aware of vulnerabilities and their likelihood of exploitation in the wild, allowing for proactive and informed remediation efforts.

Using a five-layered framework, the engine first performs a **Base Severity Assessment**, aggregating severity scores from leading security tools and public databases to ensure that no critical vulnerabilities are overlooked. Next, the **AI-Based Vulnerability Intelligence** layer leverages real-time threat intelligence to flag high-risk issues based on their likelihood of exploitation. The **Contextual Impact** layer then prioritizes vulnerabilities according to their relevance to specific business functions, protecting critical systems first, especially those that handle sensitive data. The engine is the first to enable real SSVC decision-making, fully baked into the product. This helps teams categorize vulnerabilities into specific response actions based on the affected environment’s severity, exploitability and criticality. Finally, the **Risk Customization layer** allows organizations to tailor prioritization according to their unique risk appetite and operational needs.

Additionally, Opus Security introduces **Effortless Data Querying**, allowing users to interact with the platform using natural language. This feature enables users to quickly refine vulnerability lists based on specific concerns and make precise, data-driven decisions by leveraging advanced AI-powered insights.

****Driving Value and Operational Excellence****

The engine’s multi-layered approach ensures unprecedented precision in risk management by integrating real-time intelligence with detailed contextual analysis. This integration enables SSVC decision-making, allowing security teams to focus on vulnerabilities that truly matter, reducing the likelihood of overlooking critical vulnerabilities.

Opus aligns security decisions with business priorities by deeply understanding the organization’s structure, critical services and risk profiles, driving context-aware decision-making that protects critical assets and directly supports strategic goals.

“Opus’ new Advanced Multi-Layered Prioritization Engine is a game-changer in vulnerability remediation, simplifying, streamlining and optimizing the process considerably. The engine’s ability to prioritize the vulnerabilities that pose the greatest risk reduces overall security costs and helps security and developer teams avoid unnecessary remediation of low-risk issues,” said Meny Har, CEO of Opus Security. “Minimizing friction between development and security teams, driving smoother collaboration and ensuring that security measures do not impede the development process means that all teams can focus on what matters and fix what counts.”

****About Opus Security****

Opus Security is at the forefront of cloud-native vulnerability remediation, delivering solutions that streamline remediation across complex IT ecosystems. Opus Security provides unparalleled visibility and control over vulnerabilities by integrating existing security tools and enhancing them with advanced AI and contextual intelligence. The platform’s innovative features, including the new Advanced Multi-Layered Prioritization Engine, empower organizations to protect their most critical assets with confidence and precision.

**Contact**

**Senior Account Executive**  
**Hannah Sather**  
**Montner Tech PR**  
**\[email protected\]**

Opus Security Elevates Vulnerability Management With its AI-Powered Multi-Layered Prioritization Engine

Microsoft's September 2024 Patch Tuesday is here. Make sure you’ve applied the necessary patches!

Microsoft September 2024 Patch Tuesday addresses 79 security vulnerabilities, including four actively exploited zero-days. It covers critical flaws in Windows Installer, MoTW, Publisher, and Windows Update.

Microsoft’s September 2024 Patch Tuesday is packed with critical updates, addressing a total of 79 vulnerabilities, including four actively exploited flaws and one publicly disclosed zero-day. Seven of these vulnerabilities were rated as critical, most of which were either remote code execution (RCE) or elevation of privileges (EoP) flaws.

****Highlighting Critical Vulnerabilities********1\. Actively Exploited Vulnerabilities:****

Among the most urgent updates were four vulnerabilities that were being actively exploited by malicious actors. These vulnerabilities represent a major risk to users and organizations that have yet to apply the patches, as they were being used in real-world attacks before the patches were available.

****CVE-2024-38217 – Windows Mark of the Web (MoTW) Security Feature Bypass Vulnerability:****

This critical vulnerability allows attackers to bypass security warnings meant to protect users from opening files from untrusted sources. Attackers can manipulate these security features to deceive users into executing malicious files without triggering the standard MoTW prompts. This vulnerability has previously been linked to ransomware attacks, making it a high-priority fix.

****CVE-2024-43461 – Windows MSHTML Platform Spoofing Vulnerability:****

This vulnerability enables attackers to spoof legitimate web content, which can be leveraged for phishing attacks and unauthorized data theft. This flaw shares similarities with CVE-2024-38112, which was used by advanced persistent threat (APT) groups in zero-day attacks. Given the active exploitation of related vulnerabilities, CVE-2024-43461 has a high likelihood of being used in future attacks.

****2\. Zero-Day Vulnerabilities:********CVE-2024-43491 — Remote Code Execution in Windows Update:****

This critical vulnerability could allow attackers to remotely execute code by exploiting weaknesses in the Windows Update process, gaining control of affected systems.

****CVE-2024-38014 — Elevation of Privilege in Windows Installer:****

This vulnerability allows attackers to gain elevated privileges by exploiting flaws in the Windows Installer, providing them with administrative-level access to compromised systems.

****CVE-2024-38217 — Windows Mark of the Web (MoTW) Bypass Vulnerability:****

Attackers can bypass the security mechanisms of MoTW, which are designed to alert users about harmful files downloaded from the internet, leading to unauthorized code execution.

****CVE-2024-38226 — Microsoft Publisher Security Bypass:****

This flaw allows attackers to exploit the security features in Microsoft Publisher, enabling them to execute malicious code by bypassing standard file protections.

****Critical Vulnerabilities Fixed****

Seven vulnerabilities were marked as critical, primarily involving remote code execution (RCE) or elevation of privilege. These vulnerabilities include:

*   **CVE-2024-43455** – Windows Remote Desktop Protocol (RDP) RCE vulnerability, which could allow attackers to remotely execute code on a compromised system, gaining full control of the machine.
*   **CVE-2024-43456** – Windows Kernel EoP vulnerability, allowing attackers to escalate their privileges on a targeted system, gaining administrative rights.
*   **CVE-2024-43469** – A high-severity remote code execution vulnerability in Azure CycleCloud, allowing attackers to execute arbitrary code with limited privileges. It has a CVSS score of 8.8, making patching critical to prevent exploitation

****Recommendations and Mitigation****

Given the critical nature of many of these vulnerabilities, especially the actively exploited and publicly disclosed flaws, Microsoft strongly recommends that organizations prioritize patch deployment.

**Patch Management:** Enterprises should accelerate their patch management processes to mitigate risks associated with vulnerabilities like CVE-2024-38217 and CVE-2024-43461. These flaws are being actively exploited in the wild, posing substantial risks to unpatched systems.

**User Education:** Beyond technical protection, users must be made aware of the dangers of interacting with untrusted files and websites. This is important in mitigating the MoTW and spoofing vulnerabilities discussed earlier.

The complete list of vulnerabilities, along with guidance on mitigation strategies, can be found here on Microsoft’s official September 2024 Patch Tuesday update.

Saeed Abbasi, Manager of Vulnerability Research at Qualys Threat Research Unit, commented on Microsoft’s September 2024 Patch Tuesday, stressing the importance of applying the updates promptly to mitigate possible risks.

“CVE-2024-38217 vulnerability allows an attacker to manipulate the security warnings that typically inform users about the risks of opening files from unknown or untrusted sources and similar MoTW bypasses have historically been linked to ransomware attacks, where the stakes are high,” Saeed warned.

He further stressed “Given the exploit’s public disclosure and confirmed exploitation, it is a prime vector for cybercriminals to infiltrate corporate networks. Enterprises must prioritize patch management and educate users on the risks of downloading files from untrusted sources to mitigate the exploitation of such vulnerabilities.”  

“The CVE-2024-43461 vulnerability mirrors the patterns of CVE-2024-38112 where the exploitation might be repurposed against CVE-2024-43461 due to the similar attack vectors involved. There exists a high likelihood of exploitation, as this vulnerability enables attackers to spoof legitimate web content, leading to unauthorized actions such as phishing and data theft,” he added.

“This risk is highlighted by past incidents where similar vulnerabilities were actively exploited in the wild, posing substantial security challenges to corporate networks. Given the critical nature of this vulnerability, we recommend fast-tracking patch management processes to mitigate potential impacts,” Saeed advised.

1.  **Mailcow Patches XSS and File Overwrite Flaws – Update NOW**
2.  **Google Patches Flaws in Quick Share After Researchers’ Warning**
3.  **Broadcom: Urgent Patch for Severe VMware vCenter Server Flaws**
4.  **TellYouThePass Ransomware Exploits Critical PHP Flaw, Patch NOW**
5.  **PATCH NOW! Veeam Flaw Puts Thousands of Backup Servers at Risk**

Microsoft September 2024 Patch Tuesday Fixes 79 Flaws, Including 4 Zero-Days

Cryptocurrency users beware: A malicious ComfyUI node steals sensitive data like passwords, crypto wallet addresses, etc. Stay safe…

Cryptocurrency users beware: A malicious ComfyUI node steals sensitive data like passwords, crypto wallet addresses, etc. Stay safe by using reputable sources and enabling two-factor authentication.

Cryptocurrency enthusiasts, beware! Security researchers at VPNMentor have reported a malicious custom node on the popular Stable Diffusion user interface_,_ ComfyUI to steal sensitive data like passwords, credit card details, and crypto wallet addresses.

According to VPNMentor’s report shared with Hackread.com, this malicious custom node, dubbed “ComfyUI\_LLMVISION,” has been uploaded by a user named “u/AppleBotzz” on Reddit, and is potentially putting users at risk by stealing sensitive data.

Another Reddit user, u/\_roblaughter\_, discovered and reported it after noticing login attempts on their accounts after installing the compromised node.

For your information, the ComfyUI interface is designed for workflow customization and productivity enhancement, enhancing user experience and productivity when working with the powerful AI text-to-image generation model. It, by default, uses Python-built mini-programs called custom nodes to extend its functionality, automate tasks, perform computations, or connect to external services not natively supported by ComfyUI.

“ComfyUI\_LLMVISION” presents itself as a user-friendly ComfyUI extension but in reality, it is programmed to steal sensitive data like passwords, credit card details, and browsing history, and transfer it to the attacker’s Discord server.

According to VPNMentor’s investigation, ComfyUI\_LLMVISION’s installation on ComfyUI forces the Python package manager to install several packages, including malicious versions of OpenAI and anthropic Python. 

Within these limitations, a function runs an encoded PowerShell command, which downloads the third stage of the malware and runs it. The second stage can steal crypto wallets, screenshot the user’s screen, steal device information, get IP info, and steal files with specific keywords or extensions.

It becomes hard to detect since it is concealed within custom install files for OpenAI and Anthropic libraries. However, it must be noted that ComfyUI remains secure. 

The incident highlights the need for caution when integrating third-party components into AI workflows. Recent developments, like the sale of FraudGPT or WormGPT and hijacked Bing chat responses, show the versatile nature of risks associated with AI advancements.

To protect against risks associated with open-source, third-party AI tools, exercise caution when downloading and installing custom nodes or extensions, prefer reputable repositories and developers, regularly scan systems for malware, and use strong, unique passwords for all online accounts. Enabling two-factor authentication can further enhance security. 

1.  VMCONNECT: Malicious PyPI Package Mimick Python Tools
2.  AMOS Stealer Variant Targets Safari Cookies, Crypto Wallets
3.  New Malware “BunnyLoader 3.0” Steals Credentials and Crypto
4.  Python in Threat Intelligence: Analyzing, Mitigating Cyber Threats
5.  JaskaGO Malware Targets Mac, Windows for Crypto, Browser Data

Source

HackRead