admin

admin

  • Joined: September 10, 2024
  • Articles: 5656

Microsoft Alerts U.S. Healthcare Sector About New INC Ransomware Threat

September 19, 2024
Healthcare / Malware

Microsoft has reported that a financially motivated threat actor is utilizing a ransomware strain known as INC for the first time to specifically target the U.S. healthcare sector. The company’s threat intelligence team, tracking this activity under the name Vanilla Tempest (formerly DEV-0832), noted, “Vanilla Tempest is connected to GootLoader infections orchestrated by the threat actor Storm-0494, and employs tools such as the Supper backdoor, the legitimate AnyDesk remote monitoring and management (RMM) software, and MEGA for data synchronization.” Following this, attackers execute lateral movements using Remote Desktop Protocol (RDP) and deploy the INC ransomware payload via Windows Management Instrumentation (WMI) Provider Host. Microsoft revealed that Vanilla Tempest has been operational since at least July 2022, with previous targets including the education, healthcare, IT, and manufacturing sectors.

Microsoft Alerts Healthcare Sector to Emerging INC Ransomware Threat On September 19, 2024, Microsoft issued a warning regarding a new ransomware variant named INC, which has been identified as a potential threat to the U.S. healthcare sector. This alarming development…

How Vulnerabilities in OT Devices Can Endanger Hospital Operations

Recent warnings from U.S. federal authorities concerning vulnerabilities in critical operational technology devices highlight significant security risks often overlooked by healthcare organizations. Sila Özeren, a security research engineer at Picus Security, emphasized these concerns in a recent discussion. The Cybersecurity…

⚡ Weekly Update: APT Campaigns, Browser Hijacks, AI-Powered Malware, Cloud Breaches, and Critical Vulnerabilities

Date: May 26, 2025
Category: Cybersecurity / Hacking News

Cyber threats have evolved into complex, interconnected attacks that are often obscured until they escalate. For cybersecurity teams, the focus must shift from mere reaction to proactive detection, identifying early warning signs before they escalate into serious risks. This recap aims to provide precise and actionable insights based on verified trends and developments. In today’s intricate landscape, we require targeted analysis rather than background noise. Here, we present more than a mere list of incidents; we offer a comprehensive view of how control is shifting—whether it’s being gained, lost, or subtly tested.

⚡ Threat of the Week

Lumma Stealer and DanaBot Operations Disrupted
A collaborative effort involving private sector companies and law enforcement has successfully dismantled the infrastructure tied to Lumma Stealer and DanaBot. Additionally, charges have been brought against 16 individuals implicated in the creation and deployment of DanaBot. This malware is designed to extract sensitive data from victim computers and hijack banking sessions…

Weekly Cybersecurity Update: APT Campaigns, Browser Hijacks, AI Malware, Cloud Breaches, and Critical CVEs Date: May 26, 2025 In the ever-evolving landscape of cybersecurity, threats have become increasingly sophisticated and layered, often emerging from complex schemes that remain concealed until…

Citrix Issues Urgent Patches for Actively Exploited Vulnerability CVE-2025-6543 in NetScaler ADC

June 25, 2025
Vulnerability / Network Security

Citrix has launched critical security updates to address a significant vulnerability in NetScaler ADC, which is currently being exploited in the wild. This vulnerability, identified as CVE-2025-6543, has a CVSS score of 9.2 out of 10. It involves a memory overflow issue that could lead to unintended control flow and potential denial-of-service attacks. Successful exploitation requires the appliance to be set up as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server. The affected versions include:

  • NetScaler ADC and NetScaler Gateway 14.1 prior to 14.1-47.46
  • NetScaler ADC and NetScaler Gateway 13.1 prior to 13.1-59.19
  • NetScaler ADC and NetScaler Gateway 12.1 and 13.0 (vulnerable and end-of-life)
  • NetScaler ADC 13.1-FIPS and NDcPP prior to 13.1-37.236-FIPS and NDcPP

Citrix has indicated that vulnerabilities also impact “Secure Private Access on-prem or Secure Private Access Hybrid” deployments utilizing NetScaler instances.

Citrix Issues Urgent Security Patches for Actively Exploited CVE-2025-6543 in NetScaler ADC On June 25, 2025, Citrix took decisive action in response to a critical vulnerability identified as CVE-2025-6543 affecting its NetScaler ADC products. This flaw has been reportedly exploited…

Ukraine Prohibits Telegram Use Among Government and Military Staff

September 21, 2024
National Security / Cybersecurity

Ukraine has banned the use of the Telegram messaging app by government officials, military staff, and personnel involved in defense and critical infrastructure, citing national security reasons. The announcement was made by the National Coordination Centre for Cybersecurity (NCCC) via a Facebook post. Kyrylo Budanov, head of Ukraine’s GUR military intelligence agency, emphasized, “While I support freedom of speech, the issue regarding Telegram transcends that; it is fundamentally a matter of national security.” The National Security and Defense Council (NSDC) noted that Telegram is “actively exploited by adversaries” for cyber attacks, disseminating phishing messages and malware, monitoring users’ locations, and collecting intelligence to assist Russian military operations against Ukrainian targets. Consequently, the use of Telegram is now prohibited on official devices for government employees.

Ukraine Prohibits Telegram for Government and Military Personnel Amid Security Concerns September 21, 2024 In a decisive move aimed at bolstering national security, Ukraine has enacted a ban on the use of the Telegram messaging platform among government officials, military…

Fortifying the Cloud: Developing Robust, Cross-Platform Network Protections for Hybrid and Multi-Cloud Environments Webinar.

Welcome to ISMG Registration Enhance your profile to remain informed Select Your Title LevelAnalytics/Architecture/EngineeringAttorney / General Counsel / CounselAssistant Vice President (AVP)Board MemberC-suite ExecutiveC-suite – OtherChief Communications Officer (CCO)Chief Executive Officer (CEO)Chief Financial Officer (CFO)ChairpersonChief Information Officer (CIO)Chief Information Security…

FBI Warns Law Firms of Luna Moth’s Stealthy Phishing Campaign

May 27, 2025
Data Breach / Social Engineering

The FBI has issued a warning regarding a series of social engineering attacks targeting law firms, attributed to a criminal group known as Luna Moth. This campaign has been ongoing for the past two years, utilizing IT-themed social engineering calls and callback phishing emails to gain remote access to devices and steal sensitive information for extortion purposes. Also referred to as Chatty Spider, Silent Ransom Group (SRG), Storm-0252, and UNC3753, Luna Moth has been active since at least 2022, primarily employing a tactic called callback phishing, or Telephone-Oriented Attack Delivery (TOAD), to deceive users into calling phone numbers found in seemingly innocuous phishing emails related to invoices and subscription payments. Notably, Luna Moth is the same hacking group responsible for the previous BazarCall campaigns that deployed ransomware such as Conti.

FBI Warns Law Firms of Luna Moth’s Covert Phishing Operations May 27, 2025 Data Breach / Social Engineering The Federal Bureau of Investigation (FBI) has issued a significant alert regarding a series of sophisticated social engineering attacks orchestrated by a…

9% of Microsoft Entra SaaS Apps Still Vulnerable to nOAuth Exploits Two Years Post-Discovery

June 25, 2025
SaaS Security / Vulnerability

Recent findings highlight ongoing risks associated with a known security flaw in Microsoft Entra ID, which may allow malicious actors to execute account takeovers in certain software-as-a-service (SaaS) applications. Identity security firm Semperis analyzed 104 SaaS applications and discovered that nine remain vulnerable to Entra ID cross-tenant nOAuth abuse. Initially revealed by Descope in June 2023, nOAuth pertains to a flaw in the implementation of OpenID Connect (OIDC) by SaaS applications, which is an authentication layer built on OAuth for verifying user identities. This implementation flaw allows attackers to alter the mail attribute in an Entra ID account to that of a target, leveraging the app’s “Log in with Microsoft” feature to hijack the account. The attack is straightforward, exacerbated by Entra ID’s allowance for unverified email addresses, paving the way for user impersonation.

nOAuth Vulnerability Persists in 9% of Microsoft Entra SaaS Applications Two Years After Initial Identification June 25, 2025 Recent findings have revealed that a previously identified security vulnerability within Microsoft Entra ID continues to pose risks for certain software-as-a-service (SaaS)…