Kirsten Doyle

In a recent security advisory, the FBI warned of a quietly growing cyber threat: outdated home and small business routers are being turned into tools for criminal anonymity. Bad actors are compromising end-of-life (EoL) routers (devices no longer supported by their manufacturers) to install malware and conscript them into sprawling proxy networks like 5Socks and AnyProxy. Once infected, these routers become conduits for malicious traffic, obfuscating the true origin of cyberattacks and illicit activities.  “The botnets are used in various ways, such as launching coordinated attacks or selling access to the devices. With the 5Socks and Anyproxy network, criminals are…

While reports suggest that the latest version of Samsung MagicINFO 9 Server (21.1050.0) addresses the high-severity vulnerability tracked as CVE-2024-7399, Huntress has independently confirmed that this version remains vulnerable to a publicly available proof-of-concept (PoC). Huntress has also observed active exploitation of this flaw in the wild, affecting even the most recent version. Until a proper fix is released, Huntress says MagicINFO 9 Server should not be exposed to the internet. On 12 January, a researcher working with SSD Disclosure reportedly notified Samsung of several vulnerabilities in MagicINFO 9 Server, Samsung’s content management system for controlling digital signage displays. An…

A California jury just handed down a major verdict against Pegasus spyware maker NSO Group, ordering the company to pay $167 million in punitive damages for its role in the hacking of 1,400 WhatsApp users’ phones. This wraps up a six-year legal battle, during which WhatsApp alleged that NSO repeatedly launched spyware attacks against its platform—even as its engineering teams worked to patch the vulnerabilities being exploited.  In addition to the punitive damages, the jury awarded WhatsApp $445,000 in compensatory damages to cover the cost of the considerable work its engineers undertook to defend against these attacks. “Six years ago,…

The malicious actors who targeted Marks & Spencer (M&S) and the Co-op tricked IT workers to gain a foothold into their organizations’ systems, according to a new report from Reuters. The social engineering attack on the Co-op enabled attackers to reset a member of staff’s password before breaching the network. A similar tactic was used against M&S. In the wake of these incidents, the NCSC (the government agency responsible for cyber security) has issued guidance to organizations urging them to review their IT help desk “password reset processes” to limit their chances of suffering a breach. Continually Validate Risk Exposure …

An encrypted messaging app used by President Trump’s former national security advisor, Mike Waltz, during a recent Cabinet meeting has temporarily gone dark after reportedly being hacked. The app in question, TeleMessage, an Israel-based platform that functions as a customized version of Signal—was breached, though attackers didn’t get access to messages from Waltz or his contacts, according to 404 Media, which first broke the story. Still, the incident raises some serious questions. If a secure app designed for message archiving and compliance is being used by high-ranking officials—and it’s still vulnerable—how confident can the rest of us be in its…

Hot on the heels of Marks & Spencer suffering a cyber attack, the Co-operative Group has become the latest high-profile UK retailer targeted in a major cyberattack—one that now appears far more serious than initially disclosed. A ransomware group calling itself DragonForce contacted the BBC with proof of a large-scale data breach, claiming they had exfiltrated sensitive personal data from Co-op’s internal systems. The stolen information reportedly includes names, home addresses, phone numbers, email addresses, and membership card details of up to 20 million current and former members. The bad actor also shared employee usernames and passwords and screenshots of…

A sophisticated cybercrime campaign led by the threat actor group Luna Moth is actively targeting legal and financial institutions in the United States. The campaign uses callback phishing, legitimate IT tools, and data extortion tactics to steal sensitive information and demand multimillion-dollar ransoms. According to new research by EclecticIQ, Luna Moth (also tracked as Silent Ransom Group, UNC3753, and Storm-0252) is behind a wave of high-volume phishing campaigns that rely not on malware but on social engineering, fake helpdesk sites, and commercially available remote monitoring and management (RMM) software to compromise their victims. Callback Phishing: The New Playbook The attacks…

Cybersecurity researcher Jeremiah Fowler has uncovered a publicly accessible database containing over half a million records linked to an online ticket resale service. He reported the discovery to vpnMentor. The database was neither password-protected nor encrypted and contained 520,054 records totalling approximately 200 GB. Based on file and folder names, the data appeared to belong to “Ticket to Cash,” a resale platform for event tickets. Fowler reviewed a small sample of the documents, which included concert and event tickets, ticket transfers, receipts, and user-uploaded screenshots. Some files contained personally identifiable information (PII), such as partial credit card numbers, full names,…

An enhanced version of the StealC infostealer has been found in the wild, featuring a slew of upgrades that improve its stealth, payload control, and data exfiltration capabilities.   Dubbed StealC V2, this latest variant shows how malware authors are rapidly evolving commodity stealers into sophisticated, modular tools that are able to evade modern detection techniques. Researchers from Zscaler ThreatLabz identified and analyzed multiple recent samples of StealC V2, and discoverd that it has adopted RC4 encryption, PowerShell-based execution, and a redesigned command-and-control (C2) protocol. Also, this scourge now features a modular control panel that allows bad actors to customize the…

Twenty-five years ago today, the world was introduced to one of the most infamous computer viruses in history: ILOVEYOU. Disguised as a love letter in a simple email attachment, the worm spread like wildfire across inboxes on 4 May 2000, infecting an estimated 45 million systems within days. It caused billions in damages and forced global businesses, governments, and individuals to rethink how they handled email security. ILOVEYOU marked a turning point in cybersecurity. Unlike earlier viruses that relied on floppy disks or infected executables, ILOVEYOU exploited the human element, such as curiosity, trust, and a desire for connection. It…