Russia’s New Cyberwarfare in Ukraine Is Fast, Dirty, and Relentless

Since Russia launched its catastrophic full-scale invasion of Ukraine in February, the cyberwar that it has long waged against its neighbor has entered a new era too—one in which Russia has at times seemed to be trying to determine the role of its hacking operations in the midst of a brutal, physical ground war. Now, … Read more

Russia’s Sway Over Criminal Ransomware Gangs Is Coming Into Focus

Russia-based ransomware gangs are some of the most prolific and aggressive, in part thanks to an apparent safe harbor the Russian government extends to them. The Kremlin doesn’t cooperate with international ransomware investigations and typically declines to prosecute cybercriminals operating in the country so long as they don’t attack domestic targets. A long-standing question, though, … Read more

Apple MacOS Ventura Bug Breaks Third-Party Security Tools

The release of Apple’s new macOS 13 Ventura operating system on October 24 brought a host of new features to Mac users, but it’s also causing problems for those who rely on third-party security programs like malware scanners and monitoring tools.  In the process of patching a vulnerability in the 11th Ventura developer beta, released … Read more

Your Microsoft Exchange Server Is a Security Liability

Childs points to two other ZDI discoveries of Exchange vulnerabilities, one in 2018 and another in 2020, that were actively exploited by hackers even after the bugs were reported to Microsoft and patched. Security podcast Risky Business went so far as to title a recent episode “It’s Exchangehog Day,” in a reference to the dreary … Read more

How Vice Society Got Away With a Global Ransomware Spree

Throughout 2021, Vice Society’s health care targets included Barlow Respiratory Hospital in California, Eskenazi Health in Indiana, Centre Hospitalier D’Arles in France, United Health Centers in California, and a dental company in Brazil. The group also attacked New Zealand’s Waikato District Health Board that summer, which, among other impacts, resulted in the cancellation of two … Read more

Meta Says It Has Busted More Than 400 Login-Stealing Apps This Year

Both Apple and Google have struggled for years to keep malicious apps out of their official mobile app stores and away from users’ phones. Simple programs like flashlight apps, photo editing tools, and games can mask efforts to grab user data, authorize rogue charges, or steal login credentials to a legitimate service. Today, Meta said … Read more

WhatsApp clone spying user chats in India: Report

WhatsApp clone — GB WhatsApp — is spying on Indian users’ chats, according to the T2 2022 Threat Report by cybersecurity research firm, ESET. The third-party unofficial application is not available on Google Play Store but could be installed via APK file.  The report noted that India is among the countries with the highest Android trojan … Read more

Microsoft Exchange Server Has a Zero-Day Problem

There were global ripples in tech policy this week as VPN providers were forced to pull out of India as the country’s new data collection law takes hold, and UN countries prepare to elect a new head of the International Telecommunications Union—a key internet standards body. After explosions and damage to the Nord Stream gas … Read more

Mystery Hackers Are ‘Hyperjacking’ Targets for Insidious Spying

For decades, virtualization software has offered a way to vastly multiply computers’ efficiency, hosting entire collections of computers as “virtual machines” on just one physical computer. And for almost as long, security researchers have warned about the potential dark side of that technology: theoretical “hyperjacking” and “Blue Pill” attacks, where hackers hijack virtualization to spy … Read more

Slack and Teams’ Lax App Security Raises Alarms

Collaboration apps like Slack and Microsoft Teams have become the connective tissue of the modern workplace, tying together users with everything from messaging to scheduling to video conference tools. But as Slack and Teams become full-blown, app-enabled operating systems of corporate productivity, one group of researchers has pointed to serious risks in what they expose … Read more