Category: Cybersecurity & Digital Resilience

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a security warning concerning active exploitation of Plex Media Server installations. According to the agency, attackers are chaining four distinct vulnerabilities to perform unauthorized server breaches, a campaign currently being referred to as “Plex2Shell” attacks.

The coordinated use of these vulnerabilities allows malicious actors to execute commands or gain unauthorized access to underlying server infrastructure. Given the widespread use of Plex for media management, these findings highlight a significant risk to organizations and individuals running the software on internet-facing devices.

As CISA continues to monitor the situation, users and administrators are advised to review the official guidance to ensure their instances are properly secured against these exploitation attempts. Further details regarding the specific technical mechanisms of the vulnerabilities and recommended mitigations remain a focus of ongoing security efforts.

Source: BleepingComputer
Original article: https://www.bleepingcomputer.com/news/security/cisa-hackers-chain-plex-flaws-in-plex2shell-attacks-to-breach-servers/

Security organizations are responding to a heightened alert regarding two critical vulnerabilities within the PHP programming language. Following the disclosure of leaked technical details, security professionals have reported instances of active exploitation attempts targeting these flaws.

As these vulnerabilities could potentially allow unauthorized access or remote code execution, remediation efforts are underway across the industry. Organizations utilizing PHP are encouraged to review their security posture and prioritize patching to mitigate the risk posed by the active exploitation of these identified bugs.

Source: Dark Reading
Original article: https://www.darkreading.com/application-security/php2shell-bugs-red-alert-security-industry

New research from the Cloud Security Alliance (CSA) highlights a significant gap in the effectiveness of current data loss prevention (DLP) technologies. According to the survey, among organizations that reported experiencing data loss, only 16% were able to use their DLP tools to successfully block their most significant incidents before the data actually left the organization’s control.

The findings suggest that many enterprise DLP implementations may be functioning as reactive measures rather than proactive barriers, often failing to detect or prevent unauthorized data movement in real time. For organizations relying on these systems to secure sensitive information, the data points to a persistent challenge in mitigating data exfiltration effectively.

Source: Dark Reading
Original article: https://www.darkreading.com/cloud-security/cloud-security-alliance-survey-data-loss-prevention-detects-data-loss

Marvell, Microsoft, and Oracle have launched a joint initiative aimed at standardizing hardware security within cloud and hyperscale data center environments. The collaboration focuses on the implementation of integrated Hardware Security Modules (HSMs) that meet the NIST FIPS 140-3 Level 3 security standard.

By working toward a standardized HSM framework, the companies intend to improve the security architecture supporting large-scale data center infrastructure. The effort specifically targets the adoption of FIPS 140-3 Level 3, a rigorous benchmark for cryptographic modules used to protect sensitive data in cloud computing environments.

Source: Dark Reading
Original article: https://www.darkreading.com/cloud-security/marvell-microsoft-oracle-standardize-data-center-hardware-security

Security reports indicate that the North Korean-linked hacking collective known as the Lazarus group has begun employing post-quantum cryptographic mechanisms as part of its operational toolkit. This development marks a shift in the group’s methodology, as it combines legacy malware strains with these advanced cryptographic techniques to secure the delivery of its malicious payloads.

The integration of post-quantum cryptography—typically designed to withstand decryption attempts by future quantum computers—suggests an evolving sophistication in how threat actors protect their command-and-control communications and obfuscate their delivery processes. By utilizing these mechanisms, the group aims to ensure that their malicious operations remain protected against current and future analytical attempts.

As these actors continue to update their infrastructure and tactics, the use of advanced encryption standards highlights a growing trend in the professionalization of state-sponsored cyber operations. Further details regarding the specific implementation and the scope of these campaigns remain under investigation by the security community.

Source: BleepingComputer
Original article: https://www.bleepingcomputer.com/news/security/lazarus-hackers-use-post-quantum-cryptography-for-malware-delivery/

A recent survey conducted by 360 Privacy highlights a shift in how security professionals perceive the risks faced by high-profile executives. According to the findings, more than 80% of security and wealth management professionals now assert that digital and physical security can no longer be treated as separate domains.

The study emphasizes that digital exposure has become a direct contributor to physical security threats. As professional and personal information remains accessible online, the potential for digital vulnerabilities to manifest as real-world safety concerns has grown, forcing organizations to rethink traditional protection strategies for their leadership.

Source: Dark Reading
Original article: https://www.darkreading.com/cybersecurity-operations/360-privacy-survey-high-profile-executives-feel-untouchable

Optiv has launched CyberBOT, a new cybersecurity awareness training program aimed at supporting educators, community leaders, and nonprofit organizations. The initiative provides hands-on sessions designed to foster cybersecurity knowledge across these sectors.

By offering accessible resources, the program seeks to promote year-round awareness and help organizations and community members build greater digital resilience. The program is specifically structured to assist those who play a role in community safety and education.

Source: Dark Reading
Original article: https://www.darkreading.com/cybersecurity-operations/optiv-launches-cyberbot-cybersecurity-awareness-training-program

A GitHub account associated with an OVHcloud developer has been identified as the vehicle for a malicious code distribution campaign. According to reports, the account was compromised several months prior to being utilized to push malicious files to unsuspecting users.

The incident has been attributed to the threat actor group known as GlassWorm. By gaining unauthorized access to the developer’s repository, the attackers were able to inject malicious code into projects, potentially exposing downstream users to security risks.

This development highlights the ongoing security challenges posed by supply chain attacks, where compromised developer credentials serve as a primary vector for distributing malicious software through trusted platforms. Further details regarding the scope of the compromise and specific mitigations remain limited as the situation is reviewed.

Source: Dark Reading
Original article: https://www.darkreading.com/cyberattacks-data-breaches/ovhcloud-github-compromise-glassworm-threat-actors

A sophisticated new malware campaign has been identified that leverages a decades-old Windows utility to carry out ClickFix attacks. By manipulating Google search results related to Amazon, attackers are redirecting unsuspecting users toward malicious infrastructure designed to compromise their systems.

The attack sequence utilizes the legacy ‘finger’ utility, a tool historically used for querying user information on remote systems, to initiate the infection process. Once triggered, the campaign prompts the user to complete a fake CAPTCHA. Engaging with this fraudulent verification step results in the unauthorized installation of malware, most notably the Lumma information stealer, which is designed to harvest sensitive data from infected devices.

This campaign highlights the ongoing threat of “ClickFix” social engineering techniques, where attackers guide users through seemingly routine security or verification prompts to gain execution privileges on a system. By combining deceptive search engine optimization with the repurposing of outdated or obscure system tools, threat actors continue to bypass traditional security awareness by mimicking standard web-based interactions.

Source: Dark Reading
Original article: https://www.darkreading.com/cyberattacks-data-breaches/decades-old-windows-utility-modern-clickfix-attack

Security researchers have identified an increase in ‘ClickFix’ attacks, a technique where cybercriminals deceive users into executing malicious code. According to findings from Push Security, attackers are increasingly utilizing the popularity of artificial intelligence tools as a lure to facilitate these infections.

The campaign employs various methods to target users, including the distribution of fake AI software installers and the manipulation of search results to lead victims toward malicious sites. Furthermore, attackers are leveraging trusted chatbot platforms to distribute links that initiate the attack chain.

ClickFix attacks often operate by bypassing traditional security defenses, relying on social engineering to trick individuals into performing actions that compromise their systems. By masquerading as legitimate AI utilities, these malicious campaigns aim to increase the likelihood that users will inadvertently execute malware.

The shift toward AI-themed lures reflects a broader trend of threat actors adapting their tactics to capitalize on current technological interests, making it essential for users to exercise caution when interacting with software downloads and search results related to new AI platforms.

Source: BleepingComputer
Original article: https://www.bleepingcomputer.com/news/security/clickfix-has-never-been-bigger-and-ai-tools-are-its-most-convincing-lure-yet/