News

In what can be described as the case of both cybersquatting and phishing, threat actors have reportedly created a site that imitates the legitimate secure note sharing service privnote.com to steal bitcoins. The creators of privnote.com, a legitimate site that offers a self-destructive pastes service, were concerned that someone had created a fake version of their website to trick users into using it. "Earlier this year, KrebsOnSecurity heard from the owners of Privnote.com, who complained that someone had...

The United States has announced it has amended the ban on US companies doing business with Huawei. The move entails allowing US companies to share information about technologies with Huawei for the purpose of developing joint standards without requiring an export licence. US Secretary of Commerce Wilbur Ross said, however, that the change in policy is not a softening on the government's stance against Huawei, which is still placed on the Entity List. Rather, the amendment...

Security researchers at F5 Labs have spotted ongoing attacks using Qbot malware payloads to steal credentials from customers of dozens of US financial institutions. Qbot (also known as Qakbot, Pinkslipbot, and Quakbot) is a banking trojan with worm features used to steal banking credentials and financial data, as well as to log user keystrokes, deploy backdoors, and drop additional malware on compromised machines. Among the banks whose customers have been targeted in this Qbot campaign, the...

Windows 10 users are reporting that they are unable to print using devices from multiple vendors after installing updates for Windows 10 versions 1903, 1909, and 2004 devices released on June 9, 2020. KB4560960 and KB4557957, the updates causing these issues, are cumulative updates that were released on Tuesday with security fixes for multiple Windows 10 components, as well as improvements and fixes for various Windows 10 features. Even though no Microsoft officials have confirmed it, a...

Bad guys find unprotected Elasticsearch servers exposed on the web faster than search engines can index them. A study found that threat actors are mainly going for cryptocurrency mining and credential theft. For the duration of the experiment, a honeypot with a fake database recorded more than 150 unauthorized requests, the first one occurring less than 12 hours since being exposed. Comparitech’s research team, led by Bob Diachenko, left the Elasticsearch server exposed on the...

D-Link has released a firmware update to fix three out of six security vulnerabilities reported for the DIR-865L wireless router model for consumers. One flaw is rated critical, others are high-severity. Attackers can use the bugs to execute arbitrary commands, steal sensitive information, upload malware, or delete data. D-Link’s DIR-865L was released in 2012 and is no longer supported for U.S. consumers but its status on localized pages for European countries is End of Sale. This means that...

The government will provide £10 million over four years “to develop groundbreaking cybersecurity technologies,” as part of its commitment to increase investment in R&D to 2.4 percent of GDP by 2027, Digital Secretary Oliver Dowden announced. Nine winning research teams share the £10 million investment under the government’s Digital Security by Design programme, which aims to help the tech infrastructure of UK organisations and digital devices be more resilient to cyberattacks. Grant winners are creating...

Hacker groups that engage in web skimming (also known as Magecart) attacks have breached the web stores of two of the world's biggest retail chains -- accessories store Claire's and sporting goods retailer Intersport. According to reports published today by security firms Sanguine Security and ESET, hackers breached the two companies' websites and hid malicious code that would record payment card details entered in checkout forms. According to Sanguine Security's Willem de Groot, Claire's website was compromised...

European energy company giant Enel Group suffered a ransomware attack a few days ago that impacted its internal network. Detected on June 7, the incident is the work of EKANS (SNAKE) ransomware operators, the group that also targeted Honda earlier this week. Enel Group confirmed for BleepingComputer that its internal IT network was disrupted on Sunday evening following a ransomware attack caught by their antivirus before the malware could spread. Dealing with the incident required isolating the...

Social networking giant Twitter disclosed today three new state-linked information operations that have been taking place on its platform this year. As a result of its investigation, Twitter said it banned and removed 32,242 accounts that were part of networks operated out of China, Russia, and Turkey, all three pushing local political agendas and narratives, and associated with state-sponsored entities. Of the three networks, the largest was the one based in China. Twitter said it banned 23,750...