NEWS:
EU lawmakers call for a new set of rules for A.I. tools such as ChatGPT
A group of European Union lawmakers called for new rules to regulate a larger swath of artificial intelligence tools, beyond those identified as explicitly high risk under the region’s proposed AI Act. The letter comes after a group of prominent AI experts called for Europe to make its AI rules more expansive, arguing that excluding general purpose AI, or GPAI, would miss the mark. The lawmakers said they share some of the concerns of the Future of Life Institute, which along with Elon Musk and others called for a six-month pause on some advanced AI deployment, but called some of their statements “alarmist.”
Russia-Linked Hackers Launches Espionage Attacks on Foreign Diplomatic Entities
The Russia-linked APT29 (aka Cozy Bear) threat actor has been attributed to an ongoing cyber espionage campaign targeting foreign ministries and diplomatic entities located in NATO member states, the European Union, and Africa. According to Poland’s Military Counterintelligence Service and the CERT Polska team, the observed activity shares tactical overlaps with a cluster tracked by Microsoft as Nobelium, which is known for its high-profile attack on SolarWinds in 2020. Nobelium’s operations have been attributed to Russia’s Foreign Intelligence Service (SVR), an organization that’s tasked with protecting “individuals, society, and the state from foreign threats.”
https://thehackernews.com/2023/04/russia-linked-hackers-launches.html
Germany examining Chinese components in its 5G network, interior minister says
BERLIN, April 16 (Reuters) – Germany’s Interior Ministry is examining all Chinese components that are already installed in the country’s 5G network, Minister Nancy Faeser was quoted as saying on Sunday, as Berlin re-evaluates its relationship with top trade partner China. “We have to protect our communication networks,” Faeser told Bild am Sonntag newspaper, adding that the examination’s three priorities were identifying risks, averting dangers and avoiding dependencies. “This is especially true for our critical infrastructure,” she said. Germany has been considering banning certain components from Chinese companies Huawei and ZTE in its telecoms networks, a government source told Reuters last month, in a potentially significant move to address security concerns.
Online Gaming Chats Have Long Been Spy Risk for US Military
Step into a U.S. military recreation hall at a base almost anywhere in the world and you’re bound to see it: young troops immersed in the world of online games, using government-funded gaming machines or their own consoles. The enthusiasm military personnel have for gaming — and the risk that carries — is in the spotlight after Jack Teixeira, a 21-year-old Massachusetts Air National Guardsman, was charged with illegally taking and posting highly classified material in a geopolitical chat room on Discord, a social media platform that started as a hangout for gamers.
Australians lost a record $3.1 billion to scams last year
The Australian Competition & Consumer Commission (ACCC) says Australians lost a record $3.1 billion to scams in 2022, an 80% increase over the total losses recorded in 2021. Most of the losses concern investment scams, which accounted for $1.5 billion, followed by remote access scams that resulted in losses of $229 million, and payment redirection scams that cost victims another $224 million. These figures are based on data collected by ACCC’s Scamwatch, ReportCyber, the Australian Financial Crimes Exchange (AFCX), IDCARE, and various other government agencies.
INCIDENTS:
Pegasus spyware deployed on iPhones in Mexico
Pegasus spyware has been reportedly used to target dissenters in Mexico, where the military has come under fire for repeated human rights abuses. Citizen Lab, a cyber analyst based in Canada, disclosed its most recent findings, which indicate that last year NSO Group’s “customers” deployed 16 zero-click exploits – system defense breaches that can be used to attack without luring a target into clicking on a malicious link – against civilian targets worldwide.
https://cybernews.com/tech/pegasus-spyware-iphones-nso-mexico/
Kodi Confirms Data Breach: 400K User Records and Private Messages Stolen
Open source media player software provider Kodi has confirmed a data breach after threat actors stole the company’s MyBB forum database containing user data and private messages. What’s more, the unknown threat actors attempted to sell the data dump comprising 400,635 Kodi users on the now-defunct BreachForums cybercrime marketplace. “MyBB admin logs show the account of a trusted but currently inactive member of the forum admin team was used to access the web-based MyBB admin console twice: on 16 February and again on 21 February,” Kodi said in an advisory.
https://thehackernews.com/2023/04/kodi-confirms-data-breach-400k-user.html
MALWARE:
YouTube Videos Distributing Aurora Stealer Malware via Highly Evasive Loader
Cybersecurity researchers have detailed the inner workings of a highly evasive loader named “in2al5d p3in4er” (read: invalid printer) that’s used to deliver the Aurora information stealer malware. “The in2al5d p3in4er loader is compiled with Embarcadero RAD Studio and targets endpoint workstations using advanced anti-VM (virtual machine) technique,” cybersecurity firm Morphisec said in a report shared with The Hacker News. Aurora is a Go-based information stealer that emerged on the threat landscape in late 2022. Offered as a commodity malware to other actors, it’s distributed through YouTube videos and SEO-poised fake cracked software download websites.
https://thehackernews.com/2023/04/youtube-videos-distributing-aurora.html
New QBot Banking Trojan Campaign Hijacks Business Emails to Spread Malware
A new QBot malware campaign is leveraging hijacked business correspondence to trick unsuspecting victims into installing the malware, new findings from Kaspersky reveal. The latest activity, which commenced on April 4, 2023, has primarily targeted users in Germany, Argentina, Italy, Algeria, Spain, the U.S., Russia, France, the U.K., and Morocco. QBot (aka Qakbot or Pinkslipbot) is a banking trojan that’s known to be active since at least 2007. Besides stealing passwords and cookies from web browsers, it doubles up as a backdoor to inject next-stage payloads such as Cobalt Strike or ransomware.
https://thehackernews.com/2023/04/new-qbot-banking-trojan-campaign.html
Ransomware gangs abuse Process Explorer driver to kill security software
Threat actors use a new hacking tool dubbed AuKill to disable Endpoint Detection & Response (EDR) Software on targets’ systems before deploying backdoors and ransomware in Bring Your Own Vulnerable Driver (BYOVD) attacks. In such attacks, malicious actors drop legitimate drivers signed with a valid certificate and capable of running with kernel privileges on the victims’ devices to disable security solutions and take over the system. This technique is popular among various threat actors, from state-backed hacking groups to financially-motivated ransomware gangs.
VULNERABILITIES:
Google Chrome emergency update fixes first zero-day of 2023
Google has released an emergency Chrome security update to address the first zero-day vulnerability exploited in attacks since the start of the year. “Google is aware that an exploit for CVE-2023-2033 exists in the wild,” the search giant said in a security advisory published on Friday. The new version is rolling out to users in the Stable Desktop channel, and it will reach the entire user base over the coming days or weeks.
APT28 Exploits Known Vulnerability to Carry Out Reconnaissance and Deploy Malware on Cisco Routers
The UK National Cyber Security Centre (NCSC), the US National Security Agency (NSA), US Cybersecurity and Infrastructure Security Agency (CISA) and US Federal Bureau of Investigation (FBI) are releasing this joint advisory to provide details of tactics, techniques and procedures (TTPs) associated with APT28’s exploitation of Cisco routers in 2021.
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-108
Cyber4Dev collates data from Open-Source websites, any opinions or attributions expressed in the articles are not those of Cyber4Dev and are not endorsed by the project or the EU.
