Gamaredon, a Russian-linked hacking group, targets mobile devices with BoneSpy and PlainGnome, #spyware stealing SMS, call logs, location, and photos in former Soviet states.

Find details here: https://thehackernews.com/2024/12/gamaredon-deploys-android-spyware.html

Over 296,000 Prometheus Node Exporter instances and 40,300 servers are publicly accessible, exposing sensitive credentials and API keys.

Read the full article: https://thehackernews.com/2024/12/296000-prometheus-instances-exposed.html

U.S. DoJ dismantles Rydox marketplace, seizes $225K in cryptocurrency, arrests three Kosovo nationals for selling stolen data and cybercrime tools, impacting 18,000 users.

Read the story: https://thehackernews.com/2024/12/fbi-busts-rydox-marketplace-with-7600.html

🚨 New Malware Alert: PUMAKIT, a #Linux rootkit, employs advanced stealth tactics to evade detection and escalate privileges.

It’s not just hiding files—it’s altering core system behavior while remaining invisible to system tools.

Learn how PUMAKIT operates 👉 https://thehackernews.com/2024/12/new-linux-rootkit-pumakit-uses-advanced.html

🔥 Iranian-linked IOCONTROL malware exploits IoT and OT devices, targeting SCADA systems and fuel infrastructure with advanced evasion tactics like MQTT and DNS-over-HTTPS.

🔗 Learn how this sophisticated malware operates https://thehackernews.com/2024/12/iran-linked-iocontrol-malware-targets.html

🚨 U.S. DoJ indicts 14 North Koreans for a $88M IT fraud scheme involving identity theft, extortion, and data breaches. $2.26M seized and a $5M reward announced for tips.

Learn more: https://thehackernews.com/2024/12/doj-indicts-14-north-koreans-for-88m-it.html

🛡️ Critical OpenWrt #vulnerability (CVE-2024-54143) discovered — With just a 12-character hash collision, attackers can replace legitimate firmware with a malicious alternative, all without authentication.

Discover the technical details: https://thehackernews.com/2024/12/critical-openwrt-vulnerability-exposes.html

🚨 Why Do Great Companies Still Get Breached? Advanced solutions don’t always mean advanced protection.

🎙️ Join Silverfort’s CISO, John Paul Cunningham, as he explores:
✓Common vulnerabilities often overlooked, even with advanced solutions
✓How attackers bypass traditional defenses
✓ Practical strategies to address hidden risks and blind spots

📅 16 December, 2024

👉 Don’t miss out—Reserve your spot for this exclusive webinar: https://thehacker.news/ciso-perspective-data-breaches

💬 “Strengthening defenses isn’t just about tools—it’s about strategy.”

"United States Department of Justice.pdf" – Legit? Think Again!

New Backdoor Targeting Thai Officials. Hackers are deploying a stealthy backdoor, Yokai, by disguising malware as trusted documents.

🎯 What happened? DLL side-loading enables attackers to bypass defenses.

💡 Backdoor connects to attacker-controlled servers for total system control. Without proactive measures, businesses risk breaches that cost millions.

Here’s what you can do NOW:
1️⃣ Train teams on spotting spear-phishing lures.
2️⃣ Audit systems for DLL side-loading vulnerabilities.
3️⃣ Strengthen your endpoint defenses.

Find details here: https://thehackernews.com/2024/12/thai-officials-targeted-in-yokai.html

🚨 Could Your Device Be a Secret Cybercriminal Tool?

The Federal Office of Information Security (BSI) just disrupted BADBOX, a malware preloaded on common devices like picture frames and cheap android phones.

💡 What’s the risk?
⇢ Devices turned into ad fraud machines, routing hackers' internet traffic.
⇢ Stolen authentication codes, fake Gmail & WhatsApp accounts created.

⚠️ Why it matters:
This isn’t just a malware problem—it's a supply chain crisis. If a device seems "too cheap," it might come with hidden costs.

🔗 Learn more: https://thehackernews.com/2024/12/germany-disrupts-badbox-malware-on.html

⚠️ Ukraine’s SSU uncovered a shocking case involving 15- and 16-year-olds who were tricked by the FSB into espionage missions disguised as innocent quests, assisting in reconnaissance for airstrikes.

🔎 Key Insights:
➟ How: Teens were sent coordinates, tasked to take photos/videos of key locations.
➟ Impact: Data shared via encrypted chats led to airstrikes on Ukrainian soil.
➟ Key Arrests: Ukraine’s SSU detained multiple operatives, including a Russian police officer orchestrating the missions.

Read how Ukraine dismantled this operation and what it means for cyber and physical security.

Full story here: https://thehackernews.com/2024/12/ukrainian-minors-recruited-for-cyber.html

🚨 A new PHP-based backdoor, Glutton, is wreaking havoc across the globe, targeting China, the US, Cambodia, Pakistan, and South Africa. This APT41's toolkit doesn’t stop there—it’s also attacking cybercriminals!

▶ Uses compromised enterprise hosts as bait 🎣
▶ Infects popular PHP frameworks like Laravel and ThinkPHP
▶ Modular framework with 22 unique commands for stealthy infiltration
▶ Surprisingly lacks typical nation-state-level encryption—why?
▶ Leaves no files behind—ensures stealth through FastCGI processes

👉 See how Glutton operates. Read the full story: https://thehackernews.com/2024/12/new-glutton-malware-exploits-popular.html

Double Scammed? Here’s How - Fraudsters are re-victimizing people by offering “refunds” via Europol and Interpol-branded scams:

🛑 Fake profiles, stolen accounts, and malicious links.
💸 Promises of recovering stolen money… at a high cost.

Even educated professionals are falling prey to these advanced tactics.

👉 Explore the latest trends and expert analysis here: https://thehackernews.com/2024/12/new-investment-scam-leverages-ai-social.html

🤖 AI + CI/CD: Innovation or Risk?

The BIG Question: How do you scale AI pipelines without risking compliance failures?

💡 3 Must-Know Facts:
1️⃣ Every 39 seconds, a cyberattack exploits governance gaps.
2️⃣ Weak AI governance can lead to irreversible biases and reputational damage.
3️⃣ Strong governance tracks every update and protects against evolving threats.

Decision-makers, this isn’t just about compliance—it’s about trust, ethics, and staying competitive.

👉 Secure your pipeline. Protect your innovation. Learn how here: https://thehackernews.com/2024/12/data-governance-in-devops-ensuring.html

A Serbian journalist’s phone was unlocked with Cellebrite’s tools and infected with NoviSpy, a spyware capable of:

📸 Hijacking cameras and microphones
📍 Tracking locations
🗂️ Stealing files, messages, and sensitive data

❓ Why Should You Care? This is the first known case of two invasive tools working together to spy on individuals. The misuse of surveillance tech isn't just about privacy—it's a direct threat to democracy and press freedom.

🔗 Read about the exploit: https://thehackernews.com/2024/12/novispy-spyware-installed-on.html

Salesforce powers your business—are you securing the valuable data it manages?

Join AppOmni's interactive Salesforce SaaS Security Workshop and learn how to uncover hidden risks, prevent misconfigurations, and secure your critical data.

👉 Save your spot today: https://thn.news/appomni-workshops

🚨 Malvertising Nightmare: A single ad network has been weaponized to target users with fake CAPTCHA scams, stealing credentials and money from thousands every day.

What’s happening?
🖥️ Over 3,000+ websites funnel traffic to malicious CAPTCHA pages.
💾 Victims unknowingly run dangerous PowerShell commands.
💸 Accounts and funds drained through info-stealing malware like Lumma.

👉 Learn the full story here: https://thehackernews.com/2024/12/deceptionads-delivers-1m-daily.html

🛡️ FBI: Hackers are hijacking IoT devices (web cameras, DVRs) using old vulnerabilities and weak passwords.

🛡️ CISA: Actively exploited flaws in Adobe ColdFusion and Windows Kernel. Public exploits exist.

🛡️ Routers: Over 20,000 DrayTek routers hit by ransomware via a zero-day exploit.

🔒 What’s the pattern? Unpatched systems + edge devices = easy targets for attackers.

—Patch critical systems immediately.
—Audit IoT, routers, and edge devices.

Enforce strong passwords and proactive monitoring.

🔗 Full analysis: https://thehackernews.com/2024/12/cisa-and-fbi-raise-alerts-on-exploited.html

🛑 The Mask APT is back—this time, they’re smarter.

A decade-old espionage group is exploiting trusted tools like MDaemon WorldClient and HitmanPro drivers to bypass your defenses—undetected.

—They infect Windows, macOS, Android, and iOS seamlessly.
—New attacks spotted in 2019, 2022, and 2024 prove their persistence.
—Goreto malware uses Google Drive to fetch commands, leveraging tools we all rely on.

🔗 Full analysis reveals how this group operates: https://thehackernews.com/2024/12/the-mask-apt-resurfaces-with.html

⚠️ Would you trust “UpdateMe.exe” or “SecurityPatch.exe”?

Cybercriminals are disguising malware as software updates to deliver CoinLurker, a stealer targeting cryptocurrency wallets.

❓ Did you know:
• Evades detection using stolen EV certificates and advanced obfuscation
• Steals data from crypto wallets (Bitcoin, Ledger Live, Exodus)
• Harvests credentials from tools like Telegram, Discord, FileZilla

🛡️ Protect Your Team:
• Use ad-blocking tools to filter suspicious links
• Train employees to spot fake software updates
• Monitor downloads for anomalies

👉 Read details here: https://thehackernews.com/2024/12/hackers-exploit-webview2-to-deploy.html

⚠️ Imagine this: Your team downloads what looks like a regular PDF. Behind the scenes? Malware that steals data, controls devices, and watches everything.

This isn’t fiction. The Bitter APT group is targeting high-value Turkish defense firm using:

• Fake World Bank PDFs as lures.
• NTFS Alternate Data Streams (ADS) to hide PowerShell malware inside harmless files.
• WmRAT & MiyaRAT to steal data, take screenshots, and run remote commands.

🔗 Learn more: https://thehackernews.com/2024/12/bitter-apt-targets-turkish-defense.html