🛑 The Mask APT is back—this time, they’re smarter.

A decade-old espionage group is exploiting trusted tools like MDaemon WorldClient and HitmanPro drivers to bypass your defenses—undetected.

—They infect Windows, macOS, Android, and iOS seamlessly.
—New attacks spotted in 2019, 2022, and 2024 prove their persistence.
—Goreto malware uses Google Drive to fetch commands, leveraging tools we all rely on.

🔗 Full analysis reveals how this group operates: https://thehackernews.com/2024/12/the-mask-apt-resurfaces-with.html

⚠️ Would you trust “UpdateMe.exe” or “SecurityPatch.exe”?

Cybercriminals are disguising malware as software updates to deliver CoinLurker, a stealer targeting cryptocurrency wallets.

❓ Did you know:
• Evades detection using stolen EV certificates and advanced obfuscation
• Steals data from crypto wallets (Bitcoin, Ledger Live, Exodus)
• Harvests credentials from tools like Telegram, Discord, FileZilla

🛡️ Protect Your Team:
• Use ad-blocking tools to filter suspicious links
• Train employees to spot fake software updates
• Monitor downloads for anomalies

👉 Read details here: https://thehackernews.com/2024/12/hackers-exploit-webview2-to-deploy.html

⚠️ Imagine this: Your team downloads what looks like a regular PDF. Behind the scenes? Malware that steals data, controls devices, and watches everything.

This isn’t fiction. The Bitter APT group is targeting high-value Turkish defense firm using:

• Fake World Bank PDFs as lures.
• NTFS Alternate Data Streams (ADS) to hide PowerShell malware inside harmless files.
• WmRAT & MiyaRAT to steal data, take screenshots, and run remote commands.

🔗 Learn more: https://thehackernews.com/2024/12/bitter-apt-targets-turkish-defense.html

🔒 Is your team hunting threats... or drowning in data?

Cyber attackers don’t wait. Neither should you. 5 expert techniques from @anyrun_app can help you:

• Spot threats targeting your region
• Validate suspicious IPs & scripts fast
• Track evolving TTPs to stay ahead of attackers
• Build real-time threat intel for proactive defense

⏱️ Early detection = less damage, fewer disruptions, and smarter resource allocation.

👉 Start preventing attacks. Learn the techniques here: https://thehackernews.com/2024/12/5-practical-techniques-for-effective.html

💣 From LNK to MSC — Tax-themed phishing lures are delivering stealthy backdoors using MSC files disguised as PDFs to target Pakistan.

» MSC files mimic legit Windows Management tools, making detection harder.
» The attack combines stealthy delivery and scheduled tasks for persistence.

🔗 Details here: https://thehackernews.com/2024/12/hackers-use-microsoft-msc-files-to.html

⚠️ DarkGate isn’t new – but its delivery methods are evolving.

Attackers are now impersonating external suppliers on Microsoft Teams calls, tricking victims into installing AnyDesk for remote access.

🔍 DarkGate's Capabilities: Keylogging, screen capture, credential theft, and audio recording.

👉 Read the full article here: https://thehackernews.com/2024/12/attackers-exploit-microsoft-teams-and.html

🔥 A critical Apache Struts vulnerability (CVE-2024-53677) with a 9.5/10 CVSS score is actively being exploited, putting corporate IT stacks at risk.

» Hackers are uploading malicious files, enabling remote code execution.
» Systems running Struts versions 2.0.0 to 6.3.0.2 are vulnerable.

👉 Don’t be tomorrow’s headline. Upgrade to Struts 6.4.0+ and adopt the Action File Upload mechanism NOW to stay secure.

Find details here: https://thehackernews.com/2024/12/patch-alert-critical-apache-struts-flaw.html

🔒 Meta under fire (again): The 2018 Facebook breach has just cost the company €251 million—and exposed 29 million accounts worldwide, including sensitive data such as emails, phone numbers, and even children’s information.

A flaw in the 👀 “View As” feature allowed attackers to steal access tokens and compromise user accounts.

👉 Learn more about the case: https://thehackernews.com/2024/12/meta-fined-251-million-for-2018-data.html

🔒 “Words matter,” says INTERPOL.

Shifting from "pig butchering" to "romance baiting" shifts the narrative to support victims, not shame them.

Victims are not just losing money—they're trapped in emotional manipulation by transnational organized crime groups.

Read to know how these scams operate and how to defend against them 👉 https://thehackernews.com/2024/12/interpol-pushes-for-romance-baiting-to.html

APT29, a Russia-linked threat group, is repurposing legitimate red team tools for cyberespionage:

» Targeting: Governments, researchers, and think tanks
» Scale: 200 victims hit in just one day
» Method: Malicious RDP files that bypass malware defenses

Why should you care? These attacks silently steal data like credentials and sensitive documents—without leaving a trace.

🔗 Stay informed. Details here: https://thehackernews.com/2024/12/apt29-hackers-target-high-value-victims.html

🔒 2024’s Cybersecurity Benchmark is Here! Cynet just achieved 100% Detection Visibility and 100% Protection in the 2024 MITRE ATT&CK Evaluation.

Here’s why this matters:

🛡️ 100% Detection across every test.
🚫 No false positives, no delays.
🔒 Protection on every attack step executed.

Evaluate how your current vendor compares. Read more about Cynet’s performance: https://thehackernews.com/2024/12/only-cynet-delivers-100-protection-and.html

🚨 A critical flaw (CVE-2024-12356, CVSS score: 9.8) has been discovered in BeyondTrust's Privileged Remote Access (PRA) and Remote Support (RS) products.

An unauthenticated attacker could exploit this to inject commands and execute arbitrary OS actions, posing a serious security risk.

Learn more: https://thehackernews.com/2024/12/beyondtrust-issues-urgent-patch-for.html

Are tech debt challenges holding you back?

📉 Dive into ActiveState's latest whitepaper, featuring best practices to turn tech debt into a strategic advantage.

🔍 Learn how effective open source management can reduce opportunity costs and security risks. Empower your team with actionable insights.

Download now: https://thn.news/tech-debt-best-practices

🔒 Would you click on a fake DocuSign email? Thousands already did.

Phishers are baiting employees with urgent DocuSign alerts, exploiting trusted services like HubSpot Free Form Builder to redirect users to fake Office 365 login pages for credential theft.

The numbers tell the story:
💻 20,000+ users in Europe impacted
🛠️ Bulletproof hosting powers attackers’ infrastructure
🌍 Increasing abuse of trusted tools like Google Calendar

👉 Learn more: https://thehackernews.com/2024/12/hubphish-exploits-hubspot-tools-to.html

⚠️ Ukraine’s CERT-UA uncovers a malware attack targeting military personnel.

Disguised as the Army+ app, this sophisticated attack:

» Exploits Cloudflare Workers and Pages to host fake login pages.
» Tricks users into giving up credentials.
» Installs OpenSSH and steals cryptographic keys via the TOR network.

💡 Even legitimate services are becoming a haven for cybercriminals, raising red flags for CISOs and CTOs.

🔗 Read the full analysis here: https://thehackernews.com/2024/12/uac-0125-abuses-cloudflare-workers-to.html

Netflix has been fined €4.75M for violating GDPR by failing to explain how it used customer data like email addresses and payment details between 2018–2020.

Read more: https://thehackernews.com/2024/12/dutch-dpa-fines-netflix-475-million-for.html

🔥 Critical Alert: CISA’s new directive, BOD 25-01, sets a new benchmark in cloud security for federal agencies.

Why? Misconfigurations and weak controls are opening doors to attackers.

Key Deadlines:
» By Feb 2025: Identify all cloud tenants
» By Apr 2025: Deploy SCuBA assessment tools
» By Jun 2025: Implement mandatory policies

🔗 Learn how to protect your communications effectively: https://thehackernews.com/2024/12/cisa-mandates-cloud-security-for.html

🛡️ Regularly update security configurations to reduce your attack surface.

🛑 Fortinet's Wireless LAN Manager (FortiWLM) is vulnerable to a path traversal flaw (CVE-2023-34990) with a 9.6/10 CVSS score.

Why it’s urgent: It allows attackers to...
1️⃣ Access admin accounts using static session IDs.
2️⃣ Execute unauthorized commands by chaining vulnerabilities.
3️⃣ Gain root access to your network in minutes.

🛠️ Patch now:
Affected versions: 8.5.0 to 8.6.5.
Fixed in 8.6.6—update immediately.

Read: https://thehackernews.com/2024/12/fortinet-warns-of-critical-fortiwlm.html

🚨 What if your device unknowingly became a tool for cybercrime? It’s happening now.

Mirai malware strikes Juniper SSR devices, leveraging default passwords to turn them into DDoS attack machines. Over 90% of breached systems had unaltered factory settings.

🔑 Don’t leave the door open. Secure your systems today.

Read the full report: https://thehackernews.com/2024/12/juniper-warns-of-mirai-botnet-targeting.html

Threat actors are tricking developers with fake npm packages like typescript-eslint lookalikes, amassing thousands of downloads.

Compromised tools = compromised enterprises. One wrong download could breach your entire development cycle.

🔒 Your move:
✅ Review your dependencies.
✅ Learn how these attacks work.
✅ Build a resilient security strategy.

👉 Read here: https://thehackernews.com/2024/12/thousands-download-malicious-npm.html

🚨 CISA warns of an actively exploited critical flaw (CVE-2024-12356, CVSS: 9.8) in BeyondTrust's Privileged Remote Access (PRA) and Remote Support (RS) products.

Attackers can exploit this flaw to run arbitrary commands—no authentication required.

Read: https://thehackernews.com/2024/12/cisa-adds-critical-flaw-in-beyondtrust.html