December 22

News/Trends

• Microsoft Warns of New ‘FalseFont’ Backdoor Targeting the Defense Sector

• Experts Detail Multi-Million Dollar Licensing Model of Predator Spyware

• Operation RusticWeb: Rust-Based Malware Targets Indian Government Entities

• BattleRoyal Cluster Signals DarkGate Surge

• Decoy Microsoft Word Documents Used to Deliver Nim-Based Malware

• New Report: 85% Firms Face Cyber Incidents, 11% From Shadow IT

• Court of Justice of the European Union Rules That Fear May Constitute Damage Under the GDPR

• New JavaScript Malware Targeted 50,000+ Users at Dozens of Banks Worldwide

• Top 7 Trends Shaping SaaS Security in 2024

• US and Australia Warn of Play Ransomware Threat

• Technology Manufacturers Urged to Eliminate Passwords

Law/Policy

• New Rules in UK Could Reimburse Fraud Victims up to £415,000 ($525,000)

• FTC Proposes Tougher Children’s Data Privacy Rules for First Time in a Decade

• Digital Services Act’s Impact on Terms of Service

• What the SEC Weighed in Finalizing the Cyber Disclosure Rules

• China’s MIIT Introduces Color-Coded Action Plan for Data Security Incidents

Technical

• One for All, All for One: A Unified Evaluation Framework for Univariate DPA Attacks

• An Approach to Abstract Multi-stage Cyberattack Data Generation for ML-Based IDS in Smart Grids

• Android Malware Detection with Unbiased Confidence Guarantees

• Applications of Neural Network-Based AI in Cryptography

• Can Large Language Models Identify And Reason About Security Vulnerabilities? Not Yet.

• Discovering Malicious Signatures in Software from Structural Interactions

Report, blogs, podcasts

• Data Exfiltration Using Indirect Prompt Injection

• Cyberattack on Ukraine’s Kyivstar Seems to Be Russian Hacktivists

• Smashing Security podcast #353: Phone hacking, Piers Morgan, and Carole’s Christmas cockup

• Episode 254: Dennis Giese’s Revolutionary Robot Vacuum Liberation Movement

• What Role Does Cybersecurity Awareness Play in Education?

• GCHQ Christmas Codebreaking Challenge

• BlackCat Ransomware Raises Ante After FBI Disruption

• Sharing stories on the CyberTuesday podcast

• OpenAI Is Not Training on Your Dropbox Documents—Today

• News alert: Salvador Technologies raises $6M to empower cyber resilience in critical systems

December 15

News/Trends

• New NKAbuse Malware Exploits NKN Blockchain Tech for DDoS Attacks

• Google’s New Tracking Protection in Chrome Blocks Third-Party Cookies

• US Senate Confirms Harry Coker Jr. as National Cyber Director

• Unveiling NKAbuse: a new multiplatform threat abusing the NKN protocol

• White House Wants to Set Minimum Cyber Standards for Hospitals, Healthcare

• Two Supreme Court Cases Could Shape the Future of AI and Content Moderation

• Why federal efforts to protect schools from cybersecurity threats fall short

• Iranian State-Sponsored OilRig Group Deploys 3 New Malware Downloaders

• Microsoft Takes Legal Action to Crack Down on Storm-1152’s Cybercrime Network

• Google Using Clang Sanitizers to Protect Android Against Cellular Baseband Vulnerabilities

Law/Policy

• UK Plans Tough New Security Rules for Datacenters

• FCC Updates Data Breach Rules, With Consumers in Mind

• Greece Plans National Cybersecurity Authority to Combat Rising Hacker Threats

• CISA and ENISA Signed a Working Arrangement to Enhance Cooperation

• FBI Explains How Companies can Delay SEC Cyber Incident Disclosures

Technical

• Privacy Constrained Fairness Estimation for Decision Trees

• Deep Learning-Based Cyber-Attack Detection Model for Smart Grids

• Understanding Crypto-Ransomware

• Individualized Deepfake Detection Exploiting Traces Due to Double Neural-Network Operations

• Black-box Membership Inference Attacks against Fine-tuned Diffusion Models

Report, blogs, podcasts

• EU Artificial Intelligence Act: Nearing the Finish Line

• A Robot the Size of the World

• Organizations Prefer a Combination of AI and Human Analysts to Monitor Their Digital Supply Chain

• ‘Virtual Wild, Wild West’: Cybercriminals use Wyoming shell companies for global hacks

• Smashing Security podcast #352: For research purposes only

• Ten Years Later, New Clues in the Target Breach

• Industry Regulations and Standards are Driving OT Security Priorities

• Hackers exploit Google Forms to trick users into falling for call-back phishing attack

• UK’s Ministry of Defence fined after Bcc email blinder that put the lives of Afghan citizens at risk

• Surveillance by the US Postal Service

December 8

News/Trends

• New 5G Modems Flaws Affect iOS Devices and Android Models from Major Brands

• Geopolitics to Blame For DoS Surge in Europe, Says ENISA

• Ransomware-as-a-Service: The Growing Threat You Can’t Ignore

• Quick Look at the New CISA Healthcare Mitigation Guide

• Hacking the Human Mind: Exploiting Vulnerabilities in the ‘First Line of Cyber Defense’

• Mac Users Beware: New Trojan-Proxy Malware Spreading via Pirated Software

• Unveiling the Threat of Malicious Browser Extensions

• FCC Partners With Four States on Privacy and Data Protection Enforcement

• Threat Actors Can Leverage AWS STS to Infiltrate Cloud Accounts

• Five Things You Need to Know About Security Misconfigurations

• LogoFAIL: UEFI Vulnerabilities Expose Devices to Stealth Malware Attacks

• Make a Fresh Start for 2024: Clean Out Your User Inventory to Reduce SaaS Risk

Law/Policy

• Deutsche Wohnen Ruling Set to Drive Up GDPR Fines

• CISA Performance Goals Program Trims Exploited CVEs

• CPPA Releases Draft Risk Assessment Regulations

• US Federal Agencies Miss Deadline for Incident Response Requirements

• EU cyber regulation wave quietly rolls on – Commission set to finalize new cyber standards

• OPM Launches Cyber Rotational Program for Feds

Technical

• Defense against ML-based Power Side-channel Attacks on DNN Accelerators with Adversarial Attacks

• ZTCloudGuard: Zero Trust Context-Aware Access Management Framework to Avoid Misuse Cases in the Era of Generative AI and Cloud-based Health Information Ecosystem

• On Active Attack Detection in Messaging with Immediate Decryption

• Risk-Aware and Explainable Framework for Ensuring Guaranteed Coverage in Evolving Hardware Trojan Detection

• Synthesizing Physical Backdoor Datasets: An Automated Framework Leveraging Deep Generative Models

Report, blogs, podcasts

• BlackSuit ransomware – what you need to know

• Cybersecurity: Federal Agencies Made Progress, but Need to Fully Implement Incident Response Requirements (GAO Report)

• New Bluetooth Attack

• Smashing Security podcast #351: Nuclear cybersecurity, Marketplace scams, and face up to porn

• Spying through Push Notifications

• Report: UK’s Sellafield Nuclear Site Hacked by Groups Linked to Russia and China

• Russian hacker pleads guilty to Trickbot malware conspiracy

• ICANN Launches Service to Help With WHOIS Lookups

• AI and Mass Spying

• Supply-chain ransomware attack causes outages at over 60 credit unions

December 1

News/Trends

• The EU’s Cyber Resilience Act Has Now Been Agreed

• Apple Patches Actively Exploited iOS Zero-Days

• FjordPhantom Android Malware Targets Banks With Virtualization

• DHS/CISA and UK NCSC Release Joint Guidelines for Secure AI System Development

• Google Fixes Sixth Chrome Zero-Day Bug of the Year

• AI Boosts Malware Detection Rates by 70%

• N. Korean Hackers ‘Mixing’ macOS Malware Tactics to Evade Detection

• German Data Protection Authorities Publish Paper on Cloud-Based Digital Health Applications

• Implications of “malware free” attacks on SMBs

• SysJoker Malware: Hamas-Related Threat Expands With Rust Variant

• K-12 schools improve protection against online attacks, but many are vulnerable to ransomware gangs

Law/Policy

• Queensland Passes Mandatory Data Breach Notice Laws

• British Afrobeat singer pleads guilty to stealing $6 million in hacks on financial accounts

• US seizes Sinbad Crypto Mixer Used by North Korean Lazarus Group

• Australia’s Cybersecurity Strategy Focuses on Protecting Small Businesses and Critical Infrastructure

• EDPB Issues Draft Guidelines on Technical Scope of ePrivacy Directive Rules for Storage and Access

Technical

• Blockchain-based Zero Trust on the Edge

• Mate! Are You Really Aware? An Explainability-Guided Testing Framework for Robustness of Malware Detectors

• Leveraging a Randomized Key Matrix to Enhance the Security of Symmetric Substitution Ciphers

• Understanding the Effectiveness of Large Language Models in Detecting Security Vulnerabilities

• Bridging Both Worlds in Semantics and Time: Domain Knowledge Based Analysis and Correlation of Industrial Process

Report, blogs, podcasts

• Not all cybercriminals are evil geniuses

• AI Decides to Engage in Insider Trading

• Okta: Breach Affected All Customer Support Users

• Extracting GPT’s Training Data

• Smashing Security podcast #350: Think before you shrink! And our guest is faked

• ID Theft Service Resold Access to USInfoSearch Data

• BitCoins To Bombs: North Korea Funds Military With Billions In Stolen Cryptocurrency

• iOS 17 NameDrop privacy scare: What you need to know

• Why IT teams should champion AI in the workplace, and deploy secure AI tools safely to their teams