February 23

News/Trends 9 

• Microsoft Releases PyRIT – A Red Teaming Tool for Generative AI

• Cybersecurity Trends in 2024: 5 Key Areas to Follow

• Businesses Increase Cybersecurity as Budgets Surge in 2024

• If you pay ransom, you may not get your data back and worse, you probably WILL get hit again – Cybereason Survey

• FTC Slams Avast with $16.5 Million Fine for Selling Users’ Browsing Data

• Dormant PyPI Package Compromised to Spread Nova Sentinel Malware

• IBM: Identity Compromises Surge as Top Initial Access Method for Cybercriminals

• New Wi-Fi Vulnerabilities Expose Android and Linux Devices to Hackers

• LockBit Infrastructure Disrupted by Global Law Enforcers

• Russian Government Software Backdoored to Deploy Konni RAT Malware

Law/Policy

• ICO Bans Serco Leisure’s Use of Facial Recognition for Employee Attendance

• EU Data Act Regulates Business-to-Business Contracts Relating to Access and Use of Data

• Biden Executive Order to Bolster US Maritime Cybersecurity

• Japan Sees Increased Cyberthreats to Critical Infrastructure, Particularly From China

• EU Court of Human Rights Rejects Encryption Backdoors

• SaaS Compliance through the NIST Cybersecurity Framework

Technical

• Enabling Zero Trust Security in IoMT Edge Network

• Exploring Emerging Trends in 5G Malicious Traffic Analysis and Incremental Learning Intrusion Detection Strategies

• Leveraging AI Planning For Detecting Cloud Security Vulnerabilities

• Privacy-Preserving Instructions for Aligning Large Language Models

• Unlink to Unlearn: Simplifying Edge Unlearning in GNNs

Report, blogs, podcasts

• AIs Hacking Websites

• Prescription orders delayed as US pharmacies grapple with “nation-state” cyber attack

• New Leak Shows Business Side of China’s APT Menace

• Microsoft Is Spying on Users of Its AI Tools

• Analyzing Threat Reports with Fabric

• Smashing Security podcast #360: LockBit locked out, and funeral Facebook scams

• Feds Seize LockBit Ransomware Websites, Offer Decryption Tools, Troll Affiliates

• Episode 256: Recursive Pollution? Data Feudalism? Gary McGraw On LLM Insecurity

• Insights from the NSA 2023 Cybersecurity Report

February 16

News/Trends

• Hackers Exploit EU Agenda in Spear Phishing Campaigns

• PDF Malware on the Rise, Used to Spread WikiLoader, Ursnif and DarkGate

• China Calls Out U.S. For Hacking. The Proof? TBD!

• US military notifies 20,000 of data breach after cloud email leak

• Chinese Hackers Using Deepfakes in Advanced Mobile Banking Malware Attacks

• Romantic AI Chatbots Fail the Security and Privacy Test

• Bumblebee Malware Returns with New Tricks, Targeting U.S. Businesses

• Microsoft, OpenAI Confirm Nation-States are Weaponizing Generative AI in Cyber-Attacks

• DarkMe Malware Targets Traders Using Microsoft SmartScreen Zero-Day Vulnerability

• US Dismantles Warzone RAT Malware Operation

Law/Policy

• Rules on Targeted Advertising: What do the Digital Markets Act and Digital Services Act Say?

• FTC Wants to Crack Down on AI Impersonation of Individuals

• CISA Reveals JCDC’s 2024 Cybersecurity Priorities

• European Commission Announces New Package of AI Measures

• FTC Says It Will Go After Companies That ‘Quietly’ Change Privacy Policies to Mine User Data for AI

• AI-Generated Voices in Robocalls Now Illegal

Technical

• Data Reconstruction Attacks and Defenses: A Systematic Evaluation

• MAGNETO: Edge AI for Human Activity Recognition — Privacy and Personalization

• Combatting deepfakes: Policies to address national security threats and rights violations

• Software vulnerable functions discovery based on code composite feature

• A Note on Adversarial Online Complexity in Security Proofs of Duplex-Based Authenticated Encryption Modes

Report, blogs, podcasts

• Google Calls for Framework Giving AI Access to Incident Data

• We Can’t Risk Losing Staff to Alert Fatigue

• U.S. Internet Leaked Years of Internal, Customer Emails

• On the Insecurity of Software Bloat

• Rhysida ransomware cracked! Free decryption tool released

• Fat Patch Tuesday, February 2024 Edition

• Smashing Security podcast #359: Declaring war on ransomware gangs, mobile muddles, and AI religion

• Leveraging AI LLMs to Counter Social Engineering: A Psychological Hack-Back Strategy

• Improving the Cryptanalysis of Lattice-Based Public-Key Algorithms

• 5 Key Findings from the Business Email Compromise (BEC) Trends Report

February 9

News/Trends 9

• Record-Breaking Ransomware Profits Surpassed $1B in 2023

• Chinese Hackers Operate Undetected in U.S. Critical Infrastructure for Half a Decade

• Proposed contractor cyber reporting rule sets a ‘significantly problematic’ bar, industry groups say

• After FBI Takedown, KV-Botnet Operators Shift Tactics in Attempt to Bounce Back

• Paying Ransoms is Becoming a Cost of Doing Business for Many

• Patchwork Using Romance Scam Lures to Infect Android Devices with VajraSpy Malware

• Experts Detail New Flaws in Azure HDInsight Spark, Kafka, and Hadoop Services

• Chinese Spies Hack Dutch Networks With Novel Coathanger Malware

• Malware-as-a-Service Now the Top Threat to Organizations

Law/Policy

• Are Cybersecurity Performance Measures Realistic?

• FTC Announces Proposed Consent Orders Related to Location Data

• US announces visa ban on those linked to commercial spyware

• EU Adopts First Cybersecurity Certification Scheme for Safer Tech

Technical

• Unraveling the Key of Machine Learning Solutions for Android Malware Detection

• Universal Post-Training Reverse-Engineering Defense Against Backdoors in Deep Neural Networks

• A novel pattern recognition system for detecting Android malware by analyzing suspicious boot sequences

• Privacy and Security Implications of Cloud-Based AI Services : A Survey

Report, blogs, podcasts

• Surge in deepfake “Face Swap” attacks puts remote identity verification at risk

• Best practices to shrink the ever-present risk of Exchange Server getting corrupted

• IT suppliers hacked off with Uncle Sam’s demands in aftermath of cyberattacks

• On Software Liabilities

• Tooth be told: Toothbrush DDoS attack claim was lost in translation, says Fortinet

• Smashing Security podcast #358: Hong Kong hijinks, pig butchers, and poor ransomware gangs

• Documents about the NSA’s Banning of Furby Toys in the 1990s

• Report: Ethical Hackers Reported 835 Vulnerabilities, Earned $450K in 2023

• From Cybercrime Saul Goodman to the Russian GRU

February 2

News/Trends

• DirtyMoe Malware Infects 2,000+ Ukrainian Computers for DDoS and Cryptojacking

• White House Seeks Ideas on Boosting AI Privacy

• INTERPOL Arrests 31 in Global Operation, Identifies 1,900+ Ransomware-Linked IPs

• New Malware Emerges in Attacks Exploiting Ivanti VPN Vulnerabilities

• CISA Warns of Active Exploitation Apple iOS and macOS Vulnerability

• Italian Businesses Hit by Weaponized USBs Spreading Cryptojacking Malware

• U.S. Feds Shut Down China-Linked “KV-Botnet” Targeting SOHO Routers

• Alpha Ransomware Group Launches Data Leak Site on the Dark Web

• Top Security Posture Vulnerabilities Revealed

• EU Launches First Cybersecurity Certification for Digital Products

• Researchers Uncover How Outlook Vulnerability Could Leak Your NTLM Passwords

Law/Policy

• EU and United States enhance cooperation on cybersecurity

• Trends in AI:  U.S. State Legislative Developments

• White House Rejects Efforts to Undo SEC Cyber Disclosure Rule

• EU Rules Restricting the International Transfers of Non-Personal Data

• Department of Commerce Issues Proposed Rule to Regulate Infrastructure-as-a-Service Providers and Resellers

• Draft Delegated and Implementing Acts Pursuant to the Digital Services Act

Technical

• Testing side-channel security of cryptographic implementations against future microarchitectures

• Vision-LLMs Can Fool Themselves with Self-Generated Typographic Attacks

• Securing Cloud-Based Internet of Things: Challenges and Mitigations

• Effective Multi-Stage Training Model For Edge Computing Devices In Intrusion Detection

• ActDroid: An active learning framework for Android malware detection

Report, blogs, podcasts

• FTC slams Blackbaud for “shoddy security” after hacker stole data belonging to thousands of non-profits and millions of people

• The Just Security Podcast: How Should the World Regulate Artificial Intelligence?

• Arrests in $400M SIM-Swap Tied to Heist at FTX?

• Streamlining the Cybersecurity Maturity Model Certification (CMMC)

• Smashing Security podcast #357: Interview with an iPhone thief, anti-AI, and have we gone too far?

• Facebook’s Extensive Surveillance Network

• HISCOX Cyber Readiness Report Shines Light on Commercial Cybersecurity

• NSA Buying Bulk Surveillance Data on Americans without a Warrant

• ICS and OT threat predictions for 2024

• Fla. Man Charged in SIM-Swapping Spree is Key Suspect in Hacker Groups Oktapus, Scattered Spider