Security Leftovers
-
India: Government warns of 'Akira' ransomware targeting Windows and Linux users [Ed: But how does that get onto "Linux"? It does not have NSA bug doors like Windows.]
India's nodal agency for computer security-related threats has issued a warning to citizens and organisations about the emergence of a new ransomware called 'Akira'. Union government's Computer Emergency Response Team-India (CERT-In) issued the critical advisory on Monday, stating that the ransomware was targeting both Windows and Linux-based operating systems.
The agency informed that the group responsible for the ransomware compromised the users via VPN services, particularly when the users had not enabled multi-factor authentication. It also hoodwinked the users through tools such as AnyDesk, WinRAR, and PC Hunter, to download benign-looking files.
-
Kaspersky Unveils Specialised Solution for Linux-based Embedded Devices | Technology - Science News, Times Now [Ed: Is proprietary software from Russia trustworthy?]
-
Security updates for Wednesday [LWN.net]
Security updates have been issued by Debian (amd64-microcode, gst-plugins-bad1.0, gst-plugins-base1.0, gst-plugins-good1.0, iperf3, openjdk-17, and pandoc), Fedora (389-ds-base, kitty, and thunderbird), SUSE (libqt5-qtbase, libqt5-qtsvg, mysql-connector-java, netty, netty-tcnative, openssl, openssl-1_1, openssl1, php7, python-scipy, and xmltooling), and Ubuntu (amd64-microcode, avahi, libxpm, linux, linux-aws, linux-aws-5.15, linux-azure, linux-azure-5.15, linux-azure-fde, linux-azure-fde-5.15, linux-gcp, linux-gcp-5.15, linux-gke, linux-gke-5.15, linux-gkeop, linux-gkeop-5.15, linux-hwe-5.15, linux-ibm, linux-intel-iotg, linux-kvm, linux-lowlatency, linux-lowlatency-hwe-5.15, linux-nvidia, linux-oracle, linux-oracle-5.15, linux-raspi, linux, linux-aws, linux-azure, linux-gcp, linux-ibm, linux-kvm, linux-lowlatency, linux-oracle, linux-raspi, linux-oem-5.17, linux-oem-6.0, linux-oem-6.1, openstack-trove, and python-django).
-
Major Malaysian water utilities company hit by hackers; Ranhill offline; hackers claim databases and backups deleted
After a period of quiet, DESORDEN Group has re-emerged as a threat to Malaysian entities, and now, it seems, to providing drinkable water to Johor (see this post from 2021 for an overview of Ranhill Utilities Berhad in the environment sector and the role of AquaSmart).
-
Group-IB founder Ilya Sachkov sentenced to 14 years in prison for high treason
The Moscow City Court sentenced to 14 years in prison the founder of Group-IB Ilya Sachkov. As reports (https://lenta.ru/news/2023/07/26/sachkovvv/) to Lenta.ru, he will serve his sentence in a strict regime colony.
-
Presumably the largest Dutch user of the Genesis Market arrested
-
Investigation into arms trade leads to suspected cybercriminal
-
Ambulance patient records system hauled offline for cyber-attack probe
Several UK NHS ambulance organizations have been struggling to record patient data and pass it to other providers following a cyber-attack aimed at health software company Ortivus.
In a statement, the Sweden-headquartered software vendor said it was subject to a cyber-attack on July 18 which hit UK customer systems within its hosted datacenter environment.
-
Yamaha confirms cyberattack after multiple ransomware gangs claim attacks
Yamaha’s Canadian music division confirmed that it recently dealt with a cyberattack after two different ransomware groups claimed to have attacked the company.
The Yamaha Corporation — different from the spun-off motorcycle division — is a Japanese manufacturing giant producing musical instruments and audio equipment. It is considered the world’s largest producer of musical equipment.
In a statement last Thursday, Yamaha Canada Music said it “recently encountered a cyberattack that led to unauthorized access and data theft.”
-
North Korean hackers targeting JumpCloud mistakenly exposed their IP addresses, researchers say
Security researchers say they have high confidence that North Korean hackers were behind a recent intrusion at enterprise software company JumpCloud because of a mistake the hackers made.
Mandiant, which is assisting one of JumpCloud’s affected customers, attributed the breach to hackers working for North Korea’s Reconnaissance General Bureau, or RGB, a hacking unit that targets cryptocurrency companies and steals passwords from executives and security teams.