Security Program Controls/Technologies

Threat actors who compromised Great Plains' systems between Sep. 5 and 8 were able to copy, encrypt, and exfiltrate files including individuals' names, Social Security numbers, demographic details, driver's license numbers, health insurance information, and diagnosis and medication details, according to the medical center, which did not name its attackers.

While email correspondences between the Congressional Research Service and other Library staff and certain congressional offices between January and September had been compromised, such an intrusion — which was initially reported by NBC News — did not affect the House and Senate's IT networks and respective email accounts.

Infiltration of the California-based firm's system resulted in the exfiltration of individuals' names, Social Security numbers, gender, home addresses, employment status, employee numbers, hire and role-start dates, supervisors and departments, and termination dates.

Clicking on the ads including alerts on compromised passwords redirects targets to a Chrome Web Store-spoofing page, which prompts the download of the fake update in the guise of a browser extension, according to a Bitdefender report.

Aside from utilizing junk code and conducting metamorphic transformations, BabbleLoader also exploits a plethora of other techniques, including unique control flow and encryption, to conceal malicious activities from traditional and artificial intelligence-based detection systems, according to an Intezer analysis.

More severe of the two issues — both of which have been discovered and reported by TZL security researchers during the Matrix Cup hacking competition in China — is the critical remote code execution flaw, tracked as CVE-2024-38812, which stems from a vCenter DCE/RPC protocol heap overflow issue.

Integration of a Fortinet plugin exploiting the yet-to-be-patched zero-day into its newest iteration has enabled DeepData to facilitate the identification and decryption of credentials and server details from VPN process memory-stored JSON objects, which are then exfiltrated by the DeepPost malware, according to a Volexity report.

Thirty-two of the listed victims have been included in the Akira ransomware site's "leaks" section for the first time, reported Cyberint researcher Adi Bleih, who noted that the unprecedented data exposure was more likely part of an effort to tout its expanding operations following a relative dearth of postings from August to October.