For providers

Nearly 97,000 Microsoft Exchange Servers could be at risk of ongoing attacks leveraging the critical privilege escalation zero-day vulnerability, tracked as CVE-2024-21410, BleepingComputer reports.

Operators of the Anatsa Android banking trojan have targeted Czechia, Slovakia, and Slovenia with the malware as part of a November attack campaign, which came months after the trojan, also known as Toddler and TeaBot, had been leveraged in attacks against the U.S., Switzerland, and the UK, among others, reports The Hacker News.

Cybernews reports that several documents leaked on GitHub have revealed the Chinese government's utilization of spyware developed by homegrown information security firm I-Soon in its offensive cyber operations.

Novel backdoor used in Charming Kitten attacks Attacks involving the new BASICSTAR backdoor have been deployed by Iranian advanced persistent threat operation Charming Kitten, also known as Charming Cypress, Mint Sandstorm, APT35, TA453, and Yellow Garuda, against Middle East policy experts between September and October last year, according to The Hacker News.

Numerous widely known Ukrainian media outlets, including major online newspaper Ukrainska Pravda and business media site Liga.net, have been hijacked by Russian threat actors to post false news regarding the decimation of Ukrainian special forces in the city of Avdiivka in eastern Ukraine, reports The Record, a news site by cybersecurity firm Recorded Future.

BleepingComputer reports that defense sector organizations around the world have been subjected to an ongoing cyberespionage campaign by North Korean state-backed threat operations, including the Lazarus Group.

At least 80 critical infrastructure, government, and military organizations across Europe, especially those in Ukraine, Poland, and Georgia, have been targeted by October attacks by Russian hacking operation TAG-70, also known as Winter Vivern, UAC-0014, and TA473, which involved the exploitation of cross-site scripting vulnerabilities impacting Roundcube email servers, SecurityWeek reports.

Security pros speculate that the Schneider Electric hack could wind up being another large ransomware loss like last year’s $100 million MGM case.

The now-disrupted LockBit gang outpaced its competitors in volume in 2023, as ransom amounts spiked 20% year-over-year.

Thanks to a 24-year-old security vulnerability tracked as CVE-2023-50387, attackers could stall DNS servers with just a single malicious packet, effectively taking out wide swaths of the Internet.