For providers

After inputting valid employee emails to infiltrate Starlink's admin panel hosted on a subarucs.com subdomain, threat actors could perform password resets, omit client-side overlay, and evade two-factor authentication to access the panel's features and determine different types of customer and vehicle information, including names, vehicle identification numbers, and location details.

Threat actors could also leverage all of the vulnerabilities to enable cellphone location tracking and connection detail exfiltration that could be used for more targeted intrusions, a study from University of Florida and North Carolina State University researchers revealed.

Exposed by the database were customers' full names, birthdates, ages, genders, marital status, account IDs, occupations, phone numbers, physical addresses, premium amounts and annuities, and policy types, as well as employees' names, email addresses, MLGA/RGA names and emails, and years in service, according to SafetyDetectives researchers.

Such an RCE flaw, which was given a critical severity designation by Snyk, impacts the Llama Stack component, particularly in the implementation of the reference Python Inference API, which automates Python object deserialization through the risky pickle format, according to an analysis from Oligo Security.

Such data compromise may have been achieved through an intrusion against a third-party supplier, which did not have any access to billing or financial details, according to TalkTalk Head of External Communications Liz Holloway, who did not name the supplier and noted that the incident could not be confirmed until the external vendor's investigation is finalized.

Attackers who infiltrated Change Healthcare using unsecured account credentials were not only able to exfiltrate individuals' names, birthdates, home and email addresses, Social Security numbers, and other government IDs but also their health insurance details, diagnoses, test and imaging results, treatment plans, and banking details.

Amateur threat actors have been targeted by the attacker using the "@shinyenigma" and "milleniumrat" aliases with the altered XWorm RAT builder, which not only exfiltrates data via Telegram bot tokens and API calls but also enables registry modification and virtualization checks, according to an analysis from CloudSEK.

Such an incident — which comes within six months of separate crypto heists against fellow Singaporean cryptocurrency platforms BingX and Penpie — showcased levels of sophistication that could have only been conducted by North Korean threat actors, according to experts interviewed by cryptocurrency news site The Block.

After leveraging a vulnerability and the privilege escalation tools PsExec and JuicyPotato to gain SYSTEM access on targeted devices, Andariel stealthily established a low-privilege local user before altering the Security Account Manager registry to facilitate RID hijacking, a report from AhnLab Security Intelligence Center showed.

After infiltrating ESXi instances by leveraging known vulnerabilities or stolen admin credentials, ransomware gangs proceed to utilize the built-in SSH service to facilitate lateral movement and ransomware delivery without being detected, according to an investigation from cybersecurity firm Sygnia.